@cosmicdrift/kumiko-bundled-features 0.329.0 → 0.330.2

package/README.md

@@ -0,0 +1,17 @@
+# @cosmicdrift/kumiko-bundled-features
+
+Built-in Kumiko features: tenant, user, auth, jobs, audit, delivery, billing and more. The pieces most apps rewrite anyway, already typed and tested.
+
+## Install
+
+```bash
+bun add @cosmicdrift/kumiko-bundled-features
+```
+
+```ts
+import { createJobsFeature } from "@cosmicdrift/kumiko-bundled-features/jobs";
+```
+
+Every feature is a subpath export (for example `@cosmicdrift/kumiko-bundled-features/tenant`) with a `create*Feature` factory or a ready-made feature value, and optional `/web` client plugins for the UI.
+
+Documentation: https://kumiko.rocks

package/dist/admin-shell/feature.d.ts

@@ -1,4 +1,5 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type MetricDefinition } from "../metrics/index.js";
 export type CreateAdminShellOptions = {
     /** Short workspace id for tenant operators (URL segment). Default `tenant-admin`. */
     readonly workspaceIds?: {
@@ -13,5 +14,9 @@ export type CreateAdminShellOptions = {
     readonly includeCapOverview?: boolean;
     /** When false, only overview screens + nav are registered — app owns r.workspace(). Default true. */
     readonly registerWorkspaces?: boolean;
+    /** Metric list the overview panels are built from — pass the SAME list to
+     *  createMetricsFeature / createSystemMetricsFeature. Panels exist only for
+     *  ids in this list. Default DEFAULT_METRICS. */
+    readonly metrics?: readonly MetricDefinition[];
 };
 export declare function createAdminShellFeature(options?: CreateAdminShellOptions): FeatureDefinition;

package/dist/admin-shell/feature.js

@@ -2,20 +2,19 @@
 // Screens live in owner features (tenant, audit, jobs, …); this feature only
 // composes workspaces and cross-feature nav entries.
 import { access, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
-import { ConfigQueries } from "../config/index.js";
-import { JobQueries } from "../jobs/index.js";
-import { TenantQueries } from "../tenant/index.js";
-import { UserQueries } from "../user/index.js";
+import { DEFAULT_METRICS } from "../metrics/index.js";
 import { ADMIN_SHELL_FEATURE, DEFAULT_PLATFORM_WORKSPACE_ID, DEFAULT_TENANT_WORKSPACE_ID, PLATFORM_OVERVIEW_SCREEN_ID, TENANT_OVERVIEW_SCREEN_ID, } from "./constants.js";
 import { ADMIN_SHELL_I18N } from "./i18n.js";
+import { OVERVIEW_TIME_RANGE, PLATFORM_SCOPE, PLATFORM_TENANT_FILTER, platformOverviewPanels, tenantOverviewPanels, } from "./overview-panels.js";
 export function createAdminShellFeature(options = {}) {
     const tenantWsId = options.workspaceIds?.tenant ?? DEFAULT_TENANT_WORKSPACE_ID;
     const platformWsId = options.workspaceIds?.platform ?? DEFAULT_PLATFORM_WORKSPACE_ID;
     const includeTierAdmin = options.includeTierAdmin ?? true;
     const includeCapOverview = options.includeCapOverview ?? false;
     const registerWorkspaces = options.registerWorkspaces ?? true;
+    const metrics = options.metrics ?? DEFAULT_METRICS;
     return defineFeature(ADMIN_SHELL_FEATURE, (r) => {
-        r.describe("Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`, optional `cap-overview:screen:my-caps`/`cap-overview:screen:tenant-cap-list`). Mount after user, tenant, audit, and jobs; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.");
+        r.describe("Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`, optional `cap-overview:screen:my-caps`/`cap-overview:screen:tenant-cap-list`) and the two overview dashboards, built from the metrics list (`metrics` option, default DEFAULT_METRICS). Mount after user, tenant, audit, jobs, metrics and metrics-system; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.");
         r.uiHints({
             displayLabel: "Admin Shell",
             category: "operations",
@@ -25,6 +24,8 @@ export function createAdminShellFeature(options = {}) {
         r.requires("tenant");
         r.requires("audit");
         r.requires("jobs");
+        r.requires("metrics");
+        r.requires("metrics-system");
         if (includeTierAdmin)
             r.requires("tier-engine");
         if (includeCapOverview)
@@ -47,35 +48,9 @@ export function createAdminShellFeature(options = {}) {
             id: TENANT_OVERVIEW_SCREEN_ID,
             type: "dashboard",
             access: { roles: access.admin },
-            description: "Landing page of the tenant-admin workspace, showing pending invitation, member and missing-config counts for the caller's own tenant so an operator sees what needs attention there.",
-            panels: [
-                {
-                    kind: "stat",
-                    id: "pending-invitations",
-                    label: "admin-shell:overview.pendingInvitations",
-                    query: TenantQueries.invitations,
-                    // tenant:query:invitations returns a bare array, not a paged
-                    // envelope — "length" reads record["length"], i.e. the array's
-                    // own .length. Not a typo.
-                    valueField: "length",
-                },
-                {
-                    kind: "stat",
-                    id: "members",
-                    label: "admin-shell:overview.members",
-                    query: TenantQueries.members,
-                    // Same array-shaped response as invitations above.
-                    valueField: "length",
-                },
-                {
-                    kind: "stat",
-                    id: "missing-config",
-                    label: "admin-shell:overview.missingConfig",
-                    query: ConfigQueries.readiness,
-                    valueField: "missingCount",
-                    toneField: "missingTone",
-                },
-            ],
+            description: "admin-shell.screen.tenant-overview.subtitle",
+            timeRange: OVERVIEW_TIME_RANGE,
+            panels: [...tenantOverviewPanels(metrics, { includeCapOverview })],
         });
         r.nav({
             id: "tenant-overview",
@@ -88,33 +63,12 @@ export function createAdminShellFeature(options = {}) {
             id: PLATFORM_OVERVIEW_SCREEN_ID,
             type: "dashboard",
             access: { roles: access.systemAdmin },
-            description: "Landing page of the platform-admin workspace, showing installation-wide tenant, user and failed-job counts so a system admin sees the health of the whole deployment at a glance.",
-            panels: [
-                {
-                    kind: "stat",
-                    id: "tenants",
-                    label: "admin-shell:overview.tenants",
-                    query: TenantQueries.list,
-                    params: { totalCount: true },
-                    valueField: "total",
-                },
-                {
-                    kind: "stat",
-                    id: "users",
-                    label: "admin-shell:overview.users",
-                    query: UserQueries.list,
-                    params: { totalCount: true },
-                    valueField: "total",
-                },
-                {
-                    kind: "stat",
-                    id: "failed-jobs",
-                    label: "admin-shell:overview.failedJobs",
-                    query: JobQueries.list,
-                    params: { status: "failed", totalCount: true },
-                    valueField: "total",
-                },
-            ],
+            description: "admin-shell.screen.platform-overview.subtitle",
+            scope: PLATFORM_SCOPE,
+            timeRange: OVERVIEW_TIME_RANGE,
+            // The picker needs a SystemAdmin {rows:{value,label}} tenant query; only cap-overview ships one.
+            ...(includeCapOverview && { filter: PLATFORM_TENANT_FILTER }),
+            panels: [...platformOverviewPanels(metrics)],
         });
         r.nav({
             id: "platform-overview",

package/dist/admin-shell/i18n.js

@@ -4,6 +4,12 @@
 export const ADMIN_SHELL_I18N = {
     "screen:tenant-overview.title": { en: "Overview" },
     "screen:platform-overview.title": { en: "Overview" },
+    "admin-shell.screen.tenant-overview.subtitle": {
+        en: "Activity, failed jobs and deliveries, quotas and open admin tasks of this tenant.",
+    },
+    "admin-shell.screen.platform-overview.subtitle": {
+        en: "Tenant, user, job and delivery health across the whole installation.",
+    },
     "admin-shell:workspace.tenant": { en: "Administration" },
     "admin-shell:workspace.platform": { en: "Platform" },
     "admin-shell:nav.tenantOverview": { en: "Overview" },
@@ -12,14 +18,34 @@ export const ADMIN_SHELL_I18N = {
     "admin-shell:nav.tierAdmin": { en: "Assign tier" },
     "admin-shell:nav.myCaps": { en: "Plans & Caps" },
     "admin-shell:nav.tenantCaps": { en: "Plans & Caps" },
-    "admin-shell:overview.pendingInvitations": {
-        en: "Pending invitations",
-    },
-    "admin-shell:overview.members": { en: "Members" },
-    "admin-shell:overview.missingConfig": {
-        en: "Missing configuration",
+    "admin-shell:overview.kpi.activeTenants": { en: "Active tenants" },
+    "admin-shell:overview.kpi.activeUsers7d": { en: "Active users, 7 days" },
+    "admin-shell:overview.kpi.activeMembers7d": { en: "Active members, 7 days" },
+    "admin-shell:overview.kpi.failedJobs24h": { en: "Failed jobs, 24 h" },
+    "admin-shell:overview.kpi.failedDeliveries24h": { en: "Failed deliveries, 24 h" },
+    "admin-shell:overview.chart.jobRunsByStatus": { en: "Job runs by status" },
+    "admin-shell:overview.chart.deliveriesByChannel": { en: "Deliveries by channel" },
+    "admin-shell:overview.chart.auditWrites": { en: "Changes per day" },
+    "admin-shell:overview.chart.auditWritesSubtitle": { en: "Audit log, 14 days" },
+    "admin-shell:overview.list.recentFailures": { en: "Recent failures" },
+    "admin-shell:overview.list.recentFailuresEmpty": { en: "No failed jobs" },
+    "admin-shell:overview.list.quotas": { en: "Quotas" },
+    "admin-shell:overview.list.quotasEmpty": { en: "No quotas configured" },
+    "admin-shell:overview.col.job": { en: "Job" },
+    "admin-shell:overview.col.startedAt": { en: "Started" },
+    "admin-shell:overview.col.failedAt": { en: "Failed at" },
+    "admin-shell:overview.col.reason": { en: "Reason" },
+    "admin-shell:overview.col.quota": { en: "Quota" },
+    "admin-shell:overview.col.used": { en: "Used" },
+    "admin-shell:overview.col.limit": { en: "Limit" },
+    "admin-shell:overview.col.usage": { en: "Usage" },
+    "admin-shell:overview.range.24h": { en: "24 hours" },
+    "admin-shell:overview.range.7d": { en: "7 days" },
+    "admin-shell:overview.range.30d": { en: "30 days" },
+    "admin-shell:overview.scope.badge": { en: "All tenants" },
+    "admin-shell:overview.scope.notice": {
+        en: "You are viewing data of all tenants. Cross-tenant queries are recorded in the audit log.",
     },
-    "admin-shell:overview.tenants": { en: "Tenants" },
-    "admin-shell:overview.users": { en: "Users" },
-    "admin-shell:overview.failedJobs": { en: "Failed jobs" },
+    "admin-shell:overview.filter.tenant": { en: "Tenant" },
+    "admin-shell:overview.filter.allTenants": { en: "All tenants" },
 };

package/dist/admin-shell/overview-allowlist.d.ts

@@ -1,8 +1,8 @@
 export type OverviewWorkspaceKind = "tenant" | "platform";
 /** Tenant workspace overview may only call these queries. */
-export declare const TENANT_OVERVIEW_ALLOWED_QUERIES: readonly ["tenant:query:invitations", "tenant:query:members", "config:query:readiness", "cap-counter:query:get-counter"];
+export declare const TENANT_OVERVIEW_ALLOWED_QUERIES: readonly ["jobs:query:failures", "cap-overview:query:caps:usage"];
 /** Platform workspace overview may only call these queries. */
-export declare const PLATFORM_OVERVIEW_ALLOWED_QUERIES: readonly ["tenant:query:list", "jobs:query:list", "user:query:user:list"];
+export declare const PLATFORM_OVERVIEW_ALLOWED_QUERIES: readonly ["jobs:query:list", "cap-overview:query:tenant-options"];
 /** Regression guard — TenantAdmin overview must never touch these (HTTP 403). */
 export declare const TENANT_OVERVIEW_FORBIDDEN_QUERIES: readonly ["tenant:query:list", "jobs:query:list", "feature-toggles:query:list", "feature-toggles:query:registered", "user:query:user:list"];
 export declare function overviewAllowedQueries(kind: OverviewWorkspaceKind): readonly string[];

package/dist/admin-shell/overview-allowlist.js

@@ -1,18 +1,23 @@
-// @runtime client
 // Hard-coded query allowlists for overview-home screens — security boundary
 // against privilege escalation via accidental cross-workspace fetches.
+import { CapOverviewQueries } from "../cap-overview/index.js";
+import { JobQueries } from "../jobs/index.js";
+import { METRICS_FEATURE, METRICS_SYSTEM_FEATURE } from "../metrics/index.js";
 /** Tenant workspace overview may only call these queries. */
 export const TENANT_OVERVIEW_ALLOWED_QUERIES = [
-    "tenant:query:invitations",
-    "tenant:query:members",
-    "config:query:readiness",
-    "cap-counter:query:get-counter",
+    JobQueries.failures,
+    CapOverviewQueries.capsUsage,
 ];
+// Metric ids come from the app's metric list, so the boundary is the feature
+// prefix: tenant-scope metrics for the tenant overview, system-scope for the platform one.
+const METRIC_QUERY_PREFIX = {
+    tenant: `${METRICS_FEATURE}:query:`,
+    platform: `${METRICS_SYSTEM_FEATURE}:query:`,
+};
 /** Platform workspace overview may only call these queries. */
 export const PLATFORM_OVERVIEW_ALLOWED_QUERIES = [
-    "tenant:query:list",
-    "jobs:query:list",
-    "user:query:user:list",
+    JobQueries.list,
+    CapOverviewQueries.tenantOptions,
 ];
 /** Regression guard — TenantAdmin overview must never touch these (HTTP 403). */
 export const TENANT_OVERVIEW_FORBIDDEN_QUERIES = [
@@ -26,5 +31,6 @@ export function overviewAllowedQueries(kind) {
     return kind === "tenant" ? TENANT_OVERVIEW_ALLOWED_QUERIES : PLATFORM_OVERVIEW_ALLOWED_QUERIES;
 }
 export function isOverviewQueryAllowed(kind, queryName) {
-    return overviewAllowedQueries(kind).includes(queryName);
+    return (overviewAllowedQueries(kind).includes(queryName) ||
+        queryName.startsWith(METRIC_QUERY_PREFIX[kind]));
 }

package/dist/admin-shell/overview-panels.d.ts

@@ -0,0 +1,12 @@
+import type { DashboardFilterDefinition, DashboardPanelDefinition, DashboardTimeRangeDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
+import { type MetricDefinition } from "../metrics/index.js";
+export declare const OVERVIEW_TIME_RANGE: DashboardTimeRangeDefinition;
+export declare const PLATFORM_TENANT_FILTER: DashboardFilterDefinition;
+export declare const PLATFORM_SCOPE: {
+    readonly badge: "admin-shell:overview.scope.badge";
+    readonly notice: "admin-shell:overview.scope.notice";
+};
+export declare function platformOverviewPanels(metrics: readonly MetricDefinition[]): readonly DashboardPanelDefinition[];
+export declare function tenantOverviewPanels(metrics: readonly MetricDefinition[], options: {
+    readonly includeCapOverview: boolean;
+}): readonly DashboardPanelDefinition[];

package/dist/admin-shell/overview-panels.js

@@ -0,0 +1,167 @@
+// Declarative panel sets of the two overview dashboards. Panels are derived from
+// the metric list the app mounts, so a reduced list yields a reduced dashboard
+// instead of panels pointing at queries that do not exist.
+import { CapOverviewQueries } from "../cap-overview/index.js";
+import { JobQueries } from "../jobs/index.js";
+import { metricQueryName } from "../metrics/index.js";
+const I = "admin-shell:overview";
+export const OVERVIEW_TIME_RANGE = {
+    id: "range",
+    options: [
+        { value: "24h", label: `${I}.range.24h` },
+        { value: "7d", label: `${I}.range.7d` },
+        { value: "30d", label: `${I}.range.30d` },
+    ],
+    default: "7d",
+};
+export const PLATFORM_TENANT_FILTER = {
+    id: "tenantId",
+    label: `${I}.filter.tenant`,
+    kind: "select",
+    allLabel: `${I}.filter.allTenants`,
+    optionsQuery: CapOverviewQueries.tenantOptions,
+};
+export const PLATFORM_SCOPE = {
+    badge: `${I}.scope.badge`,
+    notice: `${I}.scope.notice`,
+};
+function contextFor(metrics, scope) {
+    return {
+        scope,
+        has: (metricId) => metrics.some((metric) => metric.id === metricId && metric.scopes.includes(scope)),
+    };
+}
+function kpi(ctx, metricId, label, options = {}) {
+    if (!ctx.has(metricId))
+        return [];
+    return [
+        {
+            kind: "stat",
+            id: `kpi-${metricId}`,
+            label: `${I}.kpi.${label}`,
+            query: metricQueryName(ctx.scope, metricId),
+            valueField: "value",
+            ...(options.trend === true && {
+                deltaField: "delta",
+                deltaDirectionField: "deltaDirection",
+                sparklineField: "points",
+            }),
+            ...(options.negative === true && { tone: "negative" }),
+        },
+    ];
+}
+function kpiStrip(stats) {
+    return stats.length === 0 ? [] : [{ kind: "stat-group", id: "kpis", stats }];
+}
+function chart(ctx, metricId, panel) {
+    if (!ctx.has(metricId))
+        return [];
+    return [{ kind: "chart", query: metricQueryName(ctx.scope, metricId), ...panel }];
+}
+const DELIVERY_SEGMENT_TONES = {
+    sent: "positive",
+    failed: "negative",
+    skipped: "neutral",
+    queued: "neutral",
+};
+const HALF = { span: "half" };
+function recentFailuresList(query, params, columns, span) {
+    return {
+        kind: "list",
+        id: "recent-failures",
+        label: `${I}.list.recentFailures`,
+        query,
+        params,
+        ignoreScreenFilter: true,
+        columns,
+        span,
+        emptyLabel: `${I}.list.recentFailuresEmpty`,
+    };
+}
+export function platformOverviewPanels(metrics) {
+    const ctx = contextFor(metrics, "system");
+    // Sources without a tenant column cannot be narrowed by the tenant picker.
+    const tenantless = (panel) => ({
+        ...panel,
+        ignoreScreenFilter: true,
+    });
+    return [
+        ...kpiStrip([
+            ...kpi(ctx, "active-tenants", "activeTenants").map(tenantless),
+            ...kpi(ctx, "active-users", "activeUsers7d", { trend: true }),
+            ...kpi(ctx, "failed-job-runs", "failedJobs24h", { trend: true, negative: true }).map(tenantless),
+            ...kpi(ctx, "failed-deliveries", "failedDeliveries24h", { trend: true, negative: true }),
+        ]),
+        ...chart(ctx, "job-runs-by-status", {
+            id: "job-runs-by-status",
+            label: `${I}.chart.jobRunsByStatus`,
+            chart: "stacked-bars",
+            ...HALF,
+            ignoreScreenFilter: true,
+            seriesTones: {
+                completed: "positive",
+                failed: "negative",
+                running: "active",
+                queued: "neutral",
+            },
+        }),
+        ...chart(ctx, "deliveries-by-channel", {
+            id: "deliveries-by-channel",
+            label: `${I}.chart.deliveriesByChannel`,
+            chart: "segment-bars",
+            ...HALF,
+            seriesTones: DELIVERY_SEGMENT_TONES,
+        }),
+        recentFailuresList(JobQueries.list, { status: "failed", sort: "startedAt", sortDirection: "desc", limit: 5 }, [
+            { field: "jobName", label: `${I}.col.job` },
+            { field: "startedAt", label: `${I}.col.startedAt` },
+        ], "full"),
+    ];
+}
+export function tenantOverviewPanels(metrics, options) {
+    const ctx = contextFor(metrics, "tenant");
+    return [
+        ...kpiStrip([
+            ...kpi(ctx, "active-users", "activeMembers7d", { trend: true }),
+            ...kpi(ctx, "tenant-job-failures", "failedJobs24h", { trend: true, negative: true }),
+            ...kpi(ctx, "failed-deliveries", "failedDeliveries24h", { trend: true, negative: true }),
+        ]),
+        ...chart(ctx, "deliveries-by-channel", {
+            id: "deliveries-by-channel",
+            label: `${I}.chart.deliveriesByChannel`,
+            chart: "segment-bars",
+            ...HALF,
+            seriesTones: DELIVERY_SEGMENT_TONES,
+        }),
+        ...(options.includeCapOverview
+            ? [
+                {
+                    kind: "list",
+                    id: "quotas",
+                    label: `${I}.list.quotas`,
+                    query: CapOverviewQueries.capsUsage,
+                    columns: [
+                        { field: "label", label: `${I}.col.quota` },
+                        { field: "used", label: `${I}.col.used` },
+                        { field: "limit", label: `${I}.col.limit` },
+                        { field: "fraction", label: `${I}.col.usage`, display: "bar" },
+                    ],
+                    ...HALF,
+                    emptyLabel: `${I}.list.quotasEmpty`,
+                },
+            ]
+            : []),
+        ...chart(ctx, "audit-writes", {
+            id: "audit-writes",
+            label: `${I}.chart.auditWrites`,
+            subtitle: `${I}.chart.auditWritesSubtitle`,
+            chart: "stacked-bars",
+            ...HALF,
+        }),
+        recentFailuresList(JobQueries.failures, { limit: 5 }, [
+            { field: "jobName", label: `${I}.col.job` },
+            { field: "messageKey", label: `${I}.col.reason` },
+            { field: "failedAt", label: `${I}.col.failedAt` },
+        ], "half"),
+    ];
+}

package/dist/auth-email-password/email-templates.d.ts

@@ -1,4 +1,5 @@
 export type AuthMailLocale = string;
+export declare const AUTH_MAIL_EN: Readonly<Record<string, string>>;
 export type RenderTokenContentArgs = {
     readonly url: string;
     readonly expiresAt: string;

package/dist/auth-email-password/email-templates.js

@@ -9,7 +9,7 @@
 // (localeDe() / localeEs() call registerMailTranslations).
 import { mailT, registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
 import { Temporal } from "temporal-polyfill";
-const AUTH_MAIL_EN = {
+export const AUTH_MAIL_EN = {
     "auth.mail.appNameDefault": "Account",
     "auth.mail.reset.subject": "{app} — Reset your password",
     "auth.mail.reset.greeting": "Hi,",

package/dist/auth-mfa/i18n.js

@@ -2,6 +2,15 @@ export const AUTH_MFA_FEATURE_I18N = {
     "screen:auth-mfa-enable.title": {
         en: "Two-factor authentication",
     },
+    "auth-mfa.screen.auth-mfa-enable.subtitle": {
+        en: "Protect your account with a code from an authenticator app.",
+    },
+    "auth-mfa.screen.auth-mfa-disable.subtitle": {
+        en: "Turn off two-factor authentication. Other sessions and access tokens are signed out.",
+    },
+    "auth-mfa.screen.auth-mfa-regenerate-recovery.subtitle": {
+        en: "Replace all recovery codes. The new codes are shown only once.",
+    },
     "mfa.enable.start": { en: "Start setup" },
     "mfa.enable.reveal.title": { en: "Set up your authenticator app" },
     "mfa.enable.reveal.warning": {

package/dist/auth-mfa/screens.js

@@ -19,7 +19,7 @@ export const mfaEnableScreen = {
     // Reached only via a direct link from account settings, never from a
     // list — no nav area to resolve in isolation.
     dormant: true,
-    description: "Self-service screen where a signed-in user enrolls in TOTP two-factor authentication: it shows the QR code and manual secret, reveals the recovery codes once, and confirms enrollment with a code from their authenticator app.",
+    description: "auth-mfa.screen.auth-mfa-enable.subtitle",
     reveal: {
         title: i18nKey("mfa.enable.reveal.title"),
         warning: i18nKey("mfa.enable.reveal.warning"),
@@ -75,7 +75,7 @@ export const mfaDisableScreen = {
     // Reached only via a direct link from account settings, never from a
     // list — no nav area to resolve in isolation.
     dormant: true,
-    description: "Self-service screen where a signed-in user turns two-factor authentication off by entering a code from their authenticator app or a recovery code; their other sessions and access tokens are signed out.",
+    description: "auth-mfa.screen.auth-mfa-disable.subtitle",
 };
 export const mfaRegenerateRecoveryScreen = {
     id: MFA_REGENERATE_RECOVERY_SCREEN_ID,
@@ -93,7 +93,7 @@ export const mfaRegenerateRecoveryScreen = {
     // Reached only via a direct link from account settings, never from a
     // list — no nav area to resolve in isolation.
     dormant: true,
-    description: "Self-service screen where a signed-in user with two-factor authentication replaces all recovery codes after confirming with a current code; the new codes are shown once.",
+    description: "auth-mfa.screen.auth-mfa-regenerate-recovery.subtitle",
     reveal: {
         title: i18nKey("mfa.regenerate.reveal.title"),
         warning: i18nKey("mfa.regenerate.reveal.warning"),

package/dist/billing-foundation/checkout-core.d.ts

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { getSubscriptionForTenant } from "./get-subscription-for-tenant.js";
 import type { BillingPlanCatalog, SubscriptionProviderPlugin } from "./types.js";

package/dist/billing-foundation/checkout-core.js

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 // Shared checkout plumbing for create-checkout-session, start-plan-checkout
 // and switch-plan — provider/catalog resolution, redirect-origin hardening,
 // and the price/subscription-state gate that turns a bare priceId-driven

package/dist/billing-foundation/constants.d.ts

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 import { Temporal as TemporalPolyfill } from "temporal-polyfill";
 export declare const BILLING_FOUNDATION_FEATURE: "billing-foundation";
 export declare const SUBSCRIPTION_PROVIDER_EXTENSION: "subscriptionProvider";

package/dist/billing-foundation/constants.js

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 // @runtime client
 // temporal-polyfill is a plain npm dependency (not a framework runtime
 // module), so importing it here doesn't break browser bundles. Aliased —

package/dist/billing-foundation/get-subscription-for-tenant.d.ts

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 export type SubscriptionView = {
     readonly tier: string;

package/dist/billing-foundation/get-subscription-for-tenant.js

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 // Resolver-helper: liest die current subscription-row für einen Tenant
 // aus der read_subscriptions-projection.
 import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";

package/dist/billing-foundation/i18n.js

@@ -52,7 +52,7 @@ export const BILLING_FOUNDATION_I18N = {
         en: "This tenant has no active subscription to switch.",
     },
     "billing-foundation.errors.cancellationScheduled": {
-        en: "This subscription is scheduled to cancel. Reactivate it before switching plans.",
+        en: "This subscription is scheduled to end. Reactivate it before switching plans.",
     },
     "billing-foundation.errors.alreadyOnPlan": { en: "This tenant is already on that plan." },
     "billing-foundation.errors.planSwitchNotSupported": {

package/dist/billing-foundation/types.d.ts

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { HandlerContext, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";

package/dist/billing-foundation/types.js

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 // Plugin-Contract + Domain-Types der subscription-foundation. Provider-
 // Plugins (subscription-stripe, subscription-mollie, ...) implementieren
 // `SubscriptionProviderPlugin` und registrieren via

package/dist/cap-counter/enforce-cap.d.ts

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 import { type HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { KumikoError } from "@cosmicdrift/kumiko-framework/errors";
 /**

package/dist/cap-counter/enforce-cap.js

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 import { createEntityExecutor } from "@cosmicdrift/kumiko-framework/engine";
 import { KumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import { markCapSoftWarned, readRollingCapUsage } from "./book-cap-usage.js";

package/dist/cap-overview/handlers/caps-usage.query.js

@@ -13,10 +13,10 @@ export function createCapsUsageQuery(caps) {
         description: "Returns the calling user's own tenant's configured caps with used amount, tier limit and utilisation fraction; use it to answer how close a tenant is to its quota (only SystemAdmin may target another tenant via tenantId).",
         schema: z.object({ tenantId: z.string().min(1).optional() }),
         access: { roles: MY_CAPS_ACCESS_ROLES },
-        // App-owned CapSpec.usage() providers get this handler's db; a SUM has
-        // no TenantDb helper (count() is COUNT(*)-only), so they need raw SQL.
+        // COUNT/SUM/AVG are covered by TenantDb.count/TenantDb.aggregate; the grant
+        // stays for app-owned CapSpec.usage() providers that still use unsafeRaw.
         escapeHatch: {
-            reason: "cap-overview:caps:usage — grants app-owned CapSpec.usage() providers raw SQL for aggregates TenantDb has no typed helper for (e.g. a SUM)",
+            reason: "cap-overview:caps:usage — grants app-owned CapSpec.usage() providers that still use unsafeRaw; COUNT/SUM/AVG are covered by TenantDb.count/TenantDb.aggregate",
         },
         handler: async (query, ctx) => {
             if (!ctx.systemDb) {

package/dist/data-retention/run-retention-cleanup.js

@@ -495,7 +495,12 @@ export async function runRetentionCleanup(args) {
             case "blockDelete": {
                 const targets = await resolveAnonymizeTargets(entity.fields);
                 if (!targets) {
-                    skipped.push({ entityName, reason: "missing_anonymize_fields" });
+                    // blockDelete without anonymize fields is a pure hold: a subjectRef-only
+                    // person link outlives the hold and is cut only by the user-data
+                    // forget hook, so expiry has nothing to do here and is not reported.
+                    if (policy.strategy === "anonymize") {
+                        skipped.push({ entityName, reason: "missing_anonymize_fields" });
+                    }
                     break;
                 }
                 const executor = createEventStoreExecutor(proj.table, entity, { entityName });

package/dist/delivery/tables.js

@@ -1,4 +1,4 @@
-import { boolean, buildBaseColumns, defineUnmanagedTable, instant, table as pgTable, sql, text, uniqueIndex, uuid, } from "@cosmicdrift/kumiko-framework/db";
+import { boolean, buildBaseColumns, defineUnmanagedTable, index, instant, table as pgTable, sql, text, uniqueIndex, uuid, } from "@cosmicdrift/kumiko-framework/db";
 import { createBooleanField, createEntity, createTextField, } from "@cosmicdrift/kumiko-framework/engine";
 // Delivery-log is an append-only stream of per-attempt records. The stream
 // of truth lives in the events-Tabelle (one aggregate per attempt, event
@@ -12,6 +12,7 @@ import { createBooleanField, createEntity, createTextField, } from "@cosmicdrift
 // PK = event aggregate-id (uuid). Keeps the projection row linked back to
 // its event stream 1:1 — same convention as jobRunsTable + tenantSecretsTable.
 // Event replays stay idempotent (primary-key conflict instead of duplicate rows).
+const DELIVERY_ATTEMPTS_TENANT_CREATED_INDEX = "store_delivery_attempts_tenant_id_created_at_idx";
 export const deliveryAttemptsTable = pgTable("store_delivery_attempts", {
     id: uuid("id").primaryKey(),
     tenantId: uuid("tenant_id").notNull(),
@@ -26,7 +27,7 @@ export const deliveryAttemptsTable = pgTable("store_delivery_attempts", {
     // notify() priority from the event payload.
     priority: text("priority").notNull().default("normal").$type(),
     createdAt: instant("created_at").default(sql `now()`).notNull(),
-});
+}, (t) => [index(DELIVERY_ATTEMPTS_TENANT_CREATED_INDEX).on(t.tenantId, t.createdAt)]);
 // **Unmanaged table** — bewusst KEIN createEntity. Begründung:
 //   - id kommt aus dem Aggregate-Stream (kein gen_random_uuid()-DEFAULT)
 //   - kein version/inserted_by/modified_by/modified_at — keine in-place-
@@ -37,6 +38,7 @@ export const deliveryAttemptsTable = pgTable("store_delivery_attempts", {
 // aus dieser Meta ab.
 export const deliveryAttemptsTableMeta = defineUnmanagedTable({
     tableName: "store_delivery_attempts",
+    indexes: [{ name: DELIVERY_ATTEMPTS_TENANT_CREATED_INDEX, columns: ["tenant_id", "created_at"] }],
     columns: [
         { name: "id", pgType: "uuid", notNull: true, primaryKey: true },
         { name: "tenant_id", pgType: "uuid", notNull: true },