@cosmicdrift/kumiko-bundled-features 0.378.0 → 0.379.0

package/dist/account-security/feature.js

@@ -1,8 +1,8 @@
 import { defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
 import { AuthMfaQueries, MFA_DISABLE_SCREEN_ID, MFA_ENABLE_SCREEN_ID, MFA_REGENERATE_RECOVERY_SCREEN_ID, } from "../auth-mfa/index.js";
 import { SESSION_MINE_SCREEN_ID } from "../sessions/index.js";
-import { ACCOUNT_SECURITY_FEATURE, ACCOUNT_SECURITY_NAV_LABEL, ACCOUNT_SECURITY_SCREEN_ID, ACCOUNT_SECURITY_SCREEN_QN, } from "./constants.js";
-import { ACCOUNT_SECURITY_I18N } from "./i18n.js";
+import { ACCOUNT_SECURITY_FEATURE, ACCOUNT_SECURITY_NAV_LABEL, ACCOUNT_SECURITY_SCREEN_ID, ACCOUNT_SECURITY_SCREEN_QN, } from "./web/constants.js";
+import { ACCOUNT_SECURITY_I18N } from "./web/i18n.js";
 const DEFAULT_ACCESS = {
     openToAll: { reason: "signed-in users manage their own account security" },
 };

package/dist/account-security/index.d.ts

@@ -1,3 +1,3 @@
-export { ACCOUNT_SECURITY_FEATURE, ACCOUNT_SECURITY_NAV_LABEL, ACCOUNT_SECURITY_SCREEN_ID, ACCOUNT_SECURITY_SCREEN_QN, ACCOUNT_SECURITY_SCREEN_TITLE_KEY, } from "./constants.ts";
 export { type AccountSecurityFeatureOptions, type AccountSecurityNavOptions, accountSecurityMfaStatusVisibility, createAccountSecurityFeature, } from "./feature.ts";
-export { ACCOUNT_SECURITY_I18N } from "./i18n.ts";
+export { ACCOUNT_SECURITY_FEATURE, ACCOUNT_SECURITY_NAV_LABEL, ACCOUNT_SECURITY_SCREEN_ID, ACCOUNT_SECURITY_SCREEN_QN, ACCOUNT_SECURITY_SCREEN_TITLE_KEY, } from "./web/constants.ts";
+export { ACCOUNT_SECURITY_I18N } from "./web/i18n.ts";

package/dist/account-security/index.js

@@ -1,3 +1,3 @@
-export { ACCOUNT_SECURITY_FEATURE, ACCOUNT_SECURITY_NAV_LABEL, ACCOUNT_SECURITY_SCREEN_ID, ACCOUNT_SECURITY_SCREEN_QN, ACCOUNT_SECURITY_SCREEN_TITLE_KEY, } from "./constants.js";
 export { accountSecurityMfaStatusVisibility, createAccountSecurityFeature, } from "./feature.js";
-export { ACCOUNT_SECURITY_I18N } from "./i18n.js";
+export { ACCOUNT_SECURITY_FEATURE, ACCOUNT_SECURITY_NAV_LABEL, ACCOUNT_SECURITY_SCREEN_ID, ACCOUNT_SECURITY_SCREEN_QN, ACCOUNT_SECURITY_SCREEN_TITLE_KEY, } from "./web/constants.js";
+export { ACCOUNT_SECURITY_I18N } from "./web/i18n.js";

package/dist/account-security/{constants.js → web/constants.js}

@@ -1,4 +1,3 @@
-// @runtime client
 export const ACCOUNT_SECURITY_FEATURE = "account-security";
 export const ACCOUNT_SECURITY_SCREEN_ID = "account-security";
 export const ACCOUNT_SECURITY_SCREEN_QN = `${ACCOUNT_SECURITY_FEATURE}:screen:${ACCOUNT_SECURITY_SCREEN_ID}`;

package/dist/account-security/{i18n.js → web/i18n.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // Server-registered so the framework projects these keys into the client bundle.
 export const ACCOUNT_SECURITY_I18N = {
     "screen:account-security.title": { de: "Konto & Sicherheit", en: "Account & Security" },

package/dist/admin-shell/feature.js

@@ -3,9 +3,9 @@
 // composes workspaces and cross-feature nav entries.
 import { access, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
 import { DEFAULT_METRICS } from "../metrics/index.js";
-import { ADMIN_SHELL_FEATURE, DEFAULT_PLATFORM_WORKSPACE_ID, DEFAULT_TENANT_WORKSPACE_ID, PLATFORM_OVERVIEW_SCREEN_ID, TENANT_OVERVIEW_SCREEN_ID, } from "./constants.js";
-import { ADMIN_SHELL_I18N } from "./i18n.js";
 import { OVERVIEW_TIME_RANGE, PLATFORM_SCOPE, PLATFORM_TENANT_FILTER, platformOverviewPanels, tenantOverviewPanels, } from "./overview-panels.js";
+import { ADMIN_SHELL_FEATURE, DEFAULT_PLATFORM_WORKSPACE_ID, DEFAULT_TENANT_WORKSPACE_ID, PLATFORM_OVERVIEW_SCREEN_ID, TENANT_OVERVIEW_SCREEN_ID, } from "./web/constants.js";
+import { ADMIN_SHELL_I18N } from "./web/i18n.js";
 export function createAdminShellFeature(options = {}) {
     const tenantWsId = options.workspaceIds?.tenant ?? DEFAULT_TENANT_WORKSPACE_ID;
     const platformWsId = options.workspaceIds?.platform ?? DEFAULT_PLATFORM_WORKSPACE_ID;
@@ -15,7 +15,7 @@ export function createAdminShellFeature(options = {}) {
     const registerWorkspaces = options.registerWorkspaces ?? true;
     const metrics = options.metrics ?? DEFAULT_METRICS;
     return defineFeature(ADMIN_SHELL_FEATURE, (r) => {
-        r.describe("Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`, optional `cap-overview:screen:my-caps`/`cap-overview:screen:tenant-cap-list`, optional `document-designer` template navs) and the two overview dashboards, built from the metrics list (`metrics` option, default DEFAULT_METRICS). Mount after user, tenant, audit, jobs, metrics and metrics-system; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.");
+        r.describe("Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `audit:screen:audit-log-all-tenants`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`, optional `cap-overview:screen:my-caps`/`cap-overview:screen:tenant-cap-list`, optional `document-designer` template navs) and the two overview dashboards, built from the metrics list (`metrics` option, default DEFAULT_METRICS). Mount after user, tenant, audit, jobs, metrics and metrics-system; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.");
         r.uiHints({
             displayLabel: "Admin Shell",
             category: "operations",
@@ -45,6 +45,7 @@ export function createAdminShellFeature(options = {}) {
             "admin-shell:nav:platform-overview",
             "admin-shell:nav:tenants",
             ...(includeCapOverview ? ["admin-shell:nav:tenant-caps"] : []),
+            "audit:nav:audit-log-all-tenants",
             "jobs:nav:job-runs",
             ...(includeDocumentDesigner ? ["document-designer:nav:platform-templates"] : []),
             ...(includeTierAdmin ? ["admin-shell:nav:tier-admin"] : []),

package/dist/admin-shell/index.d.ts

@@ -1,4 +1,4 @@
-export { ADMIN_SHELL_FEATURE, DEFAULT_PLATFORM_WORKSPACE_ID, DEFAULT_TENANT_WORKSPACE_ID, PLATFORM_OVERVIEW_SCREEN_ID, TENANT_OVERVIEW_SCREEN_ID, } from "./constants.ts";
 export { type CreateAdminShellOptions, createAdminShellFeature } from "./feature.ts";
-export { ADMIN_SHELL_I18N } from "./i18n.ts";
 export { isOverviewQueryAllowed, type OverviewWorkspaceKind, overviewAllowedQueries, PLATFORM_OVERVIEW_ALLOWED_QUERIES, TENANT_OVERVIEW_ALLOWED_QUERIES, TENANT_OVERVIEW_FORBIDDEN_QUERIES, } from "./overview-allowlist.ts";
+export { ADMIN_SHELL_FEATURE, DEFAULT_PLATFORM_WORKSPACE_ID, DEFAULT_TENANT_WORKSPACE_ID, PLATFORM_OVERVIEW_SCREEN_ID, TENANT_OVERVIEW_SCREEN_ID, } from "./web/constants.ts";
+export { ADMIN_SHELL_I18N } from "./web/i18n.ts";

package/dist/admin-shell/index.js

@@ -1,4 +1,4 @@
-export { ADMIN_SHELL_FEATURE, DEFAULT_PLATFORM_WORKSPACE_ID, DEFAULT_TENANT_WORKSPACE_ID, PLATFORM_OVERVIEW_SCREEN_ID, TENANT_OVERVIEW_SCREEN_ID, } from "./constants.js";
 export { createAdminShellFeature } from "./feature.js";
-export { ADMIN_SHELL_I18N } from "./i18n.js";
 export { isOverviewQueryAllowed, overviewAllowedQueries, PLATFORM_OVERVIEW_ALLOWED_QUERIES, TENANT_OVERVIEW_ALLOWED_QUERIES, TENANT_OVERVIEW_FORBIDDEN_QUERIES, } from "./overview-allowlist.js";
+export { ADMIN_SHELL_FEATURE, DEFAULT_PLATFORM_WORKSPACE_ID, DEFAULT_TENANT_WORKSPACE_ID, PLATFORM_OVERVIEW_SCREEN_ID, TENANT_OVERVIEW_SCREEN_ID, } from "./web/constants.js";
+export { ADMIN_SHELL_I18N } from "./web/i18n.js";

package/dist/admin-shell/web/client-plugin.js

@@ -1,7 +1,6 @@
-// @runtime client
 import { mergeTranslations } from "@cosmicdrift/kumiko-renderer";
-import { ADMIN_SHELL_FEATURE } from "../constants.js";
-import { defaultTranslations } from "./i18n.js";
+import { ADMIN_SHELL_FEATURE } from "./constants.js";
+import { defaultTranslations } from "./default-translations.js";
 export function adminShellClient(options) {
     return {
         name: ADMIN_SHELL_FEATURE,

package/dist/admin-shell/{constants.js → web/constants.js}

@@ -1,4 +1,3 @@
-// @runtime client
 export const ADMIN_SHELL_FEATURE = "admin-shell";
 export const DEFAULT_TENANT_WORKSPACE_ID = "tenant-admin";
 export const DEFAULT_PLATFORM_WORKSPACE_ID = "platform";

package/dist/admin-shell/web/default-translations.d.ts

@@ -0,0 +1,2 @@
+import { type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+export declare const defaultTranslations: TranslationsByLocale;

package/dist/admin-shell/web/default-translations.js

@@ -0,0 +1,4 @@
+// Client pivot of ADMIN_SHELL_I18N — same keys as server r.translations bundle.
+import { translationsByLocaleFromKeys, } from "@cosmicdrift/kumiko-renderer";
+import { ADMIN_SHELL_I18N } from "./i18n.js";
+export const defaultTranslations = translationsByLocaleFromKeys(ADMIN_SHELL_I18N);

package/dist/admin-shell/web/i18n.d.ts

@@ -1,2 +1,5 @@
-import { type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-export declare const defaultTranslations: TranslationsByLocale;
+type LocalizedString = {
+    readonly en: string;
+};
+export declare const ADMIN_SHELL_I18N: Readonly<Record<string, LocalizedString>>;
+export {};

package/dist/admin-shell/web/i18n.js

@@ -1,5 +1,50 @@
-// @runtime client
-// Client pivot of ADMIN_SHELL_I18N — same keys as server r.translations bundle.
-import { translationsByLocaleFromKeys, } from "@cosmicdrift/kumiko-renderer";
-import { ADMIN_SHELL_I18N } from "../i18n.js";
-export const defaultTranslations = translationsByLocaleFromKeys(ADMIN_SHELL_I18N);
+// Pure-Data i18n keys for admin-shell (server r.translations + client pivot).
+// Without these keys nav labels and workspace tabs render raw QNs in the shell.
+export const ADMIN_SHELL_I18N = {
+    "screen:tenant-overview.title": { en: "Overview" },
+    "screen:platform-overview.title": { en: "Overview" },
+    "admin-shell.screen.tenant-overview.subtitle": {
+        en: "Activity, failed jobs and deliveries, quotas and open admin tasks of this tenant.",
+    },
+    "admin-shell.screen.platform-overview.subtitle": {
+        en: "Tenant, user, job and delivery health across the whole installation.",
+    },
+    "admin-shell:workspace.tenant": { en: "Administration" },
+    "admin-shell:workspace.platform": { en: "Platform" },
+    "admin-shell:nav.tenantOverview": { en: "Overview" },
+    "admin-shell:nav.platformOverview": { en: "Overview" },
+    "admin-shell:nav.tenants": { en: "Tenants" },
+    "admin-shell:nav.tierAdmin": { en: "Assign tier" },
+    "admin-shell:nav.myCaps": { en: "Plans & Caps" },
+    "admin-shell:nav.tenantCaps": { en: "Plans & Caps" },
+    "admin-shell:overview.kpi.activeTenants": { en: "Active tenants" },
+    "admin-shell:overview.kpi.activeUsers7d": { en: "Active users, 7 days" },
+    "admin-shell:overview.kpi.activeMembers7d": { en: "Active members, 7 days" },
+    "admin-shell:overview.kpi.failedJobs24h": { en: "Failed jobs, 24 h" },
+    "admin-shell:overview.kpi.failedDeliveries24h": { en: "Failed deliveries, 24 h" },
+    "admin-shell:overview.chart.jobRunsByStatus": { en: "Job runs by status" },
+    "admin-shell:overview.chart.deliveriesByChannel": { en: "Deliveries by channel" },
+    "admin-shell:overview.chart.auditWrites": { en: "Changes per day" },
+    "admin-shell:overview.chart.auditWritesSubtitle": { en: "Audit log, 14 days" },
+    "admin-shell:overview.list.recentFailures": { en: "Recent failures" },
+    "admin-shell:overview.list.recentFailuresEmpty": { en: "No failed jobs" },
+    "admin-shell:overview.list.quotas": { en: "Quotas" },
+    "admin-shell:overview.list.quotasEmpty": { en: "No quotas configured" },
+    "admin-shell:overview.col.job": { en: "Job" },
+    "admin-shell:overview.col.startedAt": { en: "Started" },
+    "admin-shell:overview.col.failedAt": { en: "Failed at" },
+    "admin-shell:overview.col.reason": { en: "Reason" },
+    "admin-shell:overview.col.quota": { en: "Quota" },
+    "admin-shell:overview.col.used": { en: "Used" },
+    "admin-shell:overview.col.limit": { en: "Limit" },
+    "admin-shell:overview.col.usage": { en: "Usage" },
+    "admin-shell:overview.range.24h": { en: "24 hours" },
+    "admin-shell:overview.range.7d": { en: "7 days" },
+    "admin-shell:overview.range.30d": { en: "30 days" },
+    "admin-shell:overview.scope.badge": { en: "All tenants" },
+    "admin-shell:overview.scope.notice": {
+        en: "You are viewing data of all tenants. Cross-tenant queries are recorded in the audit log.",
+    },
+    "admin-shell:overview.filter.tenant": { en: "Tenant" },
+    "admin-shell:overview.filter.allTenants": { en: "All tenants" },
+};

package/dist/admin-shell/web/index.js

@@ -1,2 +1 @@
-// @runtime client
 export { adminShellClient } from "./client-plugin.js";

package/dist/audit/feature.js

@@ -1,10 +1,13 @@
 import { access, createSystemConfig, defineFeature, i18nKey, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
-import { AUDIT_LOG_DETAIL_SCREEN_ID, AUDIT_LOG_SCREEN_ID, AuditQueries, DEFAULT_ESCAPE_HATCH_RETENTION_DAYS, } from "./constants.js";
 import { escapeHatchUsedSchema } from "./escape-hatch-audit-sink.js";
 import { detailsQuery } from "./handlers/details.query.js";
+import { detailsAllTenantsQuery } from "./handlers/details-all-tenants.query.js";
 import { listQuery } from "./handlers/list.query.js";
-import { AUDIT_I18N } from "./i18n.js";
+import { listAllTenantsQuery } from "./handlers/list-all-tenants.query.js";
 import { runEscapeHatchRetention } from "./run-escape-hatch-retention.js";
+import { AUDIT_LOG_ALL_TENANTS_COLUMNS, AUDIT_LOG_COLUMNS, AUDIT_LOG_DATE_RANGE_FACET, AUDIT_LOG_DETAIL_FIELD_LABELS, AUDIT_LOG_TENANT_FACET, auditLogDetailLayout, } from "./screens.js";
+import { AUDIT_LOG_ALL_TENANTS_DETAIL_SCREEN_ID, AUDIT_LOG_ALL_TENANTS_NAV_ID, AUDIT_LOG_ALL_TENANTS_SCREEN_ID, AUDIT_LOG_DETAIL_SCREEN_ID, AUDIT_LOG_SCREEN_ID, AuditQueries, DEFAULT_ESCAPE_HATCH_RETENTION_DAYS, } from "./web/constants.js";
+import { AUDIT_I18N } from "./web/i18n.js";
 // Audit feature — exposes a filtered read over the framework's event log.
 //
 // Design: the event-store IS the audit trail (every entity write produces
@@ -20,13 +23,16 @@ import { runEscapeHatchRetention } from "./run-escape-hatch-retention.js";
 // framework).
 export function createAuditFeature() {
     return defineFeature("audit", (r) => {
-        r.describe("Exposes the framework's event store as a paginated, filterable audit log via the `audit:query:list` handler (accessible to `Admin` and `SystemAdmin` roles). No separate table or projection \u2014 the event store is the audit trail by construction: every entity write already records who, when, what entity, and the event payload with PII stripped. A SystemAdmin can pass `scope: \"system\"` to read the app-instance system events such as `app.started`. Filter by `aggregateType`, `aggregateId`, `eventType`, `userId`, or time range. Also records `audit:event:escape-hatch-used` whenever a handler uses one of the framework's escape hatches (unsafeRaw, acknowledgeCrossTenant, db.global() writes, or a granted identity switch).");
+        r.describe("Exposes the framework's event store as a paginated, filterable audit log via the `audit:query:list` handler (accessible to `Admin` and `SystemAdmin` roles). No separate table or projection \u2014 the event store is the audit trail by construction: every entity write already records who, when, what entity, and the event payload with PII stripped. A SystemAdmin can pass `scope: \"system\"` to read the app-instance system events such as `app.started`, and reads the events of every tenant (system tenant excluded) through `audit:query:list-all-tenants` and the `audit-log-all-tenants` screen. Filter by `aggregateType`, `aggregateId`, `eventType`, `userId`, or time range. Also records `audit:event:escape-hatch-used` whenever a handler uses one of the framework's escape hatches (unsafeRaw, acknowledgeCrossTenant, db.global() writes, or a granted identity switch).");
         r.uiHints({
             displayLabel: "Audit Log",
             category: "compliance",
             recommended: false,
         });
         r.translations({ keys: AUDIT_I18N });
+        // The all-tenants queries read through ctx.systemDb.acknowledgeCrossTenant; the own-tenant
+        // queries use assertTenantMatch on the same handle.
+        r.systemScope();
         r.requires({ features: ["tenant", "user", "config"] });
         // Registered so ops tools/MSPs can discover the type — escape-hatch-audit-sink.ts appends it via the low-level event-store API.
         r.defineEvent("escape-hatch-used", escapeHatchUsedSchema, { piiFields: "none" });
@@ -58,35 +64,17 @@ export function createAuditFeature() {
         const queries = {
             list: r.queryHandler(listQuery),
             details: r.queryHandler(detailsQuery),
+            listAllTenants: r.queryHandler(listAllTenantsQuery),
+            detailsAllTenants: r.queryHandler(detailsAllTenantsQuery),
         };
         r.screen({
             id: AUDIT_LOG_SCREEN_ID,
             type: "projectionList",
             query: AuditQueries.list,
-            columns: [
-                {
-                    field: "createdAt",
-                    label: i18nKey("audit.log.col.when"),
-                    renderer: { format: "timestamp" },
-                },
-                { field: "type", label: i18nKey("audit.log.col.type") },
-                {
-                    field: "createdBy",
-                    label: i18nKey("audit.log.col.actor"),
-                    refEntity: "user:user",
-                    refLabelField: "displayName",
-                },
-            ],
+            columns: AUDIT_LOG_COLUMNS,
             searchable: true,
             defaultSort: { field: "createdAt", dir: "desc" },
-            facets: [
-                {
-                    type: "dateRange",
-                    field: "createdAt",
-                    label: i18nKey("audit.log.col.when"),
-                    params: { from: "from", to: "to" },
-                },
-            ],
+            facets: [AUDIT_LOG_DATE_RANGE_FACET],
             rowActions: [
                 {
                     kind: "navigate",
@@ -98,7 +86,7 @@ export function createAuditFeature() {
                 },
             ],
             pagination: "infinite",
-            description: "Admin table of the tenant's audit-trail events with actor names and event-type/date filters; open it to browse recent changes and drill into a single event.",
+            description: "audit.log.description",
             access: { roles: access.admin },
         });
         r.screen({
@@ -106,43 +94,47 @@ export function createAuditFeature() {
             type: "projectionDetail",
             query: AuditQueries.details,
             idParam: "id",
-            fieldLabels: {
-                type: i18nKey("audit.log.col.type"),
-                createdAt: i18nKey("audit.log.col.when"),
-                aggregateType: i18nKey("audit.log.col.aggregateType"),
-                aggregateId: i18nKey("audit.log.col.aggregateId"),
-                createdBy: i18nKey("audit.log.col.actor"),
-                id: i18nKey("audit.log.detail.field.id"),
-                payload: i18nKey("audit.log.detail.payload"),
-                metadata: i18nKey("audit.log.detail.metadata"),
-            },
-            layout: {
-                sections: [
-                    {
-                        fields: [
-                            "type",
-                            { field: "createdAt", renderer: { format: "timestamp" } },
-                            "aggregateType",
-                            "aggregateId",
-                            { field: "createdBy", refEntity: "user:user", refLabelField: "displayName" },
-                            "id",
-                        ],
-                    },
-                    // No section `title` here (fw#2312 label-dedup fix): each section
-                    // holds exactly one field, so a title would repeat the field's own
-                    // label (rendered by RenderField as the Field's heading) verbatim.
-                    {
-                        fields: [{ field: "payload", renderer: { format: "json" } }],
-                    },
-                    {
-                        fields: [{ field: "metadata", renderer: { format: "json" } }],
-                    },
-                ],
-            },
+            fieldLabels: AUDIT_LOG_DETAIL_FIELD_LABELS,
+            layout: auditLogDetailLayout({ withTenant: false }),
             description: "audit.log.detail.subtitle",
             listScreenId: AUDIT_LOG_SCREEN_ID,
             access: { roles: access.admin },
         });
+        r.screen({
+            id: AUDIT_LOG_ALL_TENANTS_SCREEN_ID,
+            type: "projectionList",
+            query: AuditQueries.listAllTenants,
+            columns: AUDIT_LOG_ALL_TENANTS_COLUMNS,
+            defaultSort: { field: "createdAt", dir: "desc" },
+            facets: [AUDIT_LOG_DATE_RANGE_FACET, AUDIT_LOG_TENANT_FACET],
+            rowActions: [
+                {
+                    kind: "navigate",
+                    id: "details",
+                    label: i18nKey("audit.log.details"),
+                    screen: AUDIT_LOG_ALL_TENANTS_DETAIL_SCREEN_ID,
+                    entityId: "id",
+                    rowClick: true,
+                },
+            ],
+            pagination: "infinite",
+            description: "audit.log.allTenants.description",
+            access: { roles: access.systemAdmin },
+        });
+        r.screen({
+            id: AUDIT_LOG_ALL_TENANTS_DETAIL_SCREEN_ID,
+            type: "projectionDetail",
+            query: AuditQueries.detailsAllTenants,
+            idParam: "id",
+            fieldLabels: {
+                ...AUDIT_LOG_DETAIL_FIELD_LABELS,
+                tenantId: i18nKey("audit.log.col.tenant"),
+            },
+            layout: auditLogDetailLayout({ withTenant: true }),
+            description: "audit.log.detail.subtitle",
+            listScreenId: AUDIT_LOG_ALL_TENANTS_SCREEN_ID,
+            access: { roles: access.systemAdmin },
+        });
         r.nav({
             id: "audit-log",
             label: "audit:nav.auditLog",
@@ -150,6 +142,13 @@ export function createAuditFeature() {
             screen: "audit:screen:audit-log",
             order: 30,
         });
+        r.nav({
+            id: AUDIT_LOG_ALL_TENANTS_NAV_ID,
+            label: "audit:nav.auditLogAllTenants",
+            icon: "file",
+            screen: "audit:screen:audit-log-all-tenants",
+            order: 31,
+        });
         return { queries };
     }, { dedupeOptions: {} });
 }

package/dist/audit/handlers/audit-events.d.ts

@@ -0,0 +1,102 @@
+import { type TenantDb, type WhereObject } from "@cosmicdrift/kumiko-framework/db";
+import * as z from "zod";
+export declare const auditListPayloadShape: {
+    readonly cursor: z.ZodOptional<z.ZodString>;
+    readonly before: z.ZodOptional<z.ZodString>;
+    readonly search: z.ZodOptional<z.ZodString>;
+    readonly limit: z.ZodDefault<z.ZodNumber>;
+    readonly aggregateType: z.ZodOptional<z.ZodString>;
+    readonly aggregateId: z.ZodOptional<z.ZodUUID>;
+    readonly eventType: z.ZodOptional<z.ZodString>;
+    readonly userId: z.ZodOptional<z.ZodString>;
+    readonly sort: z.ZodOptional<z.ZodEnum<{
+        createdAt: "createdAt";
+        type: "type";
+    }>>;
+    readonly sortDirection: z.ZodOptional<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+    readonly from: z.ZodOptional<z.ZodISODateTime>;
+    readonly to: z.ZodOptional<z.ZodISODateTime>;
+};
+export declare const auditEventIdSchema: z.ZodString;
+export declare const AUDIT_DATE_RANGE_CHECK: {
+    isValid: (v: {
+        from?: string | undefined;
+        to?: string | undefined;
+    }) => boolean;
+    params: {
+        message: string;
+        path: string[];
+    };
+};
+export type AuditListFilters = {
+    aggregateType?: string | undefined;
+    aggregateId?: string | undefined;
+    eventType?: string | undefined;
+    search?: string | undefined;
+    userId?: string | undefined;
+    from?: string | undefined;
+    to?: string | undefined;
+    cursor?: string | undefined;
+    before?: string | undefined;
+};
+/** `tenantCondition` is a tenant id, or an operator object for reads across tenants. */
+export declare function buildAuditWhere(tenantCondition: unknown, p: AuditListFilters, direction: "asc" | "desc"): WhereObject;
+type AuditEventRow = {
+    id: bigint;
+    tenantId: string;
+    aggregateId: string;
+    aggregateType: string;
+    version: number;
+    type: string;
+    payload: Record<string, unknown>;
+    metadata: Record<string, unknown>;
+    createdAt: unknown;
+    createdBy: string;
+};
+export declare function serializeAuditEvent(r: AuditEventRow): {
+    id: string;
+    tenantId: string;
+    aggregateId: string;
+    aggregateType: string;
+    version: number;
+    type: string;
+    payload: unknown;
+    metadata: unknown;
+    createdAt: unknown;
+    createdBy: string;
+};
+export declare function loadAuditEvent(db: TenantDb, where: WhereObject): Promise<{
+    id: string;
+    tenantId: string;
+    aggregateId: string;
+    aggregateType: string;
+    version: number;
+    type: string;
+    payload: unknown;
+    metadata: unknown;
+    createdAt: unknown;
+    createdBy: string;
+} | null>;
+export declare function listAuditEvents(db: TenantDb, where: WhereObject, p: {
+    limit: number;
+    sort?: "createdAt" | "type" | undefined;
+}, direction: "asc" | "desc"): Promise<{
+    rows: {
+        id: string;
+        tenantId: string;
+        aggregateId: string;
+        aggregateType: string;
+        version: number;
+        type: string;
+        payload: unknown;
+        metadata: unknown;
+        createdAt: unknown;
+        createdBy: string;
+    }[];
+    nextCursor: string | null;
+    nextBefore: string | null;
+}>;
+export {};

package/dist/audit/handlers/audit-events.js

@@ -0,0 +1,112 @@
+// Query building and row mapping shared by every audit read handler, so the own-tenant
+// and the all-tenants variants cannot drift apart. The tenant condition is the only part
+// that differs per handler and is passed in.
+//
+// Event payloads hold PII as subject-KMS ciphertext; it is replaced by
+// REDACTED_PII_PLACEHOLDER before returning (payload and metadata), since the API leak guard refuses ciphertext.
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
+import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import * as z from "zod";
+import { redactPiiCiphertext } from "../../shared/index.js";
+const MAX_LIMIT = 100;
+// At most 18 digits keeps the id inside bigint, so an oversized cursor or id is a 422, not a 500.
+const CURSOR_PATTERN = /^\d{1,18}$/;
+export const auditListPayloadShape = {
+    cursor: z.string().regex(CURSOR_PATTERN, "cursor must be a positive integer").optional(),
+    before: z.string().regex(CURSOR_PATTERN, "cursor must be a positive integer").optional(),
+    search: z.string().trim().optional(),
+    limit: z.number().int().min(1).max(MAX_LIMIT).default(50),
+    aggregateType: z.string().optional(),
+    aggregateId: z.uuid().optional(),
+    eventType: z.string().optional(),
+    userId: z.string().optional(),
+    sort: z.enum(["createdAt", "type"]).optional(),
+    sortDirection: z.enum(["asc", "desc"]).optional(),
+    from: z.iso.datetime().optional(),
+    to: z.iso.datetime().optional(),
+};
+export const auditEventIdSchema = z
+    .string()
+    .regex(/^[1-9]\d{0,17}$/, "id must be a positive integer");
+export const AUDIT_DATE_RANGE_CHECK = {
+    isValid: (v) => !v.from || !v.to || v.from <= v.to,
+    params: {
+        message: "`from` must be less than or equal to `to`",
+        path: ["from"],
+    },
+};
+function buildDateRange(from, to) {
+    if (!from && !to)
+        return null;
+    const range = {};
+    if (from)
+        range.gte = Temporal.Instant.from(from);
+    if (to)
+        range.lte = Temporal.Instant.from(to);
+    return range;
+}
+function escapeLikePattern(value) {
+    return value.replace(/[\\%_]/g, (m) => `\\${m}`);
+}
+/** `tenantCondition` is a tenant id, or an operator object for reads across tenants. */
+export function buildAuditWhere(tenantCondition, p, direction) {
+    const where = { tenantId: tenantCondition };
+    if (p.aggregateType)
+        where["aggregateType"] = p.aggregateType;
+    if (p.aggregateId)
+        where["aggregateId"] = p.aggregateId;
+    if (p.eventType)
+        where["type"] = p.eventType;
+    else if (p.search)
+        where["type"] = { like: `%${escapeLikePattern(p.search)}%` };
+    if (p.userId)
+        where["createdBy"] = p.userId;
+    const range = buildDateRange(p.from, p.to);
+    if (range)
+        where["createdAt"] = range;
+    const cursor = p.cursor ?? p.before;
+    // The cursor is an event id, so it only walks pages in id order: ascending
+    // pages continue past it, descending pages stop before it.
+    if (cursor)
+        where["id"] = direction === "asc" ? { gt: BigInt(cursor) } : { lt: BigInt(cursor) };
+    return where;
+}
+export function serializeAuditEvent(r) {
+    return {
+        id: String(r.id),
+        tenantId: r.tenantId,
+        aggregateId: r.aggregateId,
+        aggregateType: r.aggregateType,
+        version: r.version,
+        type: r.type,
+        payload: redactPiiCiphertext(r.payload),
+        metadata: redactPiiCiphertext(r.metadata),
+        createdAt: r.createdAt,
+        createdBy: r.createdBy,
+    };
+}
+export async function loadAuditEvent(db, where) {
+    const rows = await selectMany(db, eventsTable, where, { limit: 1 });
+    const row = rows[0];
+    return row === undefined ? null : serializeAuditEvent(row);
+}
+export async function listAuditEvents(db, where, p, direction) {
+    const rows = await selectMany(db, eventsTable, where, {
+        // The id cursor only resumes an id-ordered listing. created_at comes from the
+        // transaction start and can run against insert order, so ordering by it would let
+        // a page boundary skip rows; only the type sort leaves id order (and is one page).
+        orderBy: p.sort === "type"
+            ? [
+                { col: "type", direction },
+                { col: "id", direction },
+            ]
+            : [{ col: "id", direction }],
+        limit: p.limit,
+    });
+    const serialised = rows.map(serializeAuditEvent);
+    const last = serialised[serialised.length - 1];
+    // An id cursor cannot resume a type-ordered listing, so that sort is one page.
+    const nextId = serialised.length === p.limit && last && p.sort !== "type" ? last.id : null;
+    return { rows: serialised, nextCursor: nextId, nextBefore: nextId };
+}

package/dist/audit/handlers/audit-system-db.d.ts

@@ -0,0 +1 @@
+export declare function requireAuditSystemDb<TSystemDb>(systemDb: TSystemDb | undefined, handlerQn: string): TSystemDb;

package/dist/audit/handlers/audit-system-db.js

@@ -0,0 +1,9 @@
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+export function requireAuditSystemDb(systemDb, handlerQn) {
+    if (!systemDb) {
+        throw new InternalError({
+            message: `${handlerQn} requires ctx.systemDb — is r.systemScope() still set on the audit feature?`,
+        });
+    }
+    return systemDb;
+}

package/dist/audit/handlers/details-all-tenants.query.d.ts

@@ -0,0 +1,15 @@
+import * as z from "zod";
+export declare const detailsAllTenantsQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"details-all-tenants", z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>, {
+    id: string;
+    tenantId: string;
+    aggregateId: string;
+    aggregateType: string;
+    version: number;
+    type: string;
+    payload: unknown;
+    metadata: unknown;
+    createdAt: unknown;
+    createdBy: string;
+} | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/audit/handlers/details-all-tenants.query.js

@@ -0,0 +1,20 @@
+// One audit event of any tenant by its event-store id, for the all-tenants log's detail screen.
+import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { auditEventIdSchema, loadAuditEvent } from "./audit-events.js";
+import { requireAuditSystemDb } from "./audit-system-db.js";
+import { allTenantsCondition, assertMayReadAllTenants } from "./resolve-audit-tenant.js";
+export const detailsAllTenantsQuery = defineQueryHandler({
+    name: "details-all-tenants",
+    description: "Returns one audit-trail event of any tenant by its event-store id, with full payload, metadata and tenantId; SystemAdmin only, system-tenant events are not included.",
+    schema: z.object({ id: auditEventIdSchema }),
+    access: { roles: access.systemAdmin },
+    handler: async (query, ctx) => {
+        assertMayReadAllTenants(query.user);
+        const db = requireAuditSystemDb(ctx.systemDb, "audit:query:details-all-tenants").acknowledgeCrossTenant("SystemAdmin reads one audit event of any tenant");
+        return loadAuditEvent(db, {
+            tenantId: allTenantsCondition(undefined),
+            id: BigInt(query.payload.id),
+        });
+    },
+});

package/dist/audit/handlers/details.query.d.ts

@@ -7,12 +7,13 @@ export declare const detailsQuery: import("@cosmicdrift/kumiko-types/define-hand
     }>>;
 }, z.core.$strip>, {
     id: string;
+    tenantId: string;
     aggregateId: string;
     aggregateType: string;
     version: number;
     type: string;
     payload: unknown;
-    metadata: Record<string, unknown>;
+    metadata: unknown;
     createdAt: unknown;
     createdBy: string;
 } | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;