@cosmicdrift/kumiko-bundled-features 0.378.0 → 0.379.0

package/dist/audit/handlers/details.query.js

@@ -2,43 +2,27 @@
 // screen. Tenant-isolated at the WHERE level like list.query, so a caller
 // can only read events in their own tenant; a SystemAdmin can pass scope
 // "system" to read app-instance system events (e.g. app.started).
-import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import * as z from "zod";
-import { redactPiiCiphertext } from "../../shared/index.js";
-import { AUDIT_SCOPE_VALUES } from "../constants.js";
+import { AUDIT_SCOPE_VALUES } from "../web/constants.js";
+import { auditEventIdSchema, loadAuditEvent } from "./audit-events.js";
+import { requireAuditSystemDb } from "./audit-system-db.js";
 import { resolveAuditScopeFilter } from "./resolve-audit-tenant.js";
 export const detailsQuery = defineQueryHandler({
     name: "details",
     description: 'Returns one audit-trail event of the caller\'s tenant by its event-store id, with full payload and metadata; use it to inspect the exact change behind a row of the audit log list. A SystemAdmin can set scope "system" to read an app-instance system event (e.g. app.started).',
     schema: z.object({
-        id: z.string().regex(/^[1-9]\d*$/, "id must be a positive integer"),
+        id: auditEventIdSchema,
         scope: z.enum(AUDIT_SCOPE_VALUES).optional(),
     }),
     access: { roles: access.admin },
     handler: async (query, ctx) => {
         const scopeFilter = resolveAuditScopeFilter(query.user, query.payload.scope);
-        const rows = await selectMany(ctx.db, eventsTable, {
+        const db = requireAuditSystemDb(ctx.systemDb, "audit:query:details").assertTenantMatch(query.user.tenantId);
+        return loadAuditEvent(db, {
             tenantId: scopeFilter.tenantId,
-            ...(scopeFilter.aggregateType !== undefined && {
-                aggregateType: scopeFilter.aggregateType,
-            }),
+            ...(scopeFilter.aggregateType !== undefined && { aggregateType: scopeFilter.aggregateType }),
             id: BigInt(query.payload.id),
-        }, { limit: 1 });
-        const row = rows[0];
-        if (row === undefined)
-            return null;
-        return {
-            id: String(row.id),
-            aggregateId: row.aggregateId,
-            aggregateType: row.aggregateType,
-            version: row.version,
-            type: row.type,
-            payload: redactPiiCiphertext(row.payload),
-            metadata: row.metadata,
-            createdAt: row.createdAt,
-            createdBy: row.createdBy,
-        };
+        });
     },
 });

package/dist/audit/handlers/list-all-tenants.query.d.ts

@@ -0,0 +1,41 @@
+import * as z from "zod";
+export declare const listAllTenantsQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"list-all-tenants", z.ZodObject<{
+    cursor: z.ZodOptional<z.ZodString>;
+    before: z.ZodOptional<z.ZodString>;
+    search: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodNumber>;
+    aggregateType: z.ZodOptional<z.ZodString>;
+    aggregateId: z.ZodOptional<z.ZodUUID>;
+    eventType: z.ZodOptional<z.ZodString>;
+    userId: z.ZodOptional<z.ZodString>;
+    sort: z.ZodOptional<z.ZodEnum<{
+        createdAt: "createdAt";
+        type: "type";
+    }>>;
+    sortDirection: z.ZodOptional<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+    from: z.ZodOptional<z.ZodISODateTime>;
+    to: z.ZodOptional<z.ZodISODateTime>;
+    filters: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        field: z.ZodLiteral<"tenantId">;
+        op: z.ZodLiteral<"in">;
+        value: z.ZodArray<z.ZodUUID>;
+    }, z.core.$strict>>>;
+}, z.core.$strip>, {
+    rows: {
+        id: string;
+        tenantId: string;
+        aggregateId: string;
+        aggregateType: string;
+        version: number;
+        type: string;
+        payload: unknown;
+        metadata: unknown;
+        createdAt: unknown;
+        createdBy: string;
+    }[];
+    nextCursor: string | null;
+    nextBefore: string | null;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/audit/handlers/list-all-tenants.query.js

@@ -0,0 +1,32 @@
+// SystemAdmin view of the audit trail across every tenant (the system tenant excluded, see
+// allTenantsCondition). Rows carry their tenantId so the screen can label the tenant.
+import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { AUDIT_DATE_RANGE_CHECK, auditListPayloadShape, buildAuditWhere, listAuditEvents, } from "./audit-events.js";
+import { requireAuditSystemDb } from "./audit-system-db.js";
+import { allTenantsCondition, assertMayReadAllTenants } from "./resolve-audit-tenant.js";
+const MAX_TENANT_FILTER_IDS = 100;
+// The reference facet on the tenant column sends exactly this shape.
+const tenantIdFiltersSchema = z
+    .array(z.strictObject({
+    field: z.literal("tenantId"),
+    op: z.literal("in"),
+    value: z.array(z.uuid()).max(MAX_TENANT_FILTER_IDS),
+}))
+    .max(1);
+export const listAllTenantsQuery = defineQueryHandler({
+    name: "list-all-tenants",
+    description: "Lists audit-trail events of every tenant newest-first with cursor paging, each row carrying its tenantId; filterable by tenant, aggregate type, aggregate id, event type, actor and time range. SystemAdmin only; events of the system tenant are not included.",
+    schema: z
+        .object({ ...auditListPayloadShape, filters: tenantIdFiltersSchema.optional() })
+        .refine(AUDIT_DATE_RANGE_CHECK.isValid, AUDIT_DATE_RANGE_CHECK.params),
+    access: { roles: access.systemAdmin },
+    handler: async (query, ctx) => {
+        assertMayReadAllTenants(query.user);
+        const p = query.payload;
+        const direction = p.sortDirection ?? "desc";
+        const where = buildAuditWhere(allTenantsCondition(p.filters?.[0]?.value), p, direction);
+        const db = requireAuditSystemDb(ctx.systemDb, "audit:query:list-all-tenants").acknowledgeCrossTenant("SystemAdmin reads the audit trail of every tenant");
+        return listAuditEvents(db, where, p, direction);
+    },
+});

package/dist/audit/handlers/list.query.d.ts

@@ -25,12 +25,13 @@ export declare const listQuery: import("@cosmicdrift/kumiko-types/define-handler
 }, z.core.$strip>, {
     rows: {
         id: string;
+        tenantId: string;
         aggregateId: string;
         aggregateType: string;
         version: number;
         type: string;
         payload: unknown;
-        metadata: Record<string, unknown>;
+        metadata: unknown;
         createdAt: unknown;
         createdBy: string;
     }[];

package/dist/audit/handlers/list.query.js

@@ -7,116 +7,26 @@
 // surface any audit UI needs; tenant-isolated at the WHERE level so cross-
 // tenant peeking is structurally impossible for non-SystemAdmin callers.
 // A SystemAdmin can pass scope "system" to read the app-instance system events
-// (e.g. app.started); no other cross-tenant read exists.
-//
-// Event payloads hold PII as subject-KMS ciphertext; it is replaced by
-// REDACTED_PII_PLACEHOLDER before returning, since the API leak guard refuses ciphertext.
-import { selectMany } from "@cosmicdrift/kumiko-framework/db";
+// (e.g. app.started); list-all-tenants is the one other cross-tenant read.
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
-import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { redactPiiCiphertext } from "../../shared/index.js";
-import { AUDIT_SCOPE_VALUES } from "../constants.js";
+import { AUDIT_SCOPE_VALUES } from "../web/constants.js";
+import { AUDIT_DATE_RANGE_CHECK, auditListPayloadShape, buildAuditWhere, listAuditEvents, } from "./audit-events.js";
+import { requireAuditSystemDb } from "./audit-system-db.js";
 import { resolveAuditScopeFilter } from "./resolve-audit-tenant.js";
-const MAX_LIMIT = 100;
-function buildDateRange(from, to) {
-    if (!from && !to)
-        return null;
-    const range = {};
-    if (from)
-        range.gte = Temporal.Instant.from(from);
-    if (to)
-        range.lte = Temporal.Instant.from(to);
-    return range;
-}
-function escapeLikePattern(value) {
-    return value.replace(/[\\%_]/g, (m) => `\\${m}`);
-}
-function buildAuditWhere(tenantId, p, direction) {
-    const where = { tenantId };
-    if (p.aggregateType)
-        where["aggregateType"] = p.aggregateType;
-    if (p.aggregateId)
-        where["aggregateId"] = p.aggregateId;
-    if (p.eventType)
-        where["type"] = p.eventType;
-    else if (p.search)
-        where["type"] = { like: `%${escapeLikePattern(p.search)}%` };
-    if (p.userId)
-        where["createdBy"] = p.userId;
-    const range = buildDateRange(p.from, p.to);
-    if (range)
-        where["createdAt"] = range;
-    const cursor = p.cursor ?? p.before;
-    // The cursor is an event id, so it only walks pages in id order: ascending
-    // pages continue past it, descending pages stop before it.
-    if (cursor)
-        where["id"] = direction === "asc" ? { gt: BigInt(cursor) } : { lt: BigInt(cursor) };
-    return where;
-}
 export const listQuery = defineQueryHandler({
     name: "list",
     description: 'Lists the tenant\'s audit-trail events newest-first with cursor paging, filterable by aggregate type, aggregate id, event type, actor and time range; use it to answer who changed what and when. A SystemAdmin can set scope "system" to read the app-instance system events (e.g. app.started) instead of the own tenant.',
     schema: z
-        .object({
-        cursor: z.string().regex(/^\d+$/, "cursor must be a positive integer").optional(),
-        before: z.string().regex(/^\d+$/, "cursor must be a positive integer").optional(),
-        search: z.string().trim().optional(),
-        limit: z.number().int().min(1).max(MAX_LIMIT).default(50),
-        aggregateType: z.string().optional(),
-        aggregateId: z.uuid().optional(),
-        eventType: z.string().optional(),
-        userId: z.string().optional(),
-        sort: z.enum(["createdAt", "type"]).optional(),
-        sortDirection: z.enum(["asc", "desc"]).optional(),
-        from: z.iso.datetime().optional(),
-        to: z.iso.datetime().optional(),
-        scope: z.enum(AUDIT_SCOPE_VALUES).optional(),
-    })
-        .refine((v) => !v.from || !v.to || v.from <= v.to, {
-        message: "`from` must be less than or equal to `to`",
-        path: ["from"],
-    }),
+        .object({ ...auditListPayloadShape, scope: z.enum(AUDIT_SCOPE_VALUES).optional() })
+        .refine(AUDIT_DATE_RANGE_CHECK.isValid, AUDIT_DATE_RANGE_CHECK.params),
     access: { roles: access.admin },
     handler: async (query, ctx) => {
         const p = query.payload;
         const scopeFilter = resolveAuditScopeFilter(query.user, p.scope);
         const direction = p.sortDirection ?? "desc";
-        const where = buildAuditWhere(scopeFilter.tenantId, {
-            ...p,
-            aggregateType: scopeFilter.aggregateType ?? p.aggregateType,
-        }, direction);
-        const rows = await selectMany(ctx.db, eventsTable, where, {
-            // The id cursor only resumes an id-ordered listing. created_at comes from the
-            // transaction start and can run against insert order, so ordering by it would let
-            // a page boundary skip rows; only the type sort leaves id order (and is one page).
-            orderBy: p.sort === "type"
-                ? [
-                    { col: "type", direction },
-                    { col: "id", direction },
-                ]
-                : [{ col: "id", direction }],
-            limit: p.limit,
-        });
-        const serialised = rows.map((r) => ({
-            id: String(r.id),
-            aggregateId: r.aggregateId,
-            aggregateType: r.aggregateType,
-            version: r.version,
-            type: r.type,
-            payload: redactPiiCiphertext(r.payload),
-            metadata: r.metadata,
-            createdAt: r.createdAt,
-            createdBy: r.createdBy,
-        }));
-        const last = serialised[serialised.length - 1];
-        // An id cursor cannot resume a type-ordered listing, so that sort is one page.
-        const nextId = serialised.length === p.limit && last && p.sort !== "type" ? last.id : null;
-        return {
-            rows: serialised,
-            nextCursor: nextId,
-            nextBefore: nextId,
-        };
+        const where = buildAuditWhere(scopeFilter.tenantId, { ...p, aggregateType: scopeFilter.aggregateType ?? p.aggregateType }, direction);
+        const db = requireAuditSystemDb(ctx.systemDb, "audit:query:list").assertTenantMatch(query.user.tenantId);
+        return listAuditEvents(db, where, p, direction);
     },
 });

package/dist/audit/handlers/resolve-audit-tenant.d.ts

@@ -1,7 +1,9 @@
 import { type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import { type AuditScope } from "../constants.ts";
+import { type AuditScope } from "../web/constants.ts";
 export type AuditScopeFilter = {
     readonly tenantId: string;
     readonly aggregateType?: string;
 };
 export declare function resolveAuditScopeFilter(user: SessionUser, scope: AuditScope | undefined): AuditScopeFilter;
+export declare function assertMayReadAllTenants(user: SessionUser): void;
+export declare function allTenantsCondition(requestedTenantIds: readonly string[] | undefined): unknown;

package/dist/audit/handlers/resolve-audit-tenant.js

@@ -2,17 +2,31 @@ import { mayOverrideTenant } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, FrameworkReasons } from "@cosmicdrift/kumiko-framework/errors";
 import { APP_INSTANCE_STREAM_TYPE } from "@cosmicdrift/kumiko-framework/event-store";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-types/identifiers";
-import { AuditScopes } from "../constants.js";
+import { AuditScopes } from "../web/constants.js";
+function denySystemAdminOnlyRead() {
+    throw new AccessDeniedError({
+        i18nKey: "audit.errors.systemScopeRequiresSystemAdmin",
+        details: { reason: FrameworkReasons.tenantOverrideRequiresSystemAdmin },
+    });
+}
 // The system tenant also holds personal streams of other features (session
 // revocations, exports, ...); only app-instance streams are released.
 export function resolveAuditScopeFilter(user, scope) {
     if (scope !== AuditScopes.system)
         return { tenantId: user.tenantId };
-    if (!mayOverrideTenant(user)) {
-        throw new AccessDeniedError({
-            i18nKey: "audit.errors.systemScopeRequiresSystemAdmin",
-            details: { reason: FrameworkReasons.tenantOverrideRequiresSystemAdmin },
-        });
-    }
+    if (!mayOverrideTenant(user))
+        denySystemAdminOnlyRead();
     return { tenantId: SYSTEM_TENANT_ID, aggregateType: APP_INSTANCE_STREAM_TYPE };
 }
+export function assertMayReadAllTenants(user) {
+    if (!mayOverrideTenant(user))
+        denySystemAdminOnlyRead();
+}
+// The where condition for reads across tenants. The system tenant is always excluded: it holds
+// personal streams of other features, and a where object cannot express "only app-instance
+// streams of that one tenant" next to "every other tenant".
+export function allTenantsCondition(requestedTenantIds) {
+    if (requestedTenantIds === undefined)
+        return { ne: SYSTEM_TENANT_ID };
+    return { in: requestedTenantIds.filter((id) => id !== SYSTEM_TENANT_ID) };
+}

package/dist/audit/index.d.ts

@@ -1,3 +1,3 @@
-export { AUDIT_FEATURE, AuditQueries } from "./constants.ts";
 export { createEscapeHatchAuditSink, ESCAPE_HATCH_USED_EVENT } from "./escape-hatch-audit-sink.ts";
 export { createAuditFeature } from "./feature.ts";
+export { AUDIT_FEATURE, AuditQueries } from "./web/constants.ts";

package/dist/audit/index.js

@@ -1,3 +1,3 @@
-export { AUDIT_FEATURE, AuditQueries } from "./constants.js";
 export { createEscapeHatchAuditSink, ESCAPE_HATCH_USED_EVENT } from "./escape-hatch-audit-sink.js";
 export { createAuditFeature } from "./feature.js";
+export { AUDIT_FEATURE, AuditQueries } from "./web/constants.js";

package/dist/audit/run-escape-hatch-retention.js

@@ -6,8 +6,8 @@ import { pruneEvents } from "@cosmicdrift/kumiko-framework/pipeline";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { resolveProfileForTenant } from "../compliance-profiles/index.js";
 import { createConfigAccessor } from "../config/index.js";
-import { DEFAULT_ESCAPE_HATCH_RETENTION_DAYS, ESCAPE_HATCH_RETENTION_DAYS_KEY, } from "./constants.js";
 import { ESCAPE_HATCH_USE_AGGREGATE_TYPE, escapeHatchUsedSchema, } from "./escape-hatch-audit-sink.js";
+import { DEFAULT_ESCAPE_HATCH_RETENTION_DAYS, ESCAPE_HATCH_RETENTION_DAYS_KEY, } from "./web/constants.js";
 // pruneEvents opens its own transaction, so a runner that cannot begin one (a tx handle) is rejected instead of nested.
 export function isDbConnection(runner) {
     return runnerCanBeginTransaction(runner);

package/dist/audit/screens.d.ts

@@ -0,0 +1,65 @@
+import type { EditLayout } from "@cosmicdrift/kumiko-framework/ui-types";
+export declare const AUDIT_LOG_COLUMNS: readonly [{
+    readonly field: "createdAt";
+    readonly label: string;
+    readonly renderer: {
+        readonly format: "timestamp";
+    };
+}, {
+    readonly field: "type";
+    readonly label: string;
+}, {
+    readonly refEntity: "user:user";
+    readonly refLabelField: "displayName";
+    readonly field: "createdBy";
+    readonly label: string;
+}];
+export declare const AUDIT_LOG_ALL_TENANTS_COLUMNS: readonly [{
+    readonly field: "createdAt";
+    readonly label: string;
+    readonly renderer: {
+        readonly format: "timestamp";
+    };
+}, {
+    readonly refEntity: "tenant:tenant";
+    readonly refLabelField: "name";
+    readonly field: "tenantId";
+    readonly label: string;
+}, {
+    readonly field: "type";
+    readonly label: string;
+}, {
+    readonly refEntity: "user:user";
+    readonly refLabelField: "displayName";
+    readonly field: "createdBy";
+    readonly label: string;
+}];
+export declare const AUDIT_LOG_DATE_RANGE_FACET: {
+    readonly type: "dateRange";
+    readonly field: "createdAt";
+    readonly label: string;
+    readonly params: {
+        readonly from: "from";
+        readonly to: "to";
+    };
+};
+export declare const AUDIT_LOG_TENANT_FACET: {
+    readonly type: "reference";
+    readonly field: "tenantId";
+    readonly label: string;
+    readonly entity: "tenant:tenant";
+    readonly labelField: "name";
+};
+export declare const AUDIT_LOG_DETAIL_FIELD_LABELS: {
+    readonly type: string;
+    readonly createdAt: string;
+    readonly aggregateType: string;
+    readonly aggregateId: string;
+    readonly createdBy: string;
+    readonly id: string;
+    readonly payload: string;
+    readonly metadata: string;
+};
+export declare function auditLogDetailLayout(options: {
+    readonly withTenant: boolean;
+}): EditLayout;

package/dist/audit/screens.js

@@ -0,0 +1,73 @@
+// Columns, labels and layout shared by the tenant audit log and its all-tenants variant, so the
+// two screen pairs cannot drift apart. The all-tenants variant only adds the tenant.
+import { i18nKey } from "@cosmicdrift/kumiko-framework/engine";
+const TENANT_REFERENCE = { refEntity: "tenant:tenant", refLabelField: "name" };
+const ACTOR_REFERENCE = { refEntity: "user:user", refLabelField: "displayName" };
+const WHEN_COLUMN = {
+    field: "createdAt",
+    label: i18nKey("audit.log.col.when"),
+    renderer: { format: "timestamp" },
+};
+const TENANT_COLUMN = {
+    field: "tenantId",
+    label: i18nKey("audit.log.col.tenant"),
+    ...TENANT_REFERENCE,
+};
+const TYPE_COLUMN = { field: "type", label: i18nKey("audit.log.col.type") };
+const ACTOR_COLUMN = {
+    field: "createdBy",
+    label: i18nKey("audit.log.col.actor"),
+    ...ACTOR_REFERENCE,
+};
+export const AUDIT_LOG_COLUMNS = [WHEN_COLUMN, TYPE_COLUMN, ACTOR_COLUMN];
+export const AUDIT_LOG_ALL_TENANTS_COLUMNS = [
+    WHEN_COLUMN,
+    TENANT_COLUMN,
+    TYPE_COLUMN,
+    ACTOR_COLUMN,
+];
+export const AUDIT_LOG_DATE_RANGE_FACET = {
+    type: "dateRange",
+    field: "createdAt",
+    label: i18nKey("audit.log.col.when"),
+    params: { from: "from", to: "to" },
+};
+export const AUDIT_LOG_TENANT_FACET = {
+    type: "reference",
+    field: "tenantId",
+    label: i18nKey("audit.log.col.tenant"),
+    entity: TENANT_REFERENCE.refEntity,
+    labelField: TENANT_REFERENCE.refLabelField,
+};
+export const AUDIT_LOG_DETAIL_FIELD_LABELS = {
+    type: i18nKey("audit.log.col.type"),
+    createdAt: i18nKey("audit.log.col.when"),
+    aggregateType: i18nKey("audit.log.col.aggregateType"),
+    aggregateId: i18nKey("audit.log.col.aggregateId"),
+    createdBy: i18nKey("audit.log.col.actor"),
+    id: i18nKey("audit.log.detail.field.id"),
+    payload: i18nKey("audit.log.detail.payload"),
+    metadata: i18nKey("audit.log.detail.metadata"),
+};
+export function auditLogDetailLayout(options) {
+    return {
+        sections: [
+            {
+                fields: [
+                    "type",
+                    { field: "createdAt", renderer: { format: "timestamp" } },
+                    ...(options.withTenant ? [{ field: "tenantId", ...TENANT_REFERENCE }] : []),
+                    "aggregateType",
+                    "aggregateId",
+                    { field: "createdBy", ...ACTOR_REFERENCE },
+                    "id",
+                ],
+            },
+            // No section `title` here (fw#2312 label-dedup fix): each section
+            // holds exactly one field, so a title would repeat the field's own
+            // label (rendered by RenderField as the Field's heading) verbatim.
+            { fields: [{ field: "payload", renderer: { format: "json" } }] },
+            { fields: [{ field: "metadata", renderer: { format: "json" } }] },
+        ],
+    };
+}

package/dist/audit/web/client-plugin.js

@@ -1,7 +1,6 @@
-// @runtime client
 import { mergeTranslations } from "@cosmicdrift/kumiko-renderer";
-import { AUDIT_FEATURE } from "../constants.js";
-import { defaultTranslations } from "./i18n.js";
+import { AUDIT_FEATURE } from "./constants.js";
+import { defaultTranslations } from "./default-translations.js";
 export function auditClient(options) {
     return {
         name: AUDIT_FEATURE,

package/dist/audit/{constants.d.ts → web/constants.d.ts}

@@ -8,6 +8,8 @@ export declare const SYSTEM_ACTOR_IDS: ReadonlySet<string>;
 export declare const AuditQueries: {
     readonly list: "audit:query:list";
     readonly details: "audit:query:details";
+    readonly listAllTenants: "audit:query:list-all-tenants";
+    readonly detailsAllTenants: "audit:query:details-all-tenants";
 };
 /** Read scope of the audit queries: the caller's own tenant (default) or the system tenant (SystemAdmin only). */
 export declare const AuditScopes: {
@@ -20,6 +22,12 @@ export declare const AUDIT_SCOPE_VALUES: readonly ["tenant", "system"];
 export declare const AUDIT_LOG_SCREEN_ID: "audit-log";
 /** Single-event detail screen, breadcrumb-linked to the audit-log list. */
 export declare const AUDIT_LOG_DETAIL_SCREEN_ID: "audit-log-detail";
+/** SystemAdmin audit log across every tenant. Nav: `audit:nav:audit-log-all-tenants`. */
+export declare const AUDIT_LOG_ALL_TENANTS_SCREEN_ID: "audit-log-all-tenants";
+/** Single-event detail screen of the all-tenants log. */
+export declare const AUDIT_LOG_ALL_TENANTS_DETAIL_SCREEN_ID: "audit-log-all-tenants-detail";
+/** Nav entry of the all-tenants log (short id; QN `audit:nav:audit-log-all-tenants`). */
+export declare const AUDIT_LOG_ALL_TENANTS_NAV_ID: "audit-log-all-tenants";
 /**
  * Config key (system scope) for how long `escapeHatchUse` audit events are kept. Only a fallback
  * for apps without compliance-profiles; with it mounted, the tenant profile's `auditLog.retention`

package/dist/audit/{constants.js → web/constants.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // Qualified handler names + screen ids — shared by server feature and web client.
 export const AUDIT_FEATURE = "audit";
 /** Literal `createdBy` written by hand-built system actors (secrets/jobs/…). */
@@ -13,6 +12,8 @@ export const SYSTEM_ACTOR_IDS = new Set([
 export const AuditQueries = {
     list: "audit:query:list",
     details: "audit:query:details",
+    listAllTenants: "audit:query:list-all-tenants",
+    detailsAllTenants: "audit:query:details-all-tenants",
 };
 /** Read scope of the audit queries: the caller's own tenant (default) or the system tenant (SystemAdmin only). */
 export const AuditScopes = { tenant: "tenant", system: "system" };
@@ -21,6 +22,12 @@ export const AUDIT_SCOPE_VALUES = [AuditScopes.tenant, AuditScopes.system];
 export const AUDIT_LOG_SCREEN_ID = "audit-log";
 /** Single-event detail screen, breadcrumb-linked to the audit-log list. */
 export const AUDIT_LOG_DETAIL_SCREEN_ID = "audit-log-detail";
+/** SystemAdmin audit log across every tenant. Nav: `audit:nav:audit-log-all-tenants`. */
+export const AUDIT_LOG_ALL_TENANTS_SCREEN_ID = "audit-log-all-tenants";
+/** Single-event detail screen of the all-tenants log. */
+export const AUDIT_LOG_ALL_TENANTS_DETAIL_SCREEN_ID = "audit-log-all-tenants-detail";
+/** Nav entry of the all-tenants log (short id; QN `audit:nav:audit-log-all-tenants`). */
+export const AUDIT_LOG_ALL_TENANTS_NAV_ID = "audit-log-all-tenants";
 /**
  * Config key (system scope) for how long `escapeHatchUse` audit events are kept. Only a fallback
  * for apps without compliance-profiles; with it mounted, the tenant profile's `auditLog.retention`

package/dist/audit/web/default-translations.d.ts

@@ -0,0 +1,2 @@
+import { type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+export declare const defaultTranslations: TranslationsByLocale;

package/dist/audit/web/default-translations.js

@@ -0,0 +1,3 @@
+import { translationsByLocaleFromKeys, } from "@cosmicdrift/kumiko-renderer";
+import { AUDIT_I18N } from "./i18n.js";
+export const defaultTranslations = translationsByLocaleFromKeys(AUDIT_I18N);

package/dist/audit/web/i18n.d.ts

@@ -1,2 +1,5 @@
-import { type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-export declare const defaultTranslations: TranslationsByLocale;
+type LocalizedString = {
+    readonly en: string;
+};
+export declare const AUDIT_I18N: Readonly<Record<string, LocalizedString>>;
+export {};

package/dist/audit/web/i18n.js

@@ -1,4 +1,31 @@
-// @runtime client
-import { translationsByLocaleFromKeys, } from "@cosmicdrift/kumiko-renderer";
-import { AUDIT_I18N } from "../i18n.js";
-export const defaultTranslations = translationsByLocaleFromKeys(AUDIT_I18N);
+// Server + client i18n for audit (nav labels + audit-log/-detail screens).
+export const AUDIT_I18N = {
+    "screen:audit-log.title": { en: "Audit log" },
+    "screen:audit-log-detail.title": { en: "Event" },
+    "audit.log.description": {
+        en: "All events of this tenant. A row opens the details.",
+    },
+    "audit.log.allTenants.description": {
+        en: "All events of all tenants. A row opens the details.",
+    },
+    "audit.log.detail.subtitle": {
+        en: "One event with its actor, time and stored data.",
+    },
+    "audit.errors.systemScopeRequiresSystemAdmin": {
+        en: "Only SystemAdmin may read system events.",
+    },
+    "screen:audit-log-all-tenants.title": { en: "Audit log (all tenants)" },
+    "screen:audit-log-all-tenants-detail.title": { en: "Event" },
+    "audit:nav.auditLog": { en: "Audit" },
+    "audit:nav.auditLogAllTenants": { en: "Audit log (all tenants)" },
+    "audit.log.col.tenant": { en: "Tenant" },
+    "audit.log.col.when": { en: "When" },
+    "audit.log.col.type": { en: "Event" },
+    "audit.log.col.aggregateType": { en: "Aggregate type" },
+    "audit.log.col.aggregateId": { en: "Aggregate ID" },
+    "audit.log.col.actor": { en: "Actor" },
+    "audit.log.details": { en: "Details" },
+    "audit.log.detail.payload": { en: "Event payload" },
+    "audit.log.detail.metadata": { en: "Metadata" },
+    "audit.log.detail.field.id": { en: "Event ID" },
+};

package/dist/audit/web/index.js

@@ -1,2 +1 @@
-// @runtime client
 export { auditClient } from "./client-plugin.js";

package/dist/auth-email-password/bootstrap.d.ts

@@ -4,7 +4,7 @@ import { type Registry, type TenantId, type WriteResult } from "@cosmicdrift/kum
 import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
 import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
-import type { GlobalRole } from "../user/constants.ts";
+import type { GlobalRole } from "../user/web/constants.ts";
 export type BootstrapInvite = {
     readonly email: string;
     /** Membership role in the tenant, validated like a tenant-admin invite

package/dist/auth-email-password/bootstrap.js

@@ -9,21 +9,21 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { ConfigScopes, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 // kumiko-lint-ignore cross-feature-import bootstrap sets per-tenant config through the config feature's write handler
-import { ConfigHandlers } from "../config/constants.js";
+import { ConfigHandlers } from "../config/web/constants.js";
 // kumiko-lint-ignore cross-feature-import bootstrap compares against the stored config row to stay idempotent
 import { configRowHoldsValue, findConfigRow } from "../config/write-helpers.js";
 // kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
-import { TenantHandlers } from "../tenant/constants.js";
-// kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
 import { INVITATION_STATUS, tenantInvitationsTable } from "../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import bootstrap checks existing memberships
 import { tenantMembershipsTable } from "../tenant/membership-table.js";
 // kumiko-lint-ignore cross-feature-import bootstrap checks for an existing tenant
 import { tenantTable } from "../tenant/schema/tenant.js";
+// kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
+import { TenantHandlers } from "../tenant/web/constants.js";
 // kumiko-lint-ignore cross-feature-import bootstrap skips already activated users
 import { userTable } from "../user/schema/user.js";
-import { AuthHandlers } from "./constants.js";
 import { hasLiveInviteToken } from "./invite-token-store.js";
+import { AuthHandlers } from "./web/constants.js";
 export class BootstrapPlanError extends Error {
 }
 export class BootstrapWriteError extends Error {