@cosmicdrift/kumiko-bundled-features 0.391.1 → 0.392.0

package/dist/inbound-provider-imap/smtp-client.js

@@ -0,0 +1,106 @@
+// nodemailer wiring for sending from a connected mailbox: one short-lived, non-pooled connection
+// per call, always implicit TLS, pinned to the address the mail host guard approved.
+import { BlockedHostError, resolveMailConnectTarget, } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { errorCodeOf, propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { createTransport } from "nodemailer";
+import { imapMailHostGuard } from "./imap-client.js";
+const log = createFallbackLogger("inbound-provider-imap");
+// nodemailer's defaults wait minutes; the connect form holds a request open meanwhile.
+const CONNECTION_TIMEOUT_MS = 10_000;
+const GREETING_TIMEOUT_MS = 10_000;
+const SOCKET_TIMEOUT_MS = 30_000;
+// Carries only the category and the library code: the raw error holds the host and the server
+// response, which stay in the server log.
+export class SmtpFailureError extends Error {
+    failure;
+    constructor(failure, detail) {
+        super(`SMTP ${failure}: ${detail}`);
+        this.name = "SmtpFailureError";
+        this.failure = failure;
+    }
+}
+const LOGIN_CODES = ["EAUTH", "ENOAUTH"];
+const CONNECTION_CODES = ["ECONNECTION", "ETIMEDOUT", "ESOCKET", "EDNS", "EPROXY"];
+const TLS_CODE = /^(ETLS|ERR_SSL|ERR_TLS)|CERT|SELF_SIGNED|UNABLE_TO_VERIFY/;
+// nodemailer wraps a TLS handshake error as ESOCKET and keeps the TLS code as originalCode.
+function isTlsFailure(code, originalCode) {
+    return TLS_CODE.test(code) || (typeof originalCode === "string" && TLS_CODE.test(originalCode));
+}
+export function classifySmtpError(err) {
+    const code = errorCodeOf(err) ?? "";
+    if (LOGIN_CODES.includes(code))
+        return "loginRejected";
+    if (isTlsFailure(code, propertyOf(err, "originalCode")))
+        return "tlsFailed";
+    if (CONNECTION_CODES.includes(code))
+        return "connectFailed";
+    if (typeof propertyOf(err, "responseCode") === "number")
+        return "rejected";
+    return "connectFailed";
+}
+export function smtpTransportOptions(login, target) {
+    return {
+        host: target.host,
+        port: login.port,
+        secure: true,
+        ...(target.servername && { servername: target.servername }),
+        auth: { user: login.user, pass: login.password },
+        connectionTimeout: CONNECTION_TIMEOUT_MS,
+        greetingTimeout: GREETING_TIMEOUT_MS,
+        socketTimeout: SOCKET_TIMEOUT_MS,
+        // The message is composed by us; nothing in it may make nodemailer read files or URLs.
+        disableFileAccess: true,
+        disableUrlAccess: true,
+        logger: false,
+        debug: false,
+    };
+}
+async function openSmtpTransport(login) {
+    let target;
+    try {
+        target = await resolveMailConnectTarget(login.host, imapMailHostGuard());
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        const blocked = err instanceof BlockedHostError;
+        log.warn(blocked ? "rejected blocked smtp host" : "smtp host resolution failed", {
+            host: login.host,
+            reason,
+        });
+        throw new SmtpFailureError("hostUnreachable", blocked ? "blocked" : "unresolved");
+    }
+    return createTransport(smtpTransportOptions(login, target));
+}
+// No error message in the log: a server's reply to a failed AUTH can echo the user name.
+function smtpFailureOf(err, host) {
+    const failure = classifySmtpError(err);
+    const code = errorCodeOf(err) ?? "unknown";
+    const responseCode = propertyOf(err, "responseCode");
+    log.warn("smtp call failed", { host, failure, code, responseCode });
+    return new SmtpFailureError(failure, code);
+}
+export async function verifySmtpLogin(login) {
+    const transport = await openSmtpTransport(login);
+    try {
+        await transport.verify();
+    }
+    catch (err) {
+        throw smtpFailureOf(err, login.host);
+    }
+    finally {
+        transport.close();
+    }
+}
+export async function sendRawViaSmtp(login, envelope, raw) {
+    const transport = await openSmtpTransport(login);
+    try {
+        await transport.sendMail({ envelope: { from: envelope.from, to: [...envelope.to] }, raw });
+    }
+    catch (err) {
+        throw smtpFailureOf(err, login.host);
+    }
+    finally {
+        transport.close();
+    }
+}

package/dist/ledger/entity.d.ts

@@ -14,11 +14,11 @@ export declare const accountEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly asset?: "bad" | "neutral" | "ok" | "warn" | undefined;
-            readonly equity?: "bad" | "neutral" | "ok" | "warn" | undefined;
-            readonly expense?: "bad" | "neutral" | "ok" | "warn" | undefined;
-            readonly income?: "bad" | "neutral" | "ok" | "warn" | undefined;
-            readonly liability?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly asset?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+            readonly equity?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+            readonly expense?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+            readonly income?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+            readonly liability?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
@@ -67,8 +67,8 @@ export declare const transactionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly draft?: "bad" | "neutral" | "ok" | "warn" | undefined;
-            readonly posted?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly draft?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+            readonly posted?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
@@ -144,7 +144,7 @@ export declare const scheduleEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly monthly?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly monthly?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;

package/dist/mail-foundation/i18n.d.ts

@@ -2,12 +2,14 @@ export declare const MAIL_PROBE_KEYS: {
     readonly area: "mail-foundation.probe.area";
     readonly label: "mail-foundation.probe.send-test-mail.label";
     readonly accepted: "mail-foundation.probe.send-test-mail.accepted";
+    readonly platformAccepted: "mail-foundation.probe.send-test-mail.platform-accepted";
     readonly notConfigured: "mail-foundation.probe.not-configured";
     readonly noRecipient: "mail-foundation.probe.no-recipient";
     readonly hostNotFound: "mail-foundation.probe.host-not-found";
     readonly setupIncomplete: "mail-foundation.probe.setup-incomplete";
     readonly setupFailed: "mail-foundation.probe.setup-failed";
     readonly sendRejected: "mail-foundation.probe.send-rejected";
+    readonly platformSendRejected: "mail-foundation.probe.platform-send-rejected";
 };
 export declare const MAIL_FOUNDATION_I18N: {
     readonly "screen:mail-foundation-tenant.title": {
@@ -34,8 +36,11 @@ export declare const MAIL_FOUNDATION_I18N: {
     readonly "mail-foundation.probe.send-test-mail.accepted": {
         readonly en: "Accepted by the mail server";
     };
+    readonly "mail-foundation.probe.send-test-mail.platform-accepted": {
+        readonly en: "Sent via the platform sender, accepted by its mail server";
+    };
     readonly "mail-foundation.probe.not-configured": {
-        readonly en: "No own email sending set up";
+        readonly en: "No email sending set up";
     };
     readonly "mail-foundation.probe.no-recipient": {
         readonly en: "No email address known for the person who started the check";
@@ -52,4 +57,7 @@ export declare const MAIL_FOUNDATION_I18N: {
     readonly "mail-foundation.probe.send-rejected": {
         readonly en: "The mail server did not accept the test email, check address, port and login";
     };
+    readonly "mail-foundation.probe.platform-send-rejected": {
+        readonly en: "The platform mail server did not accept the test email";
+    };
 };

package/dist/mail-foundation/i18n.js

@@ -2,12 +2,14 @@ export const MAIL_PROBE_KEYS = {
     area: "mail-foundation.probe.area",
     label: "mail-foundation.probe.send-test-mail.label",
     accepted: "mail-foundation.probe.send-test-mail.accepted",
+    platformAccepted: "mail-foundation.probe.send-test-mail.platform-accepted",
     notConfigured: "mail-foundation.probe.not-configured",
     noRecipient: "mail-foundation.probe.no-recipient",
     hostNotFound: "mail-foundation.probe.host-not-found",
     setupIncomplete: "mail-foundation.probe.setup-incomplete",
     setupFailed: "mail-foundation.probe.setup-failed",
     sendRejected: "mail-foundation.probe.send-rejected",
+    platformSendRejected: "mail-foundation.probe.platform-send-rejected",
 };
 export const MAIL_FOUNDATION_I18N = {
     "screen:mail-foundation-tenant.title": { en: "Email sending" },
@@ -20,7 +22,10 @@ export const MAIL_FOUNDATION_I18N = {
     [MAIL_PROBE_KEYS.area]: { en: "Email" },
     [MAIL_PROBE_KEYS.label]: { en: "Test email to the person who started the check" },
     [MAIL_PROBE_KEYS.accepted]: { en: "Accepted by the mail server" },
-    [MAIL_PROBE_KEYS.notConfigured]: { en: "No own email sending set up" },
+    [MAIL_PROBE_KEYS.platformAccepted]: {
+        en: "Sent via the platform sender, accepted by its mail server",
+    },
+    [MAIL_PROBE_KEYS.notConfigured]: { en: "No email sending set up" },
     [MAIL_PROBE_KEYS.noRecipient]: {
         en: "No email address known for the person who started the check",
     },
@@ -32,4 +37,7 @@ export const MAIL_FOUNDATION_I18N = {
     [MAIL_PROBE_KEYS.sendRejected]: {
         en: "The mail server did not accept the test email, check address, port and login",
     },
+    [MAIL_PROBE_KEYS.platformSendRejected]: {
+        en: "The platform mail server did not accept the test email",
+    },
 };

package/dist/mail-foundation/probe.js

@@ -1,3 +1,4 @@
+import { findEmailAppTransport, } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import { createSystemUser, ProbeFailure, SETTINGS_HUB_FEATURE, } from "@cosmicdrift/kumiko-framework/engine";
 import { UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
 import { HostResolutionError } from "@cosmicdrift/kumiko-framework/http";
@@ -21,6 +22,28 @@ function transportFailureKey(error) {
         ? MAIL_PROBE_KEYS.setupIncomplete
         : MAIL_PROBE_KEYS.setupFailed;
 }
+async function ownTenantTransport(ctx) {
+    const { configResolver, secrets } = ctx.services;
+    if (!configResolver)
+        return null;
+    const config = createConfigAccessor(ctx.registry, configResolver, ctx.tenantId, createSystemUser(ctx.tenantId).id, ctx.db);
+    return tenantMailTransport({
+        tenantId: ctx.tenantId,
+        config,
+        registry: ctx.registry,
+        secrets,
+    }).catch((error) => {
+        throw probeFailure(ctx, error, transportFailureKey(error));
+    });
+}
+// Same order as channel-email for tenant mails: the tenant's own provider, else the app sender.
+async function probeTransport(ctx) {
+    const own = await ownTenantTransport(ctx);
+    if (own !== null)
+        return { transport: own, viaPlatform: false };
+    const platform = findEmailAppTransport(ctx.registry);
+    return platform === null ? null : { transport: platform, viaPlatform: true };
+}
 // The mail goes to whoever started the check; the address never appears in the stored result.
 export function registerMailProbe(r) {
     r.probe({
@@ -31,25 +54,14 @@ export function registerMailProbe(r) {
         label: MAIL_PROBE_KEYS.label,
         fixScreen: MAIL_SETTINGS_SCREEN_QN,
         run: async (ctx) => {
-            const { configResolver, secrets } = ctx.services;
-            if (!configResolver) {
-                return { status: "skipped", message: { key: MAIL_PROBE_KEYS.notConfigured } };
-            }
-            const config = createConfigAccessor(ctx.registry, configResolver, ctx.tenantId, createSystemUser(ctx.tenantId).id, ctx.db);
-            const transport = await tenantMailTransport({
-                tenantId: ctx.tenantId,
-                config,
-                registry: ctx.registry,
-                secrets,
-            }).catch((error) => {
-                throw probeFailure(ctx, error, transportFailureKey(error));
-            });
-            if (transport === null) {
+            const resolved = await probeTransport(ctx);
+            if (resolved === null) {
                 return { status: "skipped", message: { key: MAIL_PROBE_KEYS.notConfigured } };
             }
             if (ctx.triggeredByEmail === undefined) {
                 return { status: "skipped", message: { key: MAIL_PROBE_KEYS.noRecipient } };
             }
+            const { transport, viaPlatform } = resolved;
             await transport
                 .send({
                 to: ctx.triggeredByEmail,
@@ -58,9 +70,13 @@ export function registerMailProbe(r) {
                 html: `<p>${PROBE_TEXT}</p>`,
             })
                 .catch((error) => {
-                throw probeFailure(ctx, error, MAIL_PROBE_KEYS.sendRejected);
+                const key = viaPlatform
+                    ? MAIL_PROBE_KEYS.platformSendRejected
+                    : MAIL_PROBE_KEYS.sendRejected;
+                throw probeFailure(ctx, error, key);
             });
-            return { status: "ok", message: { key: MAIL_PROBE_KEYS.accepted } };
+            const accepted = viaPlatform ? MAIL_PROBE_KEYS.platformAccepted : MAIL_PROBE_KEYS.accepted;
+            return { status: "ok", message: { key: accepted } };
         },
     });
 }

package/dist/readiness/built-in-probes.d.ts

@@ -1,4 +1,4 @@
-import type { FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
 export declare const BuiltInProbeKeys: {
     readonly areaInfrastructure: "readiness.area.infrastructure";
     readonly databaseLabel: "readiness.probe.database.label";
@@ -7,5 +7,6 @@ export declare const BuiltInProbeKeys: {
     readonly cacheOk: "readiness.probe.cache.ok";
     readonly searchLabel: "readiness.probe.search.label";
     readonly searchOk: "readiness.probe.search.ok";
+    readonly searchUnavailable: "readiness.probe.search.unavailable";
 };
 export declare function registerBuiltInProbes(r: FeatureRegistrar<"readiness">): void;

package/dist/readiness/built-in-probes.js

@@ -1,3 +1,4 @@
+import { ProbeFailure, } from "@cosmicdrift/kumiko-framework/engine";
 import { ProbeTextKeys } from "./constants.js";
 import { probeRunsTable } from "./schema/probe-run.js";
 export const BuiltInProbeKeys = {
@@ -8,6 +9,7 @@ export const BuiltInProbeKeys = {
     cacheOk: "readiness.probe.cache.ok",
     searchLabel: "readiness.probe.search.label",
     searchOk: "readiness.probe.search.ok",
+    searchUnavailable: "readiness.probe.search.unavailable",
 };
 export function registerBuiltInProbes(r) {
     r.probe({
@@ -48,7 +50,16 @@ export function registerBuiltInProbes(r) {
             if (!searchAdapter) {
                 return { status: "skipped", message: { key: ProbeTextKeys.notConfigured } };
             }
-            await searchAdapter.search(ctx.tenantId, "readiness-probe", { limit: 1 });
+            try {
+                await searchAdapter.search(ctx.tenantId, "readiness-probe", { limit: 1 });
+            }
+            catch (error) {
+                // The raw error can name the search host, so it stays in the server log.
+                ctx.obs.log.warn("readiness search probe failed", {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                throw new ProbeFailure({ key: BuiltInProbeKeys.searchUnavailable });
+            }
             return { status: "ok", message: { key: BuiltInProbeKeys.searchOk } };
         },
     });

package/dist/readiness/constants.d.ts

@@ -10,6 +10,11 @@ export declare const ReadinessQueries: {
 export declare const ReadinessWrites: {
     readonly runProbes: "readiness:write:run-probes";
 };
+export declare const RUN_OUTCOME: {
+    readonly ok: "ok";
+    readonly failed: "failed";
+    readonly running: "running";
+};
 export declare const DEFAULT_PROBE_TIMEOUT_MS = 10000;
 export declare const MIN_STALE_RUN_AFTER_MS: number;
 export declare const STALE_RUN_TIMEOUT_FACTOR = 3;

package/dist/readiness/constants.js

@@ -12,6 +12,7 @@ export const ReadinessQueries = {
 export const ReadinessWrites = {
     runProbes: "readiness:write:run-probes",
 };
+export const RUN_OUTCOME = { ok: "ok", failed: "failed", running: "running" };
 export const DEFAULT_PROBE_TIMEOUT_MS = 10_000;
 // An active run older than this is treated as dead (worker crash) and may be replaced.
 export const MIN_STALE_RUN_AFTER_MS = 10 * 60_000;

package/dist/readiness/i18n.js

@@ -8,7 +8,8 @@ export const READINESS_I18N = {
     "readiness.probe.cache.ok": { en: "Cache reachable" },
     "readiness.probe.search.label": { en: "Search" },
     "readiness.probe.search.ok": { en: "Search reachable" },
-    "readiness.probe.paid-not-requested": { en: "Not run, paid checks were not requested" },
+    "readiness.probe.search.unavailable": { en: "The search service does not answer" },
+    "readiness.probe.paid-not-requested": { en: "Only via “Test AI extraction”" },
     "readiness.probe.no-targets": { en: "Nothing to check" },
     "readiness.probe.timeout": { en: "No answer after {seconds} seconds" },
     "readiness.probe.failed": { en: "The check failed" },
@@ -27,6 +28,11 @@ export const READINESS_I18N = {
         en: "Real calls against mail, storage, search and the other connected services. A failed row links to the screen that fixes it.",
     },
     "readiness.screen.latest.empty": { en: "No results yet. Start a check." },
+    "readiness.screen.latest.running": {
+        en: "The check is running. Results appear when it is done.",
+    },
+    "readiness.screen.latest.nothing-to-check": { en: "There is nothing to check for this tenant." },
+    "readiness.screen.latest.abandoned": { en: "The run was stopped before it returned results." },
     "readiness.screen.history.title": { en: "History" },
     "readiness.screen.history.description": {
         en: "Earlier runs, newest first. Open one to see its results.",

package/dist/readiness/index.d.ts

@@ -1,3 +1,3 @@
-export { READINESS_FEATURE, ReadinessQueries, ReadinessWrites } from "./constants.ts";
+export { ProbeTextKeys, READINESS_FEATURE, ReadinessQueries, ReadinessWrites, } from "./constants.ts";
 export { createReadinessFeature } from "./feature.ts";
 export type { ReadinessMissingSecret } from "./handlers/status.query.ts";

package/dist/readiness/index.js

@@ -1,2 +1,2 @@
-export { READINESS_FEATURE, ReadinessQueries, ReadinessWrites } from "./constants.js";
+export { ProbeTextKeys, READINESS_FEATURE, ReadinessQueries, ReadinessWrites, } from "./constants.js";
 export { createReadinessFeature } from "./feature.js";

package/dist/readiness/schema/probe-run.d.ts

@@ -36,10 +36,10 @@ export declare const probeRunEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly abandoned?: "bad" | "neutral" | "ok" | "warn" | undefined;
-            readonly done?: "bad" | "neutral" | "ok" | "warn" | undefined;
-            readonly pending?: "bad" | "neutral" | "ok" | "warn" | undefined;
-            readonly running?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly abandoned?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+            readonly done?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+            readonly pending?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+            readonly running?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
@@ -195,10 +195,10 @@ export declare const probeRunsTable: import("@cosmicdrift/kumiko-framework/db").
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly abandoned?: "bad" | "neutral" | "ok" | "warn" | undefined;
-            readonly done?: "bad" | "neutral" | "ok" | "warn" | undefined;
-            readonly pending?: "bad" | "neutral" | "ok" | "warn" | undefined;
-            readonly running?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly abandoned?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+            readonly done?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+            readonly pending?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+            readonly running?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;

package/dist/readiness/screens.d.ts

@@ -9,6 +9,9 @@ export declare const ScreenTextKeys: {
     readonly latestTitle: "readiness.screen.latest.title";
     readonly latestDescription: "readiness.screen.latest.description";
     readonly latestEmpty: "readiness.screen.latest.empty";
+    readonly latestRunning: "readiness.screen.latest.running";
+    readonly latestNothingToCheck: "readiness.screen.latest.nothing-to-check";
+    readonly latestAbandoned: "readiness.screen.latest.abandoned";
     readonly historyTitle: "readiness.screen.history.title";
     readonly historyDescription: "readiness.screen.history.description";
     readonly historyEmpty: "readiness.screen.history.empty";

package/dist/readiness/screens.js

@@ -1,4 +1,5 @@
-import { ReadinessQueries, ReadinessWrites } from "./constants.js";
+import { ReadinessQueries, ReadinessWrites, RUN_OUTCOME } from "./constants.js";
+import { PROBE_RUN_STATUS } from "./schema/probe-run.js";
 export const SYSTEM_CHECK_SCREEN_ID = "system-check";
 export const SYSTEM_CHECK_RUN_SCREEN_ID = "system-check-run";
 export const SYSTEM_CHECK_SCREEN_QN = `readiness:screen:${SYSTEM_CHECK_SCREEN_ID}`;
@@ -9,6 +10,9 @@ export const ScreenTextKeys = {
     latestTitle: "readiness.screen.latest.title",
     latestDescription: "readiness.screen.latest.description",
     latestEmpty: "readiness.screen.latest.empty",
+    latestRunning: "readiness.screen.latest.running",
+    latestNothingToCheck: "readiness.screen.latest.nothing-to-check",
+    latestAbandoned: "readiness.screen.latest.abandoned",
     historyTitle: "readiness.screen.history.title",
     historyDescription: "readiness.screen.history.description",
     historyEmpty: "readiness.screen.history.empty",
@@ -60,7 +64,24 @@ function resultsSection(query, title, extra) {
         title,
         query,
         columns: RESULT_COLUMNS,
-        emptyState: { title: ScreenTextKeys.latestEmpty },
+        emptyState: {
+            title: ScreenTextKeys.latestEmpty,
+            // A finished run without rows had nothing the caller may see, not "no run yet".
+            variants: [
+                {
+                    when: { field: "outcome", eq: RUN_OUTCOME.running },
+                    title: ScreenTextKeys.latestRunning,
+                },
+                {
+                    when: { field: "outcome", eq: RUN_OUTCOME.ok },
+                    title: ScreenTextKeys.latestNothingToCheck,
+                },
+                {
+                    when: { field: "status", eq: PROBE_RUN_STATUS.Abandoned },
+                    title: ScreenTextKeys.latestAbandoned,
+                },
+            ],
+        },
         ...extra,
     };
 }
@@ -102,6 +123,8 @@ export function systemCheckScreen(dormant) {
         access: ACCESS,
         actions: RUN_ACTIONS,
         primaryAction: "run-check",
+        // The paid run is the only way to test AI extraction, so it must not hide in the menu.
+        inlineActions: ["run-paid-check"],
         metrics: RESULT_METRICS,
         metricsStyle: "tiles",
         layout: {

package/dist/readiness/visible-results.d.ts

@@ -1,5 +1,6 @@
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import type { RUN_OUTCOME } from "./constants.ts";
 declare const probeResultRowSchema: z.ZodObject<{
     probe: z.ZodString;
     scope: z.ZodEnum<{
@@ -36,7 +37,7 @@ export type VisibleProbeResult = Omit<StoredProbeResult, "label" | "message" | "
     readonly message: ProbeText;
     readonly fixScreen?: string;
 };
-export type RunOutcome = "ok" | "failed" | "running";
+export type RunOutcome = (typeof RUN_OUTCOME)[keyof typeof RUN_OUTCOME];
 export type ResultCounts = {
     readonly okCount: number;
     readonly failedCount: number;