@cosmicdrift/kumiko-bundled-features 0.98.0 → 0.102.0

package/src/delivery/types.ts

@@ -2,6 +2,7 @@ import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type {
   NotifyOptions,
+  NotifyPriority,
   Registry,
   SessionUser,
   TenantId,
@@ -29,10 +30,31 @@ export type ChannelResult = {
   readonly address?: string;
 };
 
+// Output of a channel's render step, passed into send(). Only channels that
+// declare render() (email) produce one; inline channels (inApp) and channels
+// without an expensive render step (push) receive `undefined`.
+export type RenderedMessage = {
+  readonly html: string;
+  readonly subject: string;
+};
+
+// `mode` decides how the delivery-service dispatches a channel:
+//   inline — sent synchronously inside notify() (inApp: DB insert + SSE).
+//   queued — sent asynchronously via the delivery.send job; channels with a
+//            render() additionally run through delivery.render first.
+export type DeliveryChannelMode = "inline" | "queued";
+
 export type DeliveryChannel = {
   readonly name: string;
+  readonly mode: DeliveryChannelMode;
   resolve(userId: string, ctx: ChannelContext): Promise<string | null>;
-  send(address: string, message: ChannelMessage, ctx: ChannelContext): Promise<ChannelResult>;
+  render?(message: ChannelMessage, ctx: ChannelContext): Promise<RenderedMessage>;
+  send(
+    address: string,
+    message: ChannelMessage,
+    ctx: ChannelContext,
+    rendered?: RenderedMessage,
+  ): Promise<ChannelResult>;
 };
 
 // --- Notification Renderer ---
@@ -55,8 +77,9 @@ export type DeliveryLogEntry = {
   readonly channel: string;
   readonly recipientId: string | null;
   readonly recipientAddress: string | null;
-  readonly status: "sent" | "failed" | "skipped";
+  readonly status: "queued" | "sent" | "failed" | "skipped";
   readonly error: string | null;
+  readonly priority: NotifyPriority;
 };
 
 // --- Delivery Service ---

package/src/file-foundation/feature.ts

@@ -1,103 +1,44 @@
 // kumiko-feature-version: 1
 //
-// file-foundation as a Kumiko bundled feature — plugin-API shape.
+// file-foundation as a Kumiko bundled feature — declares the `fileProvider`
+// extension point + the per-tenant `provider` config key. Provider RESOLUTION
+// (createFileProviderForTenant) + the plugin types now live in the framework
+// (packages/framework/src/files/provider-resolver.ts) so the upload routes,
+// `ctx.files` and the GDPR jobs resolve through ONE path — uploads, export and
+// erasure hit the same store by construction. This feature re-exports the moved
+// symbols unchanged so existing imports keep working.
 //
-// **Pattern-Vorbild:** identisch zu `mail-foundation`. Foundation
-// deklariert extension-point `fileProvider`, Provider-Features (file-
-// provider-s3, später file-provider-azure-blob, file-provider-gcs)
-// registrieren sich namentlich. Tenant wählt zur Runtime via config-
-// key `provider`.
+// **Pattern-Vorbild:** identisch zu `mail-foundation`. Foundation deklariert
+// extension-point `fileProvider`, Provider-Features (file-provider-s3, -inmemory,
+// -s3-env, später -gcs/-azure-blob) registrieren sich namentlich. Tenant wählt
+// zur Runtime via config-key `provider`.
 //
-// **Was diese Foundation NICHT mehr macht:**
-//   - Keine S3-spezifischen Config-Keys mehr (bucket/region/endpoint/
-//     forcePathStyle/accessKeyId) — die leben im Provider-Plugin.
-//   - Kein direkter Import von `createS3Provider`. Foundation kennt
-//     nur das `FileStorageProvider`-Interface (Type-Import, kein
-//     runtime-coupling).
-//
-// **Standalone:** Foundation ist ohne tier-engine nutzbar. Existing
-// `files-provider-s3` (App-wide-Library) bleibt unangetastet.
-//
-// **Boot-Dependencies:** config (für provider-selector). Kein secrets,
-// weil Foundation selbst keine Secrets hält.
+// **Boot-Dependencies:** config (für provider-selector). Kein secrets, weil
+// Foundation selbst keine Secrets hält.
 
-import { requireDefined } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import {
   access,
-  type ConfigAccessor,
   createTenantConfig,
   defineFeature,
-  type Registry,
+  EXT_FILE_PROVIDER,
 } from "@cosmicdrift/kumiko-framework/engine";
-import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
-
-const FEATURE_NAME = "file-foundation";
-
-// =============================================================================
-// Plugin-Interface — what a Provider-Plugin must implement
-// =============================================================================
-
-/**
- * Schmaler Surface-Type fuer Provider-Plugins. HandlerContext ist zu
- * fett (haelt tx, actor, signal etc.) — Provider sollen sich auf die
- * read-Felder beschraenken die fuer Tenant-Config + Secret-Lookup
- * gebraucht werden.
- *
- * **Warum nicht voller HandlerContext?** Im Worker-Pfad (r.job) gibt
- * es keinen request-bezogenen `tx`/`actor`/`signal`. Wenn ein Provider
- * `ctx.tx` lesen wuerde, wuerde der ganze Worker-Pfad zur Runtime
- * brechen — und das wuerde NUR mit S3 und nur in production auffallen.
- * Die schmale Surface zwingt Provider zur expliziten Erweiterung
- * (extra-arg) statt silent ctx-feld-ausnutzen.
- *
- * **Felder:**
- *   config  — fuer tenant-config-reads (bucket/region/endpoint/...)
- *   registry — fuer extension-Lookup in der Factory (nicht Plugin-intern)
- *   secrets — fuer tenant-secret-reads (s3.secretAccessKey)
- *   _userId — Audit-Identity fuer secret-reads. Im Handler-Pfad setzt
- *             der dispatcher das auf die Caller-User-ID; im Worker-Pfad
- *             muss der r.job-Wrap das explizit auf eine System-Identity
- *             setzen (z.B. "system:user-data-rights:run-export-jobs").
- */
-export type FileProviderContext = {
-  readonly config?: ConfigAccessor;
-  readonly registry?: Registry;
-  readonly secrets?: import("@cosmicdrift/kumiko-framework/secrets").SecretsContext;
-  readonly _userId?: string | undefined;
-};
-
-/**
- * File-Storage-Plugin contract. Each provider-feature (file-provider-s3,
- * file-provider-azure-blob, ...) registers an implementation via
- * `r.useExtension("fileProvider", "<name>", { build })`.
- *
- * **Plugin-Author-Warnung:** `ctx` ist EXPLIZIT ein FileProviderContext,
- * nicht ein voller HandlerContext. Felder ausserhalb der schmalen
- * Surface (z.B. `ctx.tx`, `ctx.actor`, `ctx.signal`, `ctx.notify`) sind
- * im Worker-Pfad (r.job-getriggerte Provider-Builds) NICHT vorhanden.
- * Cast `ctx as unknown as HandlerContext` macht den Compiler happy aber
- * fliegt zur Runtime im Worker — und der Crash kommt erst in production
- * mit dem ersten S3-Tenant. Wenn ein Plugin Felder braucht die nicht in
- * FileProviderContext sind: lieber FileProviderContext explizit erweitern
- * (sichtbarer breaking change) als ctx-cast.
- */
-export type FileProviderPlugin = {
-  readonly build: (ctx: FileProviderContext, tenantId: string) => Promise<FileStorageProvider>;
-};
 
-// extension-usage `options` is engine-payload (unknown) — structurally validate
-// instead of casting blind.
-export function isFileProviderPlugin(o: unknown): o is FileProviderPlugin {
-  return typeof o === "object" && o !== null && "build" in o && typeof o.build === "function";
-}
+export type {
+  FileProviderContext,
+  FileProviderPlugin,
+} from "@cosmicdrift/kumiko-framework/files";
+// Moved into the framework — re-exported here so `@cosmicdrift/kumiko-bundled-
+// features/file-foundation` consumers (user-data-rights, app code) keep working.
+export {
+  createFileProviderForTenant,
+  isFileProviderPlugin,
+} from "@cosmicdrift/kumiko-framework/files";
 
-// =============================================================================
-// Feature-definition
-// =============================================================================
+const FEATURE_NAME = "file-foundation";
 
 export const fileFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
   r.describe(
-    "Defines the `fileProvider` extension point and a per-tenant `provider` config key that selects which registered storage plugin to use at runtime. Call `createFileProviderForTenant(ctx, tenantId)` to get a `FileStorageProvider` \u2014 use this feature together with at least one `file-provider-*` feature; the `files` feature builds on top of it for tracked `FileRef` entities with GDPR hooks.",
+    "Defines the `fileProvider` extension point and a per-tenant `provider` config key that selects which registered storage plugin to use at runtime. Call `createFileProviderForTenant(ctx, tenantId)` to get a `FileStorageProvider` — use this feature together with at least one `file-provider-*` feature; the `files` feature builds on top of it for tracked `FileRef` entities with GDPR hooks.",
   );
   r.uiHints({
     displayLabel: "File Provider Foundation",
@@ -106,7 +47,7 @@ export const fileFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
   });
   r.requires("config");
 
-  r.extendsRegistrar("fileProvider", {
+  r.extendsRegistrar(EXT_FILE_PROVIDER, {
     onRegister: () => {
       // No side-effects at register-time — registry stores the usage,
       // factory looks it up at request-time.
@@ -124,61 +65,7 @@ export const fileFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
   });
   // Readiness gating: provider-plugins' required keys/secrets count only
   // while their plugin is the one this key selects.
-  r.extensionSelector("fileProvider", configKeys.provider);
+  r.extensionSelector(EXT_FILE_PROVIDER, configKeys.provider);
 
   return { configKeys };
 });
-
-// =============================================================================
-// Provider-factory — looks up the registered plugin + delegates
-// =============================================================================
-
-export async function createFileProviderForTenant(
-  ctx: FileProviderContext,
-  tenantId: string,
-  handlerName = "file-foundation:provider-factory",
-): Promise<FileStorageProvider> {
-  const ctxConfig = ctx.config;
-  if (!ctxConfig) {
-    throw new Error(
-      `${handlerName}: ctx.config is missing — feature requires the config-feature mounted in the registry`,
-    );
-  }
-  if (!ctx.registry) {
-    throw new Error(
-      `${handlerName}: ctx.registry is missing — required to look up registered file-provider plugins`,
-    );
-  }
-
-  const provider = requireDefined(
-    await ctxConfig(fileFoundationFeature.exports.configKeys.provider),
-    FEATURE_NAME,
-    "provider",
-  ) as string; // @cast-boundary engine-payload
-  if (provider.length === 0) {
-    const usages = ctx.registry.getExtensionUsages("fileProvider");
-    const known = usages.map((u) => u.entityName).join(", ") || "<none>";
-    throw new Error(
-      `${FEATURE_NAME}: no provider selected — set the 'provider' config-key to one of: ${known}. ` +
-        `Mount a file-provider-* feature first if no plugins are registered.`,
-    );
-  }
-
-  const usages = ctx.registry.getExtensionUsages("fileProvider");
-  const usage = usages.find((u) => u.entityName === provider);
-  if (!usage) {
-    const known = usages.map((u) => u.entityName).join(", ") || "<none>";
-    throw new Error(
-      `${FEATURE_NAME}: provider "${provider}" not registered. Known: ${known}. ` +
-        `Mount the matching file-provider-${provider} feature.`,
-    );
-  }
-
-  if (!isFileProviderPlugin(usage.options)) {
-    throw new Error(
-      `${FEATURE_NAME}: provider "${provider}" registered without a build() — ` +
-        `extension options must be a FileProviderPlugin.`,
-    );
-  }
-  return usage.options.build(ctx, tenantId);
-}

package/src/presets/__tests__/dsgvo-self-service.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from "bun:test";
+import { dsgvoSelfServiceFeatures } from "../dsgvo-self-service";
+
+// Pins the DSGVO/self-service bundle: the five features in dependency order
+// (user-data-rights requires data-retention + compliance-profiles + sessions;
+// user-profile requires user-data-rights). Order is load-bearing, so it is
+// asserted explicitly.
+
+describe("dsgvoSelfServiceFeatures", () => {
+  test("returns the five features in require-order", () => {
+    const names = dsgvoSelfServiceFeatures().map((f) => f.name);
+    expect(names).toEqual([
+      "data-retention",
+      "compliance-profiles",
+      "sessions",
+      "user-data-rights",
+      "user-profile",
+    ]);
+  });
+
+  test("data-retention/compliance-profiles precede user-data-rights (dependency order holds)", () => {
+    const names = dsgvoSelfServiceFeatures().map((f) => f.name);
+    const udr = names.indexOf("user-data-rights");
+    expect(names.indexOf("data-retention")).toBeLessThan(udr);
+    expect(names.indexOf("compliance-profiles")).toBeLessThan(udr);
+    expect(names.indexOf("sessions")).toBeLessThan(udr);
+    expect(names.indexOf("user-profile")).toBeGreaterThan(udr);
+  });
+
+  test("each call yields fresh feature instances (no shared mutable state)", () => {
+    const a = dsgvoSelfServiceFeatures();
+    const b = dsgvoSelfServiceFeatures();
+    expect(a[0]).not.toBe(b[0]);
+  });
+});

package/src/presets/dsgvo-self-service.ts

@@ -0,0 +1,30 @@
+import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { createComplianceProfilesFeature } from "../compliance-profiles";
+import { createDataRetentionFeature } from "../data-retention";
+import { createSessionsFeature } from "../sessions";
+import { createUserDataRightsFeature, type UserDataRightsOptions } from "../user-data-rights";
+import { createUserProfileFeature } from "../user-profile";
+
+export type DsgvoSelfServiceOptions = {
+  /** Durchgereicht an createUserDataRightsFeature — Export-/Deletion-Mail-
+   *  Callbacks + Apex-Deletion-HMAC. Default {} (no-op Mail-Side). */
+  readonly userDataRights?: UserDataRightsOptions;
+};
+
+// DSGVO- + Account-Self-Service-Kette, die jede Kumiko-SaaS-App mountet
+// (Privacy-Center, Account-Löschung Art. 17, Export Art. 20, Sessions).
+// Die Reihenfolge IST load-bearing (Require-Order): user-data-rights braucht
+// data-retention + compliance-profiles + sessions, user-profile braucht
+// user-data-rights. Genau diese Order stand bisher in jeder App handkopiert
+// mit Erklär-Kommentar. text-content + legal-pages bleiben bewusst draußen —
+// legal-pages hat ein app-spezifisches wrapLayout, text-content ist
+// standalone Foundation; beide spreaded die App selbst dazu.
+export function dsgvoSelfServiceFeatures(opts: DsgvoSelfServiceOptions = {}): FeatureDefinition[] {
+  return [
+    createDataRetentionFeature(),
+    createComplianceProfilesFeature(),
+    createSessionsFeature(),
+    createUserDataRightsFeature(opts.userDataRights ?? {}),
+    createUserProfileFeature(),
+  ];
+}

package/src/presets/index.ts

@@ -0,0 +1 @@
+export { type DsgvoSelfServiceOptions, dsgvoSelfServiceFeatures } from "./dsgvo-self-service";

package/src/secrets/feature.ts

@@ -20,6 +20,8 @@ import { tenantSecretEntity, tenantSecretsTable } from "./table";
  * and picks the highest as the active KEK unless
  * `KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION` pins one explicitly.
  */
+export const SECRETS_FEATURE_NAME = "secrets";
+
 export const secretsEnvSchema = z.object({
   KUMIKO_SECRETS_MASTER_KEY_V1: z
     .string()
@@ -83,7 +85,7 @@ export function requireSecretsContext(
 }
 
 export function createSecretsFeature(): FeatureDefinition {
-  return defineFeature("secrets", (r) => {
+  return defineFeature(SECRETS_FEATURE_NAME, (r) => {
     r.describe(
       "Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump.",
     );

package/src/secrets/index.ts

@@ -2,6 +2,7 @@ export {
   createSecretsContext,
   createSecretsFeature,
   requireSecretsContext,
+  SECRETS_FEATURE_NAME,
   type SecretsContext,
   type SecretsContextOptions,
   type StoredEnvelope,

package/src/tags/constants.ts

@@ -19,6 +19,12 @@ export const TAGS_SECTION_EXTENSION_NAME = "TagSection";
 // after mounting tagsClient(); the renderer passes it the list's screenId.
 export const TAGS_FILTER_EXTENSION_NAME = "TagFilter";
 
+// Registry name for the <TagsCell> column renderer. A host entityList shows an
+// entity's tags inline by declaring a labeled virtual column:
+// `{ field: "tags", label: "Tags", renderer: { react: { __component: TAGS_COLUMN_RENDERER_NAME } } }`
+// after mounting tagsClient() (which registers it under clientFeatures.columnRenderers).
+export const TAGS_COLUMN_RENDERER_NAME = "TagsCell";
+
 // Screen-id of the standalone Tags management screen (custom screen rendering
 // TagManager). Qualified = "tags:screen:tag-list"; the app places it via r.nav.
 export const TAGS_SCREEN_ID = "tag-list";

package/src/tags/index.ts

@@ -2,6 +2,7 @@ export { tagAssignmentAggregateId } from "./aggregate-id";
 export {
   DEFAULT_TAG_ACCESS,
   DEFAULT_TAG_ROLES,
+  TAGS_COLUMN_RENDERER_NAME,
   TAGS_FEATURE_NAME,
   TAGS_FILTER_EXTENSION_NAME,
   TAGS_SCREEN_ID,

package/src/tags/web/__tests__/tag-filter.test.tsx

@@ -0,0 +1,124 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { fireEvent, render, screen } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { TagsQueries } from "../../constants";
+import { defaultTranslations } from "../i18n";
+import { TagFilter } from "../tag-filter";
+
+type TagRow = { id: string; name: string; color?: string };
+type AssignmentRow = { tagId: string; entityType: string; entityId: string };
+
+let catalogRows: readonly TagRow[] = [];
+let assignmentRows: readonly AssignmentRow[] = [];
+const setFilterSpy = mock((_field: string, _values: readonly string[]) => {});
+
+beforeEach(() => {
+  catalogRows = [
+    { id: "t1", name: "urgent", color: "#ef4444" },
+    { id: "t2", name: "backend", color: "#3b82f6" },
+  ];
+  assignmentRows = [
+    { tagId: "t1", entityType: "note", entityId: "n1" },
+    { tagId: "t2", entityType: "note", entityId: "n2" },
+  ];
+  setFilterSpy.mockClear();
+});
+
+const useQuerySpy = mock((type: string) => ({
+  data: type === TagsQueries.tagList ? { rows: catalogRows } : { rows: assignmentRows },
+  loading: false,
+  error: null,
+  refetch: mock(async () => {}),
+}));
+
+const actual_renderer = await import("@cosmicdrift/kumiko-renderer");
+mock.module("@cosmicdrift/kumiko-renderer", () => ({
+  ...actual_renderer,
+  useQuery: useQuerySpy,
+  useListUrlState: () => ({
+    sort: null,
+    q: "",
+    page: 1,
+    filters: {},
+    setSort: mock(() => {}),
+    setQ: mock(() => {}),
+    setPage: mock(() => {}),
+    setFilter: setFilterSpy,
+    clearFilters: mock(() => {}),
+  }),
+}));
+
+// Headless picker stub: a button that reports a tag selection back through the
+// real onChange contract — no Dialog/cmdk popover to drive.
+const StubPicker = ({
+  onChange,
+}: {
+  readonly value: readonly string[];
+  readonly onChange: (next: readonly string[]) => void;
+  readonly entityType: string;
+  readonly open: boolean;
+  readonly onOpenChange: (open: boolean) => void;
+}): ReactNode => (
+  <button type="button" data-testid="picker-pick-t1" onClick={() => onChange(["t1"])}>
+    pick urgent
+  </button>
+);
+mock.module("../tag-picker", () => ({ TagPicker: StubPicker }));
+
+function Wrapper({ children }: { readonly children: ReactNode }): ReactNode {
+  return (
+    <LocaleProvider resolver={createStaticLocaleResolver()} fallbackBundles={[defaultTranslations]}>
+      <PrimitivesProvider value={defaultPrimitives}>{children}</PrimitivesProvider>
+    </LocaleProvider>
+  );
+}
+
+describe("TagFilter", () => {
+  test("idle → just the filter button, no chips, no clear", () => {
+    render(
+      <Wrapper>
+        <TagFilter entityName="note" screenId="note-list" />
+      </Wrapper>,
+    );
+    expect(screen.getByTestId("tag-filter-open")).toBeTruthy();
+    expect(screen.queryByTestId("tag-chip")).toBeNull();
+    expect(screen.queryByTestId("tag-filter-clear")).toBeNull();
+  });
+
+  test("picking a tag → narrows the list to its entity ids + shows the selected chip + clear", () => {
+    render(
+      <Wrapper>
+        <TagFilter entityName="note" screenId="note-list" />
+      </Wrapper>,
+    );
+
+    fireEvent.click(screen.getByTestId("picker-pick-t1"));
+
+    // urgent (t1) is assigned to n1 → list narrows to that id set
+    expect(setFilterSpy).toHaveBeenCalledWith("id", ["n1"]);
+    // the active selection is visible as a chip + a clear affordance
+    expect(screen.getByText("urgent")).toBeTruthy();
+    expect(screen.getByTestId("tag-filter-clear")).toBeTruthy();
+  });
+
+  test("clear → drops the filter and the chip", () => {
+    render(
+      <Wrapper>
+        <TagFilter entityName="note" screenId="note-list" />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByTestId("picker-pick-t1"));
+    setFilterSpy.mockClear();
+
+    fireEvent.click(screen.getByTestId("tag-filter-clear"));
+
+    expect(setFilterSpy).toHaveBeenCalledWith("id", []);
+    expect(screen.queryByText("urgent")).toBeNull();
+  });
+});

package/src/tags/web/__tests__/tags-cell.test.tsx

@@ -0,0 +1,94 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { render, screen } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { TagsQueries } from "../../constants";
+import { defaultTranslations } from "../i18n";
+import { TagsCell } from "../tags-cell";
+
+type TagRow = { id: string; name: string; color?: string };
+type AssignmentRow = { tagId: string; entityType: string; entityId: string };
+
+let catalogRows: readonly TagRow[] = [];
+let assignmentRows: readonly AssignmentRow[] = [];
+
+beforeEach(() => {
+  catalogRows = [];
+  assignmentRows = [];
+});
+
+const useQuerySpy = mock((type: string) => ({
+  data: type === TagsQueries.tagList ? { rows: catalogRows } : { rows: assignmentRows },
+  loading: false,
+  error: null,
+  refetch: mock(async () => {}),
+}));
+
+const actual_renderer = await import("@cosmicdrift/kumiko-renderer");
+mock.module("@cosmicdrift/kumiko-renderer", () => ({
+  ...actual_renderer,
+  useQuery: useQuerySpy,
+}));
+
+function Wrapper({ children }: { readonly children: ReactNode }): ReactNode {
+  return (
+    <LocaleProvider resolver={createStaticLocaleResolver()} fallbackBundles={[defaultTranslations]}>
+      <PrimitivesProvider value={defaultPrimitives}>{children}</PrimitivesProvider>
+    </LocaleProvider>
+  );
+}
+
+function renderCell(rowId: string): void {
+  render(
+    <Wrapper>
+      <TagsCell value={rowId} row={{ id: rowId }} column={{ field: "tags" }} />
+    </Wrapper>,
+  );
+}
+
+describe("TagsCell", () => {
+  test("renders a chip per tag assigned to the row's id, joined to the catalog", () => {
+    catalogRows = [
+      { id: "t1", name: "important", color: "#ef4444" },
+      { id: "t2", name: "project-x", color: "#3b82f6" },
+    ];
+    assignmentRows = [
+      { tagId: "t1", entityType: "note", entityId: "n1" },
+      { tagId: "t2", entityType: "note", entityId: "n1" },
+      { tagId: "t1", entityType: "note", entityId: "n2" }, // a different row
+    ];
+
+    renderCell("n1");
+
+    expect(screen.getByTestId("tags-cell")).toBeTruthy();
+    expect(screen.getByText("important")).toBeTruthy();
+    expect(screen.getByText("project-x")).toBeTruthy();
+  });
+
+  test("renders nothing when the row has no assigned tags", () => {
+    catalogRows = [{ id: "t1", name: "important" }];
+    assignmentRows = [{ tagId: "t1", entityType: "note", entityId: "other-row" }];
+
+    renderCell("n1");
+
+    expect(screen.queryByTestId("tags-cell")).toBeNull();
+  });
+
+  test("renders nothing for an empty row id", () => {
+    catalogRows = [{ id: "t1", name: "important" }];
+    assignmentRows = [{ tagId: "t1", entityType: "note", entityId: "n1" }];
+
+    render(
+      <Wrapper>
+        <TagsCell value="" row={{}} column={{ field: "tags" }} />
+      </Wrapper>,
+    );
+
+    expect(screen.queryByTestId("tags-cell")).toBeNull();
+  });
+});

package/src/tags/web/client-plugin.tsx

@@ -2,6 +2,7 @@
 
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
 import {
+  TAGS_COLUMN_RENDERER_NAME,
   TAGS_FEATURE_NAME,
   TAGS_FILTER_EXTENSION_NAME,
   TAGS_SCREEN_ID,
@@ -11,6 +12,7 @@ import { defaultTranslations } from "./i18n";
 import { TagFilter } from "./tag-filter";
 import { TagManager } from "./tag-manager";
 import { TagSection } from "./tag-section";
+import { TagsCell } from "./tags-cell";
 
 export function tagsClient(): ClientFeatureDefinition {
   return {
@@ -20,6 +22,10 @@ export function tagsClient(): ClientFeatureDefinition {
       // Header-slot tag filter for any entityList toolbar.
       [TAGS_FILTER_EXTENSION_NAME]: TagFilter,
     },
+    // Inline tag chips on any entityList row, via a labeled virtual column.
+    columnRenderers: {
+      [TAGS_COLUMN_RENDERER_NAME]: TagsCell,
+    },
     // Standalone Tags management screen (custom screen → TagManager).
     components: {
       [TAGS_SCREEN_ID]: TagManager,

package/src/tags/web/i18n.ts

@@ -30,7 +30,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "tags.picker.title": "Tags",
     "tags.picker.done": "Fertig",
     "tags.filter.label": "Nach Tag filtern",
-    "tags.filter.active": "Tags: {count}",
+    "tags.filter.clear": "Filter zurücksetzen",
   },
   en: {
     "tags.section.createMode": "Save the entity first to add tags.",
@@ -55,6 +55,6 @@ export const defaultTranslations: TranslationsByLocale = {
     "tags.picker.title": "Tags",
     "tags.picker.done": "Done",
     "tags.filter.label": "Filter by tag",
-    "tags.filter.active": "Tags: {count}",
+    "tags.filter.clear": "Clear",
   },
 };

package/src/tags/web/index.ts

@@ -1,5 +1,6 @@
 // @runtime client
 export {
+  TAGS_COLUMN_RENDERER_NAME,
   TAGS_FILTER_EXTENSION_NAME,
   TAGS_SCREEN_ID,
   TAGS_SECTION_EXTENSION_NAME,
@@ -13,3 +14,4 @@ export { TagFilter } from "./tag-filter";
 export { TagManager } from "./tag-manager";
 export { TagPicker } from "./tag-picker";
 export { TagSection } from "./tag-section";
+export { TagsCell } from "./tags-cell";