@cosmicdrift/kumiko-samples 0.378.0 → 0.380.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.378.0",
+  "version": "0.380.0",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.378.0",
+  "version": "0.380.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -86,7 +86,7 @@
     "./user-data-rights/email-templates": "./src/user-data-rights/email-templates.ts",
     "./user-data-rights-defaults": "./src/user-data-rights-defaults/index.ts",
     "./tenant": "./src/tenant/index.ts",
-    "./tenant/constants": "./src/tenant/constants.ts",
+    "./tenant/constants": "./src/tenant/web/constants.ts",
     "./tenant/web": "./src/tenant/web/index.ts",
     "./tenant/seeding": "./src/tenant/seeding.ts",
     "./tenant-lifecycle": "./src/tenant-lifecycle/index.ts",
@@ -99,7 +99,7 @@
     "./user-profile": "./src/user-profile/index.ts",
     "./user-profile/web": "./src/user-profile/web/index.ts",
     "./auth-email-password": "./src/auth-email-password/index.ts",
-    "./auth-email-password/constants": "./src/auth-email-password/constants.ts",
+    "./auth-email-password/constants": "./src/auth-email-password/web/constants.ts",
     "./auth-email-password/email-templates": "./src/auth-email-password/email-templates.ts",
     "./auth-email-password/seeding": "./src/auth-email-password/seeding.ts",
     "./auth-email-password/testing": "./src/auth-email-password/testing.ts",
@@ -131,16 +131,16 @@
     "./feature-toggles": "./src/feature-toggles/index.ts",
     "./feature-toggles/web": "./src/feature-toggles/web/index.ts",
     "./template-resolver": "./src/template-resolver/index.ts",
-    "./template-resolver/document-schema": "./src/template-resolver/document-schema.ts",
+    "./template-resolver/document-schema": "./src/template-resolver/web/document-schema.ts",
     "./template-resolver/seeding": "./src/template-resolver/seeding.ts",
     "./template-resolver/testing": "./src/template-resolver/testing.ts",
     "./template-resolver/web": "./src/template-resolver/web/index.ts",
     "./renderer-foundation": "./src/renderer-foundation/index.ts",
     "./account-security": "./src/account-security/index.ts",
-    "./account-security/constants": "./src/account-security/constants.ts",
+    "./account-security/constants": "./src/account-security/web/constants.ts",
     "./host-routing": "./src/host-routing/index.ts",
     "./legal-pages": "./src/legal-pages/index.ts",
-    "./legal-pages/constants": "./src/legal-pages/constants.ts",
+    "./legal-pages/constants": "./src/legal-pages/web/constants.ts",
     "./legal-pages/web": "./src/legal-pages/web/index.ts",
     "./waitlist": "./src/waitlist/index.ts",
     "./page-render": "./src/page-render/index.ts",
@@ -451,8 +451,8 @@
         "default": "./dist/tenant/index.js"
       },
       "./tenant/constants": {
-        "types": "./dist/tenant/constants.d.ts",
-        "default": "./dist/tenant/constants.js"
+        "types": "./dist/tenant/web/constants.d.ts",
+        "default": "./dist/tenant/web/constants.js"
       },
       "./tenant/web": {
         "types": "./dist/tenant/web/index.d.ts",
@@ -507,8 +507,8 @@
         "default": "./dist/auth-email-password/email-templates.js"
       },
       "./auth-email-password/constants": {
-        "types": "./dist/auth-email-password/constants.d.ts",
-        "default": "./dist/auth-email-password/constants.js"
+        "types": "./dist/auth-email-password/web/constants.d.ts",
+        "default": "./dist/auth-email-password/web/constants.js"
       },
       "./auth-email-password/seeding": {
         "types": "./dist/auth-email-password/seeding.d.ts",
@@ -631,8 +631,8 @@
         "default": "./dist/template-resolver/index.js"
       },
       "./template-resolver/document-schema": {
-        "types": "./dist/template-resolver/document-schema.d.ts",
-        "default": "./dist/template-resolver/document-schema.js"
+        "types": "./dist/template-resolver/web/document-schema.d.ts",
+        "default": "./dist/template-resolver/web/document-schema.js"
       },
       "./template-resolver/seeding": {
         "types": "./dist/template-resolver/seeding.d.ts",
@@ -655,8 +655,8 @@
         "default": "./dist/account-security/index.js"
       },
       "./account-security/constants": {
-        "types": "./dist/account-security/constants.d.ts",
-        "default": "./dist/account-security/constants.js"
+        "types": "./dist/account-security/web/constants.d.ts",
+        "default": "./dist/account-security/web/constants.js"
       },
       "./host-routing": {
         "types": "./dist/host-routing/index.d.ts",
@@ -667,8 +667,8 @@
         "default": "./dist/legal-pages/index.js"
       },
       "./legal-pages/constants": {
-        "types": "./dist/legal-pages/constants.d.ts",
-        "default": "./dist/legal-pages/constants.js"
+        "types": "./dist/legal-pages/web/constants.d.ts",
+        "default": "./dist/legal-pages/web/constants.js"
       },
       "./legal-pages/web": {
         "types": "./dist/legal-pages/web/index.d.ts",
@@ -714,6 +714,7 @@
   },
   "files": [
     "dist",
+    "kumiko-es-tables.json",
     "src/*/changes.json",
     "README.md",
     "LICENSE"
@@ -728,7 +729,7 @@
     "@cosmicdrift/kumiko-testing": "workspace:*"
   },
   "peerDependencies": {
-    "@cosmicdrift/kumiko-testing": ">=0.366.0 <1.0.0"
+    "@cosmicdrift/kumiko-testing": "workspace:*"
   },
   "peerDependenciesMeta": {
     "@cosmicdrift/kumiko-testing": {

package/packages/bundled-features/src/account-security/feature.ts

@@ -15,8 +15,8 @@ import {
   ACCOUNT_SECURITY_NAV_LABEL,
   ACCOUNT_SECURITY_SCREEN_ID,
   ACCOUNT_SECURITY_SCREEN_QN,
-} from "./constants.ts";
-import { ACCOUNT_SECURITY_I18N } from "./i18n.ts";
+} from "./web/constants.ts";
+import { ACCOUNT_SECURITY_I18N } from "./web/i18n.ts";
 
 export interface AccountSecurityNavOptions {
   readonly order?: number;

package/packages/bundled-features/src/account-security/index.ts

@@ -1,14 +1,14 @@
-export {
-  ACCOUNT_SECURITY_FEATURE,
-  ACCOUNT_SECURITY_NAV_LABEL,
-  ACCOUNT_SECURITY_SCREEN_ID,
-  ACCOUNT_SECURITY_SCREEN_QN,
-  ACCOUNT_SECURITY_SCREEN_TITLE_KEY,
-} from "./constants.ts";
 export {
   type AccountSecurityFeatureOptions,
   type AccountSecurityNavOptions,
   accountSecurityMfaStatusVisibility,
   createAccountSecurityFeature,
 } from "./feature.ts";
-export { ACCOUNT_SECURITY_I18N } from "./i18n.ts";
+export {
+  ACCOUNT_SECURITY_FEATURE,
+  ACCOUNT_SECURITY_NAV_LABEL,
+  ACCOUNT_SECURITY_SCREEN_ID,
+  ACCOUNT_SECURITY_SCREEN_QN,
+  ACCOUNT_SECURITY_SCREEN_TITLE_KEY,
+} from "./web/constants.ts";
+export { ACCOUNT_SECURITY_I18N } from "./web/i18n.ts";

package/packages/bundled-features/src/account-security/{constants.ts → web/constants.ts}

@@ -1,5 +1,3 @@
-// @runtime client
-
 export const ACCOUNT_SECURITY_FEATURE = "account-security";
 export const ACCOUNT_SECURITY_SCREEN_ID = "account-security";
 export const ACCOUNT_SECURITY_SCREEN_QN = `${ACCOUNT_SECURITY_FEATURE}:screen:${ACCOUNT_SECURITY_SCREEN_ID}`;

package/packages/bundled-features/src/account-security/{i18n.ts → web/i18n.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // Server-registered so the framework projects these keys into the client bundle.
 
 type LocalizedString = { readonly de: string; readonly en: string };

package/packages/bundled-features/src/admin-shell/feature.ts

@@ -8,14 +8,6 @@ import {
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { DEFAULT_METRICS, type MetricDefinition } from "../metrics/index.ts";
-import {
-  ADMIN_SHELL_FEATURE,
-  DEFAULT_PLATFORM_WORKSPACE_ID,
-  DEFAULT_TENANT_WORKSPACE_ID,
-  PLATFORM_OVERVIEW_SCREEN_ID,
-  TENANT_OVERVIEW_SCREEN_ID,
-} from "./constants.ts";
-import { ADMIN_SHELL_I18N } from "./i18n.ts";
 import {
   OVERVIEW_TIME_RANGE,
   PLATFORM_SCOPE,
@@ -23,6 +15,14 @@ import {
   platformOverviewPanels,
   tenantOverviewPanels,
 } from "./overview-panels.ts";
+import {
+  ADMIN_SHELL_FEATURE,
+  DEFAULT_PLATFORM_WORKSPACE_ID,
+  DEFAULT_TENANT_WORKSPACE_ID,
+  PLATFORM_OVERVIEW_SCREEN_ID,
+  TENANT_OVERVIEW_SCREEN_ID,
+} from "./web/constants.ts";
+import { ADMIN_SHELL_I18N } from "./web/i18n.ts";
 
 export type CreateAdminShellOptions = {
   /** Short workspace id for tenant operators (URL segment). Default `tenant-admin`. */
@@ -58,7 +58,7 @@ export function createAdminShellFeature(options: CreateAdminShellOptions = {}):
 
   return defineFeature(ADMIN_SHELL_FEATURE, (r) => {
     r.describe(
-      "Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`, optional `cap-overview:screen:my-caps`/`cap-overview:screen:tenant-cap-list`, optional `document-designer` template navs) and the two overview dashboards, built from the metrics list (`metrics` option, default DEFAULT_METRICS). Mount after user, tenant, audit, jobs, metrics and metrics-system; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.",
+      "Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `audit:screen:audit-log-all-tenants`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`, optional `cap-overview:screen:my-caps`/`cap-overview:screen:tenant-cap-list`, optional `document-designer` template navs) and the two overview dashboards, built from the metrics list (`metrics` option, default DEFAULT_METRICS). Mount after user, tenant, audit, jobs, metrics and metrics-system; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.",
     );
     r.uiHints({
       displayLabel: "Admin Shell",
@@ -88,6 +88,7 @@ export function createAdminShellFeature(options: CreateAdminShellOptions = {}):
       "admin-shell:nav:platform-overview",
       "admin-shell:nav:tenants",
       ...(includeCapOverview ? (["admin-shell:nav:tenant-caps"] as const) : []),
+      "audit:nav:audit-log-all-tenants",
       "jobs:nav:job-runs",
       ...(includeDocumentDesigner ? (["document-designer:nav:platform-templates"] as const) : []),
       ...(includeTierAdmin ? (["admin-shell:nav:tier-admin"] as const) : []),

package/packages/bundled-features/src/admin-shell/index.ts

@@ -1,12 +1,4 @@
-export {
-  ADMIN_SHELL_FEATURE,
-  DEFAULT_PLATFORM_WORKSPACE_ID,
-  DEFAULT_TENANT_WORKSPACE_ID,
-  PLATFORM_OVERVIEW_SCREEN_ID,
-  TENANT_OVERVIEW_SCREEN_ID,
-} from "./constants.ts";
 export { type CreateAdminShellOptions, createAdminShellFeature } from "./feature.ts";
-export { ADMIN_SHELL_I18N } from "./i18n.ts";
 export {
   isOverviewQueryAllowed,
   type OverviewWorkspaceKind,
@@ -15,3 +7,11 @@ export {
   TENANT_OVERVIEW_ALLOWED_QUERIES,
   TENANT_OVERVIEW_FORBIDDEN_QUERIES,
 } from "./overview-allowlist.ts";
+export {
+  ADMIN_SHELL_FEATURE,
+  DEFAULT_PLATFORM_WORKSPACE_ID,
+  DEFAULT_TENANT_WORKSPACE_ID,
+  PLATFORM_OVERVIEW_SCREEN_ID,
+  TENANT_OVERVIEW_SCREEN_ID,
+} from "./web/constants.ts";
+export { ADMIN_SHELL_I18N } from "./web/i18n.ts";

package/packages/bundled-features/src/admin-shell/web/client-plugin.tsx

@@ -1,8 +1,7 @@
-// @runtime client
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
-import { ADMIN_SHELL_FEATURE } from "../constants.ts";
-import { defaultTranslations } from "./i18n.ts";
+import { ADMIN_SHELL_FEATURE } from "./constants.ts";
+import { defaultTranslations } from "./default-translations.ts";
 
 export type AdminShellClientOptions = {
   readonly translations?: TranslationsByLocale;

package/packages/bundled-features/src/admin-shell/{constants.ts → web/constants.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 export const ADMIN_SHELL_FEATURE = "admin-shell" as const;
 
 export const DEFAULT_TENANT_WORKSPACE_ID = "tenant-admin" as const;

package/packages/bundled-features/src/admin-shell/web/default-translations.ts

@@ -0,0 +1,10 @@
+// Client pivot of ADMIN_SHELL_I18N — same keys as server r.translations bundle.
+
+import {
+  type TranslationsByLocale,
+  translationsByLocaleFromKeys,
+} from "@cosmicdrift/kumiko-renderer";
+import { ADMIN_SHELL_I18N } from "./i18n.ts";
+
+export const defaultTranslations: TranslationsByLocale =
+  translationsByLocaleFromKeys(ADMIN_SHELL_I18N);

package/packages/bundled-features/src/admin-shell/web/i18n.ts

@@ -1,11 +1,53 @@
-// @runtime client
-// Client pivot of ADMIN_SHELL_I18N — same keys as server r.translations bundle.
+// Pure-Data i18n keys for admin-shell (server r.translations + client pivot).
+// Without these keys nav labels and workspace tabs render raw QNs in the shell.
 
-import {
-  type TranslationsByLocale,
-  translationsByLocaleFromKeys,
-} from "@cosmicdrift/kumiko-renderer";
-import { ADMIN_SHELL_I18N } from "../i18n.ts";
+type LocalizedString = { readonly en: string };
 
-export const defaultTranslations: TranslationsByLocale =
-  translationsByLocaleFromKeys(ADMIN_SHELL_I18N);
+export const ADMIN_SHELL_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:tenant-overview.title": { en: "Overview" },
+  "screen:platform-overview.title": { en: "Overview" },
+  "admin-shell.screen.tenant-overview.subtitle": {
+    en: "Activity, failed jobs and deliveries, quotas and open admin tasks of this tenant.",
+  },
+  "admin-shell.screen.platform-overview.subtitle": {
+    en: "Tenant, user, job and delivery health across the whole installation.",
+  },
+  "admin-shell:workspace.tenant": { en: "Administration" },
+  "admin-shell:workspace.platform": { en: "Platform" },
+  "admin-shell:nav.tenantOverview": { en: "Overview" },
+  "admin-shell:nav.platformOverview": { en: "Overview" },
+  "admin-shell:nav.tenants": { en: "Tenants" },
+  "admin-shell:nav.tierAdmin": { en: "Assign tier" },
+  "admin-shell:nav.myCaps": { en: "Plans & Caps" },
+  "admin-shell:nav.tenantCaps": { en: "Plans & Caps" },
+  "admin-shell:overview.kpi.activeTenants": { en: "Active tenants" },
+  "admin-shell:overview.kpi.activeUsers7d": { en: "Active users, 7 days" },
+  "admin-shell:overview.kpi.activeMembers7d": { en: "Active members, 7 days" },
+  "admin-shell:overview.kpi.failedJobs24h": { en: "Failed jobs, 24 h" },
+  "admin-shell:overview.kpi.failedDeliveries24h": { en: "Failed deliveries, 24 h" },
+  "admin-shell:overview.chart.jobRunsByStatus": { en: "Job runs by status" },
+  "admin-shell:overview.chart.deliveriesByChannel": { en: "Deliveries by channel" },
+  "admin-shell:overview.chart.auditWrites": { en: "Changes per day" },
+  "admin-shell:overview.chart.auditWritesSubtitle": { en: "Audit log, 14 days" },
+  "admin-shell:overview.list.recentFailures": { en: "Recent failures" },
+  "admin-shell:overview.list.recentFailuresEmpty": { en: "No failed jobs" },
+  "admin-shell:overview.list.quotas": { en: "Quotas" },
+  "admin-shell:overview.list.quotasEmpty": { en: "No quotas configured" },
+  "admin-shell:overview.col.job": { en: "Job" },
+  "admin-shell:overview.col.startedAt": { en: "Started" },
+  "admin-shell:overview.col.failedAt": { en: "Failed at" },
+  "admin-shell:overview.col.reason": { en: "Reason" },
+  "admin-shell:overview.col.quota": { en: "Quota" },
+  "admin-shell:overview.col.used": { en: "Used" },
+  "admin-shell:overview.col.limit": { en: "Limit" },
+  "admin-shell:overview.col.usage": { en: "Usage" },
+  "admin-shell:overview.range.24h": { en: "24 hours" },
+  "admin-shell:overview.range.7d": { en: "7 days" },
+  "admin-shell:overview.range.30d": { en: "30 days" },
+  "admin-shell:overview.scope.badge": { en: "All tenants" },
+  "admin-shell:overview.scope.notice": {
+    en: "You are viewing data of all tenants. Cross-tenant queries are recorded in the audit log.",
+  },
+  "admin-shell:overview.filter.tenant": { en: "Tenant" },
+  "admin-shell:overview.filter.allTenants": { en: "All tenants" },
+};

package/packages/bundled-features/src/admin-shell/web/index.ts

@@ -1,2 +1 @@
-// @runtime client
 export { type AdminShellClientOptions, adminShellClient } from "./client-plugin.tsx";

package/packages/bundled-features/src/audit/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "SystemAdmin audit log across all tenants",
+    "detail": "New queries audit:query:list-all-tenants and audit:query:details-all-tenants (SystemAdmin only) return the audit trail of every tenant, each row with its tenantId, filterable by tenant. Screens audit-log-all-tenants and audit-log-all-tenants-detail show the tenant name; the admin-shell platform workspace lists the new nav audit:nav:audit-log-all-tenants. Events of the system tenant are not included. The audit feature now declares r.systemScope(), so its handlers read through ctx.systemDb instead of ctx.db, and list and details rows carry tenantId too. A targetless cross-tenant read (acknowledgeCrossTenant or cross-tenant-read) is now recorded at most once per actor, handler, tenant and reason per hour, so the reference lookups of a SystemAdmin list no longer flood the trail on every page load; all other escape-hatch kinds keep the 60 s window. The audit events keep metadata free of PII ciphertext, a cursor or id beyond bigint is a 422 and the all-tenants tenant filter takes at most 100 ids. Applies to every user:user reference column and read-only reference field in all apps, not only the audit screens: an actor without a visible row no longer shows the raw id but reads \"Unknown\" (kumiko.reference.unknown-user), once the lookup finished without error (while it loads or after it failed the cell keeps a placeholder), and the \"system\" createdBy literal reads \"System\". The audit screen descriptions are now short user-facing sentences.",
+    "migration": "Apps with their own platform workspace add the nav `audit:nav:audit-log-all-tenants` (screen `audit:screen:audit-log-all-tenants`) to its navs; apps using the admin-shell platform workspace get it automatically."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/packages/bundled-features/src/audit/feature.ts

@@ -6,17 +6,30 @@ import {
   i18nKey,
   SYSTEM_USER_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { escapeHatchUsedSchema } from "./escape-hatch-audit-sink.ts";
+import { detailsQuery } from "./handlers/details.query.ts";
+import { detailsAllTenantsQuery } from "./handlers/details-all-tenants.query.ts";
+import { listQuery } from "./handlers/list.query.ts";
+import { listAllTenantsQuery } from "./handlers/list-all-tenants.query.ts";
+import { runEscapeHatchRetention } from "./run-escape-hatch-retention.ts";
+import {
+  AUDIT_LOG_ALL_TENANTS_COLUMNS,
+  AUDIT_LOG_COLUMNS,
+  AUDIT_LOG_DATE_RANGE_FACET,
+  AUDIT_LOG_DETAIL_FIELD_LABELS,
+  AUDIT_LOG_TENANT_FACET,
+  auditLogDetailLayout,
+} from "./screens.ts";
 import {
+  AUDIT_LOG_ALL_TENANTS_DETAIL_SCREEN_ID,
+  AUDIT_LOG_ALL_TENANTS_NAV_ID,
+  AUDIT_LOG_ALL_TENANTS_SCREEN_ID,
   AUDIT_LOG_DETAIL_SCREEN_ID,
   AUDIT_LOG_SCREEN_ID,
   AuditQueries,
   DEFAULT_ESCAPE_HATCH_RETENTION_DAYS,
-} from "./constants.ts";
-import { escapeHatchUsedSchema } from "./escape-hatch-audit-sink.ts";
-import { detailsQuery } from "./handlers/details.query.ts";
-import { listQuery } from "./handlers/list.query.ts";
-import { AUDIT_I18N } from "./i18n.ts";
-import { runEscapeHatchRetention } from "./run-escape-hatch-retention.ts";
+} from "./web/constants.ts";
+import { AUDIT_I18N } from "./web/i18n.ts";
 
 // Audit feature — exposes a filtered read over the framework's event log.
 //
@@ -36,7 +49,7 @@ export function createAuditFeature(): FeatureDefinition {
     "audit",
     (r) => {
       r.describe(
-        "Exposes the framework's event store as a paginated, filterable audit log via the `audit:query:list` handler (accessible to `Admin` and `SystemAdmin` roles). No separate table or projection \u2014 the event store is the audit trail by construction: every entity write already records who, when, what entity, and the event payload with PII stripped. A SystemAdmin can pass `scope: \"system\"` to read the app-instance system events such as `app.started`. Filter by `aggregateType`, `aggregateId`, `eventType`, `userId`, or time range. Also records `audit:event:escape-hatch-used` whenever a handler uses one of the framework's escape hatches (unsafeRaw, acknowledgeCrossTenant, db.global() writes, or a granted identity switch).",
+        "Exposes the framework's event store as a paginated, filterable audit log via the `audit:query:list` handler (accessible to `Admin` and `SystemAdmin` roles). No separate table or projection \u2014 the event store is the audit trail by construction: every entity write already records who, when, what entity, and the event payload with PII stripped. A SystemAdmin can pass `scope: \"system\"` to read the app-instance system events such as `app.started`, and reads the events of every tenant (system tenant excluded) through `audit:query:list-all-tenants` and the `audit-log-all-tenants` screen. Filter by `aggregateType`, `aggregateId`, `eventType`, `userId`, or time range. Also records `audit:event:escape-hatch-used` whenever a handler uses one of the framework's escape hatches (unsafeRaw, acknowledgeCrossTenant, db.global() writes, or a granted identity switch).",
       );
       r.uiHints({
         displayLabel: "Audit Log",
@@ -44,6 +57,9 @@ export function createAuditFeature(): FeatureDefinition {
         recommended: false,
       });
       r.translations({ keys: AUDIT_I18N });
+      // The all-tenants queries read through ctx.systemDb.acknowledgeCrossTenant; the own-tenant
+      // queries use assertTenantMatch on the same handle.
+      r.systemScope();
       r.requires({ features: ["tenant", "user", "config"] });
 
       // Registered so ops tools/MSPs can discover the type — escape-hatch-audit-sink.ts appends it via the low-level event-store API.
@@ -84,36 +100,18 @@ export function createAuditFeature(): FeatureDefinition {
       const queries = {
         list: r.queryHandler(listQuery),
         details: r.queryHandler(detailsQuery),
+        listAllTenants: r.queryHandler(listAllTenantsQuery),
+        detailsAllTenants: r.queryHandler(detailsAllTenantsQuery),
       };
 
       r.screen({
         id: AUDIT_LOG_SCREEN_ID,
         type: "projectionList",
         query: AuditQueries.list,
-        columns: [
-          {
-            field: "createdAt",
-            label: i18nKey("audit.log.col.when"),
-            renderer: { format: "timestamp" },
-          },
-          { field: "type", label: i18nKey("audit.log.col.type") },
-          {
-            field: "createdBy",
-            label: i18nKey("audit.log.col.actor"),
-            refEntity: "user:user",
-            refLabelField: "displayName",
-          },
-        ],
+        columns: AUDIT_LOG_COLUMNS,
         searchable: true,
         defaultSort: { field: "createdAt", dir: "desc" },
-        facets: [
-          {
-            type: "dateRange",
-            field: "createdAt",
-            label: i18nKey("audit.log.col.when"),
-            params: { from: "from", to: "to" },
-          },
-        ],
+        facets: [AUDIT_LOG_DATE_RANGE_FACET],
         rowActions: [
           {
             kind: "navigate",
@@ -125,8 +123,7 @@ export function createAuditFeature(): FeatureDefinition {
           },
         ],
         pagination: "infinite",
-        description:
-          "Admin table of the tenant's audit-trail events with actor names and event-type/date filters; open it to browse recent changes and drill into a single event.",
+        description: "audit.log.description",
         access: { roles: access.admin },
       });
       r.screen({
@@ -134,43 +131,47 @@ export function createAuditFeature(): FeatureDefinition {
         type: "projectionDetail",
         query: AuditQueries.details,
         idParam: "id",
-        fieldLabels: {
-          type: i18nKey("audit.log.col.type"),
-          createdAt: i18nKey("audit.log.col.when"),
-          aggregateType: i18nKey("audit.log.col.aggregateType"),
-          aggregateId: i18nKey("audit.log.col.aggregateId"),
-          createdBy: i18nKey("audit.log.col.actor"),
-          id: i18nKey("audit.log.detail.field.id"),
-          payload: i18nKey("audit.log.detail.payload"),
-          metadata: i18nKey("audit.log.detail.metadata"),
-        },
-        layout: {
-          sections: [
-            {
-              fields: [
-                "type",
-                { field: "createdAt", renderer: { format: "timestamp" } },
-                "aggregateType",
-                "aggregateId",
-                { field: "createdBy", refEntity: "user:user", refLabelField: "displayName" },
-                "id",
-              ],
-            },
-            // No section `title` here (fw#2312 label-dedup fix): each section
-            // holds exactly one field, so a title would repeat the field's own
-            // label (rendered by RenderField as the Field's heading) verbatim.
-            {
-              fields: [{ field: "payload", renderer: { format: "json" } }],
-            },
-            {
-              fields: [{ field: "metadata", renderer: { format: "json" } }],
-            },
-          ],
-        },
+        fieldLabels: AUDIT_LOG_DETAIL_FIELD_LABELS,
+        layout: auditLogDetailLayout({ withTenant: false }),
         description: "audit.log.detail.subtitle",
         listScreenId: AUDIT_LOG_SCREEN_ID,
         access: { roles: access.admin },
       });
+      r.screen({
+        id: AUDIT_LOG_ALL_TENANTS_SCREEN_ID,
+        type: "projectionList",
+        query: AuditQueries.listAllTenants,
+        columns: AUDIT_LOG_ALL_TENANTS_COLUMNS,
+        defaultSort: { field: "createdAt", dir: "desc" },
+        facets: [AUDIT_LOG_DATE_RANGE_FACET, AUDIT_LOG_TENANT_FACET],
+        rowActions: [
+          {
+            kind: "navigate",
+            id: "details",
+            label: i18nKey("audit.log.details"),
+            screen: AUDIT_LOG_ALL_TENANTS_DETAIL_SCREEN_ID,
+            entityId: "id",
+            rowClick: true,
+          },
+        ],
+        pagination: "infinite",
+        description: "audit.log.allTenants.description",
+        access: { roles: access.systemAdmin },
+      });
+      r.screen({
+        id: AUDIT_LOG_ALL_TENANTS_DETAIL_SCREEN_ID,
+        type: "projectionDetail",
+        query: AuditQueries.detailsAllTenants,
+        idParam: "id",
+        fieldLabels: {
+          ...AUDIT_LOG_DETAIL_FIELD_LABELS,
+          tenantId: i18nKey("audit.log.col.tenant"),
+        },
+        layout: auditLogDetailLayout({ withTenant: true }),
+        description: "audit.log.detail.subtitle",
+        listScreenId: AUDIT_LOG_ALL_TENANTS_SCREEN_ID,
+        access: { roles: access.systemAdmin },
+      });
       r.nav({
         id: "audit-log",
         label: "audit:nav.auditLog",
@@ -178,6 +179,13 @@ export function createAuditFeature(): FeatureDefinition {
         screen: "audit:screen:audit-log",
         order: 30,
       });
+      r.nav({
+        id: AUDIT_LOG_ALL_TENANTS_NAV_ID,
+        label: "audit:nav.auditLogAllTenants",
+        icon: "file",
+        screen: "audit:screen:audit-log-all-tenants",
+        order: 31,
+      });
 
       return { queries };
     },