@cosmicdrift/kumiko-samples 0.383.0 → 0.384.0

package/packages/bundled-features/src/audit/web/i18n.ts

@@ -24,8 +24,55 @@ export const AUDIT_I18N: Readonly<Record<string, LocalizedString>> = {
   "audit.log.col.tenant": { en: "Tenant" },
   "audit.log.col.when": { en: "When" },
   "audit.log.col.type": { en: "Event" },
-  "audit.log.col.aggregateType": { en: "Aggregate type" },
   "audit.log.col.aggregateId": { en: "Aggregate ID" },
+  "audit.log.col.aggregateType": { en: "Object" },
+  "audit.log.event": { en: "{entity} {action}" },
+  "audit.log.action.created": { en: "created" },
+  "audit.log.action.updated": { en: "updated" },
+  "audit.log.action.deleted": { en: "deleted" },
+  "audit.log.action.restored": { en: "restored" },
+  "audit.log.facet.technical": { en: "Technical entries" },
+  "audit.log.facet.technical.include": { en: "Show technical entries" },
+  "audit.log.event.custom-field-set": { en: "Custom field value set" },
+  "audit.log.event.custom-field-cleared": { en: "Custom field value cleared" },
+  "audit.log.event.field-definition-deleted": { en: "Custom field deleted" },
+  "audit.log.event.secret-read": { en: "Secret read" },
+  "audit.log.event.session-revoked": { en: "Session ended" },
+  "audit.log.event.subject-forgotten": { en: "Person forgotten (data erased)" },
+  "audit.log.event.forget-denied": { en: "Erasure request denied" },
+  "audit.log.event.pat-revoked": { en: "Access token revoked" },
+  "audit.log.event.mail-account-connected": { en: "Mail account connected" },
+  "audit.log.event.mail-account-updated": { en: "Mail account updated" },
+  "audit.log.event.mail-account-disconnected": { en: "Mail account disconnected" },
+  "audit.log.event.subscription-created": { en: "Subscription created" },
+  "audit.log.event.subscription-updated": { en: "Subscription updated" },
+  "audit.log.event.subscription-canceled": { en: "Subscription canceled" },
+  "audit.log.event.invoice-paid": { en: "Invoice paid" },
+  "audit.log.event.invoice-payment-failed": { en: "Invoice payment failed" },
+  "audit.log.event.payment-received": { en: "Payment received" },
+  "audit.log.event.checkout-consent-recorded": { en: "Checkout consent recorded" },
+  "audit.log.event.contract-confirmation-issued": { en: "Contract confirmation issued" },
+  "audit.log.event.contract-termination-revoked": { en: "Contract termination revoked" },
+  "audit.log.event.destruction-requested": { en: "Tenant deletion requested" },
+  "audit.log.event.destruction-cancelled": { en: "Tenant deletion cancelled" },
+  "audit.log.event.tenant-destruction-started": { en: "Tenant deletion started" },
+  "audit.log.event.tenant-destruction-completed": { en: "Tenant deletion completed" },
+  "audit.log.event.tenant-destruction-failed": { en: "Tenant deletion failed" },
+  "audit.log.event.tenant-handover-claimed": { en: "Tenant handover claimed" },
+  "audit.log.event.waitlist-exported": { en: "Waitlist exported" },
+  "audit.log.event.waitlist-purged": { en: "Waitlist purged" },
+  "audit.log.event.feature-toggle-set": { en: "Feature toggle changed" },
+  "audit.log.event.contract-termination-requested": { en: "Contract termination requested" },
+  "audit.log.event.contract-termination-declared": { en: "Contract termination declared" },
+  "audit.log.event.contract-termination-unmatched": { en: "Contract termination not matched" },
+  "audit.log.entity.tenant": { en: "Tenant" },
+  "audit.log.entity.tenant-membership": { en: "Membership" },
+  "audit.log.entity.tenant-invitation": { en: "Invitation" },
+  "audit.log.entity.user": { en: "User" },
+  "audit.log.entity.folder": { en: "Folder" },
+  "audit.log.entity.folder-assignment": { en: "Folder assignment" },
+  "audit.log.entity.field-definition": { en: "Custom field" },
+  "audit.log.entity.template-resource": { en: "Template" },
   "audit.log.col.actor": { en: "Actor" },
   "audit.log.details": { en: "Details" },
   "audit.log.detail.payload": { en: "Event payload" },

package/packages/bundled-features/src/auth-email-password/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.384.0",
+    "type": "improvement",
+    "title": "Forgot-password and account-unlock work without app wiring",
+    "detail": "With auth.mail and SMTP configured, runProdApp and runDevApp now also wire the account-unlock flow (POST /api/auth/request-account-unlock and /api/auth/confirm-account-unlock, mail link to /unlock-account) because the login lockout is always on. emailPasswordClient serves ForgotPasswordScreen, ResetPasswordScreen (with token) and the unlock screens at /forgot-password, /reset-password and /unlock-account; gates registered earlier by the app win, and defaultAuthPages: false turns it off. LoginScreen reads the new anonymous login-options query and shows the forgot and unlock links when the flows exist; explicit forgotPasswordHref and unlockAccountHref still win and null hides a link. The query needs anonymousAccess on the app, otherwise no link appears."
+  },
   {
     "version": "0.383.0",
     "type": "improvement",

package/packages/bundled-features/src/auth-email-password/feature.ts

@@ -14,6 +14,7 @@ import {
 import { inviteInfoQuery } from "./handlers/invite-info.query.ts";
 import { createInviteSignupCompleteHandler } from "./handlers/invite-signup-complete.write.ts";
 import { createLoginHandler, type LoginHandlerOptions } from "./handlers/login.write.ts";
+import { loginOptionsQuery } from "./handlers/login-options.query.ts";
 import { logoutWrite } from "./handlers/logout.write.ts";
 import {
   createRequestAccountUnlockHandler,
@@ -197,8 +198,7 @@ export function createAuthEmailPasswordFeature(
         { key: "accountUnlock", label: "Account-Unlock-Flow", type: "boolean", default: false },
       ],
     });
-    r.requires({ features: ["user"] });
-    r.requires({ features: ["tenant"] });
+    r.requires({ features: ["user", "tenant"] });
     // All five magic-link flows (reset/verify/signup/invite/unlock) dispatch
     // via ctx.notify → delivery must be mounted. Fail closed at boot instead
     // of silently dropping the mail.
@@ -256,6 +256,7 @@ export function createAuthEmailPasswordFeature(
     }
 
     const queries = {
+      loginOptions: r.queryHandler(loginOptionsQuery),
       ...(opts.signup && {
         signupRegistrationStatus: r.queryHandler(selfRegistrationStatusQuery),
       }),

package/packages/bundled-features/src/auth-email-password/handlers/login-options.query.ts

@@ -0,0 +1,19 @@
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { AuthHandlers } from "../web/constants.ts";
+
+// Anonymous-readable so the (unauthenticated) login screen can show the
+// forgot-password and unlock links only when the matching mail flows are
+// actually mounted, without every app having to pass hrefs by hand.
+export const loginOptionsQuery = defineQueryHandler({
+  name: "login-options",
+  schema: z.object({}),
+  access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
+  description:
+    "Reports which optional login-page flows (password reset, account unlock) are available, readable without signing in, so the login screen links only to flows that exist.",
+  handler: async (_query, ctx) => ({
+    passwordReset: ctx.registry.getWriteHandler(AuthHandlers.requestPasswordReset) !== undefined,
+    accountUnlock: ctx.registry.getWriteHandler(AuthHandlers.requestAccountUnlock) !== undefined,
+  }),
+});

package/packages/bundled-features/src/auth-email-password/index.ts

@@ -6,7 +6,6 @@
 // hashPassword/verifyPassword; removing it is a breaking change that needs
 // its own changeset + deliberate deprecation window, not a silent drop.
 export { hashPassword, verifyPassword } from "../shared/password-hashing.ts";
-export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.ts";
 export type {
   BootstrapConfigValue,
   BootstrapDeps,
@@ -54,6 +53,13 @@ export {
   SIGNUP_TOKEN_KEY_PREFIXES,
   storeSignupToken,
 } from "./signup-token-store.ts";
+export {
+  type AuthPath,
+  type AuthPaths,
+  DEFAULT_AUTH_PATHS,
+  DEFAULT_FORGOT_PASSWORD_PATH,
+  makeAuthPaths,
+} from "./web/auth-paths.ts";
 export {
   AUTH_EMAIL_PASSWORD_FEATURE,
   AuthErrors,

package/packages/bundled-features/src/auth-email-password/{auth-paths.ts → web/auth-paths.ts}

@@ -1,4 +1,4 @@
-// Convention paths for the four auth pages (relative to the app base URL).
+// Convention paths for the five auth pages (relative to the app base URL).
 // resolveAuthMail builds each flow's magic-link appUrl from baseUrl + these;
 // the handlers append `?token=…` and mail via delivery (ctx.notify).
 
@@ -6,23 +6,26 @@
  *  (e.g. `/en/reset-password`, `/de/reset-password`). */
 export type AuthPath = string | ((locale: string) => string);
 
-/** Pfad-Konstanten der 4 Auth-Seiten (relativ zur App-baseUrl). */
 export type AuthPaths = {
   readonly resetPassword: AuthPath;
   readonly verifyEmail: AuthPath;
   readonly signupComplete: AuthPath;
   readonly inviteAccept: AuthPath;
+  readonly unlockAccount: AuthPath;
 };
 
-/** Konventions-Pfade — alle Kumiko-Apps nutzen dieselben. Apps überschreiben
- *  nur die Ausnahme via `makeAuthPaths({ ... })`. */
+/** Shared by every Kumiko app; apps override only the exceptions via `makeAuthPaths({ ... })`. */
 export const DEFAULT_AUTH_PATHS = {
   resetPassword: "/reset-password",
   verifyEmail: "/verify-email",
   signupComplete: "/signup/complete",
   inviteAccept: "/invite/accept",
+  unlockAccount: "/unlock-account",
 } as const satisfies AuthPaths;
 
+/** Client page that requests a reset mail; no mail links to it, so it is not part of AuthPaths. */
+export const DEFAULT_FORGOT_PASSWORD_PATH = "/forgot-password";
+
 export function makeAuthPaths(overrides: Partial<AuthPaths> = {}): AuthPaths {
   return { ...DEFAULT_AUTH_PATHS, ...overrides };
 }

package/packages/bundled-features/src/auth-email-password/web/client-plugin.ts

@@ -13,6 +13,7 @@ import {
   makeSessionAuthGate,
 } from "./auth-gate.tsx";
 import { emailPasswordClientActions } from "./client-actions.ts";
+import { DefaultAuthPagesGate } from "./default-auth-pages-gate.tsx";
 import { defaultTranslations, mergeTranslations } from "./i18n.ts";
 import type { LoginScreenProps } from "./login-screen.tsx";
 
@@ -45,6 +46,11 @@ export type EmailPasswordClientOptions = {
    *  Für Branding ("Sign in" → "Login to Acme") oder weitere Sprachen
    *  (`fr`, `es`, …) zusätzlich. */
   readonly translations?: TranslationsByLocale;
+  /** Serve the forgot-password, reset-password and unlock-account pages at
+   *  their convention paths for signed-out visitors. Apps with their own
+   *  screens at those paths either register an earlier gate (it wins) or
+   *  set this to false. Default: true. */
+  readonly defaultAuthPages?: boolean;
 };
 
 // Structurally identical to the renderer/web ClientFeatureDefinition, but
@@ -66,6 +72,7 @@ export function emailPasswordClient(
     name: "auth-email-password",
     providers: [],
     gates: [
+      ...(options.defaultAuthPages === false ? [] : [DefaultAuthPagesGate]),
       makeSessionAuthGate({
         loginScreen: options.loginScreen,
         loginScreenProps: options.loginScreenProps,

package/packages/bundled-features/src/auth-email-password/web/constants.ts

@@ -48,6 +48,7 @@ export const AuthHandlers = {
 // Qualified query names. Anonymous-readable status so the (unauthenticated)
 // signup page can decide whether to show its own link/form.
 export const AuthQueries = {
+  loginOptions: "auth-email-password:query:login-options",
   signupRegistrationStatus: "auth-email-password:query:signup-registration-status",
   // Anonymous, read-only invite lookup for the invite-acceptance page —
   // see invite-info.query.ts. Does not consume the token.

package/packages/bundled-features/src/auth-email-password/web/default-auth-pages-gate.tsx

@@ -0,0 +1,31 @@
+import type { ReactNode } from "react";
+import { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH } from "./auth-paths.ts";
+import { ConfirmAccountUnlockScreen } from "./confirm-account-unlock-screen.tsx";
+import { ForgotPasswordScreen } from "./forgot-password-screen.tsx";
+import { RequestAccountUnlockScreen } from "./request-account-unlock-screen.tsx";
+import { ResetPasswordScreen } from "./reset-password-screen.tsx";
+
+function hasToken(search: string): boolean {
+  return (new URLSearchParams(search).get("token") ?? "") !== "";
+}
+
+function pickDefaultAuthPage(pathname: string, search: string): ReactNode {
+  const path = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
+  switch (path) {
+    case DEFAULT_FORGOT_PASSWORD_PATH:
+      return <ForgotPasswordScreen />;
+    case DEFAULT_AUTH_PATHS.resetPassword:
+      return hasToken(search) ? <ResetPasswordScreen /> : null;
+    case DEFAULT_AUTH_PATHS.unlockAccount:
+      return hasToken(search) ? <ConfirmAccountUnlockScreen /> : <RequestAccountUnlockScreen />;
+    default:
+      return null;
+  }
+}
+
+// Sits inside emailPasswordClient's gate list, so app gates registered earlier
+// (outer) still win on the same path. The pages are public: no session needed.
+export function DefaultAuthPagesGate({ children }: { readonly children: ReactNode }): ReactNode {
+  const { pathname, search } = window.location;
+  return pickDefaultAuthPage(pathname, search) ?? <>{children}</>;
+}

package/packages/bundled-features/src/auth-email-password/web/login-screen.tsx

@@ -1,14 +1,12 @@
-// Default-LoginScreen. Reine E-Mail-+-Passwort-Form, zentriert, Card-
-// Layout. Texte kommen aus `useTranslation()` — die Default-Bundles
-// (de+en) liefert das Feature selber mit (translations.ts); Apps die
-// was anderes wollen, setzen entweder einen eigenen LocaleResolver auf
-// App-Level oder reichen Key-Overrides an `emailPasswordClient()`.
-//
-// Die Reason-Codes aus dem Login-Handler werden 1:1 auf i18n-Keys
-// gemappt (reasonToI18nKey) — neue Reason-Codes brauchen nur eine
-// neue Zeile im Bundle + hier im Mapping.
+// Login handler reason codes map 1:1 to i18n keys (reasonToI18nKey): a new
+// reason code needs a bundle entry plus a line in that mapping.
 
-import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import {
+  useOptionalDispatcher,
+  usePrimitives,
+  useQuery,
+  useTranslation,
+} from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import {
   type KnownLoginFailureReason,
@@ -16,11 +14,12 @@ import {
   requestEmailVerification,
 } from "./auth-client.ts";
 import { AuthCard } from "./auth-form-primitives.tsx";
+import { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH } from "./auth-paths.ts";
 import { followNextOrLandingAfterLogin } from "./auth-redirect.ts";
+import { AuthQueries } from "./constants.ts";
 import { useSession } from "./session.tsx";
 
-// Resend-Status für den "Bestätigungs-Mail erneut senden"-Flow, der bei
-// reason=email_not_verified unter dem Fehler-Banner angeboten wird.
+// Resend state for the confirmation mail offered under the error banner on reason=email_not_verified.
 type ResendStatus =
   | { readonly kind: "idle" }
   | { readonly kind: "sending" }
@@ -34,32 +33,27 @@ export type AuthLegalLink = {
 };
 
 export type LoginScreenProps = {
-  /** Overridet den `auth.login.title`-i18n-Key. Nur setzen wenn der
-   *  Titel stark app-branded ist und keine Translation braucht. */
+  /** Overrides the `auth.login.title` key; only for a branded title that needs no translation. */
   readonly title?: string;
   readonly subtitle?: ReactNode;
   readonly submitLabel?: string;
-  /** Optional href zum ForgotPasswordScreen. Wenn gesetzt rendert die
-   *  LoginScreen unter dem Submit-Button einen "Passwort vergessen?"-
-   *  Link. Apps die den Reset-Flow NICHT anbieten (z.B. nur Magic-Link),
-   *  setzen das einfach nicht — Login bleibt minimalistisch. */
-  readonly forgotPasswordHref?: string;
+  /** Href of the "Forgot password?" link under the submit button. Unset: the
+   *  default path once the server offers the reset flow (login-options);
+   *  `null` hides the link deliberately. */
+  readonly forgotPasswordHref?: string | null;
   /** Optional href to RequestAccountUnlockScreen (#1266). When set, an
    *  account_locked login error renders an "Unlock account?" link inline —
    *  the account-lockout escape hatch, since forgotPasswordHref does NOT
    *  help here: the lockout gate blocks login before password verify even
    *  runs, so it also blocks the post-reset login. Apps without
-   *  accountUnlock configured just leave this unset. */
-  readonly unlockAccountHref?: string;
-  /** Optional href zum SignupScreen. Wenn gesetzt rendert die LoginScreen
-   *  einen "Account erstellen"-Link. Apps die kein Self-Signup wollen
-   *  (closed-invite-only) setzen das einfach nicht. */
+   *  accountUnlock configured just leave this unset. Unset: default path once
+   *  the server offers the flow (login-options); `null` = deliberately no link. */
+  readonly unlockAccountHref?: string | null;
+  /** Href of the "Create account" link; invite-only apps leave it unset. */
   readonly signupHref?: string;
-  /** Impressum/Datenschutz unterhalb der Card — der Login-Screen ist
-   *  oft die einzige öffentliche Seite einer Admin-Domain und braucht
-   *  dann selbst erreichbare Legal-Links (DE: Impressumspflicht).
-   *  Labels kommen vom Caller (typisch schon übersetzt bzw. Eigennamen
-   *  wie "Impressum"). */
+  /** Imprint/privacy links under the card: the login screen is often the only
+   *  public page of an admin domain, which then must reach its legal pages
+   *  itself (German imprint duty). Labels come translated from the caller. */
   readonly legalLinks?: readonly AuthLegalLink[];
   /** Called when the server responds with an MFA challenge instead of a
    *  session. Apps typically swap this screen out for auth-mfa's
@@ -112,7 +106,7 @@ function reasonToKey(failure: LoginFailure): {
   }
 }
 
-export function LoginScreen({
+function LoginScreenBody({
   title,
   subtitle,
   submitLabel,
@@ -122,7 +116,8 @@ export function LoginScreen({
   legalLinks,
   onMfaChallenge,
   onMfaSetupRequired,
-}: LoginScreenProps): ReactNode {
+  loginOptions,
+}: LoginScreenProps & { readonly loginOptions: LoginOptions | null }): ReactNode {
   const t = useTranslation();
   const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
   const session = useSession();
@@ -131,10 +126,21 @@ export function LoginScreen({
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState<LoginFailure | null>(null);
   const [resendStatus, setResendStatus] = useState<ResendStatus>({ kind: "idle" });
-  // Tracked, damit der Resend-Button verschwindet sobald der User die
-  // Email-Eingabe ändert — sonst würde Resend silent an die geänderte
-  // (potentiell typoed) Adresse gehen ohne User-Feedback.
+  // Hides the resend button once the email input changes; otherwise resend
+  // would silently go to the edited, possibly mistyped address.
   const [failedLoginEmail, setFailedLoginEmail] = useState<string | null>(null);
+  const effectiveForgotHref =
+    forgotPasswordHref === undefined
+      ? loginOptions?.passwordReset === true
+        ? DEFAULT_FORGOT_PASSWORD_PATH
+        : null
+      : forgotPasswordHref;
+  const effectiveUnlockHref =
+    unlockAccountHref === undefined
+      ? loginOptions?.accountUnlock === true
+        ? DEFAULT_AUTH_PATHS.unlockAccount
+        : null
+      : unlockAccountHref;
 
   const doSubmit = async (): Promise<void> => {
     setSubmitting(true);
@@ -173,10 +179,8 @@ export function LoginScreen({
     void doSubmit();
   };
 
-  // Resend-Bestätigungsmail bei reason=email_not_verified. requestEmail-
-  // Verification ist silent-success (200 auch wenn kein User existiert),
-  // sodass kein anti-enumeration-Branching nötig ist; 429 → rate-limit-
-  // Hint inline, sonstige Fehler → generischer Inline-Hint.
+  // requestEmailVerification answers 200 even for unknown users, so no
+  // anti-enumeration branching is needed; only 429 gets its own hint.
   const onResend = async (): Promise<void> => {
     setResendStatus({ kind: "sending" });
     try {
@@ -252,9 +256,9 @@ export function LoginScreen({
                     </Button>
                   </span>
                 )}
-              {error.reason === "account_locked" && unlockAccountHref !== undefined && (
+              {error.reason === "account_locked" && effectiveUnlockHref !== null && (
                 <span className="self-start">
-                  <Link href={unlockAccountHref} variant="default">
+                  <Link href={effectiveUnlockHref} variant="default">
                     {t("auth.login.unlockAccount")}
                   </Link>
                 </span>
@@ -272,8 +276,8 @@ export function LoginScreen({
           {submitting ? t("auth.login.submitting") : effectiveSubmit}
         </Button>
       </Form>
-      {forgotPasswordHref !== undefined && (
-        <Link href={forgotPasswordHref} variant="muted" className="self-center">
+      {effectiveForgotHref !== null && (
+        <Link href={effectiveForgotHref} variant="muted" className="self-center">
           {t("auth.login.forgotPassword")}
         </Link>
       )}
@@ -297,3 +301,25 @@ export function LoginScreen({
     </AuthCard>
   );
 }
+
+type LoginOptions = { readonly passwordReset: boolean; readonly accountUnlock: boolean };
+
+function LoginScreenWithQueriedOptions(props: LoginScreenProps): ReactNode {
+  const { data } = useQuery<LoginOptions>(
+    AuthQueries.loginOptions,
+    {},
+    { enabled: props.forgotPasswordHref === undefined || props.unlockAccountHref === undefined },
+  );
+  return <LoginScreenBody {...props} loginOptions={data} />;
+}
+
+// Without a mounted dispatcher (standalone mounts, tests) the query is skipped
+// and only explicit hrefs render.
+export function LoginScreen(props: LoginScreenProps): ReactNode {
+  const dispatcher = useOptionalDispatcher();
+  return dispatcher === undefined ? (
+    <LoginScreenBody {...props} loginOptions={null} />
+  ) : (
+    <LoginScreenWithQueriedOptions {...props} />
+  );
+}

package/packages/bundled-features/src/jobs/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.384.0",
+    "type": "improvement",
+    "title": "Event consumers screen with restart, skip, pause and resume",
+    "detail": "SystemAdmins get the screens event-consumers and event-consumer-detail. A stopped consumer offers Restart as the primary action; Skip event (with a confirm dialog), Pause and Resume sit in the overflow menu. The write handlers no longer return the raw error text: unknown consumer, wrong status and nothing to skip have their own codes and messages, anything else is logged on the server and answers a generic message. The shared instance reads \"Shared\"."
+  },
   {
     "version": "0.383.0",
     "type": "breaking",

package/packages/bundled-features/src/jobs/feature.ts

@@ -1,9 +1,12 @@
-import {
-  defineFeature,
-  type FeatureDefinition,
-  i18nKey,
-} from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { catalogQuery } from "./handlers/catalog.query.ts";
+import {
+  consumerDisableWrite,
+  consumerEnableWrite,
+  consumerRestartWrite,
+  consumerSkipWrite,
+} from "./handlers/consumer.write.ts";
+import { consumerDetailQuery, consumersQuery } from "./handlers/consumers.query.ts";
 import { detailQuery } from "./handlers/detail.query.ts";
 import { listQuery } from "./handlers/list.query.ts";
 import {
@@ -24,14 +27,15 @@ import { tenantFailuresQuery } from "./handlers/tenant-failures.query.ts";
 import { tenantRunsQuery } from "./handlers/tenant-runs.query.ts";
 import { triggerWrite } from "./handlers/trigger.write.ts";
 import { jobRunLogsTableMeta, jobRunsTableMeta } from "./job-run-table.ts";
+import {
+  eventConsumerDetailScreen,
+  eventConsumersScreen,
+  jobRunDetailScreen,
+  jobRunsScreen,
+  jobTriggerScreen,
+} from "./screens.ts";
 import { tenantJobFailuresTableMeta } from "./tenant-job-failure-table.ts";
 import { tenantJobRunsTableMeta } from "./tenant-job-run-table.ts";
-import {
-  JOB_RUN_DETAIL_SCREEN_ID,
-  JOB_RUNS_SCREEN_ID,
-  JobHandlers,
-  JobQueries,
-} from "./web/constants.ts";
 import { JOBS_I18N } from "./web/i18n.ts";
 
 export type JobsFeatureOptions = {
@@ -124,6 +128,10 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
     const handlers = {
       trigger: r.writeHandler(triggerWrite),
       retry: r.writeHandler(retryWrite),
+      consumerRestart: r.writeHandler(consumerRestartWrite),
+      consumerSkip: r.writeHandler(consumerSkipWrite),
+      consumerDisable: r.writeHandler(consumerDisableWrite),
+      consumerEnable: r.writeHandler(consumerEnableWrite),
     };
 
     const queries = {
@@ -132,126 +140,15 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
       catalog: r.queryHandler(catalogQuery),
       failures: r.queryHandler(tenantFailuresQuery),
       tenantRuns: r.queryHandler(tenantRunsQuery),
+      consumers: r.queryHandler(consumersQuery),
+      consumerDetails: r.queryHandler(consumerDetailQuery),
     };
 
-    const systemAdminAccess = { roles: ["SystemAdmin"] as const };
-
     r.translations({ keys: JOBS_I18N });
 
-    r.screen({
-      id: JOB_RUNS_SCREEN_ID,
-      type: "projectionList",
-      query: JobQueries.list,
-      columns: [
-        { field: "jobName", label: i18nKey("jobs.runs.col.job") },
-        { field: "status", label: i18nKey("jobs.runs.col.status") },
-        {
-          field: "startedAt",
-          label: i18nKey("jobs.runs.col.started"),
-          renderer: { format: "timestamp" },
-        },
-        { field: "duration", label: i18nKey("jobs.runs.col.duration") },
-      ],
-      defaultSort: { field: "startedAt", dir: "desc" },
-      facets: [
-        {
-          field: "status",
-          type: "select",
-          label: i18nKey("jobs.runs.filter.status"),
-          options: [
-            { value: "queued", label: i18nKey("jobs.runs.filter.queued") },
-            { value: "running", label: i18nKey("jobs.runs.filter.running") },
-            { value: "completed", label: i18nKey("jobs.runs.filter.completed") },
-            { value: "failed", label: i18nKey("jobs.runs.filter.failed") },
-          ],
-        },
-      ],
-      rowActions: [
-        {
-          kind: "navigate",
-          id: "open",
-          label: i18nKey("jobs.runs.open"),
-          screen: JOB_RUN_DETAIL_SCREEN_ID,
-          entityId: "id",
-          rowClick: true,
-        },
-      ],
-      toolbarActions: [
-        {
-          kind: "drawer",
-          id: "trigger",
-          label: i18nKey("jobs.trigger.title"),
-          screen: "job-trigger",
-          style: "primary",
-        },
-      ],
-      pagination: "infinite",
-      access: systemAdminAccess,
-    });
-    r.screen({
-      id: "job-trigger",
-      type: "actionForm",
-      handler: JobHandlers.trigger,
-      fields: {
-        jobName: { type: "text", required: true },
-        payload: { type: "longText", multiline: true, default: "{}" },
-      },
-      layout: { sections: [{ fields: ["jobName", "payload"] }] },
-      submitLabel: i18nKey("jobs.trigger.submit"),
-      access: systemAdminAccess,
-      description: "jobs.screen.job-trigger.subtitle",
-    });
-    r.screen({
-      id: JOB_RUN_DETAIL_SCREEN_ID,
-      type: "projectionDetail",
-      query: JobQueries.details,
-      idParam: "runId",
-      fieldLabels: {
-        jobName: i18nKey("jobs.detail.field.job"),
-        status: i18nKey("jobs.detail.field.status"),
-        id: i18nKey("jobs.detail.field.id"),
-        startedAt: i18nKey("jobs.detail.field.started"),
-        finishedAt: i18nKey("jobs.detail.field.finished"),
-        duration: i18nKey("jobs.detail.field.duration"),
-        error: i18nKey("jobs.detail.field.error"),
-        logs: i18nKey("jobs.detail.logs"),
-      },
-      layout: {
-        sections: [
-          {
-            fields: [
-              "jobName",
-              "status",
-              "id",
-              { field: "startedAt", renderer: { format: "timestamp" } },
-              { field: "finishedAt", renderer: { format: "timestamp" } },
-              "duration",
-              "error",
-            ],
-          },
-          // No section `title` here (fw#2312 label-dedup fix): the section
-          // holds exactly one field, so a title would repeat the field's own
-          // label (rendered by RenderField as the Field's heading) verbatim.
-          {
-            fields: [{ field: "logs", renderer: { format: "json" } }],
-          },
-        ],
-      },
-      actions: [
-        {
-          kind: "writeHandler",
-          id: "retry",
-          label: i18nKey("jobs.detail.retry"),
-          handler: JobHandlers.retry,
-          payload: { map: { runId: "id" } },
-          visible: { field: "status", eq: "failed" },
-          style: "primary",
-        },
-      ],
-      description: "jobs.screen.job-run-detail.subtitle",
-      listScreenId: JOB_RUNS_SCREEN_ID,
-      access: systemAdminAccess,
-    });
+    r.screen(jobRunsScreen);
+    r.screen(jobTriggerScreen);
+    r.screen(jobRunDetailScreen);
     r.nav({
       id: "job-runs",
       label: "jobs:nav.jobRuns",
@@ -260,6 +157,16 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
       order: 10,
     });
 
+    r.screen(eventConsumersScreen);
+    r.screen(eventConsumerDetailScreen);
+    r.nav({
+      id: "event-consumers",
+      label: "jobs:nav.eventConsumers",
+      icon: "list",
+      screen: "jobs:screen:event-consumers",
+      order: 11,
+    });
+
     return { handlers, queries };
   });
 }