@cosmicdrift/kumiko-samples 0.383.1 → 0.385.0

package/packages/bundled-features/src/auth-email-password/web/auth-form-primitives.tsx

@@ -1,17 +1,14 @@
-// Shared Web-Primitives für die Auth-Screens. Nur noch Layout/Style-
-// Helpers — Form/Field/Input/Button/Banner kommen jetzt über
-// usePrimitives() aus dem Framework-Vertrag, damit Native dieselben
-// Auth-Screens rendern kann (renderer-native registriert eigene
-// Implementations).
+// Shared web primitives for the auth screens. Only layout/style helpers are
+// left here; Form/Field/Input/Button/Banner come through usePrimitives() from
+// the framework contract, so apps and tests can override the implementations
+// via PrimitivesProvider.
 //
-//   <AuthCard>          — Card-Wrapper für die Auth-Screen-Layouts
-//                         (full-screen, zentriert, max-w-sm). Web-only;
-//                         eine Native-Variante landet bei Bedarf
-//                         daneben (z.B. SafeArea + ScrollView).
-//   parseUrlToken       — URL-Param-Helper (window.location.search).
+//   <AuthCard>          — card wrapper for the auth screen layouts
+//                         (full-screen, centered, max-w-sm). Web-only.
+//   parseUrlToken       — URL param helper (window.location.search).
 //
-// Link-Styles laufen über das Link-Primitive (variant="button"/"muted") —
-// die früheren authButtonClass/authMutedLinkClass sind dorthin gewandert.
+// Link styles go through the Link primitive (variant="button"/"muted"); the
+// former authButtonClass/authMutedLinkClass moved there.
 
 import { usePrimitives } from "@cosmicdrift/kumiko-renderer";
 import { BareFormProvider, cn } from "@cosmicdrift/kumiko-renderer/web";

package/packages/bundled-features/src/auth-email-password/{auth-paths.ts → web/auth-paths.ts}

@@ -1,4 +1,4 @@
-// Convention paths for the four auth pages (relative to the app base URL).
+// Convention paths for the five auth pages (relative to the app base URL).
 // resolveAuthMail builds each flow's magic-link appUrl from baseUrl + these;
 // the handlers append `?token=…` and mail via delivery (ctx.notify).
 
@@ -6,23 +6,26 @@
  *  (e.g. `/en/reset-password`, `/de/reset-password`). */
 export type AuthPath = string | ((locale: string) => string);
 
-/** Pfad-Konstanten der 4 Auth-Seiten (relativ zur App-baseUrl). */
 export type AuthPaths = {
   readonly resetPassword: AuthPath;
   readonly verifyEmail: AuthPath;
   readonly signupComplete: AuthPath;
   readonly inviteAccept: AuthPath;
+  readonly unlockAccount: AuthPath;
 };
 
-/** Konventions-Pfade — alle Kumiko-Apps nutzen dieselben. Apps überschreiben
- *  nur die Ausnahme via `makeAuthPaths({ ... })`. */
+/** Shared by every Kumiko app; apps override only the exceptions via `makeAuthPaths({ ... })`. */
 export const DEFAULT_AUTH_PATHS = {
   resetPassword: "/reset-password",
   verifyEmail: "/verify-email",
   signupComplete: "/signup/complete",
   inviteAccept: "/invite/accept",
+  unlockAccount: "/unlock-account",
 } as const satisfies AuthPaths;
 
+/** Client page that requests a reset mail; no mail links to it, so it is not part of AuthPaths. */
+export const DEFAULT_FORGOT_PASSWORD_PATH = "/forgot-password";
+
 export function makeAuthPaths(overrides: Partial<AuthPaths> = {}): AuthPaths {
   return { ...DEFAULT_AUTH_PATHS, ...overrides };
 }

package/packages/bundled-features/src/auth-email-password/web/client-plugin.ts

@@ -13,6 +13,7 @@ import {
   makeSessionAuthGate,
 } from "./auth-gate.tsx";
 import { emailPasswordClientActions } from "./client-actions.ts";
+import { DefaultAuthPagesGate } from "./default-auth-pages-gate.tsx";
 import { defaultTranslations, mergeTranslations } from "./i18n.ts";
 import type { LoginScreenProps } from "./login-screen.tsx";
 
@@ -45,6 +46,11 @@ export type EmailPasswordClientOptions = {
    *  Für Branding ("Sign in" → "Login to Acme") oder weitere Sprachen
    *  (`fr`, `es`, …) zusätzlich. */
   readonly translations?: TranslationsByLocale;
+  /** Serve the forgot-password, reset-password and unlock-account pages at
+   *  their convention paths for signed-out visitors. Apps with their own
+   *  screens at those paths either register an earlier gate (it wins) or
+   *  set this to false. Default: true. */
+  readonly defaultAuthPages?: boolean;
 };
 
 // Structurally identical to the renderer/web ClientFeatureDefinition, but
@@ -66,6 +72,7 @@ export function emailPasswordClient(
     name: "auth-email-password",
     providers: [],
     gates: [
+      ...(options.defaultAuthPages === false ? [] : [DefaultAuthPagesGate]),
       makeSessionAuthGate({
         loginScreen: options.loginScreen,
         loginScreenProps: options.loginScreenProps,

package/packages/bundled-features/src/auth-email-password/web/constants.ts

@@ -48,6 +48,7 @@ export const AuthHandlers = {
 // Qualified query names. Anonymous-readable status so the (unauthenticated)
 // signup page can decide whether to show its own link/form.
 export const AuthQueries = {
+  loginOptions: "auth-email-password:query:login-options",
   signupRegistrationStatus: "auth-email-password:query:signup-registration-status",
   // Anonymous, read-only invite lookup for the invite-acceptance page —
   // see invite-info.query.ts. Does not consume the token.

package/packages/bundled-features/src/auth-email-password/web/default-auth-pages-gate.tsx

@@ -0,0 +1,31 @@
+import type { ReactNode } from "react";
+import { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH } from "./auth-paths.ts";
+import { ConfirmAccountUnlockScreen } from "./confirm-account-unlock-screen.tsx";
+import { ForgotPasswordScreen } from "./forgot-password-screen.tsx";
+import { RequestAccountUnlockScreen } from "./request-account-unlock-screen.tsx";
+import { ResetPasswordScreen } from "./reset-password-screen.tsx";
+
+function hasToken(search: string): boolean {
+  return (new URLSearchParams(search).get("token") ?? "") !== "";
+}
+
+function pickDefaultAuthPage(pathname: string, search: string): ReactNode {
+  const path = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
+  switch (path) {
+    case DEFAULT_FORGOT_PASSWORD_PATH:
+      return <ForgotPasswordScreen />;
+    case DEFAULT_AUTH_PATHS.resetPassword:
+      return hasToken(search) ? <ResetPasswordScreen /> : null;
+    case DEFAULT_AUTH_PATHS.unlockAccount:
+      return hasToken(search) ? <ConfirmAccountUnlockScreen /> : <RequestAccountUnlockScreen />;
+    default:
+      return null;
+  }
+}
+
+// Sits inside emailPasswordClient's gate list, so app gates registered earlier
+// (outer) still win on the same path. The pages are public: no session needed.
+export function DefaultAuthPagesGate({ children }: { readonly children: ReactNode }): ReactNode {
+  const { pathname, search } = window.location;
+  return pickDefaultAuthPage(pathname, search) ?? <>{children}</>;
+}

package/packages/bundled-features/src/auth-email-password/web/login-screen.tsx

@@ -1,14 +1,12 @@
-// Default-LoginScreen. Reine E-Mail-+-Passwort-Form, zentriert, Card-
-// Layout. Texte kommen aus `useTranslation()` — die Default-Bundles
-// (de+en) liefert das Feature selber mit (translations.ts); Apps die
-// was anderes wollen, setzen entweder einen eigenen LocaleResolver auf
-// App-Level oder reichen Key-Overrides an `emailPasswordClient()`.
-//
-// Die Reason-Codes aus dem Login-Handler werden 1:1 auf i18n-Keys
-// gemappt (reasonToI18nKey) — neue Reason-Codes brauchen nur eine
-// neue Zeile im Bundle + hier im Mapping.
+// Login handler reason codes map 1:1 to i18n keys (reasonToI18nKey): a new
+// reason code needs a bundle entry plus a line in that mapping.
 
-import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import {
+  useOptionalDispatcher,
+  usePrimitives,
+  useQuery,
+  useTranslation,
+} from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import {
   type KnownLoginFailureReason,
@@ -16,11 +14,12 @@ import {
   requestEmailVerification,
 } from "./auth-client.ts";
 import { AuthCard } from "./auth-form-primitives.tsx";
+import { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH } from "./auth-paths.ts";
 import { followNextOrLandingAfterLogin } from "./auth-redirect.ts";
+import { AuthQueries } from "./constants.ts";
 import { useSession } from "./session.tsx";
 
-// Resend-Status für den "Bestätigungs-Mail erneut senden"-Flow, der bei
-// reason=email_not_verified unter dem Fehler-Banner angeboten wird.
+// Resend state for the confirmation mail offered under the error banner on reason=email_not_verified.
 type ResendStatus =
   | { readonly kind: "idle" }
   | { readonly kind: "sending" }
@@ -34,32 +33,27 @@ export type AuthLegalLink = {
 };
 
 export type LoginScreenProps = {
-  /** Overridet den `auth.login.title`-i18n-Key. Nur setzen wenn der
-   *  Titel stark app-branded ist und keine Translation braucht. */
+  /** Overrides the `auth.login.title` key; only for a branded title that needs no translation. */
   readonly title?: string;
   readonly subtitle?: ReactNode;
   readonly submitLabel?: string;
-  /** Optional href zum ForgotPasswordScreen. Wenn gesetzt rendert die
-   *  LoginScreen unter dem Submit-Button einen "Passwort vergessen?"-
-   *  Link. Apps die den Reset-Flow NICHT anbieten (z.B. nur Magic-Link),
-   *  setzen das einfach nicht — Login bleibt minimalistisch. */
-  readonly forgotPasswordHref?: string;
+  /** Href of the "Forgot password?" link under the submit button. Unset: the
+   *  default path once the server offers the reset flow (login-options);
+   *  `null` hides the link deliberately. */
+  readonly forgotPasswordHref?: string | null;
   /** Optional href to RequestAccountUnlockScreen (#1266). When set, an
    *  account_locked login error renders an "Unlock account?" link inline —
    *  the account-lockout escape hatch, since forgotPasswordHref does NOT
    *  help here: the lockout gate blocks login before password verify even
    *  runs, so it also blocks the post-reset login. Apps without
-   *  accountUnlock configured just leave this unset. */
-  readonly unlockAccountHref?: string;
-  /** Optional href zum SignupScreen. Wenn gesetzt rendert die LoginScreen
-   *  einen "Account erstellen"-Link. Apps die kein Self-Signup wollen
-   *  (closed-invite-only) setzen das einfach nicht. */
+   *  accountUnlock configured just leave this unset. Unset: default path once
+   *  the server offers the flow (login-options); `null` = deliberately no link. */
+  readonly unlockAccountHref?: string | null;
+  /** Href of the "Create account" link; invite-only apps leave it unset. */
   readonly signupHref?: string;
-  /** Impressum/Datenschutz unterhalb der Card — der Login-Screen ist
-   *  oft die einzige öffentliche Seite einer Admin-Domain und braucht
-   *  dann selbst erreichbare Legal-Links (DE: Impressumspflicht).
-   *  Labels kommen vom Caller (typisch schon übersetzt bzw. Eigennamen
-   *  wie "Impressum"). */
+  /** Imprint/privacy links under the card: the login screen is often the only
+   *  public page of an admin domain, which then must reach its legal pages
+   *  itself (German imprint duty). Labels come translated from the caller. */
   readonly legalLinks?: readonly AuthLegalLink[];
   /** Called when the server responds with an MFA challenge instead of a
    *  session. Apps typically swap this screen out for auth-mfa's
@@ -112,7 +106,7 @@ function reasonToKey(failure: LoginFailure): {
   }
 }
 
-export function LoginScreen({
+function LoginScreenBody({
   title,
   subtitle,
   submitLabel,
@@ -122,7 +116,8 @@ export function LoginScreen({
   legalLinks,
   onMfaChallenge,
   onMfaSetupRequired,
-}: LoginScreenProps): ReactNode {
+  loginOptions,
+}: LoginScreenProps & { readonly loginOptions: LoginOptions | null }): ReactNode {
   const t = useTranslation();
   const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
   const session = useSession();
@@ -131,10 +126,21 @@ export function LoginScreen({
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState<LoginFailure | null>(null);
   const [resendStatus, setResendStatus] = useState<ResendStatus>({ kind: "idle" });
-  // Tracked, damit der Resend-Button verschwindet sobald der User die
-  // Email-Eingabe ändert — sonst würde Resend silent an die geänderte
-  // (potentiell typoed) Adresse gehen ohne User-Feedback.
+  // Hides the resend button once the email input changes; otherwise resend
+  // would silently go to the edited, possibly mistyped address.
   const [failedLoginEmail, setFailedLoginEmail] = useState<string | null>(null);
+  const effectiveForgotHref =
+    forgotPasswordHref === undefined
+      ? loginOptions?.passwordReset === true
+        ? DEFAULT_FORGOT_PASSWORD_PATH
+        : null
+      : forgotPasswordHref;
+  const effectiveUnlockHref =
+    unlockAccountHref === undefined
+      ? loginOptions?.accountUnlock === true
+        ? DEFAULT_AUTH_PATHS.unlockAccount
+        : null
+      : unlockAccountHref;
 
   const doSubmit = async (): Promise<void> => {
     setSubmitting(true);
@@ -173,10 +179,8 @@ export function LoginScreen({
     void doSubmit();
   };
 
-  // Resend-Bestätigungsmail bei reason=email_not_verified. requestEmail-
-  // Verification ist silent-success (200 auch wenn kein User existiert),
-  // sodass kein anti-enumeration-Branching nötig ist; 429 → rate-limit-
-  // Hint inline, sonstige Fehler → generischer Inline-Hint.
+  // requestEmailVerification answers 200 even for unknown users, so no
+  // anti-enumeration branching is needed; only 429 gets its own hint.
   const onResend = async (): Promise<void> => {
     setResendStatus({ kind: "sending" });
     try {
@@ -252,9 +256,9 @@ export function LoginScreen({
                     </Button>
                   </span>
                 )}
-              {error.reason === "account_locked" && unlockAccountHref !== undefined && (
+              {error.reason === "account_locked" && effectiveUnlockHref !== null && (
                 <span className="self-start">
-                  <Link href={unlockAccountHref} variant="default">
+                  <Link href={effectiveUnlockHref} variant="default">
                     {t("auth.login.unlockAccount")}
                   </Link>
                 </span>
@@ -272,8 +276,8 @@ export function LoginScreen({
           {submitting ? t("auth.login.submitting") : effectiveSubmit}
         </Button>
       </Form>
-      {forgotPasswordHref !== undefined && (
-        <Link href={forgotPasswordHref} variant="muted" className="self-center">
+      {effectiveForgotHref !== null && (
+        <Link href={effectiveForgotHref} variant="muted" className="self-center">
           {t("auth.login.forgotPassword")}
         </Link>
       )}
@@ -297,3 +301,25 @@ export function LoginScreen({
     </AuthCard>
   );
 }
+
+type LoginOptions = { readonly passwordReset: boolean; readonly accountUnlock: boolean };
+
+function LoginScreenWithQueriedOptions(props: LoginScreenProps): ReactNode {
+  const { data } = useQuery<LoginOptions>(
+    AuthQueries.loginOptions,
+    {},
+    { enabled: props.forgotPasswordHref === undefined || props.unlockAccountHref === undefined },
+  );
+  return <LoginScreenBody {...props} loginOptions={data} />;
+}
+
+// Without a mounted dispatcher (standalone mounts, tests) the query is skipped
+// and only explicit hrefs render.
+export function LoginScreen(props: LoginScreenProps): ReactNode {
+  const dispatcher = useOptionalDispatcher();
+  return dispatcher === undefined ? (
+    <LoginScreenBody {...props} loginOptions={null} />
+  ) : (
+    <LoginScreenWithQueriedOptions {...props} />
+  );
+}

package/packages/bundled-features/src/channel-in-app/handlers/unread-count.query.ts

@@ -16,7 +16,7 @@ export const unreadCountQuery = defineQueryHandler({
   description:
     "Counts the calling user's unread in-app notification messages; use it for an inbox badge or to check whether a user has pending notifications.",
   handler: async (query, ctx) => {
-    // bun-db hat keinen aggregate-helper — selectMany alle matching rows,
+    // The query helpers in db/query.ts have no aggregate helper — selectMany alle matching rows,
     // count() in JS. Pragma: unread-counts sind low-cardinality (user-
     // scoped, max ~hunderte rows). Wenn das wachsen sollte: raw .unsafe()
     // mit COUNT(*).

package/packages/bundled-features/src/custom-fields/db/queries/projection.ts

@@ -9,7 +9,7 @@ function quoteTable(tableName: string): string {
 function bindJsonbParam(value: unknown): { sql: string; bound: unknown } {
   // Scalar JSON primitives can't bind directly to ::jsonb — Postgres rejects a
   // bound boolean/number with "cannot cast type boolean/integer to jsonb" (and
-  // Bun.SQL infers boolean[] candidates). Route them through ::text::jsonb with
+  // the driver may infer array candidates). Route them through ::text::jsonb with
   // a JSON-encoded literal. Objects/arrays/strings already bind as ::jsonb.
   if (typeof value === "boolean" || typeof value === "number") {
     return { sql: "$1::text::jsonb", bound: JSON.stringify(value) };

package/packages/bundled-features/src/file-derivatives/feature.ts

@@ -183,7 +183,7 @@ export function createFileDerivativesFeature(opts: FileDerivativesOptions = {}):
             // answer identically, no name-oracle. fileRefsTable.id is a UUID
             // column — a malformed id must fail here, not at the DB. Without
             // this, an anonymous, internet-facing caller can throw a Postgres
-            // 22P02 on every request (Bun.SQL pools the failed connection), a
+            // 22P02 on every request (the pooled connection is affected), a
             // DoS primitive with no auth required.
             if (!fileRefId || !variant || !VARIANT_NAME_RE.test(variant) || !isUuid(fileRefId)) {
               return c.text("not found", 404);

package/packages/bundled-features/src/jobs/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.384.0",
+    "type": "improvement",
+    "title": "Event consumers screen with restart, skip, pause and resume",
+    "detail": "SystemAdmins get the screens event-consumers and event-consumer-detail. A stopped consumer offers Restart as the primary action; Skip event (with a confirm dialog), Pause and Resume sit in the overflow menu. The write handlers no longer return the raw error text: unknown consumer, wrong status and nothing to skip have their own codes and messages, anything else is logged on the server and answers a generic message. The shared instance reads \"Shared\"."
+  },
   {
     "version": "0.383.0",
     "type": "breaking",

package/packages/bundled-features/src/jobs/feature.ts

@@ -1,9 +1,12 @@
-import {
-  defineFeature,
-  type FeatureDefinition,
-  i18nKey,
-} from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { catalogQuery } from "./handlers/catalog.query.ts";
+import {
+  consumerDisableWrite,
+  consumerEnableWrite,
+  consumerRestartWrite,
+  consumerSkipWrite,
+} from "./handlers/consumer.write.ts";
+import { consumerDetailQuery, consumersQuery } from "./handlers/consumers.query.ts";
 import { detailQuery } from "./handlers/detail.query.ts";
 import { listQuery } from "./handlers/list.query.ts";
 import {
@@ -24,14 +27,15 @@ import { tenantFailuresQuery } from "./handlers/tenant-failures.query.ts";
 import { tenantRunsQuery } from "./handlers/tenant-runs.query.ts";
 import { triggerWrite } from "./handlers/trigger.write.ts";
 import { jobRunLogsTableMeta, jobRunsTableMeta } from "./job-run-table.ts";
+import {
+  eventConsumerDetailScreen,
+  eventConsumersScreen,
+  jobRunDetailScreen,
+  jobRunsScreen,
+  jobTriggerScreen,
+} from "./screens.ts";
 import { tenantJobFailuresTableMeta } from "./tenant-job-failure-table.ts";
 import { tenantJobRunsTableMeta } from "./tenant-job-run-table.ts";
-import {
-  JOB_RUN_DETAIL_SCREEN_ID,
-  JOB_RUNS_SCREEN_ID,
-  JobHandlers,
-  JobQueries,
-} from "./web/constants.ts";
 import { JOBS_I18N } from "./web/i18n.ts";
 
 export type JobsFeatureOptions = {
@@ -124,6 +128,10 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
     const handlers = {
       trigger: r.writeHandler(triggerWrite),
       retry: r.writeHandler(retryWrite),
+      consumerRestart: r.writeHandler(consumerRestartWrite),
+      consumerSkip: r.writeHandler(consumerSkipWrite),
+      consumerDisable: r.writeHandler(consumerDisableWrite),
+      consumerEnable: r.writeHandler(consumerEnableWrite),
     };
 
     const queries = {
@@ -132,126 +140,15 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
       catalog: r.queryHandler(catalogQuery),
       failures: r.queryHandler(tenantFailuresQuery),
       tenantRuns: r.queryHandler(tenantRunsQuery),
+      consumers: r.queryHandler(consumersQuery),
+      consumerDetails: r.queryHandler(consumerDetailQuery),
     };
 
-    const systemAdminAccess = { roles: ["SystemAdmin"] as const };
-
     r.translations({ keys: JOBS_I18N });
 
-    r.screen({
-      id: JOB_RUNS_SCREEN_ID,
-      type: "projectionList",
-      query: JobQueries.list,
-      columns: [
-        { field: "jobName", label: i18nKey("jobs.runs.col.job") },
-        { field: "status", label: i18nKey("jobs.runs.col.status") },
-        {
-          field: "startedAt",
-          label: i18nKey("jobs.runs.col.started"),
-          renderer: { format: "timestamp" },
-        },
-        { field: "duration", label: i18nKey("jobs.runs.col.duration") },
-      ],
-      defaultSort: { field: "startedAt", dir: "desc" },
-      facets: [
-        {
-          field: "status",
-          type: "select",
-          label: i18nKey("jobs.runs.filter.status"),
-          options: [
-            { value: "queued", label: i18nKey("jobs.runs.filter.queued") },
-            { value: "running", label: i18nKey("jobs.runs.filter.running") },
-            { value: "completed", label: i18nKey("jobs.runs.filter.completed") },
-            { value: "failed", label: i18nKey("jobs.runs.filter.failed") },
-          ],
-        },
-      ],
-      rowActions: [
-        {
-          kind: "navigate",
-          id: "open",
-          label: i18nKey("jobs.runs.open"),
-          screen: JOB_RUN_DETAIL_SCREEN_ID,
-          entityId: "id",
-          rowClick: true,
-        },
-      ],
-      toolbarActions: [
-        {
-          kind: "drawer",
-          id: "trigger",
-          label: i18nKey("jobs.trigger.title"),
-          screen: "job-trigger",
-          style: "primary",
-        },
-      ],
-      pagination: "infinite",
-      access: systemAdminAccess,
-    });
-    r.screen({
-      id: "job-trigger",
-      type: "actionForm",
-      handler: JobHandlers.trigger,
-      fields: {
-        jobName: { type: "text", required: true },
-        payload: { type: "longText", multiline: true, default: "{}" },
-      },
-      layout: { sections: [{ fields: ["jobName", "payload"] }] },
-      submitLabel: i18nKey("jobs.trigger.submit"),
-      access: systemAdminAccess,
-      description: "jobs.screen.job-trigger.subtitle",
-    });
-    r.screen({
-      id: JOB_RUN_DETAIL_SCREEN_ID,
-      type: "projectionDetail",
-      query: JobQueries.details,
-      idParam: "runId",
-      fieldLabels: {
-        jobName: i18nKey("jobs.detail.field.job"),
-        status: i18nKey("jobs.detail.field.status"),
-        id: i18nKey("jobs.detail.field.id"),
-        startedAt: i18nKey("jobs.detail.field.started"),
-        finishedAt: i18nKey("jobs.detail.field.finished"),
-        duration: i18nKey("jobs.detail.field.duration"),
-        error: i18nKey("jobs.detail.field.error"),
-        logs: i18nKey("jobs.detail.logs"),
-      },
-      layout: {
-        sections: [
-          {
-            fields: [
-              "jobName",
-              "status",
-              "id",
-              { field: "startedAt", renderer: { format: "timestamp" } },
-              { field: "finishedAt", renderer: { format: "timestamp" } },
-              "duration",
-              "error",
-            ],
-          },
-          // No section `title` here (fw#2312 label-dedup fix): the section
-          // holds exactly one field, so a title would repeat the field's own
-          // label (rendered by RenderField as the Field's heading) verbatim.
-          {
-            fields: [{ field: "logs", renderer: { format: "json" } }],
-          },
-        ],
-      },
-      actions: [
-        {
-          kind: "writeHandler",
-          id: "retry",
-          label: i18nKey("jobs.detail.retry"),
-          handler: JobHandlers.retry,
-          payload: { map: { runId: "id" } },
-          visible: { field: "status", eq: "failed" },
-          style: "primary",
-        },
-      ],
-      description: "jobs.screen.job-run-detail.subtitle",
-      listScreenId: JOB_RUNS_SCREEN_ID,
-      access: systemAdminAccess,
-    });
+    r.screen(jobRunsScreen);
+    r.screen(jobTriggerScreen);
+    r.screen(jobRunDetailScreen);
     r.nav({
       id: "job-runs",
       label: "jobs:nav.jobRuns",
@@ -260,6 +157,16 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
       order: 10,
     });
 
+    r.screen(eventConsumersScreen);
+    r.screen(eventConsumerDetailScreen);
+    r.nav({
+      id: "event-consumers",
+      label: "jobs:nav.eventConsumers",
+      icon: "list",
+      screen: "jobs:screen:event-consumers",
+      order: 11,
+    });
+
     return { handlers, queries };
   });
 }

package/packages/bundled-features/src/jobs/handlers/consumer.write.ts

@@ -0,0 +1,98 @@
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  InternalError,
+  UnprocessableError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import {
+  type ConsumerRecoveryState,
+  ConsumerStatuses,
+  ConsumerTransitionError,
+  disableConsumer,
+  enableConsumer,
+  restartConsumer,
+  skipPoisonEvent,
+} from "@cosmicdrift/kumiko-framework/pipeline";
+import * as z from "zod";
+import { JobErrors } from "../web/constants.ts";
+
+const consumerTargetSchema = z.object({ name: z.string().min(1), instanceId: z.string().min(1) });
+
+const CONSUMER_STATE_REASON = "event consumer state is global dispatcher state, not tenant data";
+
+function rejected(code: string, i18nKey: string) {
+  return writeFailure(new UnprocessableError(code, { i18nKey }));
+}
+
+type ConsumerTransition = (
+  db: Parameters<typeof restartConsumer>[0],
+  name: string,
+  instanceId: string,
+) => Promise<ConsumerRecoveryState & { readonly skippedEventId?: bigint | null }>;
+
+function defineConsumerWrite(name: string, description: string, transition: ConsumerTransition) {
+  return defineWriteHandler({
+    name,
+    description,
+    schema: consumerTargetSchema,
+    access: { roles: ["SystemAdmin"] },
+    // Operator recovery for people only; skip drops an event for good.
+    agent: { expose: false },
+    handler: async (event, ctx) => {
+      if (!ctx.systemDb) {
+        throw new InternalError({
+          message: `jobs:write:${name} requires ctx.systemDb (feature must declare r.systemScope())`,
+        });
+      }
+      const db = ctx.systemDb.unsafeRaw(CONSUMER_STATE_REASON);
+      try {
+        const next = await transition(db, event.payload.name, event.payload.instanceId);
+        if (next.skippedEventId === null) {
+          return rejected(JobErrors.consumerNothingToSkip, "jobs.errors.consumerNothingToSkip");
+        }
+        return {
+          isSuccess: true,
+          data: {
+            name: next.name,
+            instanceId: next.instanceId,
+            status: next.status,
+            skippedEventId: next.skippedEventId?.toString() ?? null,
+          },
+        };
+      } catch (e) {
+        if (e instanceof ConsumerTransitionError) {
+          return e.rejection === "unknown-consumer"
+            ? rejected(JobErrors.consumerUnknown, "jobs.errors.consumerUnknown")
+            : rejected(JobErrors.consumerWrongStatus, "jobs.errors.consumerWrongStatus");
+        }
+        ctx.log?.error(`jobs:write:${name} failed: ${e instanceof Error ? e.message : String(e)}`, {
+          consumer: event.payload.name,
+          instanceId: event.payload.instanceId,
+        });
+        return rejected(JobErrors.consumerTransitionFailed, "jobs.errors.consumerTransitionFailed");
+      }
+    },
+  });
+}
+
+export const consumerRestartWrite = defineConsumerWrite(
+  "consumer-restart",
+  "Sets a dead event consumer back to idle so it retries the event that stopped it; use it after a transient failure is fixed.",
+  restartConsumer,
+);
+export const consumerSkipWrite = defineConsumerWrite(
+  "consumer-skip",
+  "Moves a stuck event consumer past the event that keeps failing; that event is never delivered to this consumer, so use it only for events that can never succeed.",
+  (db, consumerName, instanceId) =>
+    skipPoisonEvent(db, consumerName, instanceId, { requireStatus: ConsumerStatuses.dead }),
+);
+export const consumerDisableWrite = defineConsumerWrite(
+  "consumer-disable",
+  "Pauses an event consumer; the dispatcher skips it until it is enabled again.",
+  disableConsumer,
+);
+export const consumerEnableWrite = defineConsumerWrite(
+  "consumer-enable",
+  "Resumes a paused event consumer from where it stopped.",
+  enableConsumer,
+);