@cosmicdrift/kumiko-samples 0.383.1 → 0.385.0

package/packages/bundled-features/src/jobs/handlers/consumers.query.ts

@@ -0,0 +1,137 @@
+import { defineQueryHandler, type Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  type ConsumerProgress,
+  getAllConsumerProgress,
+  getConsumerState,
+  SEARCH_CONSUMER_NAME,
+  SSE_BROADCAST_CONSUMER_NAME,
+} from "@cosmicdrift/kumiko-framework/pipeline";
+import * as z from "zod";
+import {
+  CONSUMER_ID_SEPARATOR,
+  CONSUMER_STATUSES,
+  type ConsumerStatus,
+  isConsumerStatus,
+} from "../web/constants.ts";
+
+const LAST_ERROR_PREVIEW_LENGTH = 90;
+
+// Dead consumers are what support looks for, so they lead the default order.
+const STATUS_RANK: Readonly<Record<ConsumerStatus, number>> = {
+  dead: 0,
+  disabled: 1,
+  processing: 2,
+  "never-run": 3,
+  idle: 4,
+};
+
+export function consumerRowId(name: string, instanceId: string): string {
+  return `${name}${CONSUMER_ID_SEPARATOR}${instanceId}`;
+}
+
+export function splitConsumerRowId(id: string): { name: string; instanceId: string } | null {
+  const at = id.lastIndexOf(CONSUMER_ID_SEPARATOR);
+  if (at <= 0) return null;
+  return { name: id.slice(0, at), instanceId: id.slice(at + 1) };
+}
+
+function registeredConsumerNames(registry: Registry): readonly string[] {
+  return [
+    SSE_BROADCAST_CONSUMER_NAME,
+    SEARCH_CONSUMER_NAME,
+    ...registry.getAllMultiStreamProjections().keys(),
+  ];
+}
+
+function previewOf(error: string | null): string | null {
+  if (error === null || error.length <= LAST_ERROR_PREVIEW_LENGTH) return error;
+  return `${error.slice(0, LAST_ERROR_PREVIEW_LENGTH).trimEnd()}…`;
+}
+
+function toRow(c: ConsumerProgress) {
+  return {
+    id: consumerRowId(c.name, c.instanceId),
+    name: c.name,
+    instanceId: c.instanceId,
+    status: c.status,
+    lag: Number(c.lag),
+    attempts: c.attempts,
+    lastError: previewOf(c.lastError),
+  };
+}
+
+const statusFilterSchema = z.strictObject({
+  field: z.literal("status"),
+  op: z.literal("in"),
+  value: z.array(z.enum(CONSUMER_STATUSES)),
+});
+
+export const consumersQuery = defineQueryHandler({
+  name: "consumers",
+  description:
+    "Lists every event consumer (projections, search indexer, SSE broadcaster) with status, lag behind the event store and last error, dead consumers first; use it to find a stuck consumer.",
+  schema: z.object({
+    filters: z.array(statusFilterSchema).max(1).optional(),
+    sort: z.enum(["name", "status", "lag", "attempts"]).optional(),
+    sortDirection: z.enum(["asc", "desc"]).optional(),
+  }),
+  access: { roles: ["SystemAdmin"] },
+  handler: async (query, ctx) => {
+    if (!ctx.systemDb) {
+      throw new InternalError({
+        message:
+          "jobs:query:consumers requires ctx.systemDb (feature must declare r.systemScope())",
+      });
+    }
+    const db = ctx.systemDb.unsafeRaw(
+      "event consumer state is global dispatcher state, not tenant data",
+    );
+    const progress = await getAllConsumerProgress(db, registeredConsumerNames(ctx.registry));
+    const statuses = query.payload.filters?.[0]?.value;
+    const visible = statuses
+      ? progress.filter((c) => statuses.some((s) => s === c.status))
+      : progress;
+    const direction = query.payload.sortDirection === "desc" ? -1 : 1;
+    const sort = query.payload.sort;
+    const compare = (a: ConsumerProgress, b: ConsumerProgress): number => {
+      if (sort === "name") return a.name.localeCompare(b.name) * direction;
+      if (sort === "lag") return Number(a.lag - b.lag) * direction;
+      if (sort === "attempts") return (a.attempts - b.attempts) * direction;
+      const rank = (c: ConsumerProgress) =>
+        isConsumerStatus(c.status) ? STATUS_RANK[c.status] : 5;
+      return (rank(a) - rank(b)) * direction || a.name.localeCompare(b.name);
+    };
+    return { rows: [...visible].sort(compare).map(toRow), nextCursor: null };
+  },
+});
+
+export const consumerDetailQuery = defineQueryHandler({
+  name: "consumer-details",
+  description:
+    "Returns one event consumer with its status, lag, attempts, the full last error and the time of its last state change; use it to decide between restart, skip and pause.",
+  schema: z.object({ consumerId: z.string().min(1) }),
+  access: { roles: ["SystemAdmin"] },
+  handler: async (query, ctx) => {
+    if (!ctx.systemDb) {
+      throw new InternalError({
+        message:
+          "jobs:query:consumer-details requires ctx.systemDb (feature must declare r.systemScope())",
+      });
+    }
+    const target = splitConsumerRowId(query.payload.consumerId);
+    if (!target) return null;
+    const db = ctx.systemDb.unsafeRaw(
+      "event consumer state is global dispatcher state, not tenant data",
+    );
+    const all = await getAllConsumerProgress(db, registeredConsumerNames(ctx.registry));
+    const progress = all.find((c) => c.name === target.name && c.instanceId === target.instanceId);
+    if (!progress) return null;
+    const state = await getConsumerState(db, target.name, target.instanceId);
+    return {
+      ...toRow(progress),
+      lastError: progress.lastError,
+      updatedAt: state ? state.updatedAt.toString() : null,
+    };
+  },
+});

package/packages/bundled-features/src/jobs/screens.ts

@@ -0,0 +1,262 @@
+import {
+  type ActionFormScreenDefinition,
+  i18nKey,
+  type ProjectionDetailScreenDefinition,
+  type ProjectionListScreenDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  CONSUMER_INSTANCE_OPTION_KEY_PREFIX,
+  CONSUMER_STATUS_OPTION_KEY_PREFIX,
+  CONSUMER_STATUSES,
+  EVENT_CONSUMER_DETAIL_SCREEN_ID,
+  EVENT_CONSUMERS_SCREEN_ID,
+  JOB_RUN_DETAIL_SCREEN_ID,
+  JOB_RUNS_SCREEN_ID,
+  JobHandlers,
+  JobQueries,
+} from "./web/constants.ts";
+
+const systemAdminAccess = { roles: ["SystemAdmin"] as const };
+
+export const jobRunsScreen: ProjectionListScreenDefinition = {
+  id: JOB_RUNS_SCREEN_ID,
+  type: "projectionList",
+  query: JobQueries.list,
+  columns: [
+    { field: "jobName", label: i18nKey("jobs.runs.col.job") },
+    { field: "status", label: i18nKey("jobs.runs.col.status") },
+    {
+      field: "startedAt",
+      label: i18nKey("jobs.runs.col.started"),
+      renderer: { format: "timestamp" },
+    },
+    { field: "duration", label: i18nKey("jobs.runs.col.duration") },
+  ],
+  defaultSort: { field: "startedAt", dir: "desc" },
+  facets: [
+    {
+      field: "status",
+      type: "select",
+      label: i18nKey("jobs.runs.filter.status"),
+      options: [
+        { value: "queued", label: i18nKey("jobs.runs.filter.queued") },
+        { value: "running", label: i18nKey("jobs.runs.filter.running") },
+        { value: "completed", label: i18nKey("jobs.runs.filter.completed") },
+        { value: "failed", label: i18nKey("jobs.runs.filter.failed") },
+      ],
+    },
+  ],
+  rowActions: [
+    {
+      kind: "navigate",
+      id: "open",
+      label: i18nKey("jobs.runs.open"),
+      screen: JOB_RUN_DETAIL_SCREEN_ID,
+      entityId: "id",
+      rowClick: true,
+    },
+  ],
+  toolbarActions: [
+    {
+      kind: "drawer",
+      id: "trigger",
+      label: i18nKey("jobs.trigger.title"),
+      screen: "job-trigger",
+      style: "primary",
+    },
+  ],
+  pagination: "infinite",
+  access: systemAdminAccess,
+};
+
+export const jobTriggerScreen: ActionFormScreenDefinition = {
+  id: "job-trigger",
+  type: "actionForm",
+  handler: JobHandlers.trigger,
+  fields: {
+    jobName: { type: "text", required: true },
+    payload: { type: "longText", multiline: true, default: "{}" },
+  },
+  layout: { sections: [{ fields: ["jobName", "payload"] }] },
+  submitLabel: i18nKey("jobs.trigger.submit"),
+  access: systemAdminAccess,
+  description: "jobs.screen.job-trigger.subtitle",
+};
+
+export const jobRunDetailScreen: ProjectionDetailScreenDefinition = {
+  id: JOB_RUN_DETAIL_SCREEN_ID,
+  type: "projectionDetail",
+  query: JobQueries.details,
+  idParam: "runId",
+  fieldLabels: {
+    jobName: i18nKey("jobs.detail.field.job"),
+    status: i18nKey("jobs.detail.field.status"),
+    id: i18nKey("jobs.detail.field.id"),
+    startedAt: i18nKey("jobs.detail.field.started"),
+    finishedAt: i18nKey("jobs.detail.field.finished"),
+    duration: i18nKey("jobs.detail.field.duration"),
+    error: i18nKey("jobs.detail.field.error"),
+    logs: i18nKey("jobs.detail.logs"),
+  },
+  layout: {
+    sections: [
+      {
+        fields: [
+          "jobName",
+          "status",
+          "id",
+          { field: "startedAt", renderer: { format: "timestamp" } },
+          { field: "finishedAt", renderer: { format: "timestamp" } },
+          "duration",
+          "error",
+        ],
+      },
+      // No section `title` here (fw#2312 label-dedup fix): the section
+      // holds exactly one field, so a title would repeat the field's own
+      // label (rendered by RenderField as the Field's heading) verbatim.
+      {
+        fields: [{ field: "logs", renderer: { format: "json" } }],
+      },
+    ],
+  },
+  actions: [
+    {
+      kind: "writeHandler",
+      id: "retry",
+      label: i18nKey("jobs.detail.retry"),
+      handler: JobHandlers.retry,
+      payload: { map: { runId: "id" } },
+      visible: { field: "status", eq: "failed" },
+      style: "primary",
+    },
+  ],
+  description: "jobs.screen.job-run-detail.subtitle",
+  listScreenId: JOB_RUNS_SCREEN_ID,
+  access: systemAdminAccess,
+};
+
+export const eventConsumersScreen: ProjectionListScreenDefinition = {
+  id: EVENT_CONSUMERS_SCREEN_ID,
+  type: "projectionList",
+  query: JobQueries.consumers,
+  columns: [
+    { field: "name", label: i18nKey("jobs.consumers.col.name") },
+    {
+      field: "status",
+      label: i18nKey("jobs.consumers.col.status"),
+      renderer: { format: "enumOption", keyPrefix: CONSUMER_STATUS_OPTION_KEY_PREFIX },
+    },
+    { field: "lag", label: i18nKey("jobs.consumers.col.lag"), hideOnNarrow: true },
+    { field: "attempts", label: i18nKey("jobs.consumers.col.attempts"), hideOnNarrow: true },
+    { field: "lastError", label: i18nKey("jobs.consumers.col.lastError") },
+  ],
+  defaultSort: { field: "status", dir: "asc" },
+  facets: [
+    {
+      field: "status",
+      type: "select",
+      label: i18nKey("jobs.consumers.col.status"),
+      options: CONSUMER_STATUSES.map((status) => ({
+        value: status,
+        label: i18nKey(`${CONSUMER_STATUS_OPTION_KEY_PREFIX}${status}`),
+      })),
+    },
+  ],
+  rowActions: [
+    {
+      kind: "navigate",
+      id: "open",
+      label: i18nKey("jobs.runs.open"),
+      screen: EVENT_CONSUMER_DETAIL_SCREEN_ID,
+      entityId: "id",
+      rowClick: true,
+    },
+  ],
+  pagination: "infinite",
+  access: systemAdminAccess,
+  description: "jobs.screen.event-consumers.subtitle",
+};
+
+export const eventConsumerDetailScreen: ProjectionDetailScreenDefinition = {
+  id: EVENT_CONSUMER_DETAIL_SCREEN_ID,
+  type: "projectionDetail",
+  query: JobQueries.consumerDetails,
+  idParam: "consumerId",
+  fieldLabels: {
+    name: i18nKey("jobs.consumers.col.name"),
+    instanceId: i18nKey("jobs.consumers.field.instanceId"),
+    status: i18nKey("jobs.consumers.col.status"),
+    lag: i18nKey("jobs.consumers.col.lag"),
+    attempts: i18nKey("jobs.consumers.col.attempts"),
+    lastError: i18nKey("jobs.consumers.col.lastError"),
+    updatedAt: i18nKey("jobs.consumers.field.updatedAt"),
+  },
+  layout: {
+    sections: [
+      {
+        fields: [
+          "name",
+          {
+            field: "instanceId",
+            renderer: { format: "enumOption", keyPrefix: CONSUMER_INSTANCE_OPTION_KEY_PREFIX },
+          },
+          {
+            field: "status",
+            renderer: { format: "enumOption", keyPrefix: CONSUMER_STATUS_OPTION_KEY_PREFIX },
+          },
+          "lag",
+          "attempts",
+          { field: "updatedAt", renderer: { format: "timestamp" } },
+        ],
+      },
+      { fields: ["lastError"] },
+    ],
+  },
+  actions: [
+    {
+      kind: "writeHandler",
+      id: "restart",
+      icon: "refresh",
+      label: i18nKey("jobs.consumers.restart"),
+      handler: JobHandlers.consumerRestart,
+      payload: { map: { name: "name", instanceId: "instanceId" } },
+      visible: { field: "status", eq: "dead" },
+      style: "primary",
+    },
+    {
+      kind: "writeHandler",
+      id: "skip",
+      icon: "arrow-right",
+      label: i18nKey("jobs.consumers.skip"),
+      handler: JobHandlers.consumerSkip,
+      payload: { map: { name: "name", instanceId: "instanceId" } },
+      visible: { field: "status", eq: "dead" },
+      confirm: i18nKey("jobs.consumers.skip.confirm"),
+      style: "danger",
+    },
+    {
+      kind: "writeHandler",
+      id: "disable",
+      icon: "x",
+      label: i18nKey("jobs.consumers.disable"),
+      handler: JobHandlers.consumerDisable,
+      payload: { map: { name: "name", instanceId: "instanceId" } },
+      visible: { field: "status", ne: "disabled" },
+      style: "secondary",
+    },
+    {
+      kind: "writeHandler",
+      id: "enable",
+      icon: "check",
+      label: i18nKey("jobs.consumers.enable"),
+      handler: JobHandlers.consumerEnable,
+      payload: { map: { name: "name", instanceId: "instanceId" } },
+      visible: { field: "status", eq: "disabled" },
+      style: "primary",
+    },
+  ],
+  primaryAction: "restart",
+  description: "jobs.screen.event-consumer-detail.subtitle",
+  listScreenId: EVENT_CONSUMERS_SCREEN_ID,
+  access: systemAdminAccess,
+};

package/packages/bundled-features/src/jobs/web/constants.ts

@@ -5,6 +5,10 @@ export const JOBS_FEATURE = "jobs" as const;
 export const JobHandlers = {
   trigger: "jobs:write:trigger",
   retry: "jobs:write:retry",
+  consumerRestart: "jobs:write:consumer-restart",
+  consumerSkip: "jobs:write:consumer-skip",
+  consumerDisable: "jobs:write:consumer-disable",
+  consumerEnable: "jobs:write:consumer-enable",
 } as const;
 
 // Qualified query handler names (QN format: scope:type:name)
@@ -14,6 +18,8 @@ export const JobQueries = {
   catalog: "jobs:query:catalog",
   failures: "jobs:query:failures",
   tenantRuns: "jobs:query:tenant-runs",
+  consumers: "jobs:query:consumers",
+  consumerDetails: "jobs:query:consumer-details",
 } as const;
 
 // Error codes
@@ -24,6 +30,10 @@ export const JobErrors = {
   notManual: "job_not_manual",
   invalidPayload: "job_invalid_payload",
   payloadErased: "job_payload_erased",
+  consumerUnknown: "consumer_unknown",
+  consumerWrongStatus: "consumer_wrong_status",
+  consumerNothingToSkip: "consumer_nothing_to_skip",
+  consumerTransitionFailed: "consumer_transition_failed",
 } as const;
 
 /** SystemAdmin job-runs list. Nav: `jobs:screen:job-runs`. */
@@ -31,3 +41,22 @@ export const JOB_RUNS_SCREEN_ID = "job-runs" as const;
 
 /** Run detail — route entityId is the run uuid. Nav: `jobs:screen:job-run-detail`. */
 export const JOB_RUN_DETAIL_SCREEN_ID = "job-run-detail" as const;
+
+/** SystemAdmin event-consumer list. Nav: `jobs:screen:event-consumers`. */
+export const EVENT_CONSUMERS_SCREEN_ID = "event-consumers" as const;
+
+/** Consumer detail — route entityId is `<name>@<instanceId>`. */
+export const EVENT_CONSUMER_DETAIL_SCREEN_ID = "event-consumer-detail" as const;
+
+export const CONSUMER_ID_SEPARATOR = "@" as const;
+
+export const CONSUMER_STATUSES = ["idle", "processing", "dead", "disabled", "never-run"] as const;
+export type ConsumerStatus = (typeof CONSUMER_STATUSES)[number];
+
+export function isConsumerStatus(value: string): value is ConsumerStatus {
+  return CONSUMER_STATUSES.some((status) => status === value);
+}
+
+export const CONSUMER_STATUS_OPTION_KEY_PREFIX = "jobs.consumers.status.";
+
+export const CONSUMER_INSTANCE_OPTION_KEY_PREFIX = "jobs.consumers.instance.";

package/packages/bundled-features/src/jobs/web/i18n.ts

@@ -15,6 +15,47 @@ export const JOBS_I18N: Readonly<Record<string, LocalizedString>> = {
   "jobs:entity:__action-form__:field:jobName": { en: "Job name" },
   "jobs:entity:__action-form__:field:payload": { en: "JSON payload" },
   "jobs:nav.jobRuns": { en: "Jobs" },
+  "screen:event-consumers.title": { en: "Event consumers" },
+  "screen:event-consumer-detail.title": { en: "Event consumer" },
+  "jobs:nav.eventConsumers": { en: "Event consumers" },
+  "jobs.screen.event-consumers.subtitle": {
+    en: "Background readers that process events after they are saved; find stuck ones and get them moving again.",
+  },
+  "jobs.screen.event-consumer-detail.subtitle": {
+    en: "State and last error of one event consumer, with the actions to restart, skip or pause it.",
+  },
+  "jobs.consumers.col.name": { en: "Consumer" },
+  "jobs.consumers.col.status": { en: "Status" },
+  "jobs.consumers.col.lag": { en: "Events behind" },
+  "jobs.consumers.col.attempts": { en: "Attempts" },
+  "jobs.consumers.col.lastError": { en: "Last error" },
+  "jobs.consumers.field.instanceId": { en: "Instance" },
+  "jobs.consumers.field.updatedAt": { en: "Last change" },
+  "jobs.consumers.status.idle": { en: "Up to date" },
+  "jobs.consumers.status.processing": { en: "Running" },
+  "jobs.consumers.status.dead": { en: "Stopped by error" },
+  "jobs.consumers.status.disabled": { en: "Paused" },
+  "jobs.consumers.status.never-run": { en: "Not started yet" },
+  "jobs.consumers.instance.__shared__": { en: "Shared" },
+  "jobs.consumers.restart": { en: "Restart" },
+  "jobs.consumers.skip": { en: "Skip event" },
+  "jobs.consumers.skip.confirm": {
+    en: "The event that keeps failing is skipped and never delivered to this consumer, so its data may stay incomplete. Skip only if the event can never succeed.",
+  },
+  "jobs.consumers.disable": { en: "Pause" },
+  "jobs.consumers.enable": { en: "Resume" },
+  "jobs.errors.consumerUnknown": {
+    en: "This consumer has not run yet or does not exist.",
+  },
+  "jobs.errors.consumerWrongStatus": {
+    en: "The consumer is not in a state where this action applies. Reload and check its status.",
+  },
+  "jobs.errors.consumerNothingToSkip": {
+    en: "There is no failing event to skip.",
+  },
+  "jobs.errors.consumerTransitionFailed": {
+    en: "The consumer could not be changed. Try again; if it keeps failing, check the server log.",
+  },
   "jobs.runs.open": { en: "Details" },
   "jobs.runs.filter.status": { en: "Status" },
   "jobs.runs.filter.completed": { en: "Completed" },

package/packages/bundled-features/src/ledger/web/index.ts

@@ -1,7 +1,7 @@
 // Client-safe ledger surface: QN constants, the pure recurring helpers
 // (projection + Soll/Ist merge), and the Zod payload schemas (for client-side
 // pre-validation before dispatch) — nothing else. The full `../ledger` entry
-// re-exports the feature/handlers/executor, which pull bun-db/postgres — a
+// re-exports the feature/handlers/executor, which pull postgres-js — a
 // browser bundle that imports from there fails on Node builtins. A client screen
 // (e.g. a rent-cashflow view) imports the dispatch QNs + the pure forecast/merge
 // from HERE, then dispatches via the renderer's useDispatcher.

package/packages/bundled-features/src/notes-history/handlers/add-note.write.ts

@@ -69,7 +69,7 @@ export function createAddNoteHandler(
       let authorName: string | null = null;
       try {
         // read_users is tenant-agnostic → ctx.db.unsafeRaw, not the tenant-scoped ctx.db.
-        // Bun.SQL poisons the whole tx after any error inside it, even one that's
+        // postgres-js poisons the whole tx after any error inside it, even one that's
         // caught — so the lookup runs in a savepoint where available, otherwise directly
         // (pool statements are their own units).
         authorName = await runInSavepointIfSupported(ctx.db.unsafeRaw(), async (sp) => {

package/packages/bundled-features/src/personal-access-tokens/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.385.0",
+    "type": "improvement",
+    "title": "patScopeOptionKey for translating token scope labels",
+    "detail": "The scope labels personal-access-tokens generates from `scopes[domain].label` are English only. `patScopeOptionKey(domain, \"read\" | \"write\")` returns their translation key, so an app feature can add the other locales with `r.translations`.",
+    "migration": "Apps that mount personal-access-tokens and set `requiredLocales` with a locale other than `en` translate each generated scope label (`read`, plus `write` where the domain offers it) under `patScopeOptionKey`."
+  },
   {
     "version": "0.372.0",
     "type": "fix",

package/packages/bundled-features/src/personal-access-tokens/i18n.ts

@@ -8,6 +8,10 @@ const mintFieldKey = (field: string): string =>
 const scopeOptionKey = (grant: string): string =>
   fieldOptionLabelKey(PAT_FEATURE, ACTION_FORM_ENTITY, "scopes", grant);
 
+// The generated scope labels are English only; apps translate them under this key.
+export const patScopeOptionKey = (domain: string, level: "read" | "write"): string =>
+  scopeOptionKey(`${domain}:${level}`);
+
 type LocalizedString = { readonly en: string };
 
 export const PAT_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {

package/packages/bundled-features/src/personal-access-tokens/index.ts

@@ -8,6 +8,7 @@ export {
 } from "./feature.ts";
 export type { CreatePatOptions, PatMfaVerifyResult } from "./handlers/create.write.ts";
 export { hashPatToken, mintPatToken } from "./hash.ts";
+export { patScopeOptionKey } from "./i18n.ts";
 export {
   PAT_REVOKED_AGGREGATE_TYPE,
   PAT_REVOKED_EVENT_QN,

package/packages/bundled-features/src/secrets/i18n.ts

@@ -3,14 +3,11 @@ import { SECRETS_ERROR_KEYS } from "./web/constants.ts";
 export const SECRETS_I18N = {
   [SECRETS_ERROR_KEYS.unknownKey]: {
     en: "Unknown secret key.",
-    de: "Unbekannter Geheimnis-Schlüssel.",
   },
   [SECRETS_ERROR_KEYS.writeDenied]: {
     en: "You are not allowed to change this secret.",
-    de: "Dieses Geheimnis darf nicht geändert werden.",
   },
   [SECRETS_ERROR_KEYS.invalidValue]: {
     en: "This value is not valid for this secret.",
-    de: "Dieser Wert ist für dieses Geheimnis nicht gültig.",
   },
 } as const;

package/packages/bundled-features/src/sessions/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.384.0",
+    "type": "improvement",
+    "title": "Session lists show the device",
+    "detail": "The new subpath @cosmicdrift/kumiko-bundled-features/sessions/web exports sessionsClient(). Apps must add sessionsClient() to their client features to get the device column (browser and OS parsed from the user agent) and the translated \"This session\" cell; without it the screens fall back to the raw columns. The IP display is unchanged."
+  },
   {
     "version": "0.383.0",
     "type": "improvement",

package/packages/bundled-features/src/sessions/constants.ts

@@ -1,4 +1,6 @@
-export const SESSIONS_FEATURE = "sessions" as const;
+import { SESSIONS_FEATURE } from "./web/constants.ts";
+
+export { SESSIONS_FEATURE };
 export const USER_SESSION_ENTITY_NAME = "user-session" as const;
 
 // Qualified write handler names — entity prefix is "userSession", snake_case

package/packages/bundled-features/src/sessions/handlers/detail.query.ts

@@ -3,6 +3,7 @@ import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.ts";
 import { userSessionTable } from "../schema/user-session.ts";
+import { parsedDeviceSchema, parseUserAgent } from "../web/user-agent.ts";
 
 // Admin single-session inspector — mirrors list.query's decrypt handling for
 // the one-row case. ctx.db (TenantDb) applies tenant-scoping automatically.
@@ -14,6 +15,7 @@ const sessionRowSchema = z.object({
   revokedAt: z.unknown(),
   ip: z.string().nullable(),
   userAgent: z.string().nullable(),
+  device: parsedDeviceSchema,
 });
 
 export const createDetailQuery = (adminRoles: readonly string[] = access.admin) =>
@@ -37,6 +39,9 @@ export const createDetailQuery = (adminRoles: readonly string[] = access.admin)
         userAgent: string | null;
       }>(ctx.db, userSessionTable, { id: query.payload.id });
       if (!row) return null;
+      const userAgent = row.userAgent
+        ? await decryptStoredPii(row.userAgent, "userAgent", "sessions:detail")
+        : row.userAgent;
       return {
         id: row.id,
         userId: row.userId,
@@ -44,9 +49,8 @@ export const createDetailQuery = (adminRoles: readonly string[] = access.admin)
         expiresAt: row.expiresAt,
         revokedAt: row.revokedAt,
         ip: row.ip ? await decryptStoredPii(row.ip, "ip", "sessions:detail") : row.ip,
-        userAgent: row.userAgent
-          ? await decryptStoredPii(row.userAgent, "userAgent", "sessions:detail")
-          : row.userAgent,
+        userAgent,
+        device: parseUserAgent(userAgent),
       };
     },
   });

package/packages/bundled-features/src/sessions/handlers/list.query.ts

@@ -8,6 +8,7 @@ import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.ts";
 import { userSessionTable } from "../schema/user-session.ts";
+import { parsedDeviceSchema, parseUserAgent } from "../web/user-agent.ts";
 
 // `sort` arrives raw from the client's query string. selectMany's orderBy
 // has no column-existence check — an unrecognised field just gets
@@ -47,6 +48,7 @@ export const createListQuery = (adminRoles: readonly string[] = access.admin) =>
           revokedAt: z.unknown(),
           ip: z.string().nullable(),
           userAgent: z.string().nullable(),
+          device: parsedDeviceSchema,
         }),
       ),
       nextCursor: z.string().nullable(),
@@ -79,17 +81,21 @@ export const createListQuery = (adminRoles: readonly string[] = access.admin) =>
         ...(query.payload.limit !== undefined && { limit: query.payload.limit }),
       });
       const decryptedRows = await Promise.all(
-        rows.map(async (r) => ({
-          id: r.id,
-          userId: r.userId,
-          createdAt: r.createdAt,
-          expiresAt: r.expiresAt,
-          revokedAt: r.revokedAt,
-          ip: r.ip ? await decryptStoredPii(r.ip, "ip", "sessions:list") : r.ip,
-          userAgent: r.userAgent
+        rows.map(async (r) => {
+          const userAgent = r.userAgent
             ? await decryptStoredPii(r.userAgent, "userAgent", "sessions:list")
-            : r.userAgent,
-        })),
+            : r.userAgent;
+          return {
+            id: r.id,
+            userId: r.userId,
+            createdAt: r.createdAt,
+            expiresAt: r.expiresAt,
+            revokedAt: r.revokedAt,
+            ip: r.ip ? await decryptStoredPii(r.ip, "ip", "sessions:list") : r.ip,
+            userAgent,
+            device: parseUserAgent(userAgent),
+          };
+        }),
       );
       return { rows: decryptedRows, nextCursor: null };
     },