@saasicat/ui-vue 0.2.0

package/dist/testing-e2e/admin-pages-suite.cjs

@@ -0,0 +1,134 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/testing-e2e/admin-pages-suite.ts
+var admin_pages_suite_exports = {};
+__export(admin_pages_suite_exports, {
+  runAdminPagesSuite: () => runAdminPagesSuite
+});
+module.exports = __toCommonJS(admin_pages_suite_exports);
+var RESOURCE_FAILURE_MARKER = /Failed to load resource:/;
+function attachListeners(page, consoleAllowlist = [], networkAllowlist = []) {
+  const out = { pageErrors: [], consoleErrors: [], networkErrors: [] };
+  page.on("pageerror", (err) => out.pageErrors.push(err.message));
+  page.on("console", (msg) => {
+    if (msg.type() !== "error") return;
+    const text = msg.text();
+    if (RESOURCE_FAILURE_MARKER.test(text)) return;
+    if (consoleAllowlist.some((re) => re.test(text))) return;
+    out.consoleErrors.push(text);
+  });
+  page.on("response", (resp) => {
+    if (resp.status() < 400) return;
+    const url = resp.url();
+    if (!url.includes("/api/")) return;
+    if (networkAllowlist.some((re) => re.test(url))) return;
+    out.networkErrors.push(`HTTP ${resp.status()} ${url}`);
+  });
+  return out;
+}
+async function loginIfNeeded(page, config) {
+  if (!page.url().includes("/login")) {
+    await page.goto(config.loginUrl, { waitUntil: "networkidle" });
+  }
+  if (!page.url().includes("/login")) return;
+  await page.locator('input[type="email"]').first().fill(config.email);
+  const pw = page.locator('input[type="password"]').first();
+  await pw.fill(config.password);
+  await pw.press("Enter");
+  await page.waitForURL((u) => !u.toString().includes("/login"), {
+    timeout: 15e3
+  });
+}
+function runAdminPagesSuite(test, expect, config) {
+  const dashboardPath = config.dashboardPath ?? "/admin/";
+  test.describe(`${config.appName}: SuperAdmin-Pages Smoke`, () => {
+    for (const pageDef of config.pages) {
+      test(`${pageDef.name} rendert ohne Fehler`, async ({ page }) => {
+        const errors = attachListeners(
+          page,
+          config.consoleErrorAllowlist,
+          pageDef.allowedFailures
+        );
+        await loginIfNeeded(page, config);
+        const origin = new URL(config.loginUrl).origin;
+        await page.goto(`${origin}${pageDef.path}`, {
+          waitUntil: "networkidle",
+          timeout: 15e3
+        });
+        await page.waitForTimeout(800);
+        if (pageDef.expectVisible) {
+          await expect(page.locator(pageDef.expectVisible).first()).toBeVisible({
+            timeout: 5e3
+          });
+        }
+        expect(errors.pageErrors, `pageerror-Events auf ${pageDef.path}`).toHaveLength(0);
+        expect(
+          errors.consoleErrors,
+          `console.error-Events auf ${pageDef.path}`
+        ).toHaveLength(0);
+        expect(
+          errors.networkErrors,
+          `HTTP-Errors auf /api/ w\xE4hrend ${pageDef.path}`
+        ).toHaveLength(0);
+      });
+    }
+    test("Dashboard zeigt erwartete KPIs, Distributions und Shortcuts", async ({ page }) => {
+      attachListeners(page, config.consoleErrorAllowlist);
+      await loginIfNeeded(page, config);
+      const origin = new URL(config.loginUrl).origin;
+      await page.goto(`${origin}${dashboardPath}`, {
+        waitUntil: "networkidle",
+        timeout: 15e3
+      });
+      const kpiLabels = await page.locator(".sa-kpi__label").allTextContents();
+      const normalizedKpis = kpiLabels.map((s) => s.trim());
+      for (const expected of config.expectedKpiLabels) {
+        expect(normalizedKpis, `KPI '${expected}' fehlt auf Dashboard`).toContain(expected);
+      }
+      if (config.expectedDistributionTitles?.length) {
+        const distTitles = await page.locator(".sa-dashboard__row-head h2").allTextContents();
+        const normalizedDist = distTitles.map((s) => s.trim());
+        for (const expected of config.expectedDistributionTitles) {
+          expect(
+            normalizedDist,
+            `Distribution '${expected}' fehlt auf Dashboard`
+          ).toContain(expected);
+        }
+      }
+      const shortcutTitles = await page.locator(".sa-dashboard__shortcut-title").allTextContents();
+      const normalizedShortcuts = shortcutTitles.map((s) => s.trim());
+      for (const expected of config.expectedShortcutTitles) {
+        expect(normalizedShortcuts, `Shortcut '${expected}' fehlt auf Dashboard`).toContain(
+          expected
+        );
+      }
+      for (const forbidden of config.forbiddenShortcutTitles ?? []) {
+        expect(
+          normalizedShortcuts,
+          `Shortcut '${forbidden}' darf nicht auf Dashboard sein`
+        ).not.toContain(forbidden);
+      }
+    });
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  runAdminPagesSuite
+});

package/dist/testing-e2e/admin-pages-suite.d.cts

@@ -0,0 +1,37 @@
+import { test, expect } from '@playwright/test';
+
+interface AdminPagesSuiteConfig {
+    /** Display name, e.g. 'demoapp' / 'clubapp'. */
+    appName: string;
+    /** URL of the login page (full). */
+    loginUrl: string;
+    /** Test account. */
+    email: string;
+    password: string;
+    /** Paths the smoke test should click through. */
+    pages: ReadonlyArray<{
+        /** Display name in the test description. */
+        name: string;
+        /** Path relative to the origin (e.g. '/admin/tenants'). */
+        path: string;
+        /** Optional: if set, check that this selector exists. */
+        expectVisible?: string;
+        /** Optional: HTTP patterns that are OK as 4xx/5xx (e.g. missing backend endpoints). */
+        allowedFailures?: readonly RegExp[];
+    }>;
+    /** Expected KPI card labels on the dashboard page. */
+    expectedKpiLabels: readonly string[];
+    /** Expected distribution section titles. */
+    expectedDistributionTitles?: readonly string[];
+    /** Expected shortcut titles on the dashboard. */
+    expectedShortcutTitles: readonly string[];
+    /** Shortcuts that must NOT appear (e.g. "Dashboard"). */
+    forbiddenShortcutTitles?: readonly string[];
+    /** Console error patterns that should be ignored. */
+    consoleErrorAllowlist?: readonly RegExp[];
+    /** Path to the dashboard page (default `/admin/`). */
+    dashboardPath?: string;
+}
+declare function runAdminPagesSuite(test: typeof test, expect: typeof expect, config: AdminPagesSuiteConfig): void;
+
+export { type AdminPagesSuiteConfig, runAdminPagesSuite };

package/dist/testing-e2e/admin-pages-suite.d.ts

@@ -0,0 +1,37 @@
+import { test, expect } from '@playwright/test';
+
+interface AdminPagesSuiteConfig {
+    /** Display name, e.g. 'demoapp' / 'clubapp'. */
+    appName: string;
+    /** URL of the login page (full). */
+    loginUrl: string;
+    /** Test account. */
+    email: string;
+    password: string;
+    /** Paths the smoke test should click through. */
+    pages: ReadonlyArray<{
+        /** Display name in the test description. */
+        name: string;
+        /** Path relative to the origin (e.g. '/admin/tenants'). */
+        path: string;
+        /** Optional: if set, check that this selector exists. */
+        expectVisible?: string;
+        /** Optional: HTTP patterns that are OK as 4xx/5xx (e.g. missing backend endpoints). */
+        allowedFailures?: readonly RegExp[];
+    }>;
+    /** Expected KPI card labels on the dashboard page. */
+    expectedKpiLabels: readonly string[];
+    /** Expected distribution section titles. */
+    expectedDistributionTitles?: readonly string[];
+    /** Expected shortcut titles on the dashboard. */
+    expectedShortcutTitles: readonly string[];
+    /** Shortcuts that must NOT appear (e.g. "Dashboard"). */
+    forbiddenShortcutTitles?: readonly string[];
+    /** Console error patterns that should be ignored. */
+    consoleErrorAllowlist?: readonly RegExp[];
+    /** Path to the dashboard page (default `/admin/`). */
+    dashboardPath?: string;
+}
+declare function runAdminPagesSuite(test: typeof test, expect: typeof expect, config: AdminPagesSuiteConfig): void;
+
+export { type AdminPagesSuiteConfig, runAdminPagesSuite };

package/dist/testing-e2e/admin-pages-suite.js

@@ -0,0 +1,109 @@
+// src/testing-e2e/admin-pages-suite.ts
+var RESOURCE_FAILURE_MARKER = /Failed to load resource:/;
+function attachListeners(page, consoleAllowlist = [], networkAllowlist = []) {
+  const out = { pageErrors: [], consoleErrors: [], networkErrors: [] };
+  page.on("pageerror", (err) => out.pageErrors.push(err.message));
+  page.on("console", (msg) => {
+    if (msg.type() !== "error") return;
+    const text = msg.text();
+    if (RESOURCE_FAILURE_MARKER.test(text)) return;
+    if (consoleAllowlist.some((re) => re.test(text))) return;
+    out.consoleErrors.push(text);
+  });
+  page.on("response", (resp) => {
+    if (resp.status() < 400) return;
+    const url = resp.url();
+    if (!url.includes("/api/")) return;
+    if (networkAllowlist.some((re) => re.test(url))) return;
+    out.networkErrors.push(`HTTP ${resp.status()} ${url}`);
+  });
+  return out;
+}
+async function loginIfNeeded(page, config) {
+  if (!page.url().includes("/login")) {
+    await page.goto(config.loginUrl, { waitUntil: "networkidle" });
+  }
+  if (!page.url().includes("/login")) return;
+  await page.locator('input[type="email"]').first().fill(config.email);
+  const pw = page.locator('input[type="password"]').first();
+  await pw.fill(config.password);
+  await pw.press("Enter");
+  await page.waitForURL((u) => !u.toString().includes("/login"), {
+    timeout: 15e3
+  });
+}
+function runAdminPagesSuite(test, expect, config) {
+  const dashboardPath = config.dashboardPath ?? "/admin/";
+  test.describe(`${config.appName}: SuperAdmin-Pages Smoke`, () => {
+    for (const pageDef of config.pages) {
+      test(`${pageDef.name} rendert ohne Fehler`, async ({ page }) => {
+        const errors = attachListeners(
+          page,
+          config.consoleErrorAllowlist,
+          pageDef.allowedFailures
+        );
+        await loginIfNeeded(page, config);
+        const origin = new URL(config.loginUrl).origin;
+        await page.goto(`${origin}${pageDef.path}`, {
+          waitUntil: "networkidle",
+          timeout: 15e3
+        });
+        await page.waitForTimeout(800);
+        if (pageDef.expectVisible) {
+          await expect(page.locator(pageDef.expectVisible).first()).toBeVisible({
+            timeout: 5e3
+          });
+        }
+        expect(errors.pageErrors, `pageerror-Events auf ${pageDef.path}`).toHaveLength(0);
+        expect(
+          errors.consoleErrors,
+          `console.error-Events auf ${pageDef.path}`
+        ).toHaveLength(0);
+        expect(
+          errors.networkErrors,
+          `HTTP-Errors auf /api/ w\xE4hrend ${pageDef.path}`
+        ).toHaveLength(0);
+      });
+    }
+    test("Dashboard zeigt erwartete KPIs, Distributions und Shortcuts", async ({ page }) => {
+      attachListeners(page, config.consoleErrorAllowlist);
+      await loginIfNeeded(page, config);
+      const origin = new URL(config.loginUrl).origin;
+      await page.goto(`${origin}${dashboardPath}`, {
+        waitUntil: "networkidle",
+        timeout: 15e3
+      });
+      const kpiLabels = await page.locator(".sa-kpi__label").allTextContents();
+      const normalizedKpis = kpiLabels.map((s) => s.trim());
+      for (const expected of config.expectedKpiLabels) {
+        expect(normalizedKpis, `KPI '${expected}' fehlt auf Dashboard`).toContain(expected);
+      }
+      if (config.expectedDistributionTitles?.length) {
+        const distTitles = await page.locator(".sa-dashboard__row-head h2").allTextContents();
+        const normalizedDist = distTitles.map((s) => s.trim());
+        for (const expected of config.expectedDistributionTitles) {
+          expect(
+            normalizedDist,
+            `Distribution '${expected}' fehlt auf Dashboard`
+          ).toContain(expected);
+        }
+      }
+      const shortcutTitles = await page.locator(".sa-dashboard__shortcut-title").allTextContents();
+      const normalizedShortcuts = shortcutTitles.map((s) => s.trim());
+      for (const expected of config.expectedShortcutTitles) {
+        expect(normalizedShortcuts, `Shortcut '${expected}' fehlt auf Dashboard`).toContain(
+          expected
+        );
+      }
+      for (const forbidden of config.forbiddenShortcutTitles ?? []) {
+        expect(
+          normalizedShortcuts,
+          `Shortcut '${forbidden}' darf nicht auf Dashboard sein`
+        ).not.toContain(forbidden);
+      }
+    });
+  });
+}
+export {
+  runAdminPagesSuite
+};

package/package.json

@@ -0,0 +1,87 @@
+{
+  "name": "@saasicat/ui-vue",
+  "version": "0.2.0",
+  "description": "Vue 3 components + composables for the SuperAdmin UI shell. Provides boot loader, manifest loader (ETag cache), nav builder, action registry and standard pages.",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./pages/*": "./src/pages-standard/*",
+    "./pages-standard/*": "./src/pages-standard/*",
+    "./pages-tenant/*": "./src/pages-tenant/*",
+    "./components/*": "./src/components/*",
+    "./sa-theme.css": "./src/pages-standard/sa-theme.css",
+    "./testing-e2e/*": {
+      "types": "./dist/testing-e2e/*.d.ts",
+      "import": "./dist/testing-e2e/*.js",
+      "require": "./dist/testing-e2e/*.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "dependencies": {
+    "@saasicat/types": "^0.2.0"
+  },
+  "peerDependencies": {
+    "pinia": "^2.0.0 || ^3.0.0",
+    "quasar": "^2.18.0",
+    "vue": "^3.5.0",
+    "vue-router": "^4.5.0 || ^5.0.0"
+  },
+  "peerDependenciesMeta": {
+    "pinia": {
+      "optional": true
+    },
+    "quasar": {
+      "optional": true
+    },
+    "vue-router": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.59.1",
+    "@types/node": "^25.6.0",
+    "pinia": "^3.0.0",
+    "quasar": "^2.18.0",
+    "tsup": "^8.0.0",
+    "typescript": "^6.0.0",
+    "vue": "^3.5.0",
+    "vue-router": "^5.0.0",
+    "vue-tsc": "^3.3.3"
+  },
+  "license": "Apache-2.0",
+  "author": "Taci Uelker",
+  "homepage": "https://github.com/uelker70/saasicat",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/uelker70/saasicat.git",
+    "directory": "packages/saas-platform-ui-vue"
+  },
+  "bugs": {
+    "url": "https://github.com/uelker70/saasicat/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm,cjs --dts --clean --external @saasicat/types --external vue --external vue-router --external pinia --external quasar && tsup src/testing-e2e/admin-pages-suite.ts --format esm,cjs --dts --out-dir dist/testing-e2e --external @playwright/test",
+    "typecheck": "vue-tsc --noEmit -p tsconfig.json",
+    "pretest": "pnpm run build",
+    "test": "node --test tests/**/*.test.js",
+    "test:e2e": "playwright test"
+  }
+}

package/src/action-registry.ts

@@ -0,0 +1,110 @@
+// ActionRegistry — central dispatch for `TenantActionDef`-declared
+// operations.
+//
+// The consumer shell registers an `actions:` map with
+// `actionKey → ActionHandler` bindings. When the manifest action declares
+// e.g. `actionKey: 'TENANT_SUSPEND'`, the shell must provide a handler under
+// the same key — otherwise `dispatch` throws a `MissingHandlerError` with a
+// clear diagnostic.
+//
+// MFA prompt + confirm modal stay consumer-specific (Quasar dialog,
+// headless UI etc.); the registry only supplies the action-definition pair
+// `{def, handler}` so the shell UI layer can trigger the appropriate
+// pre-flow.
+
+import type { AdminManifest, TenantActionDef } from '@saasicat/types';
+
+/** Consumer implementation; receives the action inputs as a generic object. */
+export type ActionHandler<TInput = unknown, TResult = unknown> = (
+    input: TInput,
+) => Promise<TResult>;
+
+export interface ResolvedAction<TInput = unknown, TResult = unknown> {
+    def: TenantActionDef;
+    handler: ActionHandler<TInput, TResult>;
+}
+
+export class MissingHandlerError extends Error {
+    constructor(actionKey: string) {
+        super(
+            `Kein Handler für actionKey "${actionKey}" registriert. ` +
+                `Konsument-Shell muss \`actions["${actionKey}"]\` bereitstellen.`,
+        );
+        this.name = 'MissingHandlerError';
+    }
+}
+
+export class ActionDefNotInManifestError extends Error {
+    constructor(actionKey: string) {
+        super(
+            `actionKey "${actionKey}" ist im Manifest nicht deklariert. ` +
+                `Bitte als TenantAction in einer ManifestContribution registrieren.`,
+        );
+        this.name = 'ActionDefNotInManifestError';
+    }
+}
+
+export class ActionRegistry {
+    private readonly defs: Map<string, TenantActionDef> = new Map();
+    private readonly handlers: Map<string, ActionHandler> = new Map();
+
+    constructor(manifest: AdminManifest, handlers: Record<string, ActionHandler> = {}) {
+        for (const def of manifest.tenants?.actions ?? []) {
+            this.defs.set(def.actionKey, def);
+        }
+        for (const [key, handler] of Object.entries(handlers)) {
+            this.handlers.set(key, handler);
+        }
+    }
+
+    /**
+     * Registers a handler after the fact (e.g. when consumer code loads
+     * lazily). Throws `ActionDefNotInManifestError` if the `actionKey` is not
+     * declared in the manifest — prevents dead registrations.
+     */
+    register<TInput, TResult>(actionKey: string, handler: ActionHandler<TInput, TResult>): void {
+        if (!this.defs.has(actionKey)) {
+            throw new ActionDefNotInManifestError(actionKey);
+        }
+        this.handlers.set(actionKey, handler as ActionHandler);
+    }
+
+    /**
+     * Returns the `{def, handler}` pair. Throws if the key is missing from
+     * the manifest or no handler is registered. The shell's UI layer calls
+     * the method, checks `def.requiresMfa` / `def.confirmType` for the
+     * pre-flow, and then calls `handler(input)`.
+     */
+    get<TInput = unknown, TResult = unknown>(actionKey: string): ResolvedAction<TInput, TResult> {
+        const def = this.defs.get(actionKey);
+        if (!def) throw new ActionDefNotInManifestError(actionKey);
+        const handler = this.handlers.get(actionKey);
+        if (!handler) throw new MissingHandlerError(actionKey);
+        return { def, handler: handler as ActionHandler<TInput, TResult> };
+    }
+
+    /**
+     * Convenience: `get(key).handler(input)`. UI convenience for actions
+     * that need neither MFA nor confirm.
+     */
+    async dispatch<TInput, TResult>(actionKey: string, input: TInput): Promise<TResult> {
+        return this.get<TInput, TResult>(actionKey).handler(input);
+    }
+
+    /**
+     * List of actionKeys that are declared in the manifest but have no
+     * handler. Consumers use this in a doctor check to detect drift between
+     * the manifest and the shell build.
+     */
+    listOrphanedDefs(): string[] {
+        return [...this.defs.keys()].filter((k) => !this.handlers.has(k));
+    }
+
+    /**
+     * List of registered handlers that are missing from the manifest. Drift
+     * in the other direction.
+     */
+    listOrphanedHandlers(): string[] {
+        return [...this.handlers.keys()].filter((k) => !this.defs.has(k));
+    }
+}

package/src/batch-column-fetcher.ts

@@ -0,0 +1,152 @@
+// BatchColumnFetcher — loads custom TenantColumn data in ONE request per
+// column (required by SPEC §4.6: no N+1 for the tenant page table).
+//
+// Manifest contract: every `TenantColumnDef.endpoint` MUST be batch-capable —
+// no `{slug}` or `{tenantId}` placeholder in the path. The fetcher appends
+// `?tenantIds=t1,t2,...,tN` (or `tenantIds=t1&tenantIds=t2&...` — the
+// `paramStyle` option picks the format) and expects a response of the form
+// `Record<tenantId, value>`.
+//
+// Capability filter: columns without a satisfied `requiredCapability` are not
+// fetched at all. Manifest drift (a column `endpoint` with a `{slug}` pattern)
+// is reported in a structured way via `BatchColumnDriftError` — the consumer
+// shell then renders a warning.
+
+import type { AdminManifest, TenantColumnDef } from '@saasicat/types';
+import { defaultHttpClient, type HttpClient } from './types.js';
+
+export type BatchColumnValue = unknown;
+
+/** One value per `tenantId` (freely structured). */
+export type BatchColumnRow = Record<string, BatchColumnValue>;
+
+/** One `tenantId → value` map per column key. */
+export type BatchColumnData = Record<string, BatchColumnRow>;
+
+export type ParamStyle = 'comma' | 'repeat';
+
+export interface BatchColumnFetcherOptions {
+    http?: HttpClient;
+    /**
+     * How the `tenantIds` are passed to the endpoint. Default `'comma'` →
+     * `?tenantIds=t1,t2,t3`. `'repeat'` → `?tenantIds=t1&tenantIds=t2`.
+     * Consumer backends decide based on their framework (NestJS accepts
+     * comma-separated strings by default, or via `@Query() ids: string[]`).
+     */
+    paramStyle?: ParamStyle;
+    /**
+     * Auth-token provider for `Authorization: Bearer <token>`. The consumer
+     * supplies a function that pulls the current token from the auth store.
+     */
+    getAuthToken?: () => string | null;
+}
+
+export class BatchColumnDriftError extends Error {
+    constructor(
+        public readonly column: TenantColumnDef,
+        reason: string,
+    ) {
+        super(`Spalte "${column.key}": ${reason}`);
+        this.name = 'BatchColumnDriftError';
+    }
+}
+
+export class BatchColumnFetcher {
+    private readonly http: HttpClient;
+    private readonly paramStyle: ParamStyle;
+    private readonly getAuthToken?: () => string | null;
+
+    constructor(options: BatchColumnFetcherOptions = {}) {
+        this.http = options.http ?? defaultHttpClient();
+        this.paramStyle = options.paramStyle ?? 'comma';
+        this.getAuthToken = options.getAuthToken;
+    }
+
+    /**
+     * Loads the data for all columns declared in the manifest in parallel
+     * (one request per column, all `tenantIds` in the batch). Columns without
+     * a satisfied capability are ignored.
+     */
+    async fetchAll(manifest: AdminManifest, tenantIds: string[]): Promise<BatchColumnData> {
+        if (tenantIds.length === 0) return {};
+        const cols = this.eligibleColumns(manifest);
+        const results = await Promise.all(
+            cols.map((col) =>
+                this.fetchOne(col, tenantIds).then((data) => [col.key, data] as const),
+            ),
+        );
+        const out: BatchColumnData = {};
+        for (const [key, data] of results) out[key] = data;
+        return out;
+    }
+
+    /** Fetch a single column (consumers may also use this directly). */
+    async fetchOne(column: TenantColumnDef, tenantIds: string[]): Promise<BatchColumnRow> {
+        this.validateBatchEndpoint(column);
+        if (tenantIds.length === 0) return {};
+        const url = this.buildUrl(column.endpoint, tenantIds);
+        const headers: Record<string, string> = {};
+        const token = this.getAuthToken?.();
+        if (token) headers.Authorization = `Bearer ${token}`;
+        const res = await this.http(url, { method: 'GET', headers });
+        if (res.status !== 200) {
+            throw new Error(
+                `Spalte "${column.key}" — Endpoint ${column.endpoint} antwortete HTTP ${res.status}`,
+            );
+        }
+        const body = (await res.json()) as BatchColumnRow;
+        return body;
+    }
+
+    /**
+     * Column drift against the manifest. Consumers use this for CI smoke
+     * tests of the manifest-vs-shell build.
+     */
+    listDriftIssues(manifest: AdminManifest): BatchColumnDriftError[] {
+        const issues: BatchColumnDriftError[] = [];
+        for (const col of manifest.tenants?.columns ?? []) {
+            try {
+                this.validateBatchEndpoint(col);
+            } catch (err) {
+                if (err instanceof BatchColumnDriftError) issues.push(err);
+            }
+        }
+        return issues;
+    }
+
+    /**
+     * Which columns have a satisfied `requiredCapability`? Manifest =
+     * discovery, so a local check is enough.
+     */
+    eligibleColumns(manifest: AdminManifest): TenantColumnDef[] {
+        const caps = manifest.capabilities ?? {};
+        return (manifest.tenants?.columns ?? []).filter((col) => {
+            if (!col.requiredCapability) return true;
+            return caps[col.requiredCapability] === true;
+        });
+    }
+
+    private validateBatchEndpoint(col: TenantColumnDef): void {
+        if (!col.endpoint || col.endpoint.trim().length === 0) {
+            throw new BatchColumnDriftError(col, 'endpoint ist leer');
+        }
+        if (col.endpoint.includes('{slug}') || col.endpoint.includes('{tenantId}')) {
+            throw new BatchColumnDriftError(
+                col,
+                'endpoint enthält per-Tenant-Placeholder ({slug}/{tenantId}). ' +
+                    'Spalten-Endpoints müssen batchfähig sein — bitte Backend ' +
+                    'auf `?tenantIds=...`-Parameter umstellen.',
+            );
+        }
+    }
+
+    private buildUrl(endpoint: string, tenantIds: string[]): string {
+        const sep = endpoint.includes('?') ? '&' : '?';
+        if (this.paramStyle === 'comma') {
+            const enc = tenantIds.map(encodeURIComponent).join(',');
+            return `${endpoint}${sep}tenantIds=${enc}`;
+        }
+        const params = tenantIds.map((id) => `tenantIds=${encodeURIComponent(id)}`).join('&');
+        return `${endpoint}${sep}${params}`;
+    }
+}