Phase1: Schema + skill event tracking

Threema UX: static file middleware fix, *AIAGENT display, info banner
2026-05-23 23:50:42 +02:00 · 2026-05-23 23:45:04 +02:00 · 2026-05-17 17:29:25 +02:00 · 2026-05-17 17:13:44 +02:00 · 2026-05-17 16:50:23 +02:00 · 2026-05-17 11:10:40 +02:00
28 changed files with 3078 additions and 209 deletions
--- a/.env.example
+++ b/.env.example
@@ -17,3 +17,7 @@ LITELLM_MASTER_KEY=

 # Portal Database (CloudNativePG)
 DATABASE_URL=postgresql://portal:${PORTAL_DB_PASSWORD}@portal-db-rw.pieced-system.svc:5432/portal
+
+# Threema relay (central pieced-threema-gateway)
+THREEMA_RELAY_URL=http://pieced-threema-gateway.threema-gateway.svc:8080
+THREEMA_RELAY_ADMIN_TOKEN=__from_openbao__
--- a/README.md
+++ b/README.md
@@ -1,100 +1,273 @@
-# PieCed Portal
+# PieCed Portal — Billing Phase 1 (drop-in replacement)

-Customer self-service portal for the PieCed IT multi-tenant OpenClaw platform.
+Schema + event tracking. No UI yet (that lands in Phase 2).
+This zip mirrors the `pieced-portal/` repo root — extract over your
+existing source tree to apply.

-## Stack
+**v2 fix:** stripped stray backticks from SQL comments that were
+closing the `MIGRATION_SQL` template literal early. If you got
+"Expected a semicolon" at db.ts:335 with v1, this build is the fix.

-| Layer | Choice |
-|-------|--------|
-| Framework | Next.js 15 LTS (App Router, standalone output, Turbopack) |
-| Auth | NextAuth v5 + ZITADEL OIDC (CODE flow) |
-| Tenant mgmt | Direct K8s API → `PiecedTenant` CRs (Option A) |
-| Usage data | LiteLLM `/team/info` + `/global/spend/logs` |
-| i18n | next-intl 4.x (en/de) |
-| Styling | Tailwind CSS 4 |
-| Deployment | Container in `pieced-system`, exposed at `app.pieced.ch` |
+---

-## Setup
-
-### 1. ZITADEL Application
-
-In ZITADEL console (`auth.pieced.ch`), project "OpenClaw Platform":
-
-1. Create Application → **PieCed Portal** → Web → Authentication Method: **CODE**
-2. Redirect URI: `https://app.pieced.ch/api/auth/callback/zitadel`
-3. Post-logout URI: `https://app.pieced.ch/login`
-4. Note Client ID and Client Secret
-
-### 2. OpenBao Secrets
-
-```bash
-bao kv put pieced/portal/oidc \
-  client_id="<from step 1>" \
-  client_secret="<from step 1>" \
-  nextauth_secret="$(openssl rand -base64 32)"
-```
-
-### 3. Build & Push
-
-```bash
-docker build -t registry.c5ai.ch/pieced/pieced-portal:0.1.0 .
-docker push registry.c5ai.ch/pieced/pieced-portal:0.1.0
-```
-
-Update image tag in `pieced-gitops/apps/portal/deployment.yaml`, push, ArgoCD syncs.
-
-### 4. DNS
-
-Ensure `app.pieced.ch` A record → MetalLB ingress IP (or ExternalDNS handles it).
-
-## Local Development
-
-```bash
-cp .env.example .env.local
-# Fill in values — K8s client uses ~/.kube/config locally
-npm install
-npm run dev
-```
-
-## Project Structure
+## Files in this drop

 ```
-src/
-├── app/
-│   ├── api/
-│   │   ├── auth/[...nextauth]/route.ts   # NextAuth handler
-│   │   ├── tenants/route.ts              # Tenant CRUD (K8s API)
-│   │   └── usage/route.ts                # Usage stub
-│   ├── [locale]/
-│   │   ├── layout.tsx                    # Locale layout + NavShell
-│   │   ├── page.tsx                      # Redirect → /dashboard
-│   │   ├── login/page.tsx                # ZITADEL sign-in
-│   │   ├── dashboard/page.tsx            # Customer dashboard
-│   │   └── admin/page.tsx                # Platform admin tenant list
-│   ├── layout.tsx                        # Root layout
-│   └── globals.css                       # Tailwind 4 theme
-├── components/
-│   ├── layout/nav-shell.tsx              # Header + navigation
-│   └── ui/                               # Reusable UI components
-├── i18n/
-│   ├── routing.ts                        # next-intl 4.x routing config
-│   ├── navigation.ts                     # Localized Link, redirect, etc.
-│   └── request.ts                        # Server-side i18n config
-├── lib/
-│   ├── auth.ts                           # NextAuth v5 + ZITADEL config
-│   ├── k8s.ts                            # K8s client for PiecedTenant CRs
-│   ├── litellm.ts                        # LiteLLM API client
-│   └── session.ts                        # Session helpers
-├── messages/
-│   ├── en.json
-│   └── de.json
-└── types/index.ts                        # Shared TypeScript types
+src/lib/db.ts                                                  MODIFIED
+src/types/index.ts                                             MODIFIED
+src/app/api/admin/requests/[id]/approve/route.ts               MODIFIED
+src/app/api/tenants/[name]/route.ts                            MODIFIED
+src/app/api/tenants/[name]/suspend/route.ts                    MODIFIED
+src/app/api/admin/tenants/[name]/delete/route.ts               MODIFIED
+src/app/api/admin/billing/backfill/route.ts                    NEW
 ```

-## Session Roadmap
+No `package.json` changes — Phase 1 uses only deps already present.

- **6.1** ← This session: scaffold, auth, basic pages
- **6.2**: Instance management, package config, usage display
- **6.3**: Onboarding flow (create ZITADEL org → PiecedTenant CR)
- **6.4**: Workspace editor (SOUL.md, AGENTS.md, TOOLS.md)
- **6.5**: Admin panel (tenant lifecycle, billing overview)
+### What changed
+
+`src/lib/db.ts`
+  - Extended `MIGRATION_SQL` with 11 new tables (idempotent — uses
+    `CREATE TABLE IF NOT EXISTS`)
+  - Added a new "Billing — Phase 1" section at the bottom with ~25
+    helper functions
+
+`src/types/index.ts`
+  - 6 new interfaces appended at the bottom
+
+`src/app/api/admin/requests/[id]/approve/route.ts`
+  - Imports `recordTenantCreated`, `recordSkillEvents`,
+    `recordSuspensionEvent` from `@/lib/db`
+  - Resume path: records a `resumed` suspension event after
+    `patchTenantSpec({suspend: false})`
+  - Provision path: records `recordTenantCreated` + initial
+    `enabled` events after `createTenant`
+
+`src/app/api/tenants/[name]/route.ts`
+  - Imports `recordSkillEvents`
+  - After `patchTenantSpec` succeeds and the patch touched
+    `packages`, computes the diff (added/removed) and writes events.
+    Diff is computed against the patched CR (the returned state)
+    so events match what K8s committed.
+
+`src/app/api/tenants/[name]/suspend/route.ts`
+  - Imports `recordSuspensionEvent`
+  - Records `suspended` or `resumed` after the patch succeeds
+
+`src/app/api/admin/tenants/[name]/delete/route.ts`
+  - Imports `recordTenantDeleted`
+  - Stamps `deleted_at` on the lifecycle row after `deleteTenant`
+
+`src/app/api/admin/billing/backfill/route.ts` (new)
+  - `POST /api/admin/billing/backfill` — platform-only, idempotent
+  - Reads every live PiecedTenant CR, mirrors creationTimestamp,
+    current `spec.packages`, and `status.suspendedAt` into the new
+    tables. Run once after deploy to bootstrap historical data.
+
+### Tables added (Postgres, all idempotent)
+
+```
+platform_pricing            single-row pricing config
+skill_pricing               per-package daily price (optional)
+tenant_billing_lifecycle    per-tenant created_at + deleted_at
+tenant_skill_events         append-only enable/disable log
+tenant_suspension_events    append-only suspend/resume log
+org_billing_config          per-org billing posture (pay-by-invoice,
+                            stripe id, auto-cron toggles)
+org_payment_methods         Stripe payment methods (Phase 4)
+invoice_number_counters     gapless per-year counter
+invoices                    immutable issued invoices (Phase 2)
+invoice_lines               invoice line items (Phase 2)
+invoice_reminders           sent reminders + their PDFs (Phase 6)
+```
+
+The invoice/lines/reminders tables ship now so Phase 2 doesn't need
+a second migration, but no code writes to them until Phase 2.
+
+### Design properties
+
+* Every billing-tracking call is wrapped in `try/catch`. A logging
+  failure never blocks the K8s operation.
+* PATCH-diff is computed against the *returned* CR state, not the
+  pre-patch state, so events match what K8s actually committed.
+* Event tables are append-only. Historical billing can be
+  recomputed reproducibly.
+* `tenant_billing_lifecycle` mirrors created_at + deleted_at so
+  deleted tenants still have a final-invoice anchor.
+* All money is `NUMERIC`: 10,2 for CHF amounts, 10,5 for per-unit
+  prices.
+
+---
+
+## Deploy
+
+1. Extract this zip over your `pieced-portal/` source tree
+2. Build & push:
+   ```
+   ./buildanddeploy.sh    # or your usual flow
+   ```
+3. Bump the image tag in `gitops/apps/portal/deployment.yaml`,
+   commit, push. ArgoCD picks it up.
+4. On pod boot, the next DB query auto-runs `MIGRATION_SQL` (your
+   existing `ensureSchema` pattern). No manual `psql` needed.
+
+---
+
+## Testing (in order — don't skip steps)
+
+### Step 1 — Migration ran
+
+After the new pod is `Ready`, exec into the portal DB and verify
+all 11 new tables exist:
+
+```
+kubectl -n portal exec -it portal-db-1 -- \
+  psql -U portal -d portal -c "\dt"
+```
+
+You should see the new tables alongside the existing ones.
+
+Sanity-check the single-row pricing config seed:
+
+```
+kubectl -n portal exec -it portal-db-1 -- \
+  psql -U portal -d portal -c "SELECT * FROM platform_pricing;"
+```
+
+Expected: one row, all zeros, vat_rate_chli=8.10.
+
+### Step 2 — Backfill existing tenants
+
+Run the backfill once. From a logged-in admin browser tab DevTools
+console:
+
+```js
+await fetch('/api/admin/billing/backfill', { method: 'POST' })
+  .then(r => r.json())
+```
+
+Expected response (numbers will vary):
+```
+{
+  "message": "Backfill complete.",
+  "tenantsExamined": 4,
+  "lifecycleInserted": 4,
+  "eventsInserted": 12,
+  "suspensionEventsInserted": 0
+}
+```
+
+Run it a SECOND time — all three "Inserted" counts should be 0
+(idempotency check).
+
+### Step 3 — Verify backfill data
+
+```
+kubectl -n portal exec -it portal-db-1 -- psql -U portal -d portal
+```
+
+```sql
+SELECT tenant_name, zitadel_org_id, created_at, deleted_at
+  FROM tenant_billing_lifecycle ORDER BY created_at;
+
+SELECT tenant_name, skill_id, event_kind, occurred_at
+  FROM tenant_skill_events ORDER BY tenant_name, occurred_at;
+```
+
+Cross-check against the live CR:
+```
+kubectl get piecedtenants -o jsonpath='{range .items[*]}{.metadata.name}{": "}{.spec.packages}{"\n"}{end}'
+```
+
+Every package currently in `spec.packages` should have a matching
+`enabled` event row.
+
+### Step 4 — Live skill toggle
+
+From the customer-facing tenant detail page, enable a package not
+previously present (e.g. `searxng-local-search`):
+
+```sql
+SELECT * FROM tenant_skill_events
+ WHERE tenant_name = 'your-test-tenant'
+ ORDER BY id DESC LIMIT 3;
+```
+
+Expect a fresh `enabled` row. Disable the package → expect a
+`disabled` row on top.
+
+### Step 5 — Live suspend toggle
+
+Cancel a test tenant from the customer-side button:
+
+```sql
+SELECT * FROM tenant_suspension_events
+ WHERE tenant_name = 'your-test-tenant'
+ ORDER BY id DESC LIMIT 3;
+```
+
+Expect a `suspended` row. Resume via the admin approval flow →
+expect a `resumed` row.
+
+### Step 6 — Live delete
+
+Delete a test tenant from the admin panel:
+
+```sql
+SELECT tenant_name, created_at, deleted_at
+  FROM tenant_billing_lifecycle
+ WHERE tenant_name = 'your-deleted-tenant';
+```
+
+`deleted_at` should be stamped with roughly "now".
+
+### Step 7 — Pricing rows survive (optional)
+
+Direct-INSERT a price into `platform_pricing` and `skill_pricing`,
+restart the portal pod, confirm rows survive:
+
+```sql
+UPDATE platform_pricing
+   SET tenant_monthly_fee_chf = 49.00,
+       tenant_setup_fee_chf   = 99.00,
+       threema_message_chf    = 0.005
+ WHERE id = 1;
+
+INSERT INTO skill_pricing (skill_id, daily_price_chf)
+VALUES ('searxng-local-search', 0.10)
+ON CONFLICT (skill_id) DO UPDATE
+   SET daily_price_chf = EXCLUDED.daily_price_chf;
+```
+
+No application behaviour changes from these — they're inert until
+Phase 2 starts computing invoices.
+
+---
+
+## Rollback
+
+The migration is additive — no existing columns/tables touched.
+To roll back:
+
+1. Re-deploy the previous portal image (revert the tag in gitops)
+2. New tables remain in the DB but are unreferenced. Leave them
+   in place — Phase 2 will use them again. Or drop them:
+   ```sql
+   DROP TABLE IF EXISTS invoice_reminders, invoice_lines, invoices,
+     invoice_number_counters, org_payment_methods, org_billing_config,
+     tenant_suspension_events, tenant_skill_events,
+     tenant_billing_lifecycle, skill_pricing, platform_pricing CASCADE;
+   ```
+
+---
+
+## What's NOT in this phase (by design)
+
+* No customer-facing /billing page
+* No admin pricing UI
+* No invoice generation
+* No PDF rendering
+* No Stripe wiring
+* No reminders or cron
+
+These are Phases 2-6.
--- a/deploy/README-threema.md
+++ b/deploy/README-threema.md
@@ -0,0 +1,70 @@
+# Wiring Threema relay into the portal
+
+Drop-in files in this archive:
+
+```
+src/lib/packages.ts                                       # add 'threema' to catalog + customProvisioning flag
+src/lib/threema-relay.ts                                  # new — admin API client
+src/app/api/tenants/[name]/threema/route.ts               # new — POST provision / DELETE deprovision
+src/app/api/tenants/[name]/threema/routes/route.ts        # new — atomic add/remove of a single Threema ID
+src/components/channel-users/channel-users.tsx            # branch threema through relay-managed endpoint
+src/components/packages/package-card.tsx                  # handle customProvisioning enable/disable
+deploy/patch-i18n-threema.mjs                             # idempotent i18n key injection
+```
+
+## Manual steps after dropping in
+
+1. `.env` (and `.env.example`) — add:
+   ```
+   THREEMA_RELAY_URL=http://pieced-threema-gateway.threema-gateway.svc:8080
+   THREEMA_RELAY_ADMIN_TOKEN=__from_openbao__
+   ```
+   The portal pod's OpenBao client should also read `secret/data/threema-gateway/admin` and surface `token` as this env var (existing ESO pattern in the portal's Helm chart).
+
+2. Patch the message files (one-time):
+   ```bash
+   node deploy/patch-i18n-threema.mjs
+   ```
+
+3. Re-export `CHANNEL_PACKAGE_IDS` is unchanged in source; verify
+   `tenants/[name]/page.tsx` still derives the enabled-channels list
+   from it — it should now include `threema` automatically once a
+   tenant has it in `spec.packages`.
+
+4. Type-check:
+   ```bash
+   npx tsc --noEmit
+   ```
+
+## Flow summary
+
+### Enabling Threema for a tenant
+1. Customer toggles the threema package card.
+2. PackageCard sees `customProvisioning: true` → POSTs `/api/tenants/<name>/threema`.
+3. Handler calls relay `POST /admin/tokens` → gets `{token, hmacSecret}`.
+4. Handler writes them to OpenBao at `secret/data/tenants/tenant-<name>/threema-relay`.
+5. PackageCard then PATCHes `tenant.spec.packages` to include `threema`.
+6. Operator reconciles: ExternalSecret syncs OpenBao → Secret; OpenClaw pod restarts with `THREEMA_RELAY_*` env vars; plugin registers `threema` channel.
+
+### Customer adds a Threema ID
+1. UI calls `POST /api/tenants/<name>/threema/routes` with `{threemaId}`.
+2. Handler calls relay `POST /admin/routes` (uniqueness enforced at PK).
+3. On 201 or 409-from-same-tenant: handler patches K8s `spec.channelUsers.threema`.
+4. On 409-from-other-tenant: 409 to client with explanation.
+5. On K8s patch failure after relay success: handler compensates by `DELETE /admin/routes/...` at the relay.
+
+### Customer removes a Threema ID
+1. UI calls `DELETE /api/tenants/<name>/threema/routes?threemaId=...`.
+2. Handler patches K8s `spec.channelUsers.threema` to drop the ID.
+3. Handler calls relay `DELETE /admin/routes/...` (404 = idempotent OK).
+4. If relay drop fails: K8s already updated, surface warning but treat as success — relay deletes are idempotent on retry.
+
+### Disabling Threema for a tenant
+1. Customer disables the threema card.
+2. PackageCard DELETEs `/api/tenants/<name>/threema`.
+3. Handler calls relay `DELETE /admin/tokens/<name>` (cascades to all routes for this tenant).
+4. Handler deletes OpenBao secret at `secret/data/tenants/tenant-<name>/threema-relay`.
+5. PackageCard then PATCHes `tenant.spec.packages` to drop `threema`.
+6. Operator reconciles: ExternalSecret targets a missing OpenBao path → Secret deleted → OpenClaw pod restarts without `threema` channel.
+
+There's a small window (between step 4 and the operator's reconcile) where the pod still thinks it has a relay token but the relay has revoked it. Outbound during that window returns 401 from the relay; inbound is blackholed at the relay because routes are gone. Both are graceful failures.
--- a/deploy/patch-i18n-threema.mjs
+++ b/deploy/patch-i18n-threema.mjs
@@ -0,0 +1,130 @@
+#!/usr/bin/env node
+/**
+ * Run: node deploy/patch-i18n-threema.mjs
+ *
+ * Idempotently injects (or overwrites) customer-facing Threema texts:
+ *   - packages.threema.{description, instructions, disclaimer}
+ *   - channelUsers.threemaIdHelp
+ *   - channelUsers.threemaSetup.{title, step1, step2, step3, qrAlt}
+ *
+ * Replaces the earlier version of this script entirely. The new texts:
+ *   - Drop "Gateway account" jargon (customers don't know it)
+ *   - Drop asterisk-prefix references (customers don't see / type it)
+ *   - Tell the customer to add their OWN Threema ID, not someone else's
+ *   - Disclose that Threema charges per message via the gateway
+ *   - Walk through the QR-scan + add-your-ID flow explicitly
+ *
+ * Re-running is safe — keys are set, not merged, so this is the
+ * source of truth for the values it touches.
+ */
+import { readFileSync, writeFileSync } from "fs";
+
+const i18n = {
+  en: {
+    pkg: {
+      description:
+        "Send and receive messages through Threema. Each inbound and outbound message uses the shared PieCed messaging service and incurs a per-message charge from Threema — a third-party cost, separate from your PieCed subscription.",
+      instructions:
+        "1. Enable this package.\n2. Open Threema on your phone, scan the QR code shown under Authorized Users → threema, and accept the contact.\n3. Add your own Threema ID under Authorized Users → threema so the assistant recognises your messages.\n4. Send a message from Threema to start chatting with the assistant.",
+      disclaimer:
+        "Messages between Threema and PieCed are end-to-end encrypted up to PieCed's messaging service, where they are decrypted to be routed to your assistant. Each message sent or received is counted toward Threema's per-message billing — see your plan for current rates.",
+    },
+    channelHelp:
+      "Enter your own Threema ID — the 8 characters shown in your Threema app under Settings → My Threema ID. Once added, you'll be able to chat with the assistant directly from Threema.",
+    setup: {
+      title: "Add the assistant to your Threema",
+      step1: "Open Threema on your phone.",
+      step2: "Tap the scan icon and scan this QR code to add the assistant as a contact.",
+      step3: "Then add your own Threema ID below.",
+      qrAlt: "QR code to add {gateway} as a Threema contact",
+      bannerTitle: "Set up Threema",
+      bannerBody: "Open Threema on your phone and scan our QR code to add the assistant as a contact. Then add your own Threema ID below.",
+      bannerButton: "Show QR code",
+    },
+  },
+  de: {
+    pkg: {
+      description:
+        "Senden und empfangen Sie Nachrichten über Threema. Jede eingehende und ausgehende Nachricht läuft über den gemeinsamen PieCed-Messaging-Dienst und verursacht eine Gebühr pro Nachricht bei Threema — eine Drittanbieter-Kostenposition, unabhängig von Ihrem PieCed-Abonnement.",
+      instructions:
+        "1. Aktivieren Sie dieses Paket.\n2. Öffnen Sie Threema auf Ihrem Telefon, scannen Sie den QR-Code unter Autorisierte Benutzer → threema und akzeptieren Sie den Kontakt.\n3. Tragen Sie Ihre eigene Threema-ID unter Autorisierte Benutzer → threema ein, damit der Assistent Ihre Nachrichten erkennt.\n4. Schreiben Sie eine Nachricht aus Threema, um das Gespräch zu beginnen.",
+      disclaimer:
+        "Nachrichten zwischen Threema und PieCed werden Ende-zu-Ende verschlüsselt bis zum PieCed-Messaging-Dienst, wo sie entschlüsselt und an Ihren Assistenten weitergeleitet werden. Jede gesendete oder empfangene Nachricht wird gemäss Threema-Tarif pro Nachricht abgerechnet — die aktuellen Preise finden Sie in Ihrem Plan.",
+    },
+    channelHelp:
+      "Geben Sie Ihre eigene Threema-ID ein — die 8 Zeichen, die in Ihrer Threema-App unter Einstellungen → Meine Threema-ID angezeigt werden. Anschliessend können Sie direkt aus Threema mit dem Assistenten chatten.",
+    setup: {
+      title: "Assistenten zu Threema hinzufügen",
+      step1: "Öffnen Sie Threema auf Ihrem Telefon.",
+      step2: "Tippen Sie auf das Scan-Symbol und scannen Sie diesen QR-Code, um den Assistenten als Kontakt hinzuzufügen.",
+      step3: "Fügen Sie anschliessend unten Ihre eigene Threema-ID hinzu.",
+      qrAlt: "QR-Code, um {gateway} als Threema-Kontakt hinzuzufügen",
+      bannerTitle: "Threema einrichten",
+      bannerBody: "Öffnen Sie Threema auf Ihrem Telefon und scannen Sie unseren QR-Code, um den Assistenten als Kontakt hinzuzufügen. Geben Sie anschliessend unten Ihre eigene Threema-ID ein.",
+      bannerButton: "QR-Code anzeigen",
+    },
+  },
+  fr: {
+    pkg: {
+      description:
+        "Envoyez et recevez des messages via Threema. Chaque message entrant ou sortant transite par le service de messagerie PieCed partagé et entraîne des frais par message facturés par Threema — un coût tiers, distinct de votre abonnement PieCed.",
+      instructions:
+        "1. Activez ce package.\n2. Ouvrez Threema sur votre téléphone, scannez le QR code affiché dans Utilisateurs autorisés → threema, puis acceptez le contact.\n3. Ajoutez votre propre identifiant Threema sous Utilisateurs autorisés → threema afin que l'assistant reconnaisse vos messages.\n4. Envoyez un message depuis Threema pour commencer la conversation.",
+      disclaimer:
+        "Les messages entre Threema et PieCed sont chiffrés de bout en bout jusqu'au service de messagerie PieCed, où ils sont déchiffrés pour être acheminés vers votre assistant. Chaque message envoyé ou reçu est facturé par Threema selon son tarif par message — consultez votre plan pour les tarifs en vigueur.",
+    },
+    channelHelp:
+      "Saisissez votre propre identifiant Threema — les 8 caractères affichés dans votre application Threema sous Réglages → Mon identifiant Threema. Une fois ajouté, vous pourrez discuter directement avec l'assistant depuis Threema.",
+    setup: {
+      title: "Ajouter l'assistant à Threema",
+      step1: "Ouvrez Threema sur votre téléphone.",
+      step2: "Appuyez sur l'icône de scan et scannez ce QR code pour ajouter l'assistant comme contact.",
+      step3: "Puis ajoutez votre propre identifiant Threema ci-dessous.",
+      qrAlt: "QR code pour ajouter {gateway} comme contact Threema",
+      bannerTitle: "Configurer Threema",
+      bannerBody: "Ouvrez Threema sur votre téléphone et scannez notre QR code pour ajouter l'assistant comme contact. Saisissez ensuite votre propre identifiant Threema ci-dessous.",
+      bannerButton: "Afficher le QR code",
+    },
+  },
+  it: {
+    pkg: {
+      description:
+        "Invia e ricevi messaggi tramite Threema. Ogni messaggio in entrata e in uscita passa attraverso il servizio di messaggistica condiviso di PieCed e comporta un addebito per messaggio da parte di Threema — un costo di terzi, separato dall'abbonamento PieCed.",
+      instructions:
+        "1. Attiva questo pacchetto.\n2. Apri Threema sul tuo telefono, scansiona il QR code mostrato in Utenti autorizzati → threema e accetta il contatto.\n3. Aggiungi il tuo ID Threema sotto Utenti autorizzati → threema affinché l'assistente riconosca i tuoi messaggi.\n4. Invia un messaggio da Threema per iniziare la conversazione.",
+      disclaimer:
+        "I messaggi tra Threema e PieCed sono cifrati end-to-end fino al servizio di messaggistica PieCed, dove vengono decifrati per essere inoltrati al tuo assistente. Ogni messaggio inviato o ricevuto viene addebitato da Threema secondo la sua tariffa per messaggio — consulta il tuo piano per i prezzi attuali.",
+    },
+    channelHelp:
+      "Inserisci il tuo ID Threema — gli 8 caratteri mostrati nella tua app Threema sotto Impostazioni → Il mio ID Threema. Una volta aggiunto, potrai conversare con l'assistente direttamente da Threema.",
+    setup: {
+      title: "Aggiungi l'assistente a Threema",
+      step1: "Apri Threema sul tuo telefono.",
+      step2: "Tocca l'icona di scansione e scansiona questo QR code per aggiungere l'assistente ai contatti.",
+      step3: "Quindi aggiungi il tuo ID Threema qui sotto.",
+      qrAlt: "QR code per aggiungere {gateway} come contatto Threema",
+      bannerTitle: "Configura Threema",
+      bannerBody: "Apri Threema sul tuo telefono e scansiona il nostro QR code per aggiungere l'assistente ai contatti. Inserisci poi il tuo ID Threema qui sotto.",
+      bannerButton: "Mostra QR code",
+    },
+  },
+};
+
+for (const [lang, entries] of Object.entries(i18n)) {
+  const path = `src/messages/${lang}.json`;
+  const json = JSON.parse(readFileSync(path, "utf8"));
+
+  json.packages = json.packages ?? {};
+  json.packages.threema = {
+    description: entries.pkg.description,
+    instructions: entries.pkg.instructions,
+    disclaimer: entries.pkg.disclaimer,
+  };
+
+  json.channelUsers = json.channelUsers ?? {};
+  json.channelUsers.threemaIdHelp = entries.channelHelp;
+  json.channelUsers.threemaSetup = entries.setup;
+
+  writeFileSync(path, JSON.stringify(json, null, 2) + "\n");
+  console.log(`Patched ${path}`);
+}
--- a/public/threema/qr_code_AIAGENT.png
+++ b/public/threema/qr_code_AIAGENT.png
--- a/src/app/[locale]/tenants/[name]/page.tsx
+++ b/src/app/[locale]/tenants/[name]/page.tsx
@@ -13,8 +13,15 @@ import { ChannelUsers } from "@/components/channel-users/channel-users";
 import { AssignedUsersPanel } from "@/components/tenants/assigned-users-panel";
 import { SubscriptionToggle } from "@/components/tenants/subscription-toggle";
 import { formatDateTime, formatRelative } from "@/lib/format";
+import { CHANNEL_PACKAGE_IDS } from "@/lib/packages";

-const CHANNEL_PACKAGES = ["telegram", "discord", "email"];
+// CHANNEL_PACKAGES used to be a hardcoded literal here
+// (`["telegram", "discord", "email"]`). It now derives from the
+// portal-side catalog so adding a new channel anywhere only requires
+// editing src/lib/packages.ts. The `email` channel was dropped as
+// part of the Phase A package-model rework — IMAP/SMTP is now the
+// `mail` skill instead.
+const CHANNEL_PACKAGES = CHANNEL_PACKAGE_IDS;

 export default async function TenantDetailPage({
  params,
--- a/src/app/api/admin/billing/backfill/route.ts
+++ b/src/app/api/admin/billing/backfill/route.ts
@@ -0,0 +1,70 @@
+import { NextResponse } from "next/server";
+import { requirePlatformRole } from "@/lib/session";
+import { listTenants } from "@/lib/k8s";
+import { backfillTenantBillingLifecycle } from "@/lib/db";
+import { safeError } from "@/lib/errors";
+
+/**
+ * POST /api/admin/billing/backfill
+ *
+ * One-off bootstrap that reads every live PiecedTenant CR and
+ * mirrors it into the Phase 1 billing tables:
+ *   - tenant_billing_lifecycle.created_at ← CR's creationTimestamp
+ *   - tenant_skill_events: one 'enabled' event per package in
+ *     spec.packages, anchored at the CR's creationTimestamp
+ *   - tenant_suspension_events: one 'suspended' event if the CR is
+ *     currently suspended (anchored at status.suspendedAt)
+ *
+ * Idempotent — re-running is safe. The helper only inserts rows
+ * for tenants that have no lifecycle row / no events yet; running
+ * twice produces zero additional rows.
+ *
+ * Authorization: platform role only. The body of the request is
+ * ignored.
+ *
+ * Response: counts of rows inserted, mostly for sanity-checking
+ * (expect non-zero on first run, zero on subsequent runs).
+ *
+ * Phase 2 will surface this behind an admin UI button.
+ */
+export async function POST() {
+  try {
+    await requirePlatformRole();
+  } catch {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  try {
+    const tenants = await listTenants();
+    const result = await backfillTenantBillingLifecycle(
+      tenants.map((t) => ({
+        name: t.metadata.name,
+        // Tenants without the org label exist as a pre-Slice-3
+        // artifact; we still record them but with 'unknown' as the
+        // org id, which surfaces them in admin reports for manual
+        // labelling. Per-org billing computation skips rows with
+        // org id = 'unknown'.
+        zitadelOrgId:
+          t.metadata.labels?.["pieced.ch/zitadel-org-id"] ?? "unknown",
+        createdAt: t.metadata.creationTimestamp
+          ? new Date(t.metadata.creationTimestamp)
+          : new Date(),
+        packages: t.spec.packages ?? [],
+        suspendedAt: t.status?.suspendedAt
+          ? new Date(t.status.suspendedAt)
+          : null,
+      }))
+    );
+    return NextResponse.json({
+      message: "Backfill complete.",
+      tenantsExamined: tenants.length,
+      ...result,
+    });
+  } catch (e: any) {
+    console.error("Backfill failed:", e);
+    return NextResponse.json(
+      { error: safeError(e, "Backfill failed") },
+      { status: 500 }
+    );
+  }
+}
--- a/src/app/api/admin/requests/[id]/approve/route.ts
+++ b/src/app/api/admin/requests/[id]/approve/route.ts
@@ -4,6 +4,9 @@ import {
  getTenantRequestById,
  updateTenantRequestStatus,
  clearEncryptedSecrets,
+  recordTenantCreated,
+  recordSkillEvents,
+  recordSuspensionEvent,
 } from "@/lib/db";
 import { createTenant, patchTenantSpec, setTenantAnnotation } from "@/lib/k8s";
 import { sendApprovalEmail, sendResumeApprovalEmail } from "@/lib/email";
@@ -85,6 +88,23 @@ export async function POST(
    }
    try {
      await patchTenantSpec(tenantRequest.tenantName, { suspend: false });
+
+      // Billing — Phase 1: record the resume so monthly proration
+      // counts the suspended segment correctly. Best-effort; if
+      // logging fails, the approval still succeeds.
+      try {
+        await recordSuspensionEvent(
+          tenantRequest.tenantName,
+          tenantRequest.zitadelOrgId,
+          "resumed"
+        );
+      } catch (e) {
+        console.error(
+          "billing: failed to record resumed suspension event:",
+          e
+        );
+      }
+
      // Clear the annotation that pauses the operator's 60-day TTL.
      // Best-effort — annotation cleanup is also done by the operator
      // when it sees suspend=false on the next reconcile (it clears
@@ -199,6 +219,35 @@ export async function POST(
      }
    );

+    // Billing — Phase 1: record the tenant's creation and initial
+    // package state. Anchored at "now" rather than the CR's
+    // creationTimestamp because we don't get the timestamp back from
+    // createTenant — the few-millisecond skew vs the CR's actual
+    // creationTimestamp is irrelevant for monthly billing.
+    //
+    // Best-effort: tracking failures must never block provisioning.
+    // The backfill helper can repair any gaps later if needed.
+    const billingAnchor = new Date();
+    try {
+      await recordTenantCreated(
+        tenantName,
+        tenantRequest.zitadelOrgId,
+        billingAnchor
+      );
+      await recordSkillEvents(
+        tenantName,
+        tenantRequest.zitadelOrgId,
+        packages,
+        [],
+        billingAnchor
+      );
+    } catch (e) {
+      console.error(
+        "billing: failed to record tenant creation / initial skill events:",
+        e
+      );
+    }
+
    // Step 5: Update request status — clear admin notes on re-approval
    const updated = await updateTenantRequestStatus(id, "provisioning", {
      adminNotes: isReApproval ? null : adminNotes,
--- a/src/app/api/admin/tenants/[name]/delete/route.ts
+++ b/src/app/api/admin/tenants/[name]/delete/route.ts
@@ -4,6 +4,7 @@ import { getTenant, deleteTenant } from "@/lib/k8s";
 import {
  markTenantRequestDeletedByTenantName,
  removeAllAssignmentsForTenant,
+  recordTenantDeleted,
 } from "@/lib/db";
 import { safeError } from "@/lib/errors";

@@ -49,6 +50,15 @@ export async function POST(
      console.error("Failed to clean up tenant assignments:", e)
    );

+    // Billing — Phase 1: stamp deletion timestamp on the lifecycle
+    // row so the final invoice covering the deletion month can
+    // prorate correctly. Idempotent at the DB layer; a missing
+    // lifecycle row (e.g. pre-Phase-1 tenants that haven't been
+    // backfilled yet) makes this a no-op.
+    await recordTenantDeleted(name).catch((e) =>
+      console.error("billing: failed to stamp tenant deletion:", e)
+    );
+
    return NextResponse.json({
      message: "Tenant deletion initiated. The operator will clean up all resources.",
    });
--- a/src/app/api/tenants/[name]/route.ts
+++ b/src/app/api/tenants/[name]/route.ts
@@ -3,6 +3,7 @@ import { getSessionUser, canMutate } from "@/lib/session";
 import { canUserSeeTenant } from "@/lib/visibility";
 import { getTenant, patchTenantSpec } from "@/lib/k8s";
 import { getPackageDef } from "@/lib/packages";
+import { recordSkillEvents } from "@/lib/db";
 import { safeError } from "@/lib/errors";

 const ALLOWED_WORKSPACE_FILES = ["SOUL.md", "AGENTS.md", "TOOLS.md"];
@@ -187,6 +188,50 @@ export async function PATCH(
    }

    const updated = await patchTenantSpec(name, specPatch);
+
+    // Billing — Phase 1: if packages changed, record enable/disable
+    // events. The diff is computed against the patched CR (the
+    // returned state) rather than `existing` so the events match
+    // what K8s actually committed. Best-effort: a logging failure
+    // never poisons the PATCH response — drift would be reconciled
+    // on the next backfill or by the next normal toggle.
+    //
+    // Note on races: two concurrent PATCHes could each see the
+    // same `existing` and both succeed at the K8s layer (last write
+    // wins for spec.packages, which is replaced wholesale). The
+    // events from the losing PATCH would then describe a transition
+    // that no longer reflects reality. Acceptable trade-off for v1
+    // — the toggle UI sends one request at a time and races would
+    // only matter for adjacent same-day toggles, which the billing
+    // computation collapses to a single billable day anyway.
+    if (specPatch.packages !== undefined) {
+      try {
+        const orgId =
+          existing.metadata.labels?.["pieced.ch/zitadel-org-id"] ?? null;
+        if (orgId) {
+          const oldSet = new Set<string>(existing.spec.packages ?? []);
+          const newSet = new Set<string>(updated.spec.packages ?? []);
+          const added = [...newSet].filter((x) => !oldSet.has(x));
+          const removed = [...oldSet].filter((x) => !newSet.has(x));
+          if (added.length > 0 || removed.length > 0) {
+            await recordSkillEvents(name, orgId, added, removed);
+          }
+        } else {
+          // A tenant without the org label is a pre-Slice-3 artifact
+          // — we can't attribute its skill events to any org. Log
+          // and skip rather than guess.
+          console.warn(
+            `billing: tenant ${name} has no zitadel-org-id label; skill events not recorded`
+          );
+        }
+      } catch (e) {
+        console.error(
+          `billing: failed to record skill events for ${name}:`,
+          e
+        );
+      }
+    }
+
    return NextResponse.json(updated);
  } catch (e: any) {
    return NextResponse.json(
--- a/src/app/api/tenants/[name]/suspend/route.ts
+++ b/src/app/api/tenants/[name]/suspend/route.ts
@@ -3,6 +3,7 @@ import { z } from "zod";
 import { getSessionUser, canMutate } from "@/lib/session";
 import { getTenant, patchTenantSpec, setTenantAnnotation } from "@/lib/k8s";
 import { canUserSeeTenant } from "@/lib/visibility";
+import { recordSuspensionEvent } from "@/lib/db";
 import { safeError } from "@/lib/errors";

 const patchSchema = z.object({
@@ -101,6 +102,33 @@ export async function PATCH(
  try {
    await patchTenantSpec(name, { suspend });

+    // Billing — Phase 1: record the transition so monthly proration
+    // can exclude suspended days from the fixed fee. The portal
+    // commands this transition; the operator's status.suspendedAt
+    // lags by a reconcile cycle (seconds), which is irrelevant for
+    // monthly billing. Best-effort: a logging failure never blocks
+    // the suspend/resume itself.
+    try {
+      const orgId =
+        tenant.metadata.labels?.["pieced.ch/zitadel-org-id"] ?? null;
+      if (orgId) {
+        await recordSuspensionEvent(
+          name,
+          orgId,
+          suspend ? "suspended" : "resumed"
+        );
+      } else {
+        console.warn(
+          `billing: tenant ${name} has no zitadel-org-id label; suspension event not recorded`
+        );
+      }
+    } catch (e) {
+      console.error(
+        `billing: failed to record suspension event for ${name}:`,
+        e
+      );
+    }
+
    // On admin-side resume, also clear the pending-resume-request
    // annotation if it exists. Belt-and-suspenders: the admin-approve
    // endpoint already clears it on its happy path, but a platform
--- a/src/app/api/tenants/[name]/threema/route.ts
+++ b/src/app/api/tenants/[name]/threema/route.ts
@@ -0,0 +1,168 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSessionUser, canMutate } from "@/lib/session";
+import { getTenant } from "@/lib/k8s";
+import {
+  writePackageSecrets,
+  deletePackageSecrets,
+} from "@/lib/openbao";
+import { mintToken, revokeToken } from "@/lib/threema-relay";
+import { safeError } from "@/lib/errors";
+
+/**
+ * Threema package provisioning — special-cased because the credentials
+ * are platform-issued (relay mints them), not customer-supplied.
+ *
+ * POST /api/tenants/:name/threema
+ *   - Mints a per-tenant bearer + HMAC secret from the central relay.
+ *   - Writes both to OpenBao under
+ *     secret/data/tenants/<tenant-{name}>/threema-relay so the
+ *     operator's ExternalSecret can sync them into the tenant
+ *     namespace alongside other channel secrets.
+ *   - Returns 200 on success. The caller (PackageCard) then PATCHes
+ *     tenant.spec.packages to add "threema".
+ *
+ * DELETE /api/tenants/:name/threema
+ *   - Revokes the per-tenant token at the relay (cascades to all
+ *     routes — the relay's tokens.deleteToken also deletes routes).
+ *   - Deletes the OpenBao secret so the ExternalSecret/operator can
+ *     converge cleanly.
+ *   - Returns 200 on success even if no token existed (idempotent).
+ *
+ * Failure semantics
+ * -----------------
+ * On POST: if minting succeeds but the OpenBao write fails, we attempt
+ * to revoke the just-minted token before returning the error. That way
+ * the relay doesn't keep an orphan token row that nothing can use.
+ * Best-effort cleanup; if the revoke also fails, the relay admin can
+ * use DELETE /admin/tokens/<name> manually.
+ *
+ * On DELETE: we revoke FIRST, then delete OpenBao. If revoke fails we
+ * return the error and stop — leaving OpenBao alone means the pod's
+ * still-mounted secret keeps working in the brief window between
+ * "customer hits disable" and "operator reconciles spec without threema",
+ * which is more graceful than yanking the secret out from under a
+ * running pod.
+ */
+
+const VAULT_SUFFIX = "threema-relay";
+
+export async function POST(
+  _req: NextRequest,
+  { params }: { params: Promise<{ name: string }> },
+) {
+  const user = await getSessionUser();
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  if (!canMutate(user))
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+
+  const { name } = await params;
+
+  try {
+    const tenant = await getTenant(name);
+    if (!tenant)
+      return NextResponse.json({ error: "Not found" }, { status: 404 });
+    if (
+      !user.isPlatform &&
+      tenant.metadata.labels?.["pieced.ch/zitadel-org-id"] !== user.orgId
+    ) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const minted = await mintToken(name);
+    if (!minted.ok) {
+      return NextResponse.json(
+        { error: `Relay mint failed: ${minted.message}` },
+        { status: minted.kind === "http" ? 502 : 503 },
+      );
+    }
+
+    try {
+      await writePackageSecrets(`tenant-${name}`, VAULT_SUFFIX, {
+        token: minted.token,
+        "hmac-secret": minted.hmacSecret,
+      });
+    } catch (e) {
+      // Compensate: revoke the just-minted token so the relay doesn't
+      // hold an orphan. Best-effort — log and continue surfacing the
+      // original error.
+      const revoke = await revokeToken(name);
+      if (!revoke.ok) {
+        console.error(
+          `[threema/provision] Compensating revoke failed for ${name}: ${revoke.message}`,
+        );
+      }
+      return NextResponse.json(
+        { error: `OpenBao write failed: ${safeError(e, "secret store unavailable")}` },
+        { status: 503 },
+      );
+    }
+
+    return NextResponse.json({ ok: true });
+  } catch (e) {
+    console.error("[threema/provision]", e);
+    return NextResponse.json(
+      { error: safeError(e, "Provisioning failed") },
+      { status: 500 },
+    );
+  }
+}
+
+export async function DELETE(
+  _req: NextRequest,
+  { params }: { params: Promise<{ name: string }> },
+) {
+  const user = await getSessionUser();
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  if (!canMutate(user))
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+
+  const { name } = await params;
+
+  try {
+    const tenant = await getTenant(name);
+    if (!tenant)
+      return NextResponse.json({ error: "Not found" }, { status: 404 });
+    if (
+      !user.isPlatform &&
+      tenant.metadata.labels?.["pieced.ch/zitadel-org-id"] !== user.orgId
+    ) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const revoke = await revokeToken(name);
+    // 404 from relay = nothing to revoke = idempotent success.
+    if (!revoke.ok && !(revoke.kind === "http" && revoke.status === 404)) {
+      return NextResponse.json(
+        { error: `Relay revoke failed: ${revoke.message}` },
+        { status: revoke.kind === "http" ? 502 : 503 },
+      );
+    }
+
+    // Delete the OpenBao secret. Idempotent — deletePackageSecrets
+    // tolerates 404.
+    try {
+      await deletePackageSecrets(`tenant-${name}`, VAULT_SUFFIX);
+    } catch (e) {
+      // Already revoked at the relay — surface the openbao failure
+      // but keep the partial-success state visible.
+      return NextResponse.json(
+        {
+          error: `Token revoked, but OpenBao delete failed: ${safeError(e, "secret store unavailable")}`,
+          partial: true,
+        },
+        { status: 503 },
+      );
+    }
+
+    return NextResponse.json({
+      ok: true,
+      deletedRoutes: revoke.ok ? revoke.deletedRoutes : 0,
+    });
+  } catch (e) {
+    console.error("[threema/deprovision]", e);
+    return NextResponse.json(
+      { error: safeError(e, "Deprovisioning failed") },
+      { status: 500 },
+    );
+  }
+}
--- a/src/app/api/tenants/[name]/threema/routes/route.ts
+++ b/src/app/api/tenants/[name]/threema/routes/route.ts
@@ -0,0 +1,217 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { getSessionUser, canMutate } from "@/lib/session";
+import { getTenant, patchTenantSpec } from "@/lib/k8s";
+import {
+  createRoute,
+  deleteRoute,
+  isRouteConflictForOtherTenant,
+  isRouteConflictForSameTenant,
+  listRoutes,
+} from "@/lib/threema-relay";
+import { safeError } from "@/lib/errors";
+
+/**
+ * Threema route management — keeps three places in sync:
+ *
+ *   1. Relay DB (`routes` table)         — source of truth for uniqueness
+ *   2. K8s spec.channelUsers.threema     — what the operator sees
+ *   3. Customer UI                       — derived from (2)
+ *
+ * Add (POST) order: relay first (to claim uniqueness atomically), then
+ * K8s. On K8s failure we compensate by deleting the relay route.
+ *
+ * Remove (DELETE) order: K8s first (UI shows it gone immediately, which
+ * is the customer-facing semantic that matters), then relay. On relay
+ * failure we DO NOT rollback K8s — the customer wanted it gone, and
+ * the relay's stale route will be cleaned up on the next retry (deletes
+ * are idempotent at the relay).
+ *
+ * Read-modify-write race: patchTenantSpec uses K8s merge-patch on
+ * spec.channelUsers.threema, which REPLACES the entire array. We GET
+ * the latest array, mutate it, then PATCH. Two concurrent adds from the
+ * same customer's tabs can lose one of them. Acceptable at pilot scale
+ * (single-digit customers, low concurrency); revisit with SSA + field
+ * managers if it ever bites.
+ */
+
+const ROUTE_BODY = z.object({
+  threemaId: z
+    .string()
+    .regex(/^[A-Z0-9]{8}$/, "Threema ID must be 8 uppercase alphanumeric chars (no asterisk)"),
+});
+
+// ---- helpers --------------------------------------------------------------
+
+async function loadTenantOrError(name: string, user: Awaited<ReturnType<typeof getSessionUser>>) {
+  if (!user) return { error: NextResponse.json({ error: "Unauthorized" }, { status: 401 }) };
+  if (!canMutate(user))
+    return { error: NextResponse.json({ error: "Forbidden" }, { status: 403 }) };
+
+  const tenant = await getTenant(name);
+  if (!tenant)
+    return { error: NextResponse.json({ error: "Not found" }, { status: 404 }) };
+  if (
+    !user.isPlatform &&
+    tenant.metadata.labels?.["pieced.ch/zitadel-org-id"] !== user.orgId
+  ) {
+    return { error: NextResponse.json({ error: "Forbidden" }, { status: 403 }) };
+  }
+  return { tenant };
+}
+
+function currentThreemaIds(tenantSpec: any): string[] {
+  const cu = tenantSpec?.channelUsers ?? {};
+  const ids = cu.threema;
+  return Array.isArray(ids) ? ids.filter((x) => typeof x === "string") : [];
+}
+
+// ---- GET ------------------------------------------------------------------
+
+export async function GET(
+  _req: NextRequest,
+  { params }: { params: Promise<{ name: string }> },
+) {
+  const user = await getSessionUser();
+  const { name } = await params;
+  const loaded = await loadTenantOrError(name, user);
+  if (loaded.error) return loaded.error;
+
+  const res = await listRoutes(name);
+  if (!res.ok) {
+    return NextResponse.json(
+      { error: `Relay list failed: ${res.message}` },
+      { status: res.kind === "http" ? 502 : 503 },
+    );
+  }
+  return NextResponse.json({ routes: res.routes });
+}
+
+// ---- POST -----------------------------------------------------------------
+
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ name: string }> },
+) {
+  const user = await getSessionUser();
+  const { name } = await params;
+  const loaded = await loadTenantOrError(name, user);
+  if (loaded.error) return loaded.error;
+  const tenant = loaded.tenant;
+
+  const body = await req.json().catch(() => null);
+  const parsed = ROUTE_BODY.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "Invalid threemaId", details: parsed.error.flatten() },
+      { status: 400 },
+    );
+  }
+  const threemaId = parsed.data.threemaId;
+
+  // Step 1: claim at the relay. Uniqueness is enforced here.
+  const claim = await createRoute(name, threemaId);
+  if (!claim.ok) {
+    if (isRouteConflictForOtherTenant(claim, name)) {
+      return NextResponse.json(
+        { error: "This Threema ID is already registered to another tenant" },
+        { status: 409 },
+      );
+    }
+    if (!isRouteConflictForSameTenant(claim, name)) {
+      // Genuine non-409 failure
+      return NextResponse.json(
+        { error: `Relay create failed: ${claim.message}` },
+        { status: claim.kind === "http" ? claim.status : 503 },
+      );
+    }
+    // Idempotent self-claim — continue to step 2 to ensure K8s mirrors it.
+  }
+
+  // Step 2: add to K8s spec.channelUsers.threema (idempotent).
+  const existing = currentThreemaIds(tenant!.spec);
+  if (!existing.includes(threemaId)) {
+    const next = [...existing, threemaId];
+    try {
+      await patchTenantSpec(name, {
+        channelUsers: {
+          ...(tenant!.spec?.channelUsers ?? {}),
+          threema: next,
+        } as Record<string, string[]>,
+      });
+    } catch (e) {
+      // Compensate: drop the relay route so we don't leave an orphan.
+      const compensate = await deleteRoute(name, threemaId);
+      if (!compensate.ok) {
+        console.error(
+          `[threema/routes] Compensating route delete failed for ${name}/${threemaId}: ${compensate.message}`,
+        );
+      }
+      return NextResponse.json(
+        { error: `K8s patch failed: ${safeError(e, "patch failed")}` },
+        { status: 500 },
+      );
+    }
+  }
+
+  return NextResponse.json({ ok: true, threemaId });
+}
+
+// ---- DELETE ---------------------------------------------------------------
+
+export async function DELETE(
+  req: NextRequest,
+  { params }: { params: Promise<{ name: string }> },
+) {
+  const user = await getSessionUser();
+  const { name } = await params;
+  const loaded = await loadTenantOrError(name, user);
+  if (loaded.error) return loaded.error;
+  const tenant = loaded.tenant;
+
+  // threemaId arrives as ?threemaId=... since DELETE bodies are uneven across clients.
+  const threemaId = new URL(req.url).searchParams.get("threemaId") ?? "";
+  const parsed = ROUTE_BODY.safeParse({ threemaId });
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "Invalid threemaId", details: parsed.error.flatten() },
+      { status: 400 },
+    );
+  }
+
+  // Step 1: drop from K8s (idempotent).
+  const existing = currentThreemaIds(tenant!.spec);
+  if (existing.includes(parsed.data.threemaId)) {
+    const next = existing.filter((id) => id !== parsed.data.threemaId);
+    try {
+      await patchTenantSpec(name, {
+        channelUsers: {
+          ...(tenant!.spec?.channelUsers ?? {}),
+          threema: next,
+        } as Record<string, string[]>,
+      });
+    } catch (e) {
+      return NextResponse.json(
+        { error: `K8s patch failed: ${safeError(e, "patch failed")}` },
+        { status: 500 },
+      );
+    }
+  }
+
+  // Step 2: drop at relay (also idempotent — 404 is fine).
+  const dropped = await deleteRoute(name, parsed.data.threemaId);
+  if (!dropped.ok && !(dropped.kind === "http" && dropped.status === 404)) {
+    // K8s is already updated; surface but don't rollback. Next time the
+    // user toggles, both will converge.
+    return NextResponse.json(
+      {
+        ok: true,
+        threemaId: parsed.data.threemaId,
+        warning: `Removed from K8s but relay drop failed: ${dropped.message}`,
+      },
+      { status: 200 },
+    );
+  }
+
+  return NextResponse.json({ ok: true, threemaId: parsed.data.threemaId });
+}
--- a/src/components/channel-users/channel-users.tsx
+++ b/src/components/channel-users/channel-users.tsx
@@ -3,14 +3,32 @@
 import { useState, useCallback } from "react";
 import { useTranslations } from "next-intl";
 import { useRouter } from "next/navigation";
+import { ThreemaQrModal } from "./threema-qr-modal";

 /** Maps channel IDs to the instructions for finding the user ID. */
 const CHANNEL_ID_HELP: Record<string, string> = {
  telegram: "telegramIdHelp",
  discord: "discordIdHelp",
-  email: "emailIdHelp",
+  threema: "threemaIdHelp",
+  // email entry dropped in the Phase A rework — IMAP/SMTP is handled by
+  // the `mail` skill (category=skill, not channel), so it never appears
+  // in `enabledChannels`. If a future channel is added to the catalog,
+  // give it an entry here so the help blurb renders.
 };

+/**
+ * Channels whose user list is managed through a dedicated endpoint
+ * instead of the generic PATCH /api/tenants/:name flow.
+ *
+ * Threema is the only one today — adding/removing a Threema ID has to
+ * synchronise with the central pieced-threema-gateway relay's `routes`
+ * table (uniqueness enforced there, not in K8s). The
+ * /api/tenants/:name/threema/routes endpoint owns that two-step
+ * coordination (relay first, then K8s, with compensation on K8s
+ * failure). Other channels just patch the K8s spec directly.
+ */
+const RELAY_MANAGED_CHANNELS = new Set(["threema"]);
+
 interface ChannelUsersProps {
  tenantName: string;
  /** Currently enabled channel packages (e.g. ["telegram", "discord"]) */
@@ -34,6 +52,14 @@ export function ChannelUsers({
  const [inputValues, setInputValues] = useState<Record<string, string>>({});
  const [channelUsers, setChannelUsers] =
    useState<Record<string, string[]>>(initialChannelUsers);
+  /** Which channel's QR helper modal is open, if any. */
+  const [showQrFor, setShowQrFor] = useState<string | null>(null);
+  /**
+   * Tracks channels for which we've already auto-opened the helper
+   * modal on this page load. Prevents the modal from re-popping every
+   * time the user refocuses the input after dismissing it.
+   */
+  const [autoOpened, setAutoOpened] = useState<Set<string>>(() => new Set());

  const updateChannelUsers = useCallback(
    async (updated: Record<string, string[]>) => {
@@ -60,6 +86,70 @@ export function ChannelUsers({
    [tenantName, router]
  );

+  /**
+   * Threema (and any future relay-managed channel) uses a dedicated
+   * endpoint that synchronises the central relay's routes table with
+   * the K8s spec atomically. We call it per-ID rather than sending the
+   * whole array because uniqueness is enforced ID-by-ID at the relay,
+   * and the error UX of "this ID is taken" is per-add.
+   */
+  const addToRelayChannel = useCallback(
+    async (channel: string, threemaId: string) => {
+      setSaving(true);
+      setError("");
+      try {
+        const res = await fetch(
+          `/api/tenants/${tenantName}/${channel}/routes`,
+          {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ threemaId }),
+          }
+        );
+        if (!res.ok) {
+          const data = await res.json().catch(() => ({}));
+          throw new Error(data.error || `Add failed (HTTP ${res.status})`);
+        }
+        setChannelUsers((prev) => {
+          const current = prev[channel] ?? [];
+          if (current.includes(threemaId)) return prev;
+          return { ...prev, [channel]: [...current, threemaId] };
+        });
+        router.refresh();
+      } catch (e: any) {
+        setError(e.message);
+      } finally {
+        setSaving(false);
+      }
+    },
+    [tenantName, router]
+  );
+
+  const removeFromRelayChannel = useCallback(
+    async (channel: string, threemaId: string) => {
+      setSaving(true);
+      setError("");
+      try {
+        const url = `/api/tenants/${tenantName}/${channel}/routes?threemaId=${encodeURIComponent(threemaId)}`;
+        const res = await fetch(url, { method: "DELETE" });
+        if (!res.ok) {
+          const data = await res.json().catch(() => ({}));
+          throw new Error(data.error || `Remove failed (HTTP ${res.status})`);
+        }
+        setChannelUsers((prev) => {
+          const current = prev[channel] ?? [];
+          return { ...prev, [channel]: current.filter((id) => id !== threemaId) };
+        });
+        router.refresh();
+      } catch (e: any) {
+        setError(e.message);
+      } finally {
+        setSaving(false);
+      }
+    },
+    [tenantName, router]
+  );
+
  const handleAdd = useCallback(
    (channel: string) => {
      const userId = inputValues[channel]?.trim();
@@ -71,18 +161,27 @@ export function ChannelUsers({
        return;
      }

-      const updated = {
-        ...channelUsers,
-        [channel]: [...current, userId],
-      };
      setInputValues((prev) => ({ ...prev, [channel]: "" }));
-      updateChannelUsers(updated);
+
+      if (RELAY_MANAGED_CHANNELS.has(channel)) {
+        void addToRelayChannel(channel, userId);
+      } else {
+        const updated = {
+          ...channelUsers,
+          [channel]: [...current, userId],
+        };
+        updateChannelUsers(updated);
+      }
    },
-    [channelUsers, inputValues, updateChannelUsers, t]
+    [channelUsers, inputValues, updateChannelUsers, addToRelayChannel, t]
  );

  const handleRemove = useCallback(
    (channel: string, userId: string) => {
+      if (RELAY_MANAGED_CHANNELS.has(channel)) {
+        void removeFromRelayChannel(channel, userId);
+        return;
+      }
      const current = channelUsers[channel] || [];
      const updated = {
        ...channelUsers,
@@ -90,7 +189,7 @@ export function ChannelUsers({
      };
      updateChannelUsers(updated);
    },
-    [channelUsers, updateChannelUsers]
+    [channelUsers, updateChannelUsers, removeFromRelayChannel]
  );

  if (enabledChannels.length === 0) return null;
@@ -134,6 +233,39 @@ export function ChannelUsers({
              </span>
            </div>

+            {channel === "threema" && (
+              <div className="mb-3 flex flex-col sm:flex-row gap-3 items-start sm:items-center justify-between bg-accent/5 border border-accent/30 rounded-lg p-3">
+                <div className="flex items-start gap-2 flex-1">
+                  <svg
+                    className="w-4 h-4 mt-0.5 text-accent flex-shrink-0"
+                    fill="none"
+                    viewBox="0 0 24 24"
+                    stroke="currentColor"
+                    strokeWidth="2"
+                    aria-hidden="true"
+                  >
+                    <path
+                      strokeLinecap="round"
+                      strokeLinejoin="round"
+                      d="M3 4a1 1 0 011-1h4a1 1 0 011 1v4a1 1 0 01-1 1H4a1 1 0 01-1-1V4zM15 4a1 1 0 011-1h4a1 1 0 011 1v4a1 1 0 01-1 1h-4a1 1 0 01-1-1V4zM3 16a1 1 0 011-1h4a1 1 0 011 1v4a1 1 0 01-1 1H4a1 1 0 01-1-1v-4zM13 13h3v3h-3zM18 13h3v3h-3zM13 18h3v3h-3zM18 18h3v3h-3z"
+                    />
+                  </svg>
+                  <div className="text-xs text-text-secondary leading-relaxed">
+                    <p className="font-medium text-text-primary mb-0.5">
+                      {t("threemaSetup.bannerTitle")}
+                    </p>
+                    <p>{t("threemaSetup.bannerBody")}</p>
+                  </div>
+                </div>
+                <button
+                  onClick={() => setShowQrFor("threema")}
+                  className="self-stretch sm:self-auto px-3 py-2 text-xs font-medium bg-accent text-surface-0 rounded-lg hover:bg-accent-dim transition-colors whitespace-nowrap cursor-pointer shadow-lg shadow-accent/20"
+                >
+                  {t("threemaSetup.bannerButton")}
+                </button>
+              </div>
+            )}
+
            {helpKey && (
              <p className="text-xs text-text-secondary bg-surface-1 border border-border rounded-lg p-3 mb-3 whitespace-pre-line">
                {t(helpKey)}
@@ -176,6 +308,17 @@ export function ChannelUsers({
                      [channel]: e.target.value,
                    }))
                  }
+                  onFocus={() => {
+                    // For threema specifically, open the QR helper the
+                    // first time the user clicks into the input on this
+                    // page load. We don't repeat after dismiss — the
+                    // "Show QR" button next to the channel name covers
+                    // re-opens on demand.
+                    if (channel === "threema" && !autoOpened.has("threema")) {
+                      setShowQrFor("threema");
+                      setAutoOpened((prev) => new Set(prev).add("threema"));
+                    }
+                  }}
                  onKeyDown={(e) => {
                    if (e.key === "Enter") handleAdd(channel);
                  }}
@@ -194,6 +337,11 @@ export function ChannelUsers({
          </div>
        );
      })}
+
+      <ThreemaQrModal
+        open={showQrFor === "threema"}
+        onClose={() => setShowQrFor(null)}
+      />
    </div>
  );
 }
--- a/src/components/channel-users/threema-qr-modal.tsx
+++ b/src/components/channel-users/threema-qr-modal.tsx
@@ -0,0 +1,82 @@
+"use client";
+
+import { useTranslations } from "next-intl";
+import { useEffect } from "react";
+import { THREEMA_GATEWAY } from "@/lib/threema-gateway-config";
+
+interface ThreemaQrModalProps {
+  open: boolean;
+  onClose: () => void;
+}
+
+/**
+ * On-demand modal showing the QR for adding the assistant on Threema.
+ * Triggered by the "Show QR" button in the threema channel card and
+ * closes on overlay click, ESC, or the close button.
+ *
+ * Uses a plain <img> not next/image — image optimization adds nothing
+ * for a 57KB static PNG and removes a potential source of rendering
+ * bugs in the Next.js standalone build.
+ */
+export function ThreemaQrModal({ open, onClose }: ThreemaQrModalProps) {
+  const t = useTranslations("channelUsers.threemaSetup");
+
+  useEffect(() => {
+    if (!open) return;
+    function onKey(e: KeyboardEvent) {
+      if (e.key === "Escape") onClose();
+    }
+    window.addEventListener("keydown", onKey);
+    return () => window.removeEventListener("keydown", onKey);
+  }, [open, onClose]);
+
+  if (!open) return null;
+
+  return (
+    <div
+      onClick={onClose}
+      className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 backdrop-blur-sm p-4"
+    >
+      <div
+        onClick={(e) => e.stopPropagation()}
+        className="w-full max-w-md bg-surface-1 border border-border rounded-2xl p-6 shadow-2xl shadow-black/40 space-y-4"
+      >
+        <div className="flex items-start justify-between">
+          <h3 className="text-base font-semibold text-text-primary">
+            {t("title")}
+          </h3>
+          <button
+            onClick={onClose}
+            className="text-text-muted hover:text-text-primary text-xl leading-none"
+            aria-label="Close"
+          >
+            ×
+          </button>
+        </div>
+
+        <div className="flex justify-center">
+          <div className="bg-white p-3 rounded-md">
+            {/* eslint-disable-next-line @next/next/no-img-element */}
+            <img
+              src={THREEMA_GATEWAY.qrCodePath}
+              alt={t("qrAlt", { gateway: THREEMA_GATEWAY.displayName })}
+              width={220}
+              height={220}
+              style={{ display: "block" }}
+            />
+          </div>
+        </div>
+
+        <p className="text-center text-xs text-text-muted font-mono">
+          {THREEMA_GATEWAY.displayName}
+        </p>
+
+        <ol className="list-decimal list-inside text-xs text-text-secondary space-y-1.5">
+          <li>{t("step1")}</li>
+          <li>{t("step2")}</li>
+          <li>{t("step3")}</li>
+        </ol>
+      </div>
+    </div>
+  );
+}
--- a/src/components/onboarding/wizard.tsx
+++ b/src/components/onboarding/wizard.tsx
@@ -3,7 +3,7 @@
 import { useState, useCallback, useEffect, useRef } from "react";
 import { useTranslations } from "next-intl";
 import { Card } from "@/components/ui/card";
-import { PACKAGE_CATALOG, type PackageDef } from "@/lib/packages";
+import { PACKAGE_CATALOG, DEFAULT_PACKAGE_IDS, type PackageDef } from "@/lib/packages";
 import { isPersonalOrgName, displayOrgNameFor } from "@/lib/personal-org";
 import {
  configureStepSchema,
@@ -69,6 +69,7 @@ translation, and general question answering.
 `;

 const CATEGORIES = [
+  { key: "core" as const, labelKey: "categories.core" },
  { key: "channel" as const, labelKey: "categories.channels" },
  { key: "skill" as const, labelKey: "categories.skills" },
 ] as const;
@@ -198,7 +199,13 @@ export function OnboardingWizard({
      agentName: "Assistant",
      soulMd: FALLBACK_SOUL.replace("{company}", displayOrgName),
      agentsMd: FALLBACK_AGENTS,
-      packages: [] as string[],
+      // CORE defaults: heartbeat + cron + active-memory pre-selected so
+      // the assistant can be proactive, run scheduled tasks, and recall
+      // stable context out of the box. Customers can untoggle any of
+      // them before submitting. core-voice is fully wired (Phase B)
+      // but stays unselected — opt-in keeps audio spend predictable
+      // for tenants who don't intend to use voice channels.
+      packages: [...DEFAULT_PACKAGE_IDS] as string[],
      billingAddress: {
        // For personal accounts, leave the company field empty — it'll
        // appear on invoices. The user can still type something if they
@@ -691,7 +698,7 @@ export function OnboardingWizard({
                            <button
                              type="button"
                              onClick={() => togglePackage(pkg.id)}
-                              className="w-full flex items-center justify-between px-3 py-2.5 cursor-pointer hover:bg-surface-3/30 transition-colors"
+                              className="w-full flex items-center justify-between px-3 py-2.5 transition-colors cursor-pointer hover:bg-surface-3/30"
                            >
                              <div className="text-left">
                                <span
--- a/src/components/packages/package-card.tsx
+++ b/src/components/packages/package-card.tsx
@@ -30,6 +30,26 @@ export function PackageCard({
  const [error, setError] = useState<string | null>(null);

  async function handleEnable() {
+    if (pkg.customProvisioning) {
+      // Platform-side provisioning, then add to packages list.
+      setSaving(true);
+      setError(null);
+      try {
+        const provRes = await fetch(`/api/tenants/${tenantName}/${pkg.id}`, {
+          method: "POST",
+        });
+        if (!provRes.ok) {
+          const err = await provRes.json().catch(() => ({}));
+          throw new Error(err.error || `Provisioning failed (HTTP ${provRes.status})`);
+        }
+        await togglePackage(true);
+      } catch (e: any) {
+        setError(e.message);
+      } finally {
+        setSaving(false);
+      }
+      return;
+    }
    if (pkg.requiresSecrets) {
      setShowModal(true);
      setSecrets({});
@@ -40,6 +60,34 @@ export function PackageCard({
    await togglePackage(true);
  }

+  async function handleDisable() {
+    setSaving(true);
+    setError(null);
+    try {
+      if (pkg.customProvisioning) {
+        // Revoke platform-side credentials FIRST so the relay drops
+        // routes before the operator removes the channel from the
+        // OpenClaw config. Partial-success (token revoked, OpenBao
+        // delete failed) returns 503 with partial=true and we surface
+        // the error rather than continuing — the secret may still be
+        // valid in OpenBao and rolling back the relay revoke isn't
+        // possible (it cascaded to routes).
+        const deprovRes = await fetch(`/api/tenants/${tenantName}/${pkg.id}`, {
+          method: "DELETE",
+        });
+        if (!deprovRes.ok) {
+          const err = await deprovRes.json().catch(() => ({}));
+          throw new Error(err.error || `Deprovisioning failed (HTTP ${deprovRes.status})`);
+        }
+      }
+      await togglePackage(false);
+    } catch (e: any) {
+      setError(e.message);
+    } finally {
+      setSaving(false);
+    }
+  }
+
  async function togglePackage(enable: boolean) {
    setSaving(true);
    try {
@@ -124,7 +172,7 @@ export function PackageCard({
          )}
          {canEdit ? (
            <button
-              onClick={enabled ? () => togglePackage(false) : handleEnable}
+              onClick={enabled ? handleDisable : handleEnable}
              disabled={saving}
              className={`ml-auto rounded-lg px-3 py-1.5 text-xs font-medium transition-all cursor-pointer ${
                enabled
--- a/src/components/packages/package-list.tsx
+++ b/src/components/packages/package-list.tsx
@@ -15,6 +15,7 @@ interface Props {
 }

 const CATEGORIES = [
+  { key: "core" as const, labelKey: "categories.core" },
  { key: "channel" as const, labelKey: "categories.channels" },
  { key: "skill" as const, labelKey: "categories.skills" },
 ] as const;
--- a/src/lib/db.ts
+++ b/src/lib/db.ts
@@ -272,6 +272,252 @@ const MIGRATION_SQL = `
  END $$;
  CREATE INDEX IF NOT EXISTS idx_support_ticket_comments_ticket
    ON support_ticket_comments(ticket_id, created_at);
+
+  -- =========================================================================
+  -- Billing — Phase 1: pricing, lifecycle, and events
+  -- =========================================================================
+  --
+  -- This block introduces the schema for the consolidated billing
+  -- subsystem. Phase 1 lands the schema + writes the lifecycle and
+  -- skill-event rows that downstream phases consume; invoice
+  -- generation, PDF rendering, Stripe wiring and reminders are added
+  -- in later phases. The invoice/line/reminder tables are created
+  -- here so all billing schema lives in a single migration block,
+  -- but no code writes to them until Phase 2.
+  --
+  -- Money columns: NUMERIC(10,2) for CHF amounts (max ~99 million.99
+  -- which is fine for the foreseeable future) and NUMERIC(10,5) for
+  -- per-unit prices (Threema messages and skill-days can have
+  -- sub-rappen unit prices — 0.00012 CHF/message is the kind of
+  -- granularity we want to keep precise across multiplication).
+  --
+  -- All timestamps are TIMESTAMPTZ. Billing-day computations use UTC
+  -- by convention (matches all other stored timestamps; avoids DST
+  -- ambiguity around month boundaries).
+
+  -- Single-row platform pricing config. The id=1 CHECK and explicit
+  -- DEFAULT 1 make accidental multi-row inserts impossible, and
+  -- callers can always SELECT * FROM platform_pricing WHERE id = 1.
+  -- (Could use a settings KV table; this shape is clearer for
+  -- typed columns that the admin UI binds to directly.)
+  CREATE TABLE IF NOT EXISTS platform_pricing (
+    id                       INT PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+    tenant_monthly_fee_chf   NUMERIC(10,2) NOT NULL DEFAULT 0,
+    tenant_setup_fee_chf     NUMERIC(10,2) NOT NULL DEFAULT 0,
+    -- Single price per Threema message; the relay reports in+out
+    -- separately but the spec ("billed per Message") treats both
+    -- directions identically. If asymmetric pricing is needed
+    -- later, split into in/out columns — additive change.
+    threema_message_chf      NUMERIC(10,5) NOT NULL DEFAULT 0,
+    -- Default VAT rate for CH/LI customers, as percent (e.g. 8.10).
+    -- Foreign customers' effective rate is computed at invoice time
+    -- from billing address + VAT number (reverse-charge logic).
+    vat_rate_chli            NUMERIC(5,2) NOT NULL DEFAULT 8.10,
+    updated_at               TIMESTAMPTZ NOT NULL DEFAULT now()
+  );
+  -- Ensure the single row exists. ON CONFLICT DO NOTHING is idempotent
+  -- on every migration run.
+  INSERT INTO platform_pricing (id) VALUES (1) ON CONFLICT DO NOTHING;
+
+  -- Per-package optional daily price. Any package id can have a row;
+  -- the admin UI in Phase 2 will only expose skill-category packages
+  -- because that's what the spec called for, but nothing here
+  -- prevents pricing other categories later.
+  --
+  -- "skill" naming follows the spec ("custom pricing also for skills").
+  CREATE TABLE IF NOT EXISTS skill_pricing (
+    skill_id                 TEXT PRIMARY KEY,
+    daily_price_chf          NUMERIC(10,5) NOT NULL,
+    created_at               TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at               TIMESTAMPTZ NOT NULL DEFAULT now()
+  );
+
+  -- One row per tenant. created_at anchors first-month proration;
+  -- deleted_at (nullable, stamped on delete) anchors last-month
+  -- proration. The PiecedTenant CR is the source of truth for
+  -- existence, but once the CR is deleted we lose its
+  -- creationTimestamp — so we mirror those two bookends here.
+  CREATE TABLE IF NOT EXISTS tenant_billing_lifecycle (
+    tenant_name              TEXT PRIMARY KEY,
+    zitadel_org_id           TEXT NOT NULL,
+    created_at               TIMESTAMPTZ NOT NULL,
+    deleted_at               TIMESTAMPTZ
+  );
+  CREATE INDEX IF NOT EXISTS idx_tenant_billing_lifecycle_org
+    ON tenant_billing_lifecycle(zitadel_org_id);
+
+  -- Skill enable/disable events. One row per state change; same-day
+  -- toggles still produce multiple rows, and the billing computation
+  -- collapses to distinct UTC days at compute time. This append-only
+  -- log preserves history for audit and lets us re-bill historical
+  -- months reproducibly.
+  --
+  -- skill_id is the package id from PACKAGE_CATALOG. We store
+  -- events for ALL package toggles, not just skill-category — the
+  -- channel/core toggles are cheap to record and may become billable
+  -- in the future without a schema change.
+  CREATE TABLE IF NOT EXISTS tenant_skill_events (
+    id                       BIGSERIAL PRIMARY KEY,
+    tenant_name              TEXT NOT NULL,
+    zitadel_org_id           TEXT NOT NULL,
+    skill_id                 TEXT NOT NULL,
+    event_kind               TEXT NOT NULL CHECK (event_kind IN ('enabled', 'disabled')),
+    occurred_at              TIMESTAMPTZ NOT NULL DEFAULT now()
+  );
+  CREATE INDEX IF NOT EXISTS idx_tenant_skill_events_tenant_skill
+    ON tenant_skill_events(tenant_name, skill_id, occurred_at);
+  CREATE INDEX IF NOT EXISTS idx_tenant_skill_events_org_time
+    ON tenant_skill_events(zitadel_org_id, occurred_at);
+
+  -- Suspend/resume transitions. Same shape as skill events. Reading
+  -- these in order reconstructs the suspended-state segments for
+  -- monthly fee proration: a tenant in 'suspended' state pays no
+  -- monthly fee for the days it was suspended.
+  --
+  -- The portal commands the transition (PATCH spec.suspend); the
+  -- operator observes and stamps PiecedTenantStatus.suspendedAt
+  -- after reconcile. We record the event at command time — billing
+  -- is monthly so the few-second reconcile lag is irrelevant.
+  CREATE TABLE IF NOT EXISTS tenant_suspension_events (
+    id                       BIGSERIAL PRIMARY KEY,
+    tenant_name              TEXT NOT NULL,
+    zitadel_org_id           TEXT NOT NULL,
+    event_kind               TEXT NOT NULL CHECK (event_kind IN ('suspended','resumed')),
+    occurred_at              TIMESTAMPTZ NOT NULL DEFAULT now()
+  );
+  CREATE INDEX IF NOT EXISTS idx_tenant_suspension_events_tenant
+    ON tenant_suspension_events(tenant_name, occurred_at);
+
+  -- Per-org billing configuration. Distinct from org_billing
+  -- (address/VAT/email): that table is customer-editable, this one
+  -- is admin-controlled and holds the payment posture.
+  --
+  -- Defaults: a new org has pay_by_invoice = false (must use a
+  -- credit card per the onboarding gate in Phase 4) and auto
+  -- billing/reminders enabled. Admin can flip pay_by_invoice on
+  -- per customer, after which approval no longer requires a card.
+  CREATE TABLE IF NOT EXISTS org_billing_config (
+    zitadel_org_id           TEXT PRIMARY KEY,
+    pay_by_invoice           BOOLEAN NOT NULL DEFAULT FALSE,
+    stripe_customer_id       TEXT,
+    auto_invoice_enabled     BOOLEAN NOT NULL DEFAULT TRUE,
+    auto_reminders_enabled   BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at               TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at               TIMESTAMPTZ NOT NULL DEFAULT now()
+  );
+
+  -- Stripe payment methods. Populated by the Phase 4 webhook handler.
+  -- Created in Phase 1 so all billing schema is together; rows are
+  -- empty until Phase 4 ships.
+  CREATE TABLE IF NOT EXISTS org_payment_methods (
+    id                       UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    zitadel_org_id           TEXT NOT NULL,
+    stripe_payment_method_id TEXT NOT NULL UNIQUE,
+    brand                    TEXT,
+    last4                    TEXT,
+    exp_month                INT,
+    exp_year                 INT,
+    is_default               BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at               TIMESTAMPTZ NOT NULL DEFAULT now()
+  );
+  CREATE INDEX IF NOT EXISTS idx_org_payment_methods_org
+    ON org_payment_methods(zitadel_org_id);
+  -- At most one default payment method per org. Partial unique index
+  -- so non-default rows don't conflict with each other.
+  CREATE UNIQUE INDEX IF NOT EXISTS uniq_org_payment_methods_default
+    ON org_payment_methods(zitadel_org_id) WHERE is_default = TRUE;
+
+  -- Gapless per-year invoice number counter (Art. 957a OR
+  -- compliance). A Postgres SEQUENCE would be faster but allows
+  -- gaps on rollback; this counter table is SELECT FOR UPDATE-able
+  -- and produces gapless numbers when the invoice insert is in the
+  -- same transaction. Populated lazily — the first invoice of each
+  -- year inserts its row.
+  CREATE TABLE IF NOT EXISTS invoice_number_counters (
+    year                     INT PRIMARY KEY,
+    last_number              INT NOT NULL DEFAULT 0
+  );
+
+  -- Issued invoices. Immutable once status leaves 'draft'.
+  -- billing_snapshot captures the address/VAT/email at issue time
+  -- so subsequent edits to org_billing don't mutate historical
+  -- invoices.
+  CREATE TABLE IF NOT EXISTS invoices (
+    id                       UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    invoice_number           TEXT NOT NULL UNIQUE,
+    zitadel_org_id           TEXT NOT NULL,
+    -- Billing period as DATEs (not timestamps): a calendar month.
+    -- period_end is the last day of the month, inclusive.
+    period_start             DATE NOT NULL,
+    period_end               DATE NOT NULL,
+    issued_at                TIMESTAMPTZ NOT NULL DEFAULT now(),
+    due_at                   DATE NOT NULL,
+    subtotal_chf             NUMERIC(10,2) NOT NULL,
+    vat_rate                 NUMERIC(5,2) NOT NULL,
+    vat_amount_chf           NUMERIC(10,2) NOT NULL,
+    total_chf                NUMERIC(10,2) NOT NULL,
+    status                   TEXT NOT NULL DEFAULT 'open' CHECK (
+      status IN ('draft','open','paid','overdue','void','uncollectible')
+    ),
+    billing_snapshot         JSONB NOT NULL,
+    payment_method           TEXT NOT NULL CHECK (payment_method IN ('invoice','card')),
+    stripe_payment_intent_id TEXT,
+    pdf_data                 BYTEA,
+    pdf_filename             TEXT,
+    admin_notes              TEXT,
+    paid_at                  TIMESTAMPTZ,
+    paid_by                  TEXT,
+    paid_method_detail       TEXT,
+    created_at               TIMESTAMPTZ NOT NULL DEFAULT now()
+  );
+  CREATE INDEX IF NOT EXISTS idx_invoices_org
+    ON invoices(zitadel_org_id, issued_at DESC);
+  CREATE INDEX IF NOT EXISTS idx_invoices_status
+    ON invoices(status, due_at);
+  -- One invoice per org per billing month — protects the monthly
+  -- cron from double-issuing if it gets retried mid-run.
+  CREATE UNIQUE INDEX IF NOT EXISTS uniq_invoices_org_period
+    ON invoices(zitadel_org_id, period_start);
+
+  -- Invoice line items. The kind column lets the PDF renderer
+  -- group lines (all monthly fees together, all AI usage together,
+  -- etc.) and the admin UI filter by category.
+  CREATE TABLE IF NOT EXISTS invoice_lines (
+    id                       UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    invoice_id               UUID NOT NULL REFERENCES invoices(id) ON DELETE CASCADE,
+    -- NULL for org-wide items; tenant name for per-tenant breakdowns.
+    tenant_name              TEXT,
+    kind                     TEXT NOT NULL CHECK (kind IN (
+      'tenant_monthly','tenant_setup','ai_usage','threema_messages','skill_usage','adjustment'
+    )),
+    description              TEXT NOT NULL,
+    quantity                 NUMERIC(12,4) NOT NULL DEFAULT 1,
+    unit_label               TEXT,
+    unit_price_chf           NUMERIC(10,5) NOT NULL,
+    amount_chf               NUMERIC(10,2) NOT NULL,
+    -- Per-kind audit metadata (e.g. {proration_days, days_in_month}
+    -- for tenant_monthly; {in_count, out_count} for threema_messages).
+    metadata                 JSONB,
+    display_order            INT NOT NULL DEFAULT 0
+  );
+  CREATE INDEX IF NOT EXISTS idx_invoice_lines_invoice
+    ON invoice_lines(invoice_id, display_order);
+
+  -- Reminders fired against open/overdue invoices. Level 3 = final.
+  -- One PDF per reminder, stored alongside.
+  CREATE TABLE IF NOT EXISTS invoice_reminders (
+    id                       UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    invoice_id               UUID NOT NULL REFERENCES invoices(id) ON DELETE CASCADE,
+    level                    INT NOT NULL CHECK (level IN (1, 2, 3)),
+    sent_at                  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    sent_by                  TEXT NOT NULL,
+    pdf_data                 BYTEA,
+    pdf_filename             TEXT,
+    email_sent_to            TEXT,
+    UNIQUE (invoice_id, level)
+  );
+  CREATE INDEX IF NOT EXISTS idx_invoice_reminders_invoice
+    ON invoice_reminders(invoice_id, level);
 `;

 let migrated = false;
@@ -1336,3 +1582,545 @@ export async function updateSupportTicket(
  );
  return result.rows.length > 0 ? rowToSupportTicket(result.rows[0]) : null;
 }
+
+// ---------------------------------------------------------------------------
+// Billing — Phase 1: pricing, lifecycle, and skill events
+// ---------------------------------------------------------------------------
+//
+// All helpers are intentionally narrow CRUD — no business logic.
+// Higher-level operations (compute monthly proration, build an
+// invoice from raw signals) belong in a future lib/billing.ts
+// introduced by Phase 2.
+//
+// Hook callers should treat every write here as best-effort: if
+// recording a lifecycle/event row fails, log and continue — never
+// fail the underlying K8s mutation. Drift is corrected by the
+// idempotent backfill helper at the bottom of this section.
+
+import type {
+  PlatformPricing,
+  SkillPricing,
+  OrgBillingConfig,
+  TenantBillingLifecycle,
+  TenantSkillEvent,
+  TenantSuspensionEvent,
+} from "@/types";
+
+// --- platform_pricing ------------------------------------------------------
+
+function rowToPlatformPricing(row: any): PlatformPricing {
+  return {
+    tenantMonthlyFeeChf: Number(row.tenant_monthly_fee_chf),
+    tenantSetupFeeChf: Number(row.tenant_setup_fee_chf),
+    threemaMessageChf: Number(row.threema_message_chf),
+    vatRateChli: Number(row.vat_rate_chli),
+    updatedAt: row.updated_at?.toISOString?.() ?? row.updated_at,
+  };
+}
+
+/**
+ * Read the single-row platform pricing config. The migration seeds
+ * the row with zeros on first run, so this never returns null on a
+ * properly migrated database.
+ */
+export async function getPlatformPricing(): Promise<PlatformPricing> {
+  await ensureSchema();
+  const result = await getPool().query(
+    "SELECT * FROM platform_pricing WHERE id = 1"
+  );
+  if (result.rows.length === 0) {
+    // Defensive: re-seed if the row went missing (manual DELETE,
+    // partial restore, etc.). The migration's INSERT ON CONFLICT
+    // should have ensured this, but a stale row state shouldn't
+    // crash the helper.
+    await getPool().query(
+      "INSERT INTO platform_pricing (id) VALUES (1) ON CONFLICT DO NOTHING"
+    );
+    const retry = await getPool().query(
+      "SELECT * FROM platform_pricing WHERE id = 1"
+    );
+    return rowToPlatformPricing(retry.rows[0]);
+  }
+  return rowToPlatformPricing(result.rows[0]);
+}
+
+/**
+ * Update one or more pricing fields. Pass only the fields to change;
+ * unspecified fields are left as-is. `updated_at` is always refreshed.
+ */
+export async function updatePlatformPricing(changes: {
+  tenantMonthlyFeeChf?: number;
+  tenantSetupFeeChf?: number;
+  threemaMessageChf?: number;
+  vatRateChli?: number;
+}): Promise<PlatformPricing> {
+  await ensureSchema();
+  const sets: string[] = ["updated_at = now()"];
+  const values: any[] = [];
+  let idx = 1;
+  if (changes.tenantMonthlyFeeChf !== undefined) {
+    sets.push(`tenant_monthly_fee_chf = $${idx++}`);
+    values.push(changes.tenantMonthlyFeeChf);
+  }
+  if (changes.tenantSetupFeeChf !== undefined) {
+    sets.push(`tenant_setup_fee_chf = $${idx++}`);
+    values.push(changes.tenantSetupFeeChf);
+  }
+  if (changes.threemaMessageChf !== undefined) {
+    sets.push(`threema_message_chf = $${idx++}`);
+    values.push(changes.threemaMessageChf);
+  }
+  if (changes.vatRateChli !== undefined) {
+    sets.push(`vat_rate_chli = $${idx++}`);
+    values.push(changes.vatRateChli);
+  }
+  // Only updated_at would change → still execute so the caller's
+  // intent ("touch the row") isn't silently dropped, but make it
+  // an explicit no-op if no fields were provided.
+  if (sets.length === 1 && values.length === 0) {
+    return getPlatformPricing();
+  }
+  const result = await getPool().query(
+    `UPDATE platform_pricing SET ${sets.join(", ")} WHERE id = 1 RETURNING *`,
+    values
+  );
+  return rowToPlatformPricing(result.rows[0]);
+}
+
+// --- skill_pricing ---------------------------------------------------------
+
+function rowToSkillPricing(row: any): SkillPricing {
+  return {
+    skillId: row.skill_id,
+    dailyPriceChf: Number(row.daily_price_chf),
+    createdAt: row.created_at?.toISOString?.() ?? row.created_at,
+    updatedAt: row.updated_at?.toISOString?.() ?? row.updated_at,
+  };
+}
+
+export async function listSkillPricing(): Promise<SkillPricing[]> {
+  await ensureSchema();
+  const result = await getPool().query(
+    "SELECT * FROM skill_pricing ORDER BY skill_id"
+  );
+  return result.rows.map(rowToSkillPricing);
+}
+
+export async function getSkillPricing(
+  skillId: string
+): Promise<SkillPricing | null> {
+  await ensureSchema();
+  const result = await getPool().query(
+    "SELECT * FROM skill_pricing WHERE skill_id = $1",
+    [skillId]
+  );
+  return result.rows.length > 0 ? rowToSkillPricing(result.rows[0]) : null;
+}
+
+/**
+ * Upsert a daily price for a package. Setting a price activates
+ * usage-based billing for the (tenant, skill) pair: every UTC day
+ * the package was enabled in the billing month is one unit on the
+ * invoice.
+ */
+export async function setSkillPricing(
+  skillId: string,
+  dailyPriceChf: number
+): Promise<SkillPricing> {
+  await ensureSchema();
+  const result = await getPool().query(
+    `INSERT INTO skill_pricing (skill_id, daily_price_chf)
+     VALUES ($1, $2)
+     ON CONFLICT (skill_id) DO UPDATE SET
+       daily_price_chf = EXCLUDED.daily_price_chf,
+       updated_at      = now()
+     RETURNING *`,
+    [skillId, dailyPriceChf]
+  );
+  return rowToSkillPricing(result.rows[0]);
+}
+
+/**
+ * Remove the price for a package. Day-tracking events continue to
+ * be recorded (cheap append-only) but the package becomes free
+ * effective immediately. Historical invoices already issued are
+ * unaffected.
+ */
+export async function removeSkillPricing(skillId: string): Promise<void> {
+  await ensureSchema();
+  await getPool().query("DELETE FROM skill_pricing WHERE skill_id = $1", [
+    skillId,
+  ]);
+}
+
+// --- tenant_billing_lifecycle ---------------------------------------------
+
+function rowToTenantBillingLifecycle(row: any): TenantBillingLifecycle {
+  return {
+    tenantName: row.tenant_name,
+    zitadelOrgId: row.zitadel_org_id,
+    createdAt: row.created_at?.toISOString?.() ?? row.created_at,
+    deletedAt: row.deleted_at?.toISOString?.() ?? row.deleted_at ?? null,
+  };
+}
+
+export async function getTenantBillingLifecycle(
+  tenantName: string
+): Promise<TenantBillingLifecycle | null> {
+  await ensureSchema();
+  const result = await getPool().query(
+    "SELECT * FROM tenant_billing_lifecycle WHERE tenant_name = $1",
+    [tenantName]
+  );
+  return result.rows.length > 0
+    ? rowToTenantBillingLifecycle(result.rows[0])
+    : null;
+}
+
+/**
+ * Record a tenant's creation for billing purposes. Idempotent on
+ * `tenant_name` — re-running with a different created_at is a no-op
+ * so re-approvals don't move the proration anchor. Pair with
+ * recordInitialSkillEvents() at the same call site.
+ */
+export async function recordTenantCreated(
+  tenantName: string,
+  zitadelOrgId: string,
+  createdAt?: Date
+): Promise<void> {
+  await ensureSchema();
+  await getPool().query(
+    `INSERT INTO tenant_billing_lifecycle (tenant_name, zitadel_org_id, created_at)
+     VALUES ($1, $2, COALESCE($3::timestamptz, now()))
+     ON CONFLICT (tenant_name) DO NOTHING`,
+    [tenantName, zitadelOrgId, createdAt ?? null]
+  );
+}
+
+/**
+ * Stamp deletion timestamp. Idempotent — calling twice keeps the
+ * first deletion's timestamp. Pair with closing-skill-disabled
+ * events at the same call site if you want the events log to
+ * reflect that everything is now off.
+ *
+ * We deliberately don't delete the row — the lifecycle record is
+ * needed for any final invoice covering the deletion month.
+ */
+export async function recordTenantDeleted(
+  tenantName: string,
+  deletedAt?: Date
+): Promise<void> {
+  await ensureSchema();
+  await getPool().query(
+    `UPDATE tenant_billing_lifecycle
+       SET deleted_at = COALESCE(deleted_at, COALESCE($2::timestamptz, now()))
+     WHERE tenant_name = $1`,
+    [tenantName, deletedAt ?? null]
+  );
+}
+
+// --- tenant_skill_events --------------------------------------------------
+
+function rowToTenantSkillEvent(row: any): TenantSkillEvent {
+  return {
+    id: String(row.id),
+    tenantName: row.tenant_name,
+    zitadelOrgId: row.zitadel_org_id,
+    skillId: row.skill_id,
+    eventKind: row.event_kind as "enabled" | "disabled",
+    occurredAt: row.occurred_at?.toISOString?.() ?? row.occurred_at,
+  };
+}
+
+/**
+ * Append a batch of enabled/disabled events. Single multi-row INSERT
+ * so all rows share an effectively-identical occurred_at when
+ * `occurredAt` is omitted (otherwise they'd be a few microseconds
+ * apart, which would skew the "is this skill on for day D" computation
+ * around midnight UTC).
+ *
+ * Empty arrays are a no-op (no SQL fired).
+ */
+export async function recordSkillEvents(
+  tenantName: string,
+  zitadelOrgId: string,
+  added: string[],
+  removed: string[],
+  occurredAt?: Date
+): Promise<void> {
+  if (added.length === 0 && removed.length === 0) return;
+  await ensureSchema();
+  const at = occurredAt ?? new Date();
+  // Build placeholders. Each row uses 5 placeholders.
+  const values: any[] = [];
+  const rows: string[] = [];
+  let idx = 1;
+  for (const skillId of added) {
+    rows.push(`($${idx++}, $${idx++}, $${idx++}, 'enabled', $${idx++})`);
+    values.push(tenantName, zitadelOrgId, skillId, at);
+  }
+  for (const skillId of removed) {
+    rows.push(`($${idx++}, $${idx++}, $${idx++}, 'disabled', $${idx++})`);
+    values.push(tenantName, zitadelOrgId, skillId, at);
+  }
+  await getPool().query(
+    `INSERT INTO tenant_skill_events
+       (tenant_name, zitadel_org_id, skill_id, event_kind, occurred_at)
+     VALUES ${rows.join(", ")}`,
+    values
+  );
+}
+
+/**
+ * Read events for a tenant within a half-open interval — `from`
+ * inclusive, `to` exclusive. Used by Phase 2's billing computation
+ * to collapse to billable days. Returned in chronological order.
+ */
+export async function listSkillEventsForTenant(
+  tenantName: string,
+  from: Date,
+  to: Date
+): Promise<TenantSkillEvent[]> {
+  await ensureSchema();
+  const result = await getPool().query(
+    `SELECT * FROM tenant_skill_events
+      WHERE tenant_name = $1
+        AND occurred_at >= $2
+        AND occurred_at <  $3
+      ORDER BY occurred_at, id`,
+    [tenantName, from, to]
+  );
+  return result.rows.map(rowToTenantSkillEvent);
+}
+
+/**
+ * Read the most recent event for each (tenant, skill) pair as of
+ * a moment in time. Phase 2 uses this to know which skills were
+ * enabled at the start of a billing window.
+ *
+ * Implemented with DISTINCT ON for a single round-trip; the
+ * (tenant_name, skill_id, occurred_at) index supports the sort.
+ */
+export async function getSkillStateAt(
+  tenantName: string,
+  asOf: Date
+): Promise<Record<string, "enabled" | "disabled">> {
+  await ensureSchema();
+  const result = await getPool().query(
+    `SELECT DISTINCT ON (skill_id) skill_id, event_kind
+       FROM tenant_skill_events
+      WHERE tenant_name = $1 AND occurred_at <= $2
+      ORDER BY skill_id, occurred_at DESC, id DESC`,
+    [tenantName, asOf]
+  );
+  const out: Record<string, "enabled" | "disabled"> = {};
+  for (const row of result.rows) {
+    out[row.skill_id] = row.event_kind as "enabled" | "disabled";
+  }
+  return out;
+}
+
+// --- tenant_suspension_events ---------------------------------------------
+
+function rowToTenantSuspensionEvent(row: any): TenantSuspensionEvent {
+  return {
+    id: String(row.id),
+    tenantName: row.tenant_name,
+    zitadelOrgId: row.zitadel_org_id,
+    eventKind: row.event_kind as "suspended" | "resumed",
+    occurredAt: row.occurred_at?.toISOString?.() ?? row.occurred_at,
+  };
+}
+
+export async function recordSuspensionEvent(
+  tenantName: string,
+  zitadelOrgId: string,
+  eventKind: "suspended" | "resumed",
+  occurredAt?: Date
+): Promise<void> {
+  await ensureSchema();
+  await getPool().query(
+    `INSERT INTO tenant_suspension_events
+       (tenant_name, zitadel_org_id, event_kind, occurred_at)
+     VALUES ($1, $2, $3, COALESCE($4::timestamptz, now()))`,
+    [tenantName, zitadelOrgId, eventKind, occurredAt ?? null]
+  );
+}
+
+export async function listSuspensionEventsForTenant(
+  tenantName: string,
+  from: Date,
+  to: Date
+): Promise<TenantSuspensionEvent[]> {
+  await ensureSchema();
+  const result = await getPool().query(
+    `SELECT * FROM tenant_suspension_events
+      WHERE tenant_name = $1
+        AND occurred_at >= $2
+        AND occurred_at <  $3
+      ORDER BY occurred_at, id`,
+    [tenantName, from, to]
+  );
+  return result.rows.map(rowToTenantSuspensionEvent);
+}
+
+// --- org_billing_config ---------------------------------------------------
+
+function rowToOrgBillingConfig(row: any): OrgBillingConfig {
+  return {
+    zitadelOrgId: row.zitadel_org_id,
+    payByInvoice: row.pay_by_invoice,
+    stripeCustomerId: row.stripe_customer_id ?? null,
+    autoInvoiceEnabled: row.auto_invoice_enabled,
+    autoRemindersEnabled: row.auto_reminders_enabled,
+    createdAt: row.created_at?.toISOString?.() ?? row.created_at,
+    updatedAt: row.updated_at?.toISOString?.() ?? row.updated_at,
+  };
+}
+
+/**
+ * Get config for an org, auto-creating with defaults if missing.
+ * Returning the row (vs null) simplifies callers: the gate logic in
+ * Phase 4 ("approve only if pay_by_invoice OR has card") doesn't
+ * need a "what if no row" branch.
+ *
+ * Defaults are baked into the table's column defaults, so the
+ * INSERT here only needs the primary key.
+ */
+export async function getOrgBillingConfig(
+  zitadelOrgId: string
+): Promise<OrgBillingConfig> {
+  await ensureSchema();
+  await getPool().query(
+    `INSERT INTO org_billing_config (zitadel_org_id)
+     VALUES ($1)
+     ON CONFLICT (zitadel_org_id) DO NOTHING`,
+    [zitadelOrgId]
+  );
+  const result = await getPool().query(
+    "SELECT * FROM org_billing_config WHERE zitadel_org_id = $1",
+    [zitadelOrgId]
+  );
+  return rowToOrgBillingConfig(result.rows[0]);
+}
+
+export async function updateOrgBillingConfig(
+  zitadelOrgId: string,
+  changes: {
+    payByInvoice?: boolean;
+    stripeCustomerId?: string | null;
+    autoInvoiceEnabled?: boolean;
+    autoRemindersEnabled?: boolean;
+  }
+): Promise<OrgBillingConfig> {
+  await ensureSchema();
+  // Ensure row exists first — mirrors getOrgBillingConfig's
+  // auto-create.
+  await getPool().query(
+    `INSERT INTO org_billing_config (zitadel_org_id)
+     VALUES ($1)
+     ON CONFLICT (zitadel_org_id) DO NOTHING`,
+    [zitadelOrgId]
+  );
+  const sets: string[] = ["updated_at = now()"];
+  const values: any[] = [zitadelOrgId];
+  let idx = 2;
+  if (changes.payByInvoice !== undefined) {
+    sets.push(`pay_by_invoice = $${idx++}`);
+    values.push(changes.payByInvoice);
+  }
+  if (changes.stripeCustomerId !== undefined) {
+    sets.push(`stripe_customer_id = $${idx++}`);
+    values.push(changes.stripeCustomerId);
+  }
+  if (changes.autoInvoiceEnabled !== undefined) {
+    sets.push(`auto_invoice_enabled = $${idx++}`);
+    values.push(changes.autoInvoiceEnabled);
+  }
+  if (changes.autoRemindersEnabled !== undefined) {
+    sets.push(`auto_reminders_enabled = $${idx++}`);
+    values.push(changes.autoRemindersEnabled);
+  }
+  const result = await getPool().query(
+    `UPDATE org_billing_config
+        SET ${sets.join(", ")}
+      WHERE zitadel_org_id = $1
+      RETURNING *`,
+    values
+  );
+  return rowToOrgBillingConfig(result.rows[0]);
+}
+
+// --- Backfill -------------------------------------------------------------
+//
+// Idempotent one-time bootstrap for tenants that existed before
+// Phase 1 shipped. Phase 2 wraps this in an admin endpoint; for now
+// it can be invoked from a one-off node script.
+//
+// For each PiecedTenant CR:
+//   - If no tenant_billing_lifecycle row exists, insert one with
+//     created_at = metadata.creationTimestamp.
+//   - If no tenant_skill_events row exists for the tenant, insert
+//     'enabled' events at the same timestamp for every package
+//     currently in spec.packages.
+// Tenants suspended at backfill time get a 'suspended' event at
+// status.suspendedAt (operator-stamped); resumed tenants get nothing
+// extra (default state is "running").
+
+/**
+ * Returns a count of lifecycle rows inserted and skill events
+ * recorded — both expected to be zero on a second run.
+ */
+export async function backfillTenantBillingLifecycle(tenants: {
+  name: string;
+  zitadelOrgId: string;
+  createdAt: Date;
+  packages: string[];
+  suspendedAt: Date | null;
+}[]): Promise<{ lifecycleInserted: number; eventsInserted: number; suspensionEventsInserted: number }> {
+  await ensureSchema();
+  let lifecycleInserted = 0;
+  let eventsInserted = 0;
+  let suspensionEventsInserted = 0;
+  for (const t of tenants) {
+    // Lifecycle row — idempotent.
+    const existing = await getTenantBillingLifecycle(t.name);
+    if (!existing) {
+      await recordTenantCreated(t.name, t.zitadelOrgId, t.createdAt);
+      lifecycleInserted++;
+    }
+    // Initial skill events — only if the tenant has zero events at
+    // all. We don't want to add to an active event stream.
+    const eventsRow = await getPool().query(
+      "SELECT 1 FROM tenant_skill_events WHERE tenant_name = $1 LIMIT 1",
+      [t.name]
+    );
+    if (eventsRow.rows.length === 0 && t.packages.length > 0) {
+      await recordSkillEvents(
+        t.name,
+        t.zitadelOrgId,
+        t.packages,
+        [],
+        t.createdAt
+      );
+      eventsInserted += t.packages.length;
+    }
+    // Suspension state — only if the tenant has zero suspension
+    // events. If it's currently suspended, record one 'suspended'
+    // event at the operator-stamped time so proration sees it.
+    const susRow = await getPool().query(
+      "SELECT 1 FROM tenant_suspension_events WHERE tenant_name = $1 LIMIT 1",
+      [t.name]
+    );
+    if (susRow.rows.length === 0 && t.suspendedAt) {
+      await recordSuspensionEvent(
+        t.name,
+        t.zitadelOrgId,
+        "suspended",
+        t.suspendedAt
+      );
+      suspensionEventsInserted++;
+    }
+  }
+  return { lifecycleInserted, eventsInserted, suspensionEventsInserted };
+}
--- a/src/lib/packages.ts
+++ b/src/lib/packages.ts
@@ -1,9 +1,45 @@
+/**
+ * Portal-side package catalog. Hardcoded mirror of the operator-side
+ * catalog ConfigMap (deploy/helm/pieced-operator/templates/catalog-cm.yaml).
+ *
+ * The two have to stay in sync:
+ *   - `id` here must match the catalog key in the ConfigMap.
+ *   - `secrets[].key` here must match the catalog's env_vars[].secret_key
+ *     so that POST /api/tenants/:name/secrets writes to the same OpenBao
+ *     path the operator's ExternalSecret reads from.
+ *   - `requiresSecrets` is true when the catalog declares any env_var
+ *     that is a secret (vault_path_suffix set, no default value).
+ *
+ * Category model (Phase A rework):
+ *   - core    — platform-behaviour toggles (heartbeat, cron,
+ *               active-memory, voice). Mostly no secrets. core-voice is
+ *               fully wired (Phase B): toggling installs the STT / TTS /
+ *               Talk surface via the operator's config_patch, routed
+ *               through LiteLLM (pieced-stt, pieced-tts-inbound,
+ *               pieced-tts-talk).
+ *   - channel — messaging integration.
+ *   - skill   — ClawHub skill install.
+ *
+ * Custom provisioning (Threema):
+ *   The `threema` channel sets `requiresSecrets: false` because its
+ *   credentials are platform-issued, not customer-entered. Enabling
+ *   threema goes through a dedicated endpoint
+ *   (/api/tenants/:name/threema) that mints token + HMAC secret from
+ *   the central pieced-threema-gateway relay and writes them to OpenBao
+ *   at secret/data/tenants/<name>/threema-relay before the package is
+ *   added to spec.packages. Disabling reverses both steps. The
+ *   `customProvisioning` flag here tells the package-card UI to use
+ *   that endpoint instead of the standard /secrets+PATCH dance.
+ */
+
 export interface PackageSecretField {
  key: string;
  labelKey: string;
  placeholderKey: string;
 }

+export type PackageCategory = "core" | "channel" | "skill";
+
 export interface PackageDef {
  id: string;
  name: string;
@@ -12,10 +48,53 @@ export interface PackageDef {
  secrets?: PackageSecretField[];
  instructionsKey?: string;
  disclaimerKey?: string;
-  category: "channel" | "skill";
+  category: PackageCategory;
+  /**
+   * When true, enabling/disabling this package goes through
+   * /api/tenants/:name/<id> (POST/DELETE) instead of the generic
+   * /secrets+PATCH flow. The handler at that path does platform-side
+   * provisioning (mint credentials, register with sibling services, etc.)
+   * that the customer is not aware of.
+   */
+  customProvisioning?: boolean;
 }

 export const PACKAGE_CATALOG: PackageDef[] = [
+  // -------------------------------------------------------------------------
+  // CORE
+  // -------------------------------------------------------------------------
+  {
+    id: "core-heartbeat",
+    name: "Heartbeat (Proactive Checks)",
+    descriptionKey: "packages.coreHeartbeat.description",
+    requiresSecrets: false,
+    category: "core",
+  },
+  {
+    id: "core-cron",
+    name: "Scheduled Tasks (Cron)",
+    descriptionKey: "packages.coreCron.description",
+    requiresSecrets: false,
+    category: "core",
+  },
+  {
+    id: "core-active-memory",
+    name: "Active Memory",
+    descriptionKey: "packages.coreActiveMemory.description",
+    requiresSecrets: false,
+    category: "core",
+  },
+  {
+    id: "core-voice",
+    name: "Voice Interaction",
+    descriptionKey: "packages.coreVoice.description",
+    requiresSecrets: false,
+    category: "core",
+  },
+
+  // -------------------------------------------------------------------------
+  // CHANNELS
+  // -------------------------------------------------------------------------
  {
    id: "telegram",
    name: "Telegram",
@@ -43,42 +122,201 @@ export const PACKAGE_CATALOG: PackageDef[] = [
        labelKey: "packages.discord.botTokenLabel",
        placeholderKey: "packages.discord.botTokenPlaceholder",
      },
+      // app-id was missing from the portal catalog historically while the
+      // operator catalog declared DISCORD_APP_ID as a required env var.
+      // Tenants who enabled Discord ended up with the env var blank
+      // because the secrets POST never wrote an `app-id` key to OpenBao
+      // and the operator's ExternalSecret couldn't populate it. Added
+      // here as part of the Phase A rework to close the alignment gap;
+      // not strictly secret (the application ID is visible in the bot's
+      // profile URL) but stored alongside the bot token for convenience.
+      {
+        key: "app-id",
+        labelKey: "packages.discord.appIdLabel",
+        placeholderKey: "packages.discord.appIdPlaceholder",
+      },
    ],
    instructionsKey: "packages.discord.instructions",
    disclaimerKey: "packages.discord.disclaimer",
    category: "channel",
  },
  {
-    id: "email",
-    name: "Email",
-    descriptionKey: "packages.email.description",
-    requiresSecrets: true,
-    secrets: [
-      { key: "smtp-host", labelKey: "packages.email.smtpHostLabel", placeholderKey: "packages.email.smtpHostPlaceholder" },
-      { key: "smtp-user", labelKey: "packages.email.smtpUserLabel", placeholderKey: "packages.email.smtpUserPlaceholder" },
-      { key: "smtp-password", labelKey: "packages.email.smtpPasswordLabel", placeholderKey: "packages.email.smtpPasswordPlaceholder" },
-      { key: "imap-host", labelKey: "packages.email.imapHostLabel", placeholderKey: "packages.email.imapHostPlaceholder" },
-    ],
-    instructionsKey: "packages.email.instructions",
-    disclaimerKey: "packages.email.disclaimer",
+    id: "threema",
+    name: "Threema",
+    descriptionKey: "packages.threema.description",
+    // No customer-entered secrets. The token + hmac secret are minted
+    // server-side by the relay's /admin/tokens endpoint when the
+    // package is enabled, and stored in OpenBao by the portal. The
+    // `customProvisioning` flag steers the PackageCard UI through the
+    // dedicated /api/tenants/:name/threema endpoint instead.
+    requiresSecrets: false,
+    customProvisioning: true,
+    instructionsKey: "packages.threema.instructions",
+    disclaimerKey: "packages.threema.disclaimer",
    category: "channel",
  },
+
+  // -------------------------------------------------------------------------
+  // SKILLS
+  // -------------------------------------------------------------------------
  {
-    id: "web-search",
-    name: "Web Search",
-    descriptionKey: "packages.webSearch.description",
+    id: "git-cli",
+    name: "Git CLI",
+    descriptionKey: "packages.gitCli.description",
    requiresSecrets: false,
    category: "skill",
  },
  {
-    id: "document-processing",
-    name: "Document Processing",
-    descriptionKey: "packages.documentProcessing.description",
+    id: "github",
+    name: "GitHub (gh CLI)",
+    descriptionKey: "packages.github.description",
+    requiresSecrets: true,
+    secrets: [
+      {
+        key: "token",
+        labelKey: "packages.github.tokenLabel",
+        placeholderKey: "packages.github.tokenPlaceholder",
+      },
+    ],
+    instructionsKey: "packages.github.instructions",
+    category: "skill",
+  },
+  {
+    id: "gitea",
+    name: "Gitea",
+    descriptionKey: "packages.gitea.description",
+    requiresSecrets: true,
+    secrets: [
+      {
+        key: "token",
+        labelKey: "packages.gitea.tokenLabel",
+        placeholderKey: "packages.gitea.tokenPlaceholder",
+      },
+    ],
+    instructionsKey: "packages.gitea.instructions",
+    category: "skill",
+  },
+  {
+    id: "whisper-self-hosted",
+    name: "Whisper (Self-Hosted Transcription)",
+    descriptionKey: "packages.whisperSelfHosted.description",
    requiresSecrets: false,
    category: "skill",
  },
+  {
+    id: "searxng-local-search",
+    name: "Web Search (SearXNG)",
+    descriptionKey: "packages.searxngLocalSearch.description",
+    requiresSecrets: false,
+    category: "skill",
+  },
+  {
+    id: "gog",
+    name: "Google Workspace (Gog)",
+    descriptionKey: "packages.gog.description",
+    requiresSecrets: true,
+    secrets: [
+      {
+        key: "client-id",
+        labelKey: "packages.gog.clientIdLabel",
+        placeholderKey: "packages.gog.clientIdPlaceholder",
+      },
+      {
+        key: "client-secret",
+        labelKey: "packages.gog.clientSecretLabel",
+        placeholderKey: "packages.gog.clientSecretPlaceholder",
+      },
+      {
+        key: "refresh-token",
+        labelKey: "packages.gog.refreshTokenLabel",
+        placeholderKey: "packages.gog.refreshTokenPlaceholder",
+      },
+    ],
+    instructionsKey: "packages.gog.instructions",
+    disclaimerKey: "packages.gog.disclaimer",
+    category: "skill",
+  },
+  {
+    id: "mail",
+    name: "Email (IMAP / SMTP)",
+    descriptionKey: "packages.mail.description",
+    requiresSecrets: true,
+    secrets: [
+      {
+        key: "imap-host",
+        labelKey: "packages.mail.imapHostLabel",
+        placeholderKey: "packages.mail.imapHostPlaceholder",
+      },
+      {
+        key: "imap-user",
+        labelKey: "packages.mail.imapUserLabel",
+        placeholderKey: "packages.mail.imapUserPlaceholder",
+      },
+      {
+        key: "imap-pass",
+        labelKey: "packages.mail.imapPassLabel",
+        placeholderKey: "packages.mail.imapPassPlaceholder",
+      },
+      {
+        key: "smtp-host",
+        labelKey: "packages.mail.smtpHostLabel",
+        placeholderKey: "packages.mail.smtpHostPlaceholder",
+      },
+      {
+        key: "smtp-user",
+        labelKey: "packages.mail.smtpUserLabel",
+        placeholderKey: "packages.mail.smtpUserPlaceholder",
+      },
+      {
+        key: "smtp-pass",
+        labelKey: "packages.mail.smtpPassLabel",
+        placeholderKey: "packages.mail.smtpPassPlaceholder",
+      },
+    ],
+    instructionsKey: "packages.mail.instructions",
+    disclaimerKey: "packages.mail.disclaimer",
+    category: "skill",
+  },
 ];

 export function getPackageDef(id: string): PackageDef | undefined {
  return PACKAGE_CATALOG.find((p) => p.id === id);
 }
+
+/**
+ * IDs of channel-category packages. Derived from the catalog so it
+ * cannot drift from the source of truth (previously hardcoded as
+ * `["telegram", "discord", "email"]` in tenants/[name]/page.tsx —
+ * removed as part of the Phase A package-model rework).
+ *
+ * Consumers: tenant detail page (filter spec.packages to channel set
+ * before rendering the channel-users panel).
+ */
+export const CHANNEL_PACKAGE_IDS: string[] = PACKAGE_CATALOG
+  .filter((p) => p.category === "channel")
+  .map((p) => p.id);
+
+/**
+ * Default packages selected when the wizard opens a fresh onboarding
+ * request. The three CORE behaviours that make the assistant feel
+ * "smart out of the box":
+ *   - heartbeat:     proactive checks (otherwise the assistant is purely
+ *                    reactive).
+ *   - cron:          scheduled tasks (daily briefings, reminders).
+ *   - active-memory: long-term recall of stable preferences and habits.
+ *
+ * Each adds some token cost — active-memory the most (one extra
+ * sub-agent turn per inbound message) — so customers can untoggle any
+ * of them before submitting.
+ *
+ * core-voice is intentionally NOT a default. It is fully wired (Phase B)
+ * and customers can enable it from the wizard, but it incurs separate
+ * audio spend on every inbound voice note (Whisper STT) and every
+ * outbound reply (kani-tts / kokoro-fastapi via LiteLLM). Opt-in keeps
+ * cost predictable for tenants who don't intend to use voice channels.
+ */
+export const DEFAULT_PACKAGE_IDS: string[] = [
+  "core-heartbeat",
+  "core-cron",
+  "core-active-memory",
+];
--- a/src/lib/threema-gateway-config.ts
+++ b/src/lib/threema-gateway-config.ts
@@ -0,0 +1,31 @@
+/**
+ * Threema central gateway info shown to customers.
+ *
+ * Today PieCed runs exactly one Threema Gateway account (*AIAGENT) and
+ * every tenant talks to that. The constants below are hardcoded for
+ * that account. The values are intentionally kept here (and not split
+ * across i18n / env / runtime config) so when we move to multiple
+ * gateway accounts there's a single file to refactor.
+ *
+ * To go dynamic (future):
+ *   1. Replace `THREEMA_GATEWAY` constant with a runtime lookup —
+ *      either per-tenant from the relay's admin API, or from an
+ *      env var that lists the active account.
+ *   2. Move the QR PNG into a server-rendered route that takes a
+ *      gateway ID query param.
+ *   3. Update consumers to accept the gateway info as a prop and pass
+ *      it from a server component.
+ */
+
+export const THREEMA_GATEWAY = {
+  /** Technical Threema Gateway ID, with leading asterisk. */
+  id: "*AIAGENT",
+  /**
+   * Display name shown to customers. INCLUDES the leading asterisk —
+   * customers need to recognise this exact string in their Threema
+   * contacts after scanning the QR, so we don't strip it.
+   */
+  displayName: "*AIAGENT",
+  /** Public path to the QR code PNG served from `public/`. */
+  qrCodePath: "/threema/qr_code_AIAGENT.png",
+} as const;
--- a/src/lib/threema-relay.ts
+++ b/src/lib/threema-relay.ts
@@ -0,0 +1,202 @@
+/**
+ * Admin client for the central pieced-threema-gateway relay.
+ *
+ * All calls authenticate with a static admin bearer (THREEMA_RELAY_ADMIN_TOKEN
+ * from env, sourced from OpenBao at secret/data/threema-gateway/admin). The
+ * portal is the only caller; never expose these functions through a public
+ * HTTP surface.
+ *
+ * Resilience: every method returns a strongly-typed result rather than
+ * throwing. Network errors surface as `{ ok: false, kind: 'network' }`,
+ * 4xx/5xx as `{ ok: false, kind: 'http', status, ... }`. Callers that need
+ * to compensate (e.g. delete a route after a K8s patch failure) can
+ * inspect `kind` to decide whether retry is sensible.
+ */
+
+const RELAY_URL = (process.env.THREEMA_RELAY_URL ?? "").replace(/\/+$/, "");
+const ADMIN_TOKEN = process.env.THREEMA_RELAY_ADMIN_TOKEN ?? "";
+
+function assertConfigured(): void {
+  if (!RELAY_URL) throw new Error("THREEMA_RELAY_URL not set");
+  if (!ADMIN_TOKEN) throw new Error("THREEMA_RELAY_ADMIN_TOKEN not set");
+}
+
+type RelayError =
+  | { ok: false; kind: "network"; message: string }
+  | { ok: false; kind: "http"; status: number; message: string; body?: unknown };
+
+export type RelayResult<T> = ({ ok: true } & T) | RelayError;
+
+async function call<T>(
+  path: string,
+  init: RequestInit,
+): Promise<RelayResult<T>> {
+  assertConfigured();
+  try {
+    const res = await fetch(`${RELAY_URL}${path}`, {
+      ...init,
+      headers: {
+        ...(init.headers ?? {}),
+        Authorization: `Bearer ${ADMIN_TOKEN}`,
+        "Content-Type": "application/json",
+      },
+    });
+    let body: unknown = null;
+    const text = await res.text().catch(() => "");
+    if (text) {
+      try {
+        body = JSON.parse(text);
+      } catch {
+        body = text;
+      }
+    }
+    if (!res.ok) {
+      const message =
+        (body && typeof body === "object" && "error" in body && typeof (body as Record<string, unknown>).error === "string"
+          ? ((body as Record<string, unknown>).error as string)
+          : `HTTP ${res.status}`);
+      return { ok: false, kind: "http", status: res.status, message, body };
+    }
+    return { ok: true, ...(body as Record<string, unknown>) } as RelayResult<T>;
+  } catch (e) {
+    return { ok: false, kind: "network", message: (e as Error).message };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Tokens
+// ---------------------------------------------------------------------------
+
+/** Mint (or rotate) per-tenant bearer + HMAC secret. */
+export function mintToken(
+  tenantName: string,
+): Promise<RelayResult<{ token: string; hmacSecret: string }>> {
+  return call("/admin/tokens", {
+    method: "POST",
+    body: JSON.stringify({ tenantName }),
+  });
+}
+
+/**
+ * Revoke per-tenant token. Cascades — relay also deletes all routes
+ * owned by this tenant.
+ */
+export function revokeToken(
+  tenantName: string,
+): Promise<RelayResult<{ deletedRoutes: number }>> {
+  return call(`/admin/tokens/${encodeURIComponent(tenantName)}`, {
+    method: "DELETE",
+  });
+}
+
+export function tokenExists(
+  tenantName: string,
+): Promise<RelayResult<{ exists: true }>> {
+  return call(`/admin/tokens/${encodeURIComponent(tenantName)}`, {
+    method: "GET",
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Routes
+// ---------------------------------------------------------------------------
+
+export interface RouteRow {
+  threema_id: string;
+  tenant_name: string;
+  created_at: string;
+  created_by: string;
+}
+
+export function listRoutes(
+  tenantName: string,
+): Promise<RelayResult<{ routes: RouteRow[] }>> {
+  return call(`/admin/routes?tenant=${encodeURIComponent(tenantName)}`, {
+    method: "GET",
+  });
+}
+
+/**
+ * Create a route. The relay enforces uniqueness — on conflict returns
+ * status 409 with body `{ ownedBy: <tenantName> | null }`. Callers
+ * should inspect `kind === 'http'` + status 409 + body.ownedBy to
+ * distinguish idempotent self-claim from real conflict.
+ */
+export function createRoute(
+  tenantName: string,
+  threemaId: string,
+): Promise<RelayResult<{ ok: true }>> {
+  return call("/admin/routes", {
+    method: "POST",
+    body: JSON.stringify({ tenantName, threemaId }),
+  });
+}
+
+export function deleteRoute(
+  tenantName: string,
+  threemaId: string,
+): Promise<RelayResult<{ ok: true }>> {
+  return call(
+    `/admin/routes/${encodeURIComponent(threemaId)}?tenant=${encodeURIComponent(tenantName)}`,
+    { method: "DELETE" },
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Usage
+// ---------------------------------------------------------------------------
+
+export interface UsageBreakdown {
+  tenant: string;
+  from: string;
+  to: string;
+  totals: { in: number; out: number };
+  daily: Array<{ day: string; direction: "in" | "out"; count: number }>;
+}
+
+export function getUsage(
+  tenantName: string,
+  from?: Date,
+  to?: Date,
+): Promise<RelayResult<UsageBreakdown>> {
+  const qs = new URLSearchParams({ tenant: tenantName });
+  if (from) qs.set("from", from.toISOString());
+  if (to) qs.set("to", to.toISOString());
+  return call(`/admin/usage?${qs.toString()}`, { method: "GET" });
+}
+
+// ---------------------------------------------------------------------------
+// Health
+// ---------------------------------------------------------------------------
+
+export function health(): Promise<RelayResult<{ credits: number }>> {
+  return call("/admin/health", { method: "GET" });
+}
+
+// ---------------------------------------------------------------------------
+// Helpers for caller code
+// ---------------------------------------------------------------------------
+
+/**
+ * Type guard: did this route-create fail because the ID is owned by
+ * someone else? Distinguishes from "owned by SAME tenant" (idempotent).
+ */
+export function isRouteConflictForOtherTenant(
+  result: RelayResult<{ ok: true }>,
+  tenantName: string,
+): boolean {
+  if (result.ok) return false;
+  if (result.kind !== "http" || result.status !== 409) return false;
+  const body = result.body as { ownedBy?: string | null } | undefined;
+  return !!body?.ownedBy && body.ownedBy !== tenantName;
+}
+
+export function isRouteConflictForSameTenant(
+  result: RelayResult<{ ok: true }>,
+  tenantName: string,
+): boolean {
+  if (result.ok) return false;
+  if (result.kind !== "http" || result.status !== 409) return false;
+  const body = result.body as { ownedBy?: string | null } | undefined;
+  return body?.ownedBy === tenantName;
+}
--- a/src/messages/de.json
+++ b/src/messages/de.json
@@ -214,7 +214,8 @@
  "packages": {
    "categories": {
      "channels": "Kanäle",
-      "skills": "Fähigkeiten"
+      "skills": "Fähigkeiten",
+      "core": "Kern"
    },
    "enable": "Aktivieren",
    "disable": "Deaktivieren",
@@ -239,29 +240,78 @@
      "botTokenLabel": "Discord Bot Token",
      "botTokenPlaceholder": "MTAxNjQ0OTk2NjAz...",
      "instructions": "1. Gehen Sie zu discord.com/developers/applications\n2. Erstellen Sie eine neue Anwendung und fügen Sie einen Bot hinzu\n3. Kopieren Sie den Bot-Token",
-      "disclaimer": "Ich bestätige, dass ich diesen Discord-Bot besitze und PieCed IT autorisiere, ihn mit meinem KI-Assistenten zu verbinden."
-    },
-    "email": {
-      "description": "Ermöglichen Sie Ihrem KI-Assistenten, E-Mails zu senden und zu empfangen.",
-      "smtpHostLabel": "SMTP Host",
-      "smtpHostPlaceholder": "smtp.example.com",
-      "smtpUserLabel": "SMTP Benutzername",
-      "smtpUserPlaceholder": "user@example.com",
-      "smtpPasswordLabel": "SMTP Passwort",
-      "smtpPasswordPlaceholder": "••••••••",
-      "imapHostLabel": "IMAP Host",
-      "imapHostPlaceholder": "imap.example.com",
-      "instructions": "Geben Sie SMTP- und IMAP-Zugangsdaten an. Der Assistent nutzt diese zum Senden und Empfangen von Nachrichten.",
-      "disclaimer": "Ich bestätige, dass ich berechtigt bin, diese E-Mail-Zugangsdaten zu verwenden und dass PieCed IT auf dieses Postfach zugreifen darf."
-    },
-    "webSearch": {
-      "description": "Geben Sie Ihrem KI-Assistenten die Möglichkeit, im Web zu suchen."
-    },
-    "documentProcessing": {
-      "description": "Aktivieren Sie Dokumentenverarbeitung, Zusammenfassung und Extraktion."
+      "disclaimer": "Ich bestätige, dass ich diesen Discord-Bot besitze und PieCed IT autorisiere, ihn mit meinem KI-Assistenten zu verbinden.",
+      "appIdLabel": "Discord-Anwendungs-ID",
+      "appIdPlaceholder": "18–19-stellige numerische ID aus dem Developer Portal"
    },
    "statusEnabled": "aktiviert",
-    "statusDisabled": "deaktiviert"
+    "statusDisabled": "deaktiviert",
+    "coreHeartbeat": {
+      "description": "Periodischer Agentenlauf alle 30 Minuten, der es dem Assistenten erlaubt, Posteingang, Kalender und andere konfigurierte Quellen zu prüfen und proaktiv Bescheid zu geben, wenn etwas Aufmerksamkeit braucht. Ohne diese Option reagiert der Assistent nur, wenn Sie ihn ansprechen."
+    },
+    "coreCron": {
+      "description": "Erlaubt dem Assistenten, geplante Aufgaben auszuführen (tägliche Briefings, wiederkehrende Erinnerungen, periodische Berichte). Standardmässig deaktiviert. Bei Deaktivierung bleibt das Cron-Werkzeug verfügbar, aber keine geplante Aufgabe wird ausgeführt."
+    },
+    "coreActiveMemory": {
+      "description": "Erlaubt dem Assistenten, stabile Präferenzen, wiederkehrende Gewohnheiten und langfristigen Kontext aus früheren Gesprächen abzurufen. Nutzt einen zusätzlichen Sub-Agent-Lauf pro eingehender Nachricht, um den Memory-Store abzufragen. Nur Direktnachrichten. Kleiner Mehraufwand an Tokens im Tausch gegen Kontinuität und Personalisierung."
+    },
+    "coreVoice": {
+      "description": "Spracherkennung für eingehende Sprachnachrichten und Sprachsynthese für Antworten, über das PieCed-LiteLLM-Gateway, damit Audiokosten pro Mandant erfasst werden. Die Laufzeit-Integration kommt im nächsten Plattform-Release; das Umschalten speichert die Auswahl für diese Auslieferung."
+    },
+    "gitCli": {
+      "description": "Eigenständige Git-Kommandozeilenoperationen (clone, commit, branch, diff, log, status). Für private Repositories konfigurieren Sie die Zugangsdaten in Ihrem Workspace."
+    },
+    "github": {
+      "description": "Interaktion mit GitHub-Repositories über die gh-CLI — Issues, Pull Requests, CI-Läufe, Releases, Gists. Erfordert ein persönliches Zugriffstoken.",
+      "tokenLabel": "GitHub Persönliches Zugriffstoken",
+      "tokenPlaceholder": "ghp_… oder github_pat_…",
+      "instructions": "1. Öffnen Sie https://github.com/settings/tokens\n2. Erstellen Sie ein fein abgestimmtes persönliches Zugriffstoken mit den gewünschten Repo-Berechtigungen\n3. Kopieren Sie das Token (es wird nur einmal angezeigt)"
+    },
+    "gitea": {
+      "description": "Interaktion mit einer Gitea-Instanz — Repositories, Issues, Pull Requests, Releases. Standardmässig die PieCed-Plattform-Gitea unter git.c5ai.ch.",
+      "tokenLabel": "Gitea-Zugriffstoken",
+      "tokenPlaceholder": "Erstellt unter Einstellungen → Anwendungen",
+      "instructions": "1. Melden Sie sich bei Ihrer Gitea-Instanz an (Standard https://git.c5ai.ch)\n2. Gehen Sie zu Einstellungen → Anwendungen → Neues Token erstellen\n3. Vergeben Sie die gewünschten Berechtigungen (repo, issue, user)\n4. Kopieren Sie das Token"
+    },
+    "whisperSelfHosted": {
+      "description": "Transkribieren Sie Audiodateien über die plattformeigene Whisper-Instanz. Nützlich für Ad-hoc-Transkriptionsaufgaben aus dem Chat heraus."
+    },
+    "searxngLocalSearch": {
+      "description": "Datenschutzfreundliche Web-Suche über die interne SearXNG-Instanz der Plattform. Durchsuchen Sie Web, Bilder und News ohne externe API-Aufrufe oder Tracker."
+    },
+    "gog": {
+      "description": "Gebündelter Zugriff auf Gmail, Kalender, Drive, Docs, Sheets und Kontakte via Google OAuth. Setup erfordert ein Google-Cloud-Projekt — wenden Sie sich an den PieCed-Support für die Einrichtung.",
+      "clientIdLabel": "Google OAuth Client-ID",
+      "clientIdPlaceholder": "xxxxxxxxxxx.apps.googleusercontent.com",
+      "clientSecretLabel": "Google OAuth Client-Secret",
+      "clientSecretPlaceholder": "GOCSPX-…",
+      "refreshTokenLabel": "Google OAuth Refresh-Token",
+      "refreshTokenPlaceholder": "1//0g…",
+      "instructions": "Die Google-Workspace-Integration verwendet OAuth und erfordert derzeit manuelles Onboarding. Bitte eröffnen Sie ein Support-Ticket, um den Setup-Prozess zu starten — wir tauschen die Client-Zugangsdaten und ein Refresh-Token offline aus und aktivieren dann dieses Paket für Ihren Mandanten.",
+      "disclaimer": "Mit der Aktivierung der Google-Workspace-Integration autorisieren Sie PieCed, in Ihrem Namen auf Gmail, Kalender, Drive, Docs, Sheets und Kontakte zuzugreifen. Daten fliessen über die Google-APIs, vorbehaltlich der Google-Bedingungen."
+    },
+    "mail": {
+      "description": "E-Mails über IMAP lesen, suchen und verwalten; senden über SMTP. Funktioniert mit Gmail (mit App-Passwort), Outlook, Fastmail und jedem standardkonformen IMAP/SMTP-Host.",
+      "imapHostLabel": "IMAP-Host",
+      "imapHostPlaceholder": "imap.example.com",
+      "imapUserLabel": "IMAP-Benutzername",
+      "imapUserPlaceholder": "benutzer@example.com",
+      "imapPassLabel": "IMAP-Passwort",
+      "imapPassPlaceholder": "••••••••",
+      "smtpHostLabel": "SMTP-Host",
+      "smtpHostPlaceholder": "smtp.example.com",
+      "smtpUserLabel": "SMTP-Benutzername",
+      "smtpUserPlaceholder": "benutzer@example.com",
+      "smtpPassLabel": "SMTP-Passwort",
+      "smtpPassPlaceholder": "••••••••",
+      "instructions": "1. Für Gmail: Aktivieren Sie die 2-Faktor-Authentifizierung, erstellen Sie dann unter https://myaccount.google.com/apppasswords ein App-Passwort und verwenden Sie es als IMAP- und SMTP-Passwort.\n2. Für Outlook / Microsoft 365 mit MFA: Generieren Sie ein App-Passwort in den Sicherheitseinstellungen Ihres Kontos.\n3. Für andere Anbieter: Konsultieren Sie deren IMAP/SMTP-Dokumentation für Hostnamen und Ports.\n4. Typische IMAP-Hosts: imap.gmail.com, outlook.office365.com.\n5. Typische SMTP-Hosts: smtp.gmail.com, smtp.office365.com.",
+      "disclaimer": "Der Assistent erhält Lese- und Schreibzugriff auf das von Ihnen konfigurierte Postfach. Verwenden Sie eine dedizierte Adresse anstelle eines persönlichen Postfachs, wenn Sie den Umfang einschränken möchten."
+    },
+    "threema": {
+      "description": "Senden und empfangen Sie Nachrichten über Threema. Jede eingehende und ausgehende Nachricht läuft über den gemeinsamen PieCed-Messaging-Dienst und verursacht eine Gebühr pro Nachricht bei Threema — eine Drittanbieter-Kostenposition, unabhängig von Ihrem PieCed-Abonnement.",
+      "instructions": "1. Aktivieren Sie dieses Paket.\n2. Öffnen Sie Threema auf Ihrem Telefon, scannen Sie den QR-Code unter Autorisierte Benutzer → threema und akzeptieren Sie den Kontakt.\n3. Tragen Sie Ihre eigene Threema-ID unter Autorisierte Benutzer → threema ein, damit der Assistent Ihre Nachrichten erkennt.\n4. Schreiben Sie eine Nachricht aus Threema, um das Gespräch zu beginnen.",
+      "disclaimer": "Nachrichten zwischen Threema und PieCed werden Ende-zu-Ende verschlüsselt bis zum PieCed-Messaging-Dienst, wo sie entschlüsselt und an Ihren Assistenten weitergeleitet werden. Jede gesendete oder empfangene Nachricht wird gemäss Threema-Tarif pro Nachricht abgerechnet — die aktuellen Preise finden Sie in Ihrem Plan."
+    }
  },
  "admin": {
    "title": "Plattform-Admin",
@@ -346,7 +396,17 @@
    "alreadyAdded": "Diese Benutzer-ID ist bereits autorisiert.",
    "telegramIdHelp": "So finden Sie Ihre Telegram-Benutzer-ID:\n1. Öffnen Sie Telegram und schreiben Sie @userinfobot\n2. Der Bot antwortet sofort mit Ihrer numerischen ID\n3. Geben Sie diese Nummer hier ein",
    "discordIdHelp": "So finden Sie Ihre Discord-Benutzer-ID:\n1. Aktivieren Sie den Entwicklermodus in den Discord-Einstellungen (Erweitert)\n2. Rechtsklick auf Ihren Namen → Benutzer-ID kopieren\n3. Geben Sie diese Nummer hier ein",
-    "emailIdHelp": "Geben Sie die E-Mail-Adresse ein, die zur Interaktion mit dem Assistenten autorisiert werden soll."
+    "threemaIdHelp": "Geben Sie Ihre eigene Threema-ID ein — die 8 Zeichen, die in Ihrer Threema-App unter Einstellungen → Meine Threema-ID angezeigt werden. Anschliessend können Sie direkt aus Threema mit dem Assistenten chatten.",
+    "threemaSetup": {
+      "title": "Assistenten zu Threema hinzufügen",
+      "step1": "Öffnen Sie Threema auf Ihrem Telefon.",
+      "step2": "Tippen Sie auf das Scan-Symbol und scannen Sie diesen QR-Code, um den Assistenten als Kontakt hinzuzufügen.",
+      "step3": "Fügen Sie anschliessend unten Ihre eigene Threema-ID hinzu.",
+      "qrAlt": "QR-Code, um {gateway} als Threema-Kontakt hinzuzufügen",
+      "bannerTitle": "Threema einrichten",
+      "bannerBody": "Öffnen Sie Threema auf Ihrem Telefon und scannen Sie unseren QR-Code, um den Assistenten als Kontakt hinzuzufügen. Geben Sie anschliessend unten Ihre eigene Threema-ID ein.",
+      "bannerButton": "QR-Code anzeigen"
+    }
  },
  "team": {
    "title": "Team",
--- a/src/messages/en.json
+++ b/src/messages/en.json
@@ -214,7 +214,8 @@
  "packages": {
    "categories": {
      "channels": "Channels",
-      "skills": "Skills"
+      "skills": "Skills",
+      "core": "Core"
    },
    "enable": "Enable",
    "disable": "Disable",
@@ -239,29 +240,78 @@
      "botTokenLabel": "Discord Bot Token",
      "botTokenPlaceholder": "MTAxNjQ0OTk2NjAz...",
      "instructions": "1. Go to discord.com/developers/applications\n2. Create a new application and add a bot\n3. Copy the bot token",
-      "disclaimer": "I confirm I own this Discord bot and authorize PieCed IT to connect it to my AI assistant."
+      "disclaimer": "I confirm I own this Discord bot and authorize PieCed IT to connect it to my AI assistant.",
+      "appIdLabel": "Discord Application ID",
+      "appIdPlaceholder": "18-19 digit numeric ID from Developer Portal"
    },
-    "email": {
-      "description": "Enable your AI assistant to send and receive email.",
+    "statusEnabled": "enabled",
+    "statusDisabled": "disabled",
+    "coreHeartbeat": {
+      "description": "Periodic agent run every 30 minutes that lets your assistant check inbox, calendar, and other configured sources and message you proactively when something needs attention. Without this, the assistant only responds when you message it first."
+    },
+    "coreCron": {
+      "description": "Allow the assistant to run scheduled tasks (daily briefings, recurring reminders, periodic reports). Off by default. When off, the agent's cron tool stays available but no scheduled job ever fires."
+    },
+    "coreActiveMemory": {
+      "description": "Lets the assistant recall stable preferences, recurring habits, and long-term context from past conversations during a chat. Uses an extra sub-agent turn per inbound message to query the memory store. Direct-message sessions only. Adds a small token cost in exchange for continuity and personalisation."
+    },
+    "coreVoice": {
+      "description": "Speech-to-text on incoming voice notes and text-to-speech on replies, routed through the PieCed LiteLLM gateway so audio cost is tracked per tenant alongside chat. Runtime wiring lands in the next platform release; toggling now stores the preference for that rollout."
+    },
+    "gitCli": {
+      "description": "Standalone git command-line operations (clone, commit, branch, diff, log, status). For private repositories, configure credentials in your workspace."
+    },
+    "github": {
+      "description": "Interact with GitHub repositories via the gh CLI — issues, pull requests, CI runs, releases, gists. Requires a personal access token.",
+      "tokenLabel": "GitHub Personal Access Token",
+      "tokenPlaceholder": "ghp_… or github_pat_…",
+      "instructions": "1. Open https://github.com/settings/tokens\n2. Generate a fine-grained personal access token with the repo scopes you want the assistant to use\n3. Copy the token (it's shown only once)"
+    },
+    "gitea": {
+      "description": "Interact with a Gitea instance — repositories, issues, pull requests, releases. Defaults to the PieCed-platform Gitea at git.c5ai.ch.",
+      "tokenLabel": "Gitea Access Token",
+      "tokenPlaceholder": "Generated under Settings → Applications",
+      "instructions": "1. Log in to your Gitea instance (default https://git.c5ai.ch)\n2. Go to Settings → Applications → Generate New Token\n3. Grant the scopes you want the assistant to use (repo, issue, user)\n4. Copy the token"
+    },
+    "whisperSelfHosted": {
+      "description": "Transcribe audio files via the platform's self-hosted Whisper instance. Useful for ad-hoc transcription tasks initiated from chat."
+    },
+    "searxngLocalSearch": {
+      "description": "Privacy-respecting web search via the platform's internal SearXNG instance. Search the web, images, and news without external API calls or trackers."
+    },
+    "gog": {
+      "description": "Bundled access to Gmail, Calendar, Drive, Docs, Sheets, and Contacts via Google OAuth. Setup requires a Google Cloud project — contact PieCed support to onboard.",
+      "clientIdLabel": "Google OAuth Client ID",
+      "clientIdPlaceholder": "xxxxxxxxxxx.apps.googleusercontent.com",
+      "clientSecretLabel": "Google OAuth Client Secret",
+      "clientSecretPlaceholder": "GOCSPX-…",
+      "refreshTokenLabel": "Google OAuth Refresh Token",
+      "refreshTokenPlaceholder": "1//0g…",
+      "instructions": "Google Workspace integration uses OAuth and requires manual onboarding for now. Please open a support ticket to start the setup — we'll exchange the client credentials and a refresh token offline, then enable this package on your tenant.",
+      "disclaimer": "By enabling Google Workspace integration you authorize PieCed to access Gmail, Calendar, Drive, Docs, Sheets, and Contacts on your behalf. Data flows through Google's APIs subject to Google's terms."
+    },
+    "mail": {
+      "description": "Read, search, and manage email via IMAP; send via SMTP. Works with Gmail (with an app password), Outlook, Fastmail, and any standard IMAP/SMTP host.",
+      "imapHostLabel": "IMAP Host",
+      "imapHostPlaceholder": "imap.example.com",
+      "imapUserLabel": "IMAP Username",
+      "imapUserPlaceholder": "user@example.com",
+      "imapPassLabel": "IMAP Password",
+      "imapPassPlaceholder": "••••••••",
      "smtpHostLabel": "SMTP Host",
      "smtpHostPlaceholder": "smtp.example.com",
      "smtpUserLabel": "SMTP Username",
      "smtpUserPlaceholder": "user@example.com",
-      "smtpPasswordLabel": "SMTP Password",
-      "smtpPasswordPlaceholder": "••••••••",
-      "imapHostLabel": "IMAP Host",
-      "imapHostPlaceholder": "imap.example.com",
-      "instructions": "Provide SMTP and IMAP credentials. The assistant uses these to send and monitor messages.",
-      "disclaimer": "I confirm I am authorized to use these email credentials and that PieCed IT may access this mailbox."
+      "smtpPassLabel": "SMTP Password",
+      "smtpPassPlaceholder": "••••••••",
+      "instructions": "1. For Gmail: enable 2-Step Verification, then create an App Password at https://myaccount.google.com/apppasswords and use it as both IMAP and SMTP password.\n2. For Outlook / Microsoft 365 with MFA: generate an app password in your account's security settings.\n3. For other providers: refer to their IMAP/SMTP documentation for host names and ports.\n4. Typical IMAP hosts: imap.gmail.com, outlook.office365.com.\n5. Typical SMTP hosts: smtp.gmail.com, smtp.office365.com.",
+      "disclaimer": "The assistant gains read/write access to the mailbox you configure. Consider using a dedicated address rather than a personal inbox if you want to limit scope."
    },
-    "webSearch": {
-      "description": "Give your AI assistant the ability to search the web."
-    },
-    "documentProcessing": {
-      "description": "Enable document parsing, summarization, and extraction."
-    },
-    "statusEnabled": "enabled",
-    "statusDisabled": "disabled"
+    "threema": {
+      "description": "Send and receive messages through Threema. Each inbound and outbound message uses the shared PieCed messaging service and incurs a per-message charge from Threema — a third-party cost, separate from your PieCed subscription.",
+      "instructions": "1. Enable this package.\n2. Open Threema on your phone, scan the QR code shown under Authorized Users → threema, and accept the contact.\n3. Add your own Threema ID under Authorized Users → threema so the assistant recognises your messages.\n4. Send a message from Threema to start chatting with the assistant.",
+      "disclaimer": "Messages between Threema and PieCed are end-to-end encrypted up to PieCed's messaging service, where they are decrypted to be routed to your assistant. Each message sent or received is counted toward Threema's per-message billing — see your plan for current rates."
+    }
  },
  "admin": {
    "title": "Platform Admin",
@@ -346,7 +396,17 @@
    "alreadyAdded": "This user ID is already authorized.",
    "telegramIdHelp": "To find your Telegram user ID:\n1. Open Telegram and message @userinfobot\n2. It instantly replies with your numeric ID\n3. Enter that number here",
    "discordIdHelp": "To find your Discord user ID:\n1. Enable Developer Mode in Discord settings (Advanced)\n2. Right-click your name → Copy User ID\n3. Enter that number here",
-    "emailIdHelp": "Enter the email address that should be authorized to interact with the assistant."
+    "threemaIdHelp": "Enter your own Threema ID — the 8 characters shown in your Threema app under Settings → My Threema ID. Once added, you'll be able to chat with the assistant directly from Threema.",
+    "threemaSetup": {
+      "title": "Add the assistant to your Threema",
+      "step1": "Open Threema on your phone.",
+      "step2": "Tap the scan icon and scan this QR code to add the assistant as a contact.",
+      "step3": "Then add your own Threema ID below.",
+      "qrAlt": "QR code to add {gateway} as a Threema contact",
+      "bannerTitle": "Set up Threema",
+      "bannerBody": "Open Threema on your phone and scan our QR code to add the assistant as a contact. Then add your own Threema ID below.",
+      "bannerButton": "Show QR code"
+    }
  },
  "team": {
    "title": "Team",
--- a/src/messages/fr.json
+++ b/src/messages/fr.json
@@ -214,7 +214,8 @@
  "packages": {
    "categories": {
      "channels": "Canaux",
-      "skills": "Compétences"
+      "skills": "Compétences",
+      "core": "Cœur"
    },
    "enable": "Activer",
    "disable": "Désactiver",
@@ -239,29 +240,78 @@
      "botTokenLabel": "Token du bot Discord",
      "botTokenPlaceholder": "MTAxNjQ0OTk2NjAz...",
      "instructions": "1. Allez sur discord.com/developers/applications\n2. Créez une nouvelle application et ajoutez un bot\n3. Copiez le token du bot",
-      "disclaimer": "Je confirme que je possède ce bot Discord et autorise PieCed IT à le connecter à mon assistant IA."
+      "disclaimer": "Je confirme que je possède ce bot Discord et autorise PieCed IT à le connecter à mon assistant IA.",
+      "appIdLabel": "ID d'application Discord",
+      "appIdPlaceholder": "ID numérique de 18–19 chiffres depuis le Developer Portal"
    },
-    "email": {
-      "description": "Permettez à votre assistant IA d'envoyer et de recevoir des e-mails.",
+    "statusEnabled": "activé",
+    "statusDisabled": "désactivé",
+    "coreHeartbeat": {
+      "description": "Exécution périodique de l'agent toutes les 30 minutes pour vérifier votre boîte mail, votre agenda et d'autres sources configurées, et vous notifier de manière proactive lorsqu'une attention est requise. Sans cette option, l'assistant ne répond que lorsque vous lui écrivez."
+    },
+    "coreCron": {
+      "description": "Permet à l'assistant d'exécuter des tâches programmées (briefings quotidiens, rappels récurrents, rapports périodiques). Désactivé par défaut. Lorsqu'il est désactivé, l'outil cron reste disponible mais aucune tâche planifiée ne s'exécute."
+    },
+    "coreActiveMemory": {
+      "description": "Permet à l'assistant de se rappeler des préférences stables, des habitudes récurrentes et du contexte à long terme issu de conversations passées. Utilise un tour de sous-agent supplémentaire par message entrant pour interroger la mémoire. Uniquement en messages directs. Légère consommation de tokens supplémentaire en échange de continuité et de personnalisation."
+    },
+    "coreVoice": {
+      "description": "Reconnaissance vocale sur les notes vocales entrantes et synthèse vocale sur les réponses, via la passerelle PieCed LiteLLM pour un suivi du coût audio par tenant. L'intégration runtime arrive dans la prochaine version de la plateforme ; basculer le commutateur enregistre dès maintenant la préférence."
+    },
+    "gitCli": {
+      "description": "Opérations git en ligne de commande autonomes (clone, commit, branch, diff, log, status). Pour les dépôts privés, configurez les identifiants dans votre espace de travail."
+    },
+    "github": {
+      "description": "Interagissez avec les dépôts GitHub via la CLI gh — issues, pull requests, exécutions CI, releases, gists. Nécessite un jeton d'accès personnel.",
+      "tokenLabel": "Jeton d'accès personnel GitHub",
+      "tokenPlaceholder": "ghp_… ou github_pat_…",
+      "instructions": "1. Ouvrez https://github.com/settings/tokens\n2. Générez un jeton d'accès personnel fin avec les portées de dépôt souhaitées\n3. Copiez le jeton (il n'est affiché qu'une fois)"
+    },
+    "gitea": {
+      "description": "Interagissez avec une instance Gitea — dépôts, issues, pull requests, releases. Par défaut, l'instance Gitea PieCed à git.c5ai.ch.",
+      "tokenLabel": "Jeton d'accès Gitea",
+      "tokenPlaceholder": "Généré sous Paramètres → Applications",
+      "instructions": "1. Connectez-vous à votre instance Gitea (par défaut https://git.c5ai.ch)\n2. Allez dans Paramètres → Applications → Générer un nouveau jeton\n3. Accordez les portées souhaitées (repo, issue, user)\n4. Copiez le jeton"
+    },
+    "whisperSelfHosted": {
+      "description": "Transcrivez des fichiers audio via l'instance Whisper auto-hébergée de la plateforme. Utile pour les transcriptions ad hoc initiées depuis le chat."
+    },
+    "searxngLocalSearch": {
+      "description": "Recherche web respectueuse de la vie privée via l'instance SearXNG interne de la plateforme. Recherchez le web, les images et les actualités sans appels d'API externes ni traqueurs."
+    },
+    "gog": {
+      "description": "Accès groupé à Gmail, Agenda, Drive, Docs, Sheets et Contacts via Google OAuth. La configuration nécessite un projet Google Cloud — contactez le support PieCed pour l'intégration.",
+      "clientIdLabel": "ID client Google OAuth",
+      "clientIdPlaceholder": "xxxxxxxxxxx.apps.googleusercontent.com",
+      "clientSecretLabel": "Secret client Google OAuth",
+      "clientSecretPlaceholder": "GOCSPX-…",
+      "refreshTokenLabel": "Jeton de rafraîchissement Google OAuth",
+      "refreshTokenPlaceholder": "1//0g…",
+      "instructions": "L'intégration de Google Workspace utilise OAuth et nécessite actuellement une intégration manuelle. Veuillez ouvrir un ticket de support pour démarrer la configuration — nous échangerons hors ligne les identifiants client et un jeton de rafraîchissement, puis activerons ce package sur votre tenant.",
+      "disclaimer": "En activant l'intégration de Google Workspace, vous autorisez PieCed à accéder à Gmail, Agenda, Drive, Docs, Sheets et Contacts en votre nom. Les données transitent par les API de Google, soumises aux conditions de Google."
+    },
+    "mail": {
+      "description": "Lisez, recherchez et gérez vos e-mails via IMAP ; envoyez via SMTP. Compatible avec Gmail (avec un mot de passe d'application), Outlook, Fastmail et tout hôte IMAP/SMTP standard.",
+      "imapHostLabel": "Hôte IMAP",
+      "imapHostPlaceholder": "imap.example.com",
+      "imapUserLabel": "Nom d'utilisateur IMAP",
+      "imapUserPlaceholder": "utilisateur@example.com",
+      "imapPassLabel": "Mot de passe IMAP",
+      "imapPassPlaceholder": "••••••••",
      "smtpHostLabel": "Hôte SMTP",
      "smtpHostPlaceholder": "smtp.example.com",
      "smtpUserLabel": "Nom d'utilisateur SMTP",
-      "smtpUserPlaceholder": "user@example.com",
-      "smtpPasswordLabel": "Mot de passe SMTP",
-      "smtpPasswordPlaceholder": "••••••••",
-      "imapHostLabel": "Hôte IMAP",
-      "imapHostPlaceholder": "imap.example.com",
-      "instructions": "Fournissez les identifiants SMTP et IMAP. L'assistant les utilise pour envoyer et surveiller les messages.",
-      "disclaimer": "Je confirme que je suis autorisé à utiliser ces identifiants e-mail et que PieCed IT peut accéder à cette boîte mail."
+      "smtpUserPlaceholder": "utilisateur@example.com",
+      "smtpPassLabel": "Mot de passe SMTP",
+      "smtpPassPlaceholder": "••••••••",
+      "instructions": "1. Pour Gmail : activez la validation en deux étapes, puis créez un mot de passe d'application sur https://myaccount.google.com/apppasswords et utilisez-le comme mot de passe IMAP et SMTP.\n2. Pour Outlook / Microsoft 365 avec MFA : générez un mot de passe d'application dans les paramètres de sécurité de votre compte.\n3. Pour les autres fournisseurs : consultez leur documentation IMAP/SMTP pour les noms d'hôte et les ports.\n4. Hôtes IMAP typiques : imap.gmail.com, outlook.office365.com.\n5. Hôtes SMTP typiques : smtp.gmail.com, smtp.office365.com.",
+      "disclaimer": "L'assistant obtient un accès en lecture/écriture à la boîte aux lettres que vous configurez. Envisagez d'utiliser une adresse dédiée plutôt qu'une boîte personnelle si vous souhaitez limiter la portée."
    },
-    "webSearch": {
-      "description": "Donnez à votre assistant IA la capacité de rechercher sur le web."
-    },
-    "documentProcessing": {
-      "description": "Activez l'analyse, le résumé et l'extraction de documents."
-    },
-    "statusEnabled": "activé",
-    "statusDisabled": "désactivé"
+    "threema": {
+      "description": "Envoyez et recevez des messages via Threema. Chaque message entrant ou sortant transite par le service de messagerie PieCed partagé et entraîne des frais par message facturés par Threema — un coût tiers, distinct de votre abonnement PieCed.",
+      "instructions": "1. Activez ce package.\n2. Ouvrez Threema sur votre téléphone, scannez le QR code affiché dans Utilisateurs autorisés → threema, puis acceptez le contact.\n3. Ajoutez votre propre identifiant Threema sous Utilisateurs autorisés → threema afin que l'assistant reconnaisse vos messages.\n4. Envoyez un message depuis Threema pour commencer la conversation.",
+      "disclaimer": "Les messages entre Threema et PieCed sont chiffrés de bout en bout jusqu'au service de messagerie PieCed, où ils sont déchiffrés pour être acheminés vers votre assistant. Chaque message envoyé ou reçu est facturé par Threema selon son tarif par message — consultez votre plan pour les tarifs en vigueur."
+    }
  },
  "admin": {
    "title": "Admin plateforme",
@@ -346,7 +396,17 @@
    "alreadyAdded": "Cet identifiant est déjà autorisé.",
    "telegramIdHelp": "Pour trouver votre identifiant Telegram :\n1. Ouvrez Telegram et envoyez un message à @userinfobot\n2. Il répond instantanément avec votre identifiant numérique\n3. Entrez ce numéro ici",
    "discordIdHelp": "Pour trouver votre identifiant Discord :\n1. Activez le mode développeur dans les paramètres Discord (Avancé)\n2. Clic droit sur votre nom → Copier l'identifiant\n3. Entrez ce numéro ici",
-    "emailIdHelp": "Entrez l'adresse e-mail qui doit être autorisée à interagir avec l'assistant."
+    "threemaIdHelp": "Saisissez votre propre identifiant Threema — les 8 caractères affichés dans votre application Threema sous Réglages → Mon identifiant Threema. Une fois ajouté, vous pourrez discuter directement avec l'assistant depuis Threema.",
+    "threemaSetup": {
+      "title": "Ajouter l'assistant à Threema",
+      "step1": "Ouvrez Threema sur votre téléphone.",
+      "step2": "Appuyez sur l'icône de scan et scannez ce QR code pour ajouter l'assistant comme contact.",
+      "step3": "Puis ajoutez votre propre identifiant Threema ci-dessous.",
+      "qrAlt": "QR code pour ajouter {gateway} comme contact Threema",
+      "bannerTitle": "Configurer Threema",
+      "bannerBody": "Ouvrez Threema sur votre téléphone et scannez notre QR code pour ajouter l'assistant comme contact. Saisissez ensuite votre propre identifiant Threema ci-dessous.",
+      "bannerButton": "Afficher le QR code"
+    }
  },
  "team": {
    "title": "Équipe",
--- a/src/messages/it.json
+++ b/src/messages/it.json
@@ -214,7 +214,8 @@
  "packages": {
    "categories": {
      "channels": "Canali",
-      "skills": "Capacità"
+      "skills": "Capacità",
+      "core": "Core"
    },
    "enable": "Attiva",
    "disable": "Disattiva",
@@ -239,29 +240,78 @@
      "botTokenLabel": "Token bot Discord",
      "botTokenPlaceholder": "MTAxNjQ0OTk2NjAz...",
      "instructions": "1. Vai su discord.com/developers/applications\n2. Crea una nuova applicazione e aggiungi un bot\n3. Copia il token del bot",
-      "disclaimer": "Confermo di possedere questo bot Discord e autorizzo PieCed IT a collegarlo al mio assistente IA."
-    },
-    "email": {
-      "description": "Permetti al tuo assistente IA di inviare e ricevere e-mail.",
-      "smtpHostLabel": "Host SMTP",
-      "smtpHostPlaceholder": "smtp.example.com",
-      "smtpUserLabel": "Nome utente SMTP",
-      "smtpUserPlaceholder": "user@example.com",
-      "smtpPasswordLabel": "Password SMTP",
-      "smtpPasswordPlaceholder": "••••••••",
-      "imapHostLabel": "Host IMAP",
-      "imapHostPlaceholder": "imap.example.com",
-      "instructions": "Fornisci le credenziali SMTP e IMAP. L'assistente le usa per inviare e monitorare i messaggi.",
-      "disclaimer": "Confermo di essere autorizzato a utilizzare queste credenziali e-mail e che PieCed IT può accedere a questa casella di posta."
-    },
-    "webSearch": {
-      "description": "Dai al tuo assistente IA la capacità di cercare nel web."
-    },
-    "documentProcessing": {
-      "description": "Attiva l'analisi, il riassunto e l'estrazione di documenti."
+      "disclaimer": "Confermo di possedere questo bot Discord e autorizzo PieCed IT a collegarlo al mio assistente IA.",
+      "appIdLabel": "ID applicazione Discord",
+      "appIdPlaceholder": "ID numerico di 18–19 cifre dal Developer Portal"
    },
    "statusEnabled": "abilitato",
-    "statusDisabled": "disabilitato"
+    "statusDisabled": "disabilitato",
+    "coreHeartbeat": {
+      "description": "Esecuzione periodica dell'agente ogni 30 minuti che consente all'assistente di controllare posta, calendario e altre fonti configurate e di avvisarti proattivamente quando serve attenzione. Senza questa opzione, l'assistente risponde solo quando lo contatti."
+    },
+    "coreCron": {
+      "description": "Consente all'assistente di eseguire attività pianificate (briefing giornalieri, promemoria ricorrenti, report periodici). Disattivato per impostazione predefinita. Quando è disattivato, lo strumento cron resta disponibile ma nessuna attività pianificata viene eseguita."
+    },
+    "coreActiveMemory": {
+      "description": "Consente all'assistente di richiamare preferenze stabili, abitudini ricorrenti e contesto a lungo termine dalle conversazioni precedenti. Utilizza un turno extra di sub-agente per ogni messaggio in entrata per interrogare lo store di memoria. Solo messaggi diretti. Aggiunge un piccolo costo in token in cambio di continuità e personalizzazione."
+    },
+    "coreVoice": {
+      "description": "Riconoscimento vocale sui messaggi audio in entrata e sintesi vocale sulle risposte, instradati attraverso il gateway PieCed LiteLLM per tracciare il costo audio per tenant. L'integrazione runtime arriverà nel prossimo rilascio della piattaforma; attivare ora salva la preferenza per quel rilascio."
+    },
+    "gitCli": {
+      "description": "Operazioni git da riga di comando autonome (clone, commit, branch, diff, log, status). Per i repository privati, configura le credenziali nel tuo workspace."
+    },
+    "github": {
+      "description": "Interagisci con repository GitHub tramite la CLI gh — issue, pull request, esecuzioni CI, release, gist. Richiede un token di accesso personale.",
+      "tokenLabel": "Token di accesso personale GitHub",
+      "tokenPlaceholder": "ghp_… o github_pat_…",
+      "instructions": "1. Apri https://github.com/settings/tokens\n2. Genera un token di accesso personale fine con gli ambiti repo desiderati\n3. Copia il token (viene mostrato una sola volta)"
+    },
+    "gitea": {
+      "description": "Interagisci con un'istanza Gitea — repository, issue, pull request, release. Per impostazione predefinita, l'istanza Gitea PieCed su git.c5ai.ch.",
+      "tokenLabel": "Token di accesso Gitea",
+      "tokenPlaceholder": "Generato in Impostazioni → Applicazioni",
+      "instructions": "1. Accedi alla tua istanza Gitea (predefinito https://git.c5ai.ch)\n2. Vai a Impostazioni → Applicazioni → Genera nuovo token\n3. Concedi gli ambiti desiderati (repo, issue, user)\n4. Copia il token"
+    },
+    "whisperSelfHosted": {
+      "description": "Trascrivi file audio tramite l'istanza Whisper auto-ospitata della piattaforma. Utile per attività di trascrizione ad hoc avviate dalla chat."
+    },
+    "searxngLocalSearch": {
+      "description": "Ricerca web rispettosa della privacy tramite l'istanza SearXNG interna della piattaforma. Cerca sul web, nelle immagini e nelle notizie senza chiamate ad API esterne né tracker."
+    },
+    "gog": {
+      "description": "Accesso integrato a Gmail, Calendar, Drive, Docs, Sheets e Contatti tramite Google OAuth. La configurazione richiede un progetto Google Cloud — contatta il supporto PieCed per l'onboarding.",
+      "clientIdLabel": "ID client Google OAuth",
+      "clientIdPlaceholder": "xxxxxxxxxxx.apps.googleusercontent.com",
+      "clientSecretLabel": "Client secret Google OAuth",
+      "clientSecretPlaceholder": "GOCSPX-…",
+      "refreshTokenLabel": "Token di refresh Google OAuth",
+      "refreshTokenPlaceholder": "1//0g…",
+      "instructions": "L'integrazione con Google Workspace utilizza OAuth e richiede attualmente un onboarding manuale. Apri un ticket di supporto per avviare la configurazione — scambieremo le credenziali del client e un token di refresh offline, quindi abiliteremo questo pacchetto sul tuo tenant.",
+      "disclaimer": "Abilitando l'integrazione con Google Workspace autorizzi PieCed ad accedere per tuo conto a Gmail, Calendar, Drive, Docs, Sheets e Contatti. I dati transitano attraverso le API di Google, soggetti ai termini di Google."
+    },
+    "mail": {
+      "description": "Leggi, cerca e gestisci le e-mail via IMAP; invia tramite SMTP. Funziona con Gmail (con una password per app), Outlook, Fastmail e qualsiasi host IMAP/SMTP standard.",
+      "imapHostLabel": "Host IMAP",
+      "imapHostPlaceholder": "imap.example.com",
+      "imapUserLabel": "Username IMAP",
+      "imapUserPlaceholder": "utente@example.com",
+      "imapPassLabel": "Password IMAP",
+      "imapPassPlaceholder": "••••••••",
+      "smtpHostLabel": "Host SMTP",
+      "smtpHostPlaceholder": "smtp.example.com",
+      "smtpUserLabel": "Username SMTP",
+      "smtpUserPlaceholder": "utente@example.com",
+      "smtpPassLabel": "Password SMTP",
+      "smtpPassPlaceholder": "••••••••",
+      "instructions": "1. Per Gmail: abilita la verifica in due passaggi, quindi crea una password per app su https://myaccount.google.com/apppasswords e usala come password IMAP e SMTP.\n2. Per Outlook / Microsoft 365 con MFA: genera una password per app nelle impostazioni di sicurezza del tuo account.\n3. Per altri provider: consulta la loro documentazione IMAP/SMTP per nomi host e porte.\n4. Host IMAP tipici: imap.gmail.com, outlook.office365.com.\n5. Host SMTP tipici: smtp.gmail.com, smtp.office365.com.",
+      "disclaimer": "L'assistente ottiene accesso in lettura/scrittura alla casella di posta che configuri. Valuta l'uso di un indirizzo dedicato anziché di una casella personale se vuoi limitare la portata."
+    },
+    "threema": {
+      "description": "Invia e ricevi messaggi tramite Threema. Ogni messaggio in entrata e in uscita passa attraverso il servizio di messaggistica condiviso di PieCed e comporta un addebito per messaggio da parte di Threema — un costo di terzi, separato dall'abbonamento PieCed.",
+      "instructions": "1. Attiva questo pacchetto.\n2. Apri Threema sul tuo telefono, scansiona il QR code mostrato in Utenti autorizzati → threema e accetta il contatto.\n3. Aggiungi il tuo ID Threema sotto Utenti autorizzati → threema affinché l'assistente riconosca i tuoi messaggi.\n4. Invia un messaggio da Threema per iniziare la conversazione.",
+      "disclaimer": "I messaggi tra Threema e PieCed sono cifrati end-to-end fino al servizio di messaggistica PieCed, dove vengono decifrati per essere inoltrati al tuo assistente. Ogni messaggio inviato o ricevuto viene addebitato da Threema secondo la sua tariffa per messaggio — consulta il tuo piano per i prezzi attuali."
+    }
  },
  "admin": {
    "title": "Admin piattaforma",
@@ -346,7 +396,17 @@
    "alreadyAdded": "Questo ID utente è già autorizzato.",
    "telegramIdHelp": "Per trovare il tuo ID Telegram:\n1. Apri Telegram e invia un messaggio a @userinfobot\n2. Risponde istantaneamente con il tuo ID numerico\n3. Inserisci quel numero qui",
    "discordIdHelp": "Per trovare il tuo ID Discord:\n1. Attiva la Modalità sviluppatore nelle impostazioni Discord (Avanzate)\n2. Clic destro sul tuo nome → Copia ID utente\n3. Inserisci quel numero qui",
-    "emailIdHelp": "Inserisci l'indirizzo e-mail che deve essere autorizzato a interagire con l'assistente."
+    "threemaIdHelp": "Inserisci il tuo ID Threema — gli 8 caratteri mostrati nella tua app Threema sotto Impostazioni → Il mio ID Threema. Una volta aggiunto, potrai conversare con l'assistente direttamente da Threema.",
+    "threemaSetup": {
+      "title": "Aggiungi l'assistente a Threema",
+      "step1": "Apri Threema sul tuo telefono.",
+      "step2": "Tocca l'icona di scansione e scansiona questo QR code per aggiungere l'assistente ai contatti.",
+      "step3": "Quindi aggiungi il tuo ID Threema qui sotto.",
+      "qrAlt": "QR code per aggiungere {gateway} come contatto Threema",
+      "bannerTitle": "Configura Threema",
+      "bannerBody": "Apri Threema sul tuo telefono e scansiona il nostro QR code per aggiungere l'assistente ai contatti. Inserisci poi il tuo ID Threema qui sotto.",
+      "bannerButton": "Mostra QR code"
+    }
  },
  "team": {
    "title": "Team",
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -40,5 +40,10 @@ export default async function middleware(request: NextRequest) {
 }

 export const config = {
-  matcher: ["/((?!_next|favicon.ico|api).*)"],
+  // Excludes _next/* internal routes, the favicon, api routes, AND any
+  // path containing a dot (covers all static files served from public/,
+  // e.g. /threema/qr_code_AIAGENT.png). Without the dot exclusion, the
+  // i18n middleware prepends the locale ("/en/threema/qr_code_AIAGENT.png")
+  // and the file is not found.
+  matcher: ["/((?!_next|favicon.ico|api|.*\\..*).*)"],
 };
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -412,3 +412,111 @@ export interface SupportTicketDetail {
  ticket: SupportTicket;
  comments: SupportTicketComment[];
 }
+
+// ---------------------------------------------------------------------------
+// Billing — Phase 1: pricing, lifecycle, and events
+// ---------------------------------------------------------------------------
+//
+// All money values are numbers (CHF). The DB stores NUMERIC and the
+// helpers coerce to Number on read. JS floats are exact for integers
+// up to 2^53; at this domain (CHF amounts to 2 decimals, unit prices
+// to 5 decimals) precision is fine. The Phase 2 billing computation
+// will still do arithmetic carefully (sum in cents, round at the
+// end) to avoid 0.1 + 0.2 surprises.
+
+/**
+ * Single-row platform pricing config. Editable via the admin
+ * pricing page (Phase 2). The `vatRateChli` field is the rate
+ * applied to invoices whose billing address resolves to CH/LI;
+ * foreign customers' rates are decided per-invoice from address +
+ * VAT number, not from this config.
+ */
+export interface PlatformPricing {
+  tenantMonthlyFeeChf: number;
+  tenantSetupFeeChf: number;
+  threemaMessageChf: number;
+  vatRateChli: number;
+  updatedAt: string;
+}
+
+/**
+ * Per-package daily price. Phase 2's admin UI restricts setting
+ * these to skill-category packages, but the schema accepts any
+ * package id. A row's existence is what activates billing for that
+ * package; deleting the row makes it free without affecting the
+ * append-only event log.
+ */
+export interface SkillPricing {
+  skillId: string;
+  dailyPriceChf: number;
+  createdAt: string;
+  updatedAt: string;
+}
+
+/**
+ * Tenant lifecycle bookends mirrored from K8s into Postgres so
+ * deleted tenants still have a billing record for their final
+ * invoice. `createdAt` matches PiecedTenant.metadata.creationTimestamp
+ * at the moment of approval; `deletedAt` is stamped when the admin
+ * delete endpoint runs.
+ */
+export interface TenantBillingLifecycle {
+  tenantName: string;
+  zitadelOrgId: string;
+  createdAt: string;
+  deletedAt: string | null;
+}
+
+/**
+ * Append-only enable/disable event for a package on a tenant.
+ * Phase 2's billing computation reads the event stream within the
+ * billing window and collapses it to a set of UTC days during
+ * which the package was active.
+ */
+export interface TenantSkillEvent {
+  id: string;
+  tenantName: string;
+  zitadelOrgId: string;
+  skillId: string;
+  eventKind: "enabled" | "disabled";
+  occurredAt: string;
+}
+
+/**
+ * Append-only suspend/resume event. Recorded by the portal at
+ * command time (when PATCH spec.suspend lands), not at operator
+ * reconcile time. The few-second delta is irrelevant for monthly
+ * billing.
+ */
+export interface TenantSuspensionEvent {
+  id: string;
+  tenantName: string;
+  zitadelOrgId: string;
+  eventKind: "suspended" | "resumed";
+  occurredAt: string;
+}
+
+/**
+ * Per-org billing posture and Stripe linkage. Distinct from
+ * OrgBilling (which is the customer-editable address/VAT block):
+ * this one is admin-controlled.
+ *
+ * `payByInvoice` flips the onboarding gate (Phase 4): when true,
+ * tenant requests for this org are approvable without a card on
+ * file. When false, the customer must have a validated Stripe
+ * payment method before admin approval is allowed.
+ *
+ * `stripeCustomerId` is populated by Phase 4's onboarding flow.
+ * `autoInvoiceEnabled` / `autoRemindersEnabled` give admin per-org
+ * kill switches for the Phase 6 cron without disabling the cron
+ * globally.
+ */
+export interface OrgBillingConfig {
+  zitadelOrgId: string;
+  payByInvoice: boolean;
+  stripeCustomerId: string | null;
+  autoInvoiceEnabled: boolean;
+  autoRemindersEnabled: boolean;
+  createdAt: string;
+  updatedAt: string;
+}
Author	SHA1	Message	Date
admin	faf49119ea	Phase1: Schema + skill event tracking All checks were successful Build and Push / build (push) Successful in 1m27s Details	2026-05-23 23:50:42 +02:00
admin	ce70fe8480	Phase1: Schema + skill event tracking Some checks failed Build and Push / build (push) Failing after 38s Details	2026-05-23 23:45:04 +02:00
admin	55571b1e59	Threema UX: static file middleware fix, *AIAGENT display, info banner All checks were successful Build and Push / build (push) Successful in 1m26s Details	2026-05-17 17:29:25 +02:00
admin	c0ff22394c	Threema QR: on-demand modal + auto-open on first add All checks were successful Build and Push / build (push) Successful in 1m29s Details	2026-05-17 17:13:44 +02:00
admin	395d2f43cc	Threema: customer-friendly texts + QR setup component All checks were successful Build and Push / build (push) Successful in 1m27s Details	2026-05-17 16:50:23 +02:00
admin	6f42b56ad5	Threema package: relay-managed channel users + provisioning endpoints All checks were successful Build and Push / build (push) Successful in 1m26s Details	2026-05-17 11:10:40 +02:00
admin	85c4302f7a	Threema Gateway All checks were successful Build and Push / build (push) Successful in 1m30s Details	2026-05-16 22:00:27 +02:00
admin	726151d90b	Add new TTS/STT Logic Some checks failed Build and Push / build (push) Failing after 45s Details	2026-05-16 19:55:51 +02:00
admin	a13af83655	Adjust skills All checks were successful Build and Push / build (push) Successful in 1m31s Details	2026-05-11 21:25:09 +02:00