@cosmicdrift/kumiko-samples 0.352.0 → 0.353.0

package/packages/bundled-features/src/tenant-handover/move-entity-graph.ts

@@ -268,7 +268,7 @@ export async function moveTransferGraph(args: {
     { entityName: rootEntityName, rowIds: [rootRowId] },
   ];
 
-  for (let round = 0; round < MAX_TRANSFER_DEPTH && pending.length > 0; round++) {
+  for (let round = 0; round <= MAX_TRANSFER_DEPTH && pending.length > 0; round++) {
     // Merged per type so an edge leaving a type runs once per round, not once
     // per edge that reached it.
     const discovered = new Map<string, string[]>();
@@ -330,25 +330,18 @@ export async function moveTransferGraph(args: {
       }
     }
 
-    pending = [...discovered].map(([entityName, rowIds]) => ({ entityName, rowIds }));
-  }
+    // The extra round past the limit is a probe: it only exists to find out
+    // whether rows still hang below the last allowed hop. Its moves are rolled
+    // back with the transaction when this throws.
+    const [strandedEntityName] = discovered.keys();
+    if (round === MAX_TRANSFER_DEPTH && strandedEntityName !== undefined) {
+      throw new UnprocessableError("transfer_graph_too_deep", {
+        i18nKey: "errors.tenantHandover.transferGraphTooDeep",
+        details: { entityName: strandedEntityName },
+      });
+    }
 
-  // The depth limit is a safety net, not a licence to move part of a graph: if
-  // rounds ran out while rows remain whose type still leads somewhere, the
-  // declaration reaches further than the mover does, and returning quietly
-  // would leave exactly the orphaned rows #3088 is about.
-  //
-  // Rounds count hops of both edge kinds, while the boot validator measures
-  // reference chains between transferable entities only. A graph that fills the
-  // limit with reference hops and then adds a parentRef child therefore boots
-  // clean and fails here instead — the residual the validator cannot see, and
-  // the reason this check has to exist rather than trusting boot alone.
-  const stranded = pending.find(({ entityName }) => (adjacency.get(entityName) ?? []).length > 0);
-  if (stranded !== undefined) {
-    throw new UnprocessableError("transfer_graph_too_deep", {
-      i18nKey: "errors.tenantHandover.transferGraphTooDeep",
-      details: { entityName: stranded.entityName },
-    });
+    pending = [...discovered].map(([entityName, rowIds]) => ({ entityName, rowIds }));
   }
 
   return movedCounts;

package/packages/bundled-features/src/tenant-lifecycle/feature.ts

@@ -141,6 +141,7 @@ export function createTenantLifecycleFeature(): FeatureDefinition {
           now,
           log: (message) => ctx.log?.warn(message),
           fileProviderResolver: ctx._fileProviderResolver,
+          searchAdapter: ctx.searchAdapter,
           escapeHatchAuditSink: ctx._escapeHatchAuditSink,
           actor: ctx.systemUser.id,
         });

package/packages/bundled-features/src/tenant-lifecycle/run-tenant-destroy.ts

@@ -14,6 +14,7 @@ import {
   VersionConflictError,
 } from "@cosmicdrift/kumiko-framework/event-store";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
+import type { SearchAdapter } from "@cosmicdrift/kumiko-framework/search";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { tenantEntity, tenantTable } from "../tenant/index.js";
 import {
@@ -222,6 +223,7 @@ export async function runNextDestructionStage(args: {
   readonly tenantId: TenantId;
   readonly log?: (message: string) => void;
   readonly fileProviderResolver?: FileProviderResolver;
+  readonly searchAdapter?: SearchAdapter;
   readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
   readonly actor?: string;
 }): Promise<{ readonly done: boolean; readonly error?: string; readonly halted?: boolean }> {
@@ -246,6 +248,7 @@ export async function runNextDestructionStage(args: {
     tenantId: args.tenantId,
     log: args.log,
     fileProviderResolver: args.fileProviderResolver,
+    searchAdapter: args.searchAdapter,
     escapeHatchAuditSink: args.escapeHatchAuditSink,
     actor: args.actor,
   };
@@ -334,6 +337,7 @@ export async function runTenantDestructionSweep(args: {
   readonly now?: Temporal.Instant;
   readonly log?: (message: string) => void;
   readonly fileProviderResolver?: FileProviderResolver;
+  readonly searchAdapter?: SearchAdapter;
   readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
   readonly actor?: string;
 }): Promise<{ readonly triggered: number; readonly advanced: number }> {
@@ -380,6 +384,7 @@ export async function runTenantDestructionSweep(args: {
         tenantId: row.id as TenantId,
         log: args.log,
         fileProviderResolver: args.fileProviderResolver,
+        searchAdapter: args.searchAdapter,
         escapeHatchAuditSink: args.escapeHatchAuditSink,
         actor: args.actor,
       });

package/packages/bundled-features/src/tenant-lifecycle/stages.ts

@@ -1,5 +1,9 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { configuredPiiSubjectKms, type SubjectId } from "@cosmicdrift/kumiko-framework/crypto";
+import {
+  configuredPiiSubjectKms,
+  type SubjectId,
+  subjectIdToKey,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import {
   createEventStoreExecutor,
   createTenantDb,
@@ -26,6 +30,10 @@ import {
   createEscapeHatchReporter,
   UNATTRIBUTED_ACTOR,
 } from "@cosmicdrift/kumiko-framework/pipeline";
+import {
+  purgeSearchDocumentsForSubject,
+  type SearchAdapter,
+} from "@cosmicdrift/kumiko-framework/search";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   tenantEntity,
@@ -45,6 +53,9 @@ export type DestructionStageCtx = {
   // "destroyTenant" hooks) — undefined when no file-provider is wired,
   // which those hooks must treat as "nothing to clean up", not an error.
   readonly fileProviderResolver?: FileProviderResolver;
+  // Derived search docs of the tenant record (its name) live in the writer's
+  // index, not the destroyed tenant's, so the subject-keys stage purges them.
+  readonly searchAdapter?: SearchAdapter;
   // fw#2914 — sourced from the owning job's ctx (_escapeHatchAuditSink,
   // systemUser.id); runTenantDataHooks uses them to attribute+audit any
   // EXT_TENANT_DATA usage's declared escapeHatch.
@@ -123,8 +134,10 @@ async function eraseSubjectKeys(ctx: DestructionStageCtx): Promise<void> {
   const memberships = await selectMany<{ userId: string }>(ctx.db, tenantMembershipsTable, {
     tenantId: ctx.tenantId,
   });
+  const tenantRecordSubject: SubjectId = { kind: "record", entity: "tenant", id: ctx.tenantId };
   const subjects: SubjectId[] = [
     { kind: "tenant", tenantId: ctx.tenantId },
+    tenantRecordSubject,
     ...memberships.map((m) => ({ kind: "user" as const, userId: m.userId })),
   ];
   for (const subject of subjects) {
@@ -133,6 +146,15 @@ async function eraseSubjectKeys(ctx: DestructionStageCtx): Promise<void> {
       eraseReason: "tenant-destroy stage subject-keys",
     });
   }
+  if (ctx.searchAdapter) {
+    await purgeSearchDocumentsForSubject(
+      ctx.db,
+      ctx.registry.features,
+      ctx.searchAdapter,
+      subjectIdToKey(tenantRecordSubject),
+      tenantRecordSubject,
+    );
+  }
 }
 
 async function purgeTenantCache(ctx: DestructionStageCtx): Promise<void> {

package/packages/bundled-features/src/user/handlers/list.query.ts

@@ -8,7 +8,7 @@ import {
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import type { QueryHandlerDef } from "@cosmicdrift/kumiko-types/handlers";
 // kumiko-lint-ignore cross-feature-import SystemAdmin user-list joins memberships for tenants column
-import { tenantMembershipsTable, tenantTable } from "../../tenant/index.js";
+import { decryptTenantNames, tenantMembershipsTable, tenantTable } from "../../tenant/index.js";
 import { userEntity } from "../schema/user.js";
 
 const baseList = defineEntityListHandler("user", userEntity, {
@@ -82,7 +82,10 @@ export async function attachTenantLabels(
   ];
   const tenants =
     tenantIds.length > 0
-      ? await selectMany<TenantRow>(db, tenantTable, { id: { in: tenantIds } })
+      ? await decryptTenantNames(
+          await selectMany<TenantRow>(db, tenantTable, { id: { in: tenantIds } }),
+          "user:list",
+        )
       : [];
   const byUser = labelsByUserId(memberships, tenantLabelById(tenants));
   return rows.map((row) => {

package/packages/bundled-features/src/user-data-rights/boot-checks.ts

@@ -24,6 +24,13 @@ export function validateGdprHookCompleteness(features: readonly FeatureDefinitio
       if (usage.extensionName !== EXT_USER_DATA) continue;
       const hasExport = typeof usage.options?.["export"] === "function";
       const hasDelete = typeof usage.options?.["delete"] === "function";
+      // The compile-time "at least one hook" type is bypassed by string-typed
+      // extension names and casts; without this an empty bag registers nothing.
+      if (!hasExport && !hasDelete) {
+        throw new Error(
+          `[kumiko:boot] Feature "${feature.name}" registers EXT_USER_DATA for entity "${usage.entityName}" with neither an export nor a delete hook — the entity silently stays out of the Art.15/17/20 pipeline. Register at least one hook.`,
+        );
+      }
       if (hasExport && !hasDelete) {
         throw new Error(
           `[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`,

package/packages/bundled-features/src/user-data-rights/deletion-token.ts

@@ -38,7 +38,7 @@ export function redeemDeletionToken(args: {
   readonly secret: string | undefined;
   readonly loadPendingRequestId: (userId: string) => Promise<string | null>;
   // Spends the anchor AND performs the actual lifecycle transition in one
-  // atomic step (#3024) — the caller (confirm-deletion-by-token) folds the
+  // atomic step — the caller (confirm-deletion-by-token) folds the
   // Active→DeletionRequested write itself in here via `updateUserLifecycle`'s
   // `expect: { status: Active, pendingDeletionRequestId }`, so a write issued
   // after `ok: true` can't lose its work to a crash while the grant is

package/packages/bundled-features/src/user-data-rights/handlers/confirm-deletion-by-token.write.ts

@@ -37,7 +37,7 @@ async function readPendingDeletionRequestId(
 
 // Anonymous apex flow step 2: verify-link target. Verifies the HMAC token,
 // extracts the userId, and flips the grace period through the shared logic —
-// in ONE atomic step with the anchor spend (#3024): commitDeletion carries
+// in ONE atomic step with the anchor spend: commitDeletion carries
 // the actual grace-period transition, so a crash after the spend can no
 // longer lose the write step.
 //
@@ -47,7 +47,7 @@ async function readPendingDeletionRequestId(
 // a cancel-deletion (status → Active, pendingDeletionRequestId → null), a
 // replayed token fails against the nulled/renewed requestId — no re-arm.
 //
-// Concurrency (#3024): two simultaneous confirms of the same token both read
+// Concurrency: two simultaneous confirms of the same token both read
 // the same requestId and both verify the HMAC — commitDeletion spends the
 // anchor AND writes the transition atomically (expect: status===Active &&
 // pendingDeletionRequestId===requestId), so exactly one wins. The loser gets

package/packages/bundled-features/src/workflow-runner/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "workflow.run-failed carries the real stepIndex when a run suspends in an unsupported step"
+  },
   {
     "version": "0.340.0",
     "type": "improvement",

package/packages/bundled-features/src/workflow-runner/event-trigger.ts

@@ -23,7 +23,11 @@ import {
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { workflowRunAggregateId } from "./aggregate-id.js";
 import { registerEventWakeup } from "./event-subscriber.js";
-import { startAndRunWorkflow, type WorkflowRunFailedPayload } from "./runner.js";
+import {
+  startAndRunWorkflow,
+  type WorkflowRunFailedPayload,
+  WorkflowSuspensionUnsupportedError,
+} from "./runner.js";
 import { registerWorkflow } from "./workflow-registry.js";
 
 const log = createFallbackLogger("workflow-runner");
@@ -98,15 +102,19 @@ export function registerEventTrigger(r: FeatureRegistrar, workflow: WorkflowDefi
             handlerCtx: ctx as never,
           });
         } catch (error) {
+          // Only the suspension error knows its step; a throw inside a step
+          // carries no index, so it still reports 0.
+          const stepIndex =
+            error instanceof WorkflowSuspensionUnsupportedError ? error.stepIndex : 0;
           log.warn("workflow run failed", {
             runId,
             workflowName: workflow.name,
-            stepIndex: 0,
+            stepIndex,
             error: String(error),
           });
           const failedPayload: WorkflowRunFailedPayload = {
             workflowName: workflow.name,
-            stepIndex: 0,
+            stepIndex,
             error: describeWorkflowStepError(error),
           };
           await ctx.unsafeAppendEvent({

package/packages/bundled-features/src/workflow-runner/handlers/resume-run.write.ts

@@ -92,6 +92,11 @@ function checkQ7Fingerprint(
   storedFingerprint: string | null,
 ): WorkflowRunFailedPayload | null {
   const currentFingerprint = computeDefinitionFingerprint(workflow);
+  if (storedFingerprint === null) {
+    log.warn(
+      `Run ${runId} of workflow "${workflowName}" has no stored definition fingerprint — resuming against the current definition unchecked.`,
+    );
+  }
   const fingerprintChanged = storedFingerprint !== null && currentFingerprint !== storedFingerprint;
   if (!fingerprintChanged) {
     return null;

package/samples/apps/showcase/src/features/items/schema/item.ts

@@ -53,7 +53,6 @@ export const itemEditScreen: EntityEditScreenDefinition = {
   type: "entityEdit",
   entity: "item",
   layout: {
-    width: "3xl",
     sections: [
       {
         title: "Basics",

package/samples/apps/styleguide/src/features/widgets/demo-locale.ts

@@ -0,0 +1,47 @@
+// Server-side locale helpers for the dashboard demo queries. Not shared with
+// renderer-web's format.ts: server code must not import renderer-web.
+
+import { WIDGETS_I18N } from "./i18n";
+
+type WidgetsI18nKey = keyof typeof WIDGETS_I18N;
+type DemoCurrency = "EUR" | "USD";
+
+const FALLBACK_LOCALE = "en";
+
+// Intl throws RangeError on malformed tags.
+function usableLocale(locale: string): string {
+  try {
+    return Intl.getCanonicalLocales(locale)[0] ?? FALLBACK_LOCALE;
+  } catch {
+    return FALLBACK_LOCALE;
+  }
+}
+
+// The bundle only carries de + en: any "de" tag ("de-AT") picks de, everything else en.
+export function demoText(key: WidgetsI18nKey, locale: string): string {
+  const entry = WIDGETS_I18N[key];
+  const primarySubtag = usableLocale(locale).split("-")[0];
+  return primarySubtag === "de" ? entry.de : entry.en;
+}
+
+export function demoMoney(amount: number, currency: DemoCurrency, locale: string): string {
+  return new Intl.NumberFormat(usableLocale(locale), {
+    style: "currency",
+    currency,
+    maximumFractionDigits: 0,
+  }).format(amount);
+}
+
+export function demoPercent(fraction: number, locale: string): string {
+  return new Intl.NumberFormat(usableLocale(locale), {
+    style: "percent",
+    maximumFractionDigits: 0,
+  }).format(fraction);
+}
+
+export function demoMonthYear(year: number, month: number, locale: string): string {
+  return Temporal.PlainDate.from({ year, month, day: 1 }).toLocaleString(usableLocale(locale), {
+    month: "short",
+    year: "numeric",
+  });
+}

package/samples/apps/styleguide/src/features/widgets/feature.ts

@@ -5,6 +5,7 @@
 
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { demoMoney, demoMonthYear, demoPercent, demoText } from "./demo-locale";
 import { WIDGETS_I18N } from "./i18n";
 
 // Statische Demo-Zeitreihe (48 Punkte à 30 Minuten) — kein Date-API,
@@ -33,6 +34,13 @@ const INBOX_MESSAGES = Array.from({ length: 18 }, (_, i) => ({
   unread: i % 4 === 0,
 }));
 
+function openAmount(amount: number, locale: string): string {
+  return demoText("widgets:dashboard:demo-amount-open", locale).replace(
+    "{amount}",
+    demoMoney(amount, "EUR", locale),
+  );
+}
+
 export const widgetsFeature = defineFeature("widgets", (r) => {
   r.screen({ id: "widgets", type: "custom", renderer: { react: { __component: "widgets" } } });
   r.screen({
@@ -129,11 +137,14 @@ export const widgetsFeature = defineFeature("widgets", (r) => {
   r.queryHandler(
     "metrics:portfolio-stat",
     z.object({ region: z.string().optional() }),
-    async ({ payload: { region } }) => ({
-      value: region === "us" ? "38.120 $" : region === "eu" ? "54.630 €" : "92.753 €",
-      sub: "über 4 Konten",
+    async ({ payload: { region } }, ctx) => ({
+      value:
+        region === "us"
+          ? demoMoney(38120, "USD", ctx.locale)
+          : demoMoney(region === "eu" ? 54630 : 92753, "EUR", ctx.locale),
+      sub: demoText("widgets:catalog:portfolio-sub", ctx.locale),
       tone: "positive",
-      delta: "12 %",
+      delta: demoPercent(0.12, ctx.locale),
       deltaDirection: "up",
       deltaTone: "positive",
     }),
@@ -150,7 +161,7 @@ export const widgetsFeature = defineFeature("widgets", (r) => {
   r.queryHandler(
     "metrics:net-worth-assets",
     z.object({ region: z.string().optional() }),
-    async () => ({ value: "120.000 €" }),
+    async (_query, ctx) => ({ value: demoMoney(120000, "EUR", ctx.locale) }),
     {
       access: {
         openToAll: {
@@ -164,7 +175,7 @@ export const widgetsFeature = defineFeature("widgets", (r) => {
   r.queryHandler(
     "metrics:net-worth-debts",
     z.object({ region: z.string().optional() }),
-    async () => ({ value: "65.370 €" }),
+    async (_query, ctx) => ({ value: demoMoney(65370, "EUR", ctx.locale) }),
     {
       access: {
         openToAll: {
@@ -196,10 +207,18 @@ export const widgetsFeature = defineFeature("widgets", (r) => {
   r.queryHandler(
     "metrics:latest-items",
     z.object({}),
-    async () => ({
+    async (_query, ctx) => ({
       rows: [
-        { id: "i1", name: "API-Timeout eu-central", status: "resolved" },
-        { id: "i2", name: "Zertifikat erneuert", status: "done" },
+        {
+          id: "i1",
+          name: demoText("widgets:dashboard:demo-incident-timeout", ctx.locale),
+          status: "resolved",
+        },
+        {
+          id: "i2",
+          name: demoText("widgets:dashboard:demo-incident-certificate", ctx.locale),
+          status: "done",
+        },
       ],
       nextCursor: null,
     }),
@@ -249,10 +268,16 @@ export const widgetsFeature = defineFeature("widgets", (r) => {
   r.queryHandler(
     "metrics:upcoming-events",
     z.object({}),
-    async () => ({
+    async (_query, ctx) => ({
       rows: [
-        { primary: "Zinsanpassung Baudarlehen", trailing: "Aug 2026" },
-        { primary: "Bausparvertrag zuteilungsreif", trailing: "Okt 2026" },
+        {
+          primary: demoText("widgets:dashboard:demo-event-rate-adjustment", ctx.locale),
+          trailing: demoMonthYear(2026, 8, ctx.locale),
+        },
+        {
+          primary: demoText("widgets:dashboard:demo-event-savings-contract", ctx.locale),
+          trailing: demoMonthYear(2026, 10, ctx.locale),
+        },
       ],
     }),
     {
@@ -268,10 +293,18 @@ export const widgetsFeature = defineFeature("widgets", (r) => {
   r.queryHandler(
     "metrics:goal-progress",
     z.object({}),
-    async () => ({
+    async (_query, ctx) => ({
       rows: [
-        { label: "Baudarlehen", value: "42.000 € offen", fraction: 0.71 },
-        { label: "Autokredit", value: "3.200 € offen", fraction: 0.92 },
+        {
+          label: demoText("widgets:dashboard:demo-goal-mortgage", ctx.locale),
+          value: openAmount(42000, ctx.locale),
+          fraction: 0.71,
+        },
+        {
+          label: demoText("widgets:dashboard:demo-goal-car-loan", ctx.locale),
+          value: openAmount(3200, ctx.locale),
+          fraction: 0.92,
+        },
       ],
     }),
     {

package/samples/apps/styleguide/src/features/widgets/i18n.ts

@@ -27,6 +27,34 @@ export const WIDGETS_I18N = {
   "widgets:dashboard:filter-region": { de: "Region", en: "Region" },
   "widgets:dashboard:filter-region-eu": { de: "Europa", en: "Europe" },
   "widgets:dashboard:filter-region-us": { de: "USA", en: "USA" },
+  "widgets:dashboard:filter-echo-title": { de: "Custom-Panel", en: "Custom panel" },
+  "widgets:dashboard:filter-echo-filtered": {
+    de: "Gefiltert nach Region: {region}",
+    en: "Filtered by region: {region}",
+  },
+  "widgets:dashboard:filter-echo-unfiltered": {
+    de: "Ungefiltert (alle Regionen)",
+    en: "Unfiltered (all regions)",
+  },
+  "widgets:dashboard:demo-incident-timeout": {
+    de: "API-Timeout eu-central",
+    en: "API timeout eu-central",
+  },
+  "widgets:dashboard:demo-incident-certificate": {
+    de: "Zertifikat erneuert",
+    en: "Certificate renewed",
+  },
+  "widgets:dashboard:demo-event-rate-adjustment": {
+    de: "Zinsanpassung Baudarlehen",
+    en: "Mortgage rate adjustment",
+  },
+  "widgets:dashboard:demo-event-savings-contract": {
+    de: "Bausparvertrag zuteilungsreif",
+    en: "Building savings contract ready for allocation",
+  },
+  "widgets:dashboard:demo-goal-mortgage": { de: "Baudarlehen", en: "Mortgage" },
+  "widgets:dashboard:demo-goal-car-loan": { de: "Autokredit", en: "Car loan" },
+  "widgets:dashboard:demo-amount-open": { de: "{amount} offen", en: "{amount} outstanding" },
   "widgets:catalog:portfolio": { de: "Portfolio", en: "Portfolio" },
   "widgets:catalog:portfolio-sub": { de: "über 4 Konten", en: "across 4 accounts" },
   "widgets:catalog:remaining-debt": { de: "Restschuld", en: "Remaining debt" },

package/samples/apps/styleguide/src/features/widgets/web/DashboardFilterEcho.tsx

@@ -3,18 +3,19 @@
 // gewählten Screen-Filter-Wert über `filterParams` sieht (siehe
 // DashboardFilterDefinition in feature.ts).
 
-import type { ExtensionSectionProps } from "@cosmicdrift/kumiko-renderer";
+import { type ExtensionSectionProps, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { SectionCard } from "@cosmicdrift/kumiko-renderer-web";
 import type { ReactNode } from "react";
 
 export function DashboardFilterEcho({ filterParams }: ExtensionSectionProps): ReactNode {
+  const t = useTranslation();
   const region = filterParams?.["region"];
   return (
-    <SectionCard title="Custom-Panel">
+    <SectionCard title={t("widgets:dashboard:filter-echo-title")}>
       <p className="text-sm text-muted-foreground">
         {typeof region === "string"
-          ? `Gefiltert nach Region: ${region}`
-          : "Ungefiltert (alle Regionen)"}
+          ? t("widgets:dashboard:filter-echo-filtered", { region })
+          : t("widgets:dashboard:filter-echo-unfiltered")}
       </p>
     </SectionCard>
   );

package/samples/recipes/public-share-token/README.md

@@ -3,9 +3,8 @@
 Minimal pattern for **tokenized anonymous read surfaces**: authenticated users
 mint a link; visitors resolve it without login.
 
-Domain-agnostic — no credit/folder logic. Full consumer:
-[Cashcolt money-horse](https://github.com/CosmicDriftGameStudio/money-horse)
-(`share-by-token` + 5 layout templates).
+Domain-agnostic — no credit/folder logic. A full consumer adds snapshots,
+layout templates and tier gates on top.
 
 ## What it shows
 
@@ -16,8 +15,8 @@ Domain-agnostic — no credit/folder logic. Full consumer:
 - **`anonymousAccess`** on test stack (see integration test)
 
 Client wiring: [`recipes/apex-surface-auth`](../apex-surface-auth/) or a gate
-before `createKumikoApp` (money-horse uses `public-share-gate.tsx` like the public
-calculator).
+before `createKumikoApp` (a small gate component that renders the public view when
+the URL carries a share token).
 
 ## Handlers
 

package/samples/recipes/public-share-token/src/feature.ts

@@ -3,7 +3,7 @@
 // Pattern: authenticated create → plain token show-once → anonymous
 // read-by-token with SHA-256 lookup. Revoke sets revokedAt via executor.
 //
-// See money-horse for credit/folder snapshots, layouts, tier gates.
+// A full consumer adds domain snapshots, layouts and tier gates on top.
 
 import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";

package/samples/recipes/security-baseline/README.md

@@ -54,6 +54,12 @@ export const APP_FEATURES = [
 For an app that does not mount `dsgvoSelfServiceFeatures()`, use
 `securityBaselineFeatures()` with its default options, as this recipe does.
 
+Dedupe keeps the first mounted instance. Late-bound state such as
+`bindAutoRevokeOnPasswordChange` must be bound on the instance returned by
+`composeFeatures`/`createApp`, not on a locally held handle to the dropped one:
+the dropped instance's hooks never run and password changes silently stop
+revoking sessions.
+
 A `createSessionsFeature({ ... })` mounted with different options than the
 preset's own no-arg instance still produces a clear boot error — dedupe only
 collapses provably interchangeable instances, never silently picks one:

package/samples/recipes/tenant-settings/README.md

@@ -20,7 +20,7 @@ import { defineCreateWithTenantDefaults } from "@cosmicdrift/kumiko-bundled-feat
 export const invoiceEntity = createEntity({
   table: "read_invoices",
   fields: {
-    title: createTextField({ required: true }),
+    title: createTextField({ personal: false, reason: "is_business_data", required: true }),
     amount: createMoneyField({ required: true }),
     language: createSelectField({ options: ["en", "de", "fr"] as const }),
   },

package/packages/bundled-features/src/shared/has-where-rule.ts

@@ -1,11 +0,0 @@
-import type { OwnershipMap } from "@cosmicdrift/kumiko-framework/engine";
-
-// `where`-rules are read-path only (buildOwnershipClause). The write path
-// decides in memory against the concrete row, so a where-rule there can only
-// ever deny — boot validation rejects the shape (fw#2626). Feature factories
-// that accept an `ownership` option reject it earlier, at build time, so the
-// author gets the option name in the message instead of an entity scope.
-export function hasWhereRule(map: OwnershipMap | undefined): boolean {
-  if (!map) return false;
-  return Object.values(map).some((rule) => rule !== "all" && rule.kind === "where");
-}