@cosmicdrift/kumiko-samples 0.388.0 → 0.390.0

package/samples/apps/styleguide/src/features/workboard/seed.ts

@@ -0,0 +1,121 @@
+import type { SeedFn } from "@cosmicdrift/kumiko-dev-server";
+import { TestUsers } from "@cosmicdrift/kumiko-framework/seeding";
+
+type SeedTask = {
+  readonly title: string;
+  readonly status: "open" | "inProgress" | "blocked" | "done";
+  readonly priority: "low" | "medium" | "high";
+  readonly dueDate: string;
+  readonly assignee: string;
+  readonly estimateHours: number;
+};
+
+const TASKS: readonly SeedTask[] = [
+  {
+    title: "Quarterly VAT filing",
+    status: "inProgress",
+    priority: "high",
+    dueDate: "2026-11-10",
+    assignee: "Ines Vogel",
+    estimateHours: 6,
+  },
+  {
+    title: "Renew office lease",
+    status: "open",
+    priority: "medium",
+    dueDate: "2026-12-01",
+    assignee: "Tomas Berg",
+    estimateHours: 3,
+  },
+  {
+    title: "Onboard new support hire",
+    status: "open",
+    priority: "high",
+    dueDate: "2026-11-03",
+    assignee: "Ines Vogel",
+    estimateHours: 12,
+  },
+  {
+    title: "Migrate invoices to new numbering",
+    status: "blocked",
+    priority: "high",
+    dueDate: "2026-11-15",
+    assignee: "Mara Lindqvist",
+    estimateHours: 16,
+  },
+  {
+    title: "Update privacy policy",
+    status: "done",
+    priority: "medium",
+    dueDate: "2026-10-20",
+    assignee: "Tomas Berg",
+    estimateHours: 4,
+  },
+  {
+    title: "Order replacement laptops",
+    status: "inProgress",
+    priority: "low",
+    dueDate: "2026-11-25",
+    assignee: "Mara Lindqvist",
+    estimateHours: 2,
+  },
+  {
+    title: "Prepare annual audit documents",
+    status: "open",
+    priority: "high",
+    dueDate: "2027-01-15",
+    assignee: "Ines Vogel",
+    estimateHours: 24,
+  },
+  {
+    title: "Fix mobile checkout layout",
+    status: "inProgress",
+    priority: "medium",
+    dueDate: "2026-11-05",
+    assignee: "Jonas Keller",
+    estimateHours: 8,
+  },
+  {
+    title: "Review supplier contracts",
+    status: "blocked",
+    priority: "medium",
+    dueDate: "2026-11-30",
+    assignee: "Tomas Berg",
+    estimateHours: 10,
+  },
+  {
+    title: "Archive 2025 customer files",
+    status: "done",
+    priority: "low",
+    dueDate: "2026-10-31",
+    assignee: "Jonas Keller",
+    estimateHours: 5,
+  },
+  {
+    title: "Plan team offsite",
+    status: "open",
+    priority: "low",
+    dueDate: "2027-02-20",
+    assignee: "Mara Lindqvist",
+    estimateHours: 7,
+  },
+  {
+    title: "Set up weekly sales report",
+    status: "inProgress",
+    priority: "medium",
+    dueDate: "2026-11-12",
+    assignee: "Jonas Keller",
+    estimateHours: 9,
+  },
+];
+
+export const seedWorkboardTasks: SeedFn = async (stack) => {
+  for (const task of TASKS) {
+    const res = await stack.http.write("workboard:write:task:create", task, TestUsers.admin);
+    if (!res.ok) {
+      // biome-ignore lint/suspicious/noConsole: dev-seed surfaces failures in the runner log
+      console.error(`[seed] workboard task "${task.title}" failed:`, await res.text());
+      return;
+    }
+  }
+};

package/samples/apps/styleguide/src/features/workboard/web.ts

@@ -0,0 +1,13 @@
+import type {
+  ClientFeatureDefinition,
+  TranslationsByLocale,
+} from "@cosmicdrift/kumiko-renderer/web";
+import { toClientTranslations } from "../shared-i18n";
+import { WORKBOARD_I18N } from "./i18n";
+
+const translations: TranslationsByLocale = toClientTranslations(WORKBOARD_I18N);
+
+export const workboardClient: ClientFeatureDefinition = {
+  name: "workboard",
+  translations,
+};

package/samples/apps/ui-walkthrough/src/features/rental/i18n.ts

@@ -50,6 +50,7 @@ export const rentalTranslations: TranslationsByLocale = {
     "rental.party.role.main": "Hauptmieter",
     "rental.party.role.co": "Mitmieterin",
     "rental.action.addParty": "Partei hinzufügen",
+    "rental.action.showTerminated": "Beendete Verträge",
 
     "rental.tab.parties": "Vertragsparteien",
     "rental.tab.positions": "Positionen",
@@ -214,6 +215,7 @@ export const rentalTranslations: TranslationsByLocale = {
     "rental.party.role.main": "Main tenant",
     "rental.party.role.co": "Co-tenant",
     "rental.action.addParty": "Add party",
+    "rental.action.showTerminated": "Terminated leases",
 
     "rental.tab.parties": "Parties",
     "rental.tab.positions": "Positions",

package/samples/apps/ui-walkthrough/src/features/rental/screens.ts

@@ -52,6 +52,15 @@ export const leaseListScreen: EntityListScreenDefinition = {
   pageSize: 25,
   createLabel: "rental.action.createLease",
   searchPlaceholder: "rental.search.placeholder",
+  toolbarActions: [
+    {
+      kind: "navigate",
+      id: "show-terminated",
+      label: "rental.action.showTerminated",
+      style: "primary",
+      screen: "lease-list-short",
+    },
+  ],
   rowActions: [openLeaseDetail],
   access: OPEN_ACCESS,
 };

package/samples/apps/use-all-bundled/bin/main.ts

@@ -8,6 +8,7 @@ import { InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { composeEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import { runProdApp } from "@cosmicdrift/kumiko-server-runtime";
+import { BUNDLED_LISTS } from "../src/bundled-lists";
 import {
   APP_FEATURES,
   AUTH_COMPOSE_OPTIONS,
@@ -27,6 +28,7 @@ await runProdApp({
   featureToggles: true,
   envSchema,
   validateBootOptions: VALIDATE_BOOT_OPTIONS,
+  bundledLists: BUNDLED_LISTS,
   // Smoke-only: exercises the hard PII boot gate + blind-index gate with
   // every bundled feature mounted. Real apps wire createPgKmsAdapter(...).
   kms: new InMemoryKmsAdapter(),

package/samples/apps/use-all-bundled/feature-manifest.json

@@ -71,6 +71,7 @@
       "name": "audit",
       "description": "Exposes the framework's event store as a paginated, filterable audit log via the `audit:query:list` handler (accessible to `Admin` and `SystemAdmin` roles). No separate table or projection — the event store is the audit trail by construction: every entity write already records who, when, what entity, and the event payload with PII stripped. A SystemAdmin can pass `scope: \"system\"` to read the app-instance system events such as `app.started`, and reads the events of every tenant (system tenant excluded) through `audit:query:list-all-tenants` and the `audit-log-all-tenants` screen. Filter by `aggregateType`, `aggregateId`, `eventType`, `userId`, or time range. Also records `audit:event:escape-hatch-used` whenever a handler uses one of the framework's escape hatches (unsafeRaw, acknowledgeCrossTenant, db.global() writes, or a granted identity switch).",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [
         "tenant",
         "user",
@@ -232,6 +233,7 @@
           "validated": false,
           "options": [
             "optional",
+            "systemAdmins",
             "admins",
             "all"
           ],
@@ -339,6 +341,7 @@
       "name": "cap-counter",
       "description": "Tracks per-tenant usage against configurable limits using two complementary storage models: calendar-period counters (one projection row per tenant/capName/period, reset implicitly by period rollover) and rolling-window counters (append-only event stream, no projection). Use `enforceCap` / `enforceRollingCap` (or the `withCapEnforcement` / `withRollingCapEnforcement` handler wrappers) in your write-handlers to check limits with soft-warn and hard-block tolerances; call `enforceCapAndMaybeNotify` when you also want to trigger a delivery notification on soft-threshold hits.",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [],
       "optionalRequires": [],
       "configReads": [],
@@ -362,6 +365,7 @@
       "name": "cap-overview",
       "description": "Read-only visibility into per-tenant tier assignment and cap usage. SystemAdmin gets a platform-wide tenant list with usage bars; tenant admins (or the roles in `usageVisibleTo`) get their own tenant's usage as dashboard cards. Reads tier-engine, billing-foundation, and tenant data plus app-owned usage tables via caller-supplied CapSpec callbacks — never writes.",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [
         "tenant",
         "tier-engine",
@@ -744,6 +748,7 @@
       "name": "delivery",
       "description": "The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting — add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (the `runProdApp` and `runDevApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. An app serving its own (e.g. legacy) unsubscribe links renders the same result page with `renderUnsubscribeResultPage({ kind, locale })`. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [
         "tenant"
       ],
@@ -895,6 +900,7 @@
       "name": "feature-toggles",
       "description": "Persists per-feature enabled/disabled state in the `store_global_feature_state` table and exposes a `set` write-handler plus `list`/`registered` query-handlers so operators can flip features at runtime without redeploying. Each API instance keeps an in-memory `GlobalFeatureToggleRuntime` snapshot (initialize it via `createFeatureToggleRuntime`, pass a `() => runtime` accessor to `createFeatureTogglesFeature`) that the dispatcher gate reads on every request; a `toggle-cache-sync` multi-stream projection with `delivery: \"shared\"` syncs the snapshot across instances whenever a `toggle-set` event is appended.",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [],
       "optionalRequires": [],
       "configReads": [],
@@ -914,7 +920,7 @@
     },
     {
       "name": "file-derivatives",
-      "description": "Declares the `derivativeRenderer` extension point. `ctx.derivatives.variant(fileRefId, spec, name)` derives a variant of a tracked FileRef the first time it's requested and reuses the stored result afterwards (derive-on-first-use, keyed by a hash of the spec). Mount at least one `derivatives-*` renderer feature alongside this one — without a registered renderer for the FileRef's MIME type, every `variant(...)` call throws. Also declares the `derivativePublicPredicate` extension point (`r.useExtension(EXT_DERIVATIVE_PUBLIC_PREDICATE, '<entityType>', { isPublic })`) and, when `createFileDerivativesFeature({resolveApexTenant})` is passed a host-resolver, mounts an anonymous `GET {basePath}/:fileRefId/:variant` route that serves any variant name the FileRef's field declared in its `variants` for a FileRef whose entityType has a registered predicate returning true — default-deny (404) otherwise, same as an unknown FileRef or an undeclared variant name. The route's only rate-limit (`per: \"ip\"`) depends on the server's `trustedProxyHops` matching the deployment's actual reverse-proxy count — at the default 0 it ignores `x-forwarded-for` entirely, so every caller shares one bucket until that's configured. `publicTenantResolution: \"fileRef\"` keeps resolveApexTenant as the host gate but reads the variant from the FileRef row's own tenant instead of the host's, so one shared platform host serves every tenant's public variants — each FileRef-tenant's own `isPublic` predicate still default-denies. Also declares the `derivativeOverlayResolver` extension point (`r.useExtension(EXT_DERIVATIVE_OVERLAY_RESOLVER, '<entityType>', { resolve })`), used to turn a variant's `overlays[].dataToken` into the actual QR payload for that FileRef's entityType before the variant is rendered — a variant declaring a `qr` overlay throws at request-time if no resolver is registered for the FileRef's entityType.",
+      "description": "Declares the `derivativeRenderer` extension point. `ctx.services.derivatives.variant(fileRefId, spec, name)` derives a variant of a tracked FileRef the first time it's requested and reuses the stored result afterwards (derive-on-first-use, keyed by a hash of the spec). Mount at least one `derivatives-*` renderer feature alongside this one — without a registered renderer for the FileRef's MIME type, every `variant(...)` call throws. Also declares the `derivativePublicPredicate` extension point (`r.useExtension(EXT_DERIVATIVE_PUBLIC_PREDICATE, '<entityType>', { isPublic })`) and, when `createFileDerivativesFeature({resolveApexTenant})` is passed a host-resolver, mounts an anonymous `GET {basePath}/:fileRefId/:variant` route that serves any variant name the FileRef's field declared in its `variants` for a FileRef whose entityType has a registered predicate returning true — default-deny (404) otherwise, same as an unknown FileRef or an undeclared variant name. The route's only rate-limit (`per: \"ip\"`) depends on the server's `trustedProxyHops` matching the deployment's actual reverse-proxy count — at the default 0 it ignores `x-forwarded-for` entirely, so every caller shares one bucket until that's configured. `publicTenantResolution: \"fileRef\"` keeps resolveApexTenant as the host gate but reads the variant from the FileRef row's own tenant instead of the host's, so one shared platform host serves every tenant's public variants — each FileRef-tenant's own `isPublic` predicate still default-denies. Also declares the `derivativeOverlayResolver` extension point (`r.useExtension(EXT_DERIVATIVE_OVERLAY_RESOLVER, '<entityType>', { resolve })`), used to turn a variant's `overlays[].dataToken` into the actual QR payload for that FileRef's entityType before the variant is rendered — a variant declaring a `qr` overlay throws at request-time if no resolver is registered for the FileRef's entityType.",
       "toggleableDefault": null,
       "requires": [
         "file-foundation",
@@ -1372,6 +1378,7 @@
       "name": "inbound-mail-foundation",
       "description": "Plugin host for inbound e-mail (inbox federation) — provider plugins (inbound-provider-imap, later M365 Graph / Gmail REST) register at the `inboundMailProvider` extension point with verify/fetch and optional oauth/watch (live push). The foundation owns three event-sourced streams (mail-account lifecycle, inbound-message with exactly-once ingest via deterministic aggregate ids, mail-thread rollup) and their projections `read_mail_accounts`/`read_inbound_messages`/`read_mail_threads`; PII fields are envelope-encrypted per tenant subject key before every append (crypto-shredding on tenant destroy). Wire `createInboundMailConnectRoutes` (OAuth connect + anonymous callback outside /api) and `createInboundMailSupervisor` (IDLE watch with backoff + reconciliation poll) in bin/server.ts. Consume `inbound-mail-foundation:event:inbound-message-received` from app features to attach business processes.",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [
         "tenant-lifecycle"
       ],
@@ -1464,6 +1471,7 @@
       "name": "jobs",
       "description": "Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`; an hourly `stale-run-sweep` job marks runs stuck at status `running` past `staleRunTimeoutHours` as `failed` (#2246 — a crashed worker never fires the completion callback, so nothing else ever revisits the row). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI. A job that declares `tenantVisibleFailure` also records its last failed attempt per tenant and subject in `store_tenant_job_failures`, which the tenant itself reads through `jobs:query:failures` — a translation key only, never the provider's message (fw#3079). A job that declares `tenantVisibleRun` also keeps its run state per tenant and subject in `store_tenant_job_runs` (queued, running, plus the latest completed or failed run, no payload, error text or logs), which the tenant reads through `jobs:query:tenant-runs` (fw#3616); the stale-run sweep fails its stuck `running` rows and drops `queued` rows older than `retentionDays`.",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [],
       "optionalRequires": [],
       "configReads": [],
@@ -1759,6 +1767,7 @@
       "name": "managed-pages",
       "description": "Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset,custom-css}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [
         "config"
       ],
@@ -2088,6 +2097,7 @@
       "name": "personal-access-tokens",
       "description": "Long-lived, revocable Personal Access Tokens for headless HTTP-API access. Stores SHA-256 token hashes in the `store_api_tokens` direct-write table; the plaintext is returned once at creation. `create`/`revoke`/`mine` manage a user's own tokens and `available-scopes` lists the app-declared scope catalog. Bearer tokens carrying the PAT prefix are resolved before jwt.verify (roles resolved live, granted scopes enforced fail-closed at the API boundary) — registered as an auth-foundation tokenVerifier provider, resolved generically by the middleware. Pass { toggleable: { default: false } } to tier-gate the whole feature.",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [
         "user",
         "tenant",
@@ -2417,6 +2427,7 @@
       "name": "sessions",
       "description": "Tracks signed-in clients in the `store_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the same callbacks are also registered as an auth-foundation sessionStore provider, resolvable generically via `resolveSessionStore()`. The feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [
         "user",
         "auth-foundation"
@@ -2711,6 +2722,7 @@
       "name": "tags",
       "description": "Generic, host-agnostic tagging for any entity. Owns two event-sourced entities — the per-tenant `tag` catalog (`read_tags`, with optional `color` and `scope`) and `tag-assignment` join rows keyed by (entityType, entityId) (`read_tag_assignments`) — so tagging adds NO column to the host entity and needs no relational pivot or JOIN. Catalog screens are declarative (`entityList` + `entityEdit`) and use convention QNs `tag:{create,update,delete}`; TagManager/TagPicker keep `create-tag`/`update-tag`/`delete-tag`. Also: `assign-tag` (idempotent), `remove-tag` (idempotent) and list queries for the catalog and the assignments. Read which tags an entity has, or which entities carry a tag, by listing `tag-assignment` filtered on `entityId` or `tagId` and composing in the read-layer. A tag with empty `scope` is global; a `scope` of an entityType restricts it to that type in the picker. Every path uses one access rule — adopt the host's model with createTagsFeature({ access: { openToAll: { reason } } }) or pin roles with createTagsFeature({ roles }). Pass { toggleable: { default: false } } to make the whole feature tier-gatable via the tier-engine (no host hook).",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [],
       "optionalRequires": [],
       "configReads": [],
@@ -2826,6 +2838,7 @@
       "name": "tenant",
       "description": "Registers the three core multi-tenancy entities — `tenant`, `tenant-membership`, and `tenant-invitation` (DB tables `read_tenants`, `read_tenant_memberships`, and `read_tenant_invitations`) — along with write handlers for create/update/disable/enable/addMember/removeMember/updateMemberRoles and the matching queries. It also declares a set of per-tenant config keys (companyName, timezone, locale, SMTP credentials) and system-only keys (priceModel, maxUsers) via `r.config({ keys: { ... } })`. Use this feature in every multi-tenant app; membership resolution and invitation flows depend on it, and `auth-email-password` requires it.",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [
         "config"
       ],
@@ -3192,6 +3205,7 @@
       "name": "user",
       "description": "Manages the cross-tenant user identity: the `read_users` table holds each user's email, `displayName`, global `roles`, `emailVerified` flag, and lifecycle `status` (active / restricted / deletionRequested / deleted). Because users exist above any individual tenant, the feature runs with `r.systemScope()` — membership and tenant-specific roles live in the `tenant` feature instead. Add this feature whenever your app needs a persistent, tenant-agnostic user record that auth and GDPR pipelines can reference.",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [],
       "optionalRequires": [],
       "configReads": [],
@@ -3219,6 +3233,7 @@
       "name": "user-data-rights",
       "description": "Implements GDPR Art. 15 (access / `my-audit-log` query), Art. 17 (erasure / `request-deletion` + `cancel-deletion`, plus the anonymous email-verified `request-deletion-by-email` + `confirm-deletion-by-token` flow for lockout-safe self-service, + cron cleanup with grace period), Art. 18 (restriction / `restrict-account` + `lift-restriction`), and Art. 20 (portability / async `request-export` → ZIP via `file-foundation`, Magic-Link download) as first-class HTTP handlers and cron jobs. Each domain feature opts in by calling `r.useExtension(EXT_USER_DATA, \"<entity>\", { export, delete })` — the feature then orchestrates the export and forget pipelines across all registered hooks automatically. When `mail-foundation` and a `mail-transport-*` are mounted, it also sends the four GDPR notifications (export ready/failed, deletion requested/executed) itself with no app callback code, rendered in each recipient’s locale. Requires `user`, `data-retention`, `compliance-profiles`, and `sessions`.",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [
         "user",
         "data-retention",
@@ -3386,6 +3401,7 @@
       "name": "waitlist",
       "description": "Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response body is identical whether or not an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.",
       "toggleableDefault": null,
+      "adoptsBundledLists": true,
       "requires": [
         "tenant",
         "auth-email-password",

package/samples/apps/use-all-bundled/kumiko/schema.ts

@@ -11,6 +11,7 @@
 import { collectTableMetas, type EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
+import { BUNDLED_LISTS } from "../src/bundled-lists";
 import { APP_FEATURES, AUTH_COMPOSE_OPTIONS, VALIDATE_BOOT_OPTIONS } from "../src/run-config";
 
 export { VALIDATE_BOOT_OPTIONS };
@@ -18,6 +19,7 @@ export { VALIDATE_BOOT_OPTIONS };
 export const FEATURES: readonly FeatureDefinition[] = composeFeatures(APP_FEATURES, {
   includeBundled: true,
   authOptions: AUTH_COMPOSE_OPTIONS,
+  bundledLists: BUNDLED_LISTS,
 });
 
 // collectTableMetas erfasst neben entities auch

package/samples/apps/use-all-bundled/kumiko.config.ts

@@ -12,11 +12,13 @@ import {
 } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 import { notesFeature } from "./src/app/notes-feature";
 import { appScreensFeature } from "./src/app/screens-feature";
+import { BUNDLED_LISTS } from "./src/bundled-lists";
 import { APP_FEATURES, AUTH_COMPOSE_OPTIONS } from "./src/run-config";
 
 export default {
   features: composeFeatures([...APP_FEATURES, appScreensFeature, notesFeature], {
     includeBundled: true,
+    bundledLists: BUNDLED_LISTS,
     ...(buildComposeAuthOptions(AUTH_COMPOSE_OPTIONS) !== undefined && {
       authOptions: buildComposeAuthOptions(AUTH_COMPOSE_OPTIONS),
     }),

package/samples/apps/use-all-bundled/package.json

@@ -33,6 +33,7 @@
     "@cosmicdrift/kumiko-locale-it": "workspace:*"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "workspace:*"
+    "@cosmicdrift/kumiko-testing": "workspace:*",
+    "fflate": "^0.8.2"
   }
 }

package/samples/apps/use-all-bundled/src/app/dev-app-options.ts

@@ -13,6 +13,7 @@
 import { createTemplateResolverApi } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import type { RunDevAppOptions } from "@cosmicdrift/kumiko-dev-server";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { BUNDLED_LISTS } from "../bundled-lists";
 import { AUTH_COMPOSE_OPTIONS, BOOT_FEATURES, VALIDATE_BOOT_OPTIONS } from "../run-config";
 import { ADMIN_EMAIL, ADMIN_PASSWORD, BETA_TENANT_ID, DEV_TENANT_ID } from "./auth-constants";
 import { invoiceReportsFeature } from "./invoice-reports-feature";
@@ -31,6 +32,7 @@ export const devAppOptions = {
   features: [...BOOT_FEATURES, appScreensFeature, notesFeature, invoiceReportsFeature],
   featureToggles: true,
   validateBootOptions: VALIDATE_BOOT_OPTIONS,
+  bundledLists: BUNDLED_LISTS,
   port: Number.parseInt(process.env["PORT"] ?? "4186", 10),
   clientEntry: "./src/app/client.tsx",
   htmlPath: "./public/index.html",

package/samples/apps/use-all-bundled/src/app/notes-feature.ts

@@ -45,6 +45,7 @@ export const noteEntity = createEntity({
       required: true,
       maxLength: 200,
       sortable: true,
+      searchable: true,
     }),
     customFields: customFieldsField(),
   },
@@ -65,6 +66,7 @@ const noteListScreen: EntityListScreenDefinition = {
     },
   ],
   searchable: true,
+  table: { export: { xlsx: true } },
   defaultSort: { field: "title", dir: "asc" },
   slots: { header: { react: { __component: TAGS_FILTER_EXTENSION_NAME } } },
   rowActions: [

package/samples/apps/use-all-bundled/src/app/seed.ts

@@ -93,7 +93,12 @@ async function seedTierAssignment(
   adminUserId: string,
 ): Promise<void> {
   const by: SessionUser = { ...TestUsers.systemAdmin, tenantId, id: adminUserId };
-  const tdb = createTenantDb({ db, tenantId, mode: "system" });
+  const tdb = createTenantDb({
+    db,
+    tenantId,
+    mode: "system",
+    reason: "demo seed writes tier assignments for the tenant being provisioned",
+  });
   const result = await tierAssignmentExecutor.create(
     { id: tierAssignmentAggregateId(tenantId), tier, source: "manual", tenantId },
     by,
@@ -117,7 +122,12 @@ async function seedTagsAndNotes(
   adminUserId: string,
 ): Promise<void> {
   const by: SessionUser = { ...TestUsers.systemAdmin, tenantId, id: adminUserId };
-  const tdb = createTenantDb({ db, tenantId, mode: "system" });
+  const tdb = createTenantDb({
+    db,
+    tenantId,
+    mode: "system",
+    reason: "demo seed writes tier assignments for the tenant being provisioned",
+  });
 
   const created = async (
     label: string,

package/samples/apps/use-all-bundled/src/bundled-lists.ts

@@ -0,0 +1,15 @@
+import type { BundledListsOptions } from "@cosmicdrift/kumiko-framework/engine";
+
+export const BUNDLED_LISTS = {
+  table: {
+    rememberState: true,
+    resetAll: true,
+    columnPicker: true,
+    density: { userChoice: true },
+    pinning: true,
+    resizing: true,
+    keyboardNavigation: true,
+    export: { xlsx: true },
+  },
+  pinFirstColumn: true,
+} as const satisfies BundledListsOptions;

package/samples/apps/user-data-rights-demo/README.md

@@ -16,7 +16,7 @@ DSGVO requests work end-to-end:
 
 | Article | Endpoint / Runner | What it does |
 |---------|-----------|----------------|
-| **Art. 15** | `user-data-rights:query:my-audit-log` | User sees own framework events (auth, deletion-request, restriction). Domain entities like todos appear in the **export bundle** (Art. 20), not the audit-log — only handlers using `ctx.appendEvent` show up here. |
+| **Art. 15** | `user-data-rights:query:my-audit-log` | User sees own framework events (auth, deletion-request, restriction). Domain entities like todos appear in the **export bundle** (Art. 20), not the audit-log — only handlers using `ctx.events.append` show up here. |
 | **Art. 15+20** | `user-data-rights:write:request-export` | ZIP with user-profile + fileRefs + todos + signed download magic-link |
 | **Art. 17** | `user-data-rights:write:request-deletion` | Soft-delete with grace period; cron anonymizes user + deletes todos |
 | **Art. 18** | `user-data-rights:write:restrict-account` | Auth-middleware blocks logins until lift-restriction |

package/samples/apps/user-data-rights-demo/src/feature.ts

@@ -25,6 +25,7 @@
 //   3. todoDeleteHook DELETEt alle Rows mit author_id = userId
 //   4. user wird anonymisiert (display_name="(deleted)", email=null)
 
+import { UserDataRightsScreens } from "@cosmicdrift/kumiko-bundled-features/user-data-rights";
 import {
   deleteMany,
   deriveEntityTableMeta,
@@ -182,7 +183,7 @@ export const todosFeature = defineFeature(FEATURE_NAME, (r) => {
     id: "gdpr-export-jobs",
     label: "GDPR · Export Jobs",
     icon: "shield",
-    screen: "user-data-rights:screen:export-job-list",
+    screen: UserDataRightsScreens.exportJobList,
     access: { roles: ["SystemAdmin"] },
     order: 90,
   });
@@ -190,7 +191,7 @@ export const todosFeature = defineFeature(FEATURE_NAME, (r) => {
     id: "gdpr-download-attempts",
     label: "GDPR · Download Attempts",
     icon: "download",
-    screen: "user-data-rights:screen:download-attempt-list",
+    screen: UserDataRightsScreens.downloadAttemptList,
     access: { roles: ["SystemAdmin"] },
     order: 91,
   });

package/samples/recipes/api-worker-split/README.md

@@ -60,7 +60,8 @@ row and the `read_fulfillments` row appear.
 is re-run after `ms` on the same queue job: no retry attempt is used, no failure is logged
 or recorded, and the run log shows only the runs that actually executed. `maxDefers`
 (default 100) bounds it; beyond that the run fails. It needs a queued run: an inline boot
-gate throws.
+gate throws. `context.canDefer` is false in both cases, so the job checks it and calls the
+carrier anyway instead of failing.
 
 ## Test
 

package/samples/recipes/api-worker-split/src/feature.ts

@@ -131,8 +131,9 @@ export function createApiWorkerSplitFeature() {
         }
         const { customerName } = processOrderPayloadSchema.parse(payload);
         // Busy is not a failure: ctx.defer re-runs the job later without burning a retry.
+        // Once the defer budget is used up (or the run is inline), try anyway and let a failure retry.
         const retryAfterMs = carrierRetryAfterMs();
-        if (retryAfterMs > 0) return context.defer(retryAfterMs);
+        if (retryAfterMs > 0 && context.canDefer) return context.defer(retryAfterMs);
         const result = await fulfillWrite({
           handlerQn: "orders:write:fulfillment:create",
           payload: {

package/samples/recipes/cross-feature-events/README.md

@@ -11,10 +11,10 @@ Three building blocks:
 
 - **`r.defineEvent("name", zodSchema)`** declares the name and payload.
   The qualified name (e.g. `pubsub-orders:event:order-placed`) comes
-  back as `.name` — pass it directly to `ctx.appendEvent`. Events that
-  aren't registered are rejected by `ctx.appendEvent` at the emit site.
+  back as `.name` — pass it directly to `ctx.events.append`. Events that
+  aren't registered are rejected by `ctx.events.append` at the emit site.
 
-- **`ctx.appendEvent({ aggregateId, aggregateType, type, payload })`**
+- **`ctx.events.append({ aggregateId, aggregateType, type, payload })`**
   appends the event onto the aggregate stream within the same TX.
   Version lineage is continued automatically — no synthetic
   `"pubsub"` stream anymore, the event truly lives on the aggregate.
@@ -32,7 +32,7 @@ Three building blocks:
 HTTP → writeHandler
          ↓ TX begin
          orderExecutor.create(...)     ← business row + auto-event (pubsubOrder.created, v1)
-         ctx.appendEvent({...})        ← domain event (pubsub-orders:event:order-placed, v2)
+         ctx.events.append({...})        ← domain event (pubsub-orders:event:order-placed, v2)
          ↓ TX commit
          (async, post-commit)
          event-dispatcher runOnce
@@ -42,7 +42,7 @@ HTTP → writeHandler
 
 ## Migration note
 
-`r.postEvent` was removed in Sprint E.2. `ctx.appendEvent` +
+`r.postEvent` was removed in Sprint E.2. `ctx.events.append` +
 `r.multiStreamProjection` is the unified Marten API for CRUD events,
 domain events, and cross-feature reactions.
 

package/samples/recipes/cross-feature-events/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-sample-cross-feature-events",
-  "description": "Feature appends a typed domain event via ctx.appendEvent; a r.multiStreamProjection reacts asynchronously.",
+  "description": "Feature appends a typed domain event via ctx.events.append; a r.multiStreamProjection reacts asynchronously.",
   "private": true,
   "dependencies": {
     "@cosmicdrift/kumiko-framework": "workspace:*"

package/samples/recipes/cross-feature-events/src/feature.ts

@@ -1,7 +1,7 @@
 // Cross-Feature Reactions Sample (Marten gold-standard path)
 //
 // Demonstrates the Sprint-E pattern for reacting to events across features:
-// a writeHandler emits a DOMAIN event via `ctx.appendEvent(...)` onto the
+// a writeHandler emits a DOMAIN event via `ctx.events.append(...)` onto the
 // aggregate's own stream, and a `r.multiStreamProjection` picks it up
 // asynchronously through the event-dispatcher.
 //
@@ -9,11 +9,11 @@
 //
 //   1. `r.defineEvent("short-name", zodSchema)` declares the event shape.
 //      Returns a def whose `.name` is the fully-qualified event name —
-//      pass that straight to `ctx.appendEvent` so there's no string to
+//      pass that straight to `ctx.events.append` so there's no string to
 //      hand-type (and no way to emit an unregistered event: appendEvent
 //      rejects at the emit site).
 //
-//   2. `ctx.appendEvent({ aggregateId, aggregateType, type, payload })`
+//   2. `ctx.events.append({ aggregateId, aggregateType, type, payload })`
 //      writes the event onto the aggregate's own stream inside the same
 //      transaction as the business write. Commit both or roll back both —
 //      no lost events, no orphan events. The event carries real
@@ -67,7 +67,7 @@ export const pubsubOrderFeature = defineFeature("pubsubOrders", (r) => {
   r.entity({ name: "pubsub-order", ...orderEntity });
 
   // Define the event shape once. The returned `.name` is the qualified
-  // name ("pubsub-orders:event:order-placed") — pass it to ctx.appendEvent.
+  // name ("pubsub-orders:event:order-placed") — pass it to ctx.events.append.
   const orderPlaced = r.defineEvent(
     "order-placed",
     z.object({ id: z.string(), customer: z.string(), product: z.string() }),

package/samples/recipes/event-sourcing/README.md

@@ -9,12 +9,12 @@ blocks Kumiko provides.
 | API | Purpose |
 |---|---|
 | `r.defineEvent(name, schema, { version, migrations })` | Event schema with version number + upcaster chain |
-| `ctx.appendEvent({ aggregateId, aggregateType, type, payload })` | Domain event on aggregate stream |
+| `ctx.events.append({ aggregateId, aggregateType, type, payload })` | Domain event on aggregate stream |
 | `r.projection(...)` | Single-stream read model, inline in the write TX |
 | `r.multiStreamProjection(...)` | Cross-aggregate read model, async via dispatcher |
-| `ctx.loadAggregate(id, { asOf })` | Live aggregation with point-in-time |
-| `ctx.archiveStream(id, { aggregateType })` | Archive a stream (Marten `ArchiveStream`) |
-| `ctx.queryProjection(name)` | Tenant-scoped read-model query |
+| `ctx.events.load(id, { asOf })` | Live aggregation with point-in-time |
+| `ctx.events.archive(id, { aggregateType })` | Archive a stream (Marten `ArchiveStream`) |
+| `ctx.dispatch.queryProjection(name)` | Tenant-scoped read-model query |
 
 ## Domain
 
@@ -45,7 +45,7 @@ HTTP POST /api/write { type: "showcase:write:invoice:approve", ... }
          ↓
   writeHandler("invoice:approve")
          ↓ TX begin
-         ctx.appendEvent({ type: "showcase:event:invoice-approved", ... })
+         ctx.events.append({ type: "showcase:event:invoice-approved", ... })
          r.projection("invoice-detail")         ← updates status = "approved"
          ↓ TX commit
          (async)

package/samples/recipes/event-sourcing/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-sample-event-sourcing",
-  "description": "Production-pattern ES sample: r.defineEvent (versioned + migrations) + ctx.appendEvent + r.projection + r.multiStreamProjection + ctx.loadAggregate (asOf) + ctx.archiveStream + ctx.queryProjection.",
+  "description": "Production-pattern ES sample: r.defineEvent (versioned + migrations) + ctx.events.append + r.projection + r.multiStreamProjection + ctx.events.load (asOf) + ctx.events.archive + ctx.dispatch.queryProjection.",
   "private": true,
   "dependencies": {
     "@cosmicdrift/kumiko-framework": "workspace:*"