@cosmicdrift/kumiko-samples 0.391.0 → 0.392.0

package/samples/recipes/apex-surface-auth/src/feature.ts

@@ -1,18 +1,18 @@
-// apex-surface-auth Recipe — der evidente Weg für öffentlichen Apex-Content.
+// apex-surface-auth recipe — the evident way for public apex content.
 //
-// Eine Kumiko-App hat eine öffentliche Apex-Präsenz (Landing/Login) UND eine
-// schema-getriebene Admin-UI. Die Admin-UI mountet via createKumikoApp (volles
-// Schema). Die Apex mountet via createPublicSurface — schema-LOS, anonym
-// erreichbar, kein Admin-Nav/Topologie-Leak. Beide teilen Locale + Primitives.
+// A Kumiko app has a public apex presence (landing/login) AND a
+// schema-driven admin UI. The admin UI mounts via createKumikoApp (full
+// schema). The apex mounts via createPublicSurface — schema-LESS, anonymously
+// reachable, no admin nav/topology leak. Both share locale + primitives.
 //
-// Dieses Recipe zeigt:
-//   1. Server: die Feature-Komposition für die 4 Account-Flows + den anonymen,
-//      email-verifizierten Deletion-Flow (Lockout-sicher).
-//   2. Client (Kommentar unten + README): wie createPublicSurface + AuthShell
-//      die Screens in der Apex-Chrome mounten.
+// This recipe shows:
+//   1. Server: the feature composition for the 4 account flows + the anonymous,
+//      email-verified deletion flow (lockout-safe).
+//   2. Client (comment below + README): how createPublicSurface + AuthShell
+//      mount the screens in the apex chrome.
 //
-// CLIENT-WIRING (apex.tsx der App — renderer/web, hier nur als Referenz, da
-// Recipes keine Browser-Deps ziehen):
+// CLIENT-WIRING (the app's apex.tsx — renderer/web, only a reference here, since
+// recipes pull in no browser deps):
 //
 //   import {
 //     ForgotPasswordScreen, SignupScreen, createLoginRoute,
@@ -24,8 +24,8 @@
 //   } from "@cosmicdrift/kumiko-bundled-features/user-data-rights/web";
 //   import { createPublicSurface } from "@cosmicdrift/kumiko-renderer/web";
 //
-//   // AuthShell: die Auth-Card rendert in der Marketing-Chrome statt
-//   // Fullscreen. Default (ohne Provider) bleibt der Fullscreen-Wrapper.
+//   // AuthShell: the auth card renders inside the marketing chrome instead of
+//   // fullscreen. Default (without a provider) stays the fullscreen wrapper.
 //   const shell = ({ children }) => (
 //     <MarketingChrome>
 //       <AuthShellProvider shell={(card) => <div className="py-12 flex justify-center">{card}</div>}>
@@ -34,12 +34,12 @@
 //     </MarketingChrome>
 //   );
 //
-//   // createLoginRoute — NICHT LoginScreen direkt rendern: die Route
-//   // braucht die Challenge-Swap-Logik für einen zweiten Faktor. Ohne die
-//   // (z.B. raw <LoginScreen />) bleibt ein MFA-enrolter User beim Login
-//   // hängen, sobald die App irgendwann auth-mfa mountet. Mountet die App
-//   // auth-mfa, `mfaVerifyScreen: MfaVerifyScreen` (aus
-//   // "@cosmicdrift/kumiko-bundled-features/auth-mfa/web") ergänzen.
+//   // createLoginRoute — do NOT render LoginScreen directly: the route
+//   // needs the challenge-swap logic for a second factor. Without it
+//   // (e.g. a raw <LoginScreen />) an MFA-enrolled user gets stuck at login
+//   // as soon as the app mounts auth-mfa at some point. If the app mounts
+//   // auth-mfa, add `mfaVerifyScreen: MfaVerifyScreen` (from
+//   // "@cosmicdrift/kumiko-bundled-features/auth-mfa/web").
 //   const LoginRoute = createLoginRoute({ loginScreenProps: { signupHref: "/signup" } });
 //
 //   createPublicSurface({
@@ -56,8 +56,8 @@
 //   });
 //
 //
-// SERVER-WIRING: die App aktiviert `anonymousAccess` (defaultTenantId = der
-// Apex-Host-Tenant), damit /api/write die anonymen Deletion-Handler erreicht:
+// SERVER-WIRING: the app enables `anonymousAccess` (defaultTenantId = the
+// apex host tenant) so /api/write reaches the anonymous deletion handlers:
 //
 //   runProdApp({ features: composeApexAccountApp({...}), envSchema,
 //                anonymousAccess: { defaultTenantId: APEX_TENANT_ID } })
@@ -78,20 +78,20 @@ import {
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 
 export type ApexAccountAppOptions = {
-  /** HMAC-Secret für das Deletion-Verify-Token. */
+  /** HMAC secret for the deletion verify token. */
   readonly deletionTokenSecret: string;
-  /** Apex-Route des Confirm-Screens; der Handler hängt das Token als
-   *  URL-Fragment an (`#token=`). */
+  /** Apex route of the confirm screen; the handler appends the token as a
+   *  URL fragment (`#token=`). */
   readonly deletionVerifyUrl: string;
-  /** Versand des Verify-Magic-Links. MUSS non-blocking sein (enqueue) — ein
-   *  synchroner Send würde ein Timing-Oracle für Account-Enumeration öffnen. */
+  /** Sending the verify magic link. MUST be non-blocking (enqueue) — a
+   *  synchronous send would open a timing oracle for account enumeration. */
   readonly sendDeletionVerificationEmail: SendDeletionVerificationEmailFn;
 };
 
-// Volle Feature-Komposition für die öffentlichen Account-Flows. Die
-// user-data-rights-Options aktivieren den anonymen Deletion-Flow; die übrigen
-// Features liefern Login/Register/PW (auth-email-password) + die
-// Require-Kette (user-data-rights → data-retention + compliance-profiles +
+// Full feature composition for the public account flows. The
+// user-data-rights options enable the anonymous deletion flow; the remaining
+// features provide login/register/PW (auth-email-password) + the
+// require chain (user-data-rights → data-retention + compliance-profiles +
 // sessions).
 export function composeApexAccountApp(opts: ApexAccountAppOptions): FeatureDefinition[] {
   return [

package/samples/recipes/designer-demo/src/feature.ts

@@ -1,10 +1,10 @@
 // kumiko-feature-version: 1
-// Demo-Feature für den Designer-Skeleton (C5).
-// Enthält bewusst Patterns aus den 3 hand-rollten View-Kategorien:
-//   - entity      → Tabelle der Fields
-//   - writeHandler → Header + Code-Blocks (schema + handler)
-//   - nav         → ID/Label/Screen-Card
-// Plus optionalRequires + metric als JSON-Dump-Fallback.
+// Demo feature for the designer skeleton (C5).
+// Deliberately contains patterns from the 3 hand-rolled view categories:
+//   - entity      → table of fields
+//   - writeHandler → header + code blocks (schema + handler)
+//   - nav         → ID/label/screen card
+// Plus optionalRequires + metric as a JSON dump fallback.
 
 import { createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";

package/samples/recipes/encrypted-tenant-config/src/feature.ts

@@ -1,14 +1,14 @@
-// Encrypted per-tenant config — Stripe-API-key pattern.
+// Encrypted per-tenant config — Stripe API key pattern.
 //
-// Minimal-Showcase: ein dummy "billing"-feature mit einem per-tenant
-// Stripe-API-Key. Der `mask`-Eintrag lässt den configEdit-Screen +
-// Settings-Hub-Nav automatisch entstehen (kein handgeschriebenes
-// r.screen/r.nav mehr). charge-handler liest den Key über ctx.config
-// (entschlüsselt automatisch).
+// Minimal showcase: a dummy "billing" feature with a per-tenant
+// Stripe API key. The `mask` entry makes the configEdit screen +
+// settings hub nav appear automatically (no more hand-written
+// r.screen/r.nav). The charge handler reads the key via ctx.config
+// (decrypted automatically).
 //
-// Production: nicht aufrufen — der echte Stripe-Call ist hier ein Mock.
-// Pattern in produktiven Apps: Strip-API-Key in tenantBillingConfig.key,
-// charge-handler lädt key + ruft tatsächlich Stripe.
+// Production: do not call — the real Stripe call is a mock here.
+// Pattern in productive apps: Stripe API key in tenantBillingConfig.key,
+// the charge handler loads the key + actually calls Stripe.
 
 import {
   access,
@@ -40,8 +40,8 @@ const stripeApiKeyHandle: ConfigKeyHandle<"text"> = {
   type: "text",
 };
 
-// Charge-Handler — nutzt den entschlüsselten API-Key. Caller sieht NUR
-// die charge-id zurück, der Key bleibt server-side.
+// Charge handler — uses the decrypted API key. The caller sees ONLY
+// the charge id back, the key stays server-side.
 const chargeHandler = defineWriteHandler({
   name: "charge",
   schema: z.object({
@@ -66,10 +66,10 @@ const chargeHandler = defineWriteHandler({
       );
     }
 
-    // Mock: real impl würde fetch("https://api.stripe.com/v1/charges",
-    // { headers: { Authorization: `Bearer ${apiKey}` }, ... }) ausführen.
-    // Wichtig: apiKey verlässt den server NICHT — kein log, kein
-    // response-field, kein error-detail.
+    // Mock: a real impl would execute fetch("https://api.stripe.com/v1/charges",
+    // { headers: { Authorization: `Bearer ${apiKey}` }, ... }).
+    // Important: apiKey does NOT leave the server — no log, no
+    // response field, no error detail.
     const chargeId = `ch_${Date.now()}_${event.payload.customerRef}`;
 
     return {
@@ -83,10 +83,10 @@ export const billingFeature = defineFeature(FEATURE, (r) => {
   r.requires({ features: ["config"] });
   r.config("stripe-api-key", stripeApiKeyDef);
   r.writeHandler(chargeHandler);
-  // Kein r.screen/r.nav: der `mask`-Eintrag auf dem Key lässt
-  // buildConfigFeatureSchema den configEdit-Screen (••••••-maskiert,
-  // config:write:set verschlüsselt vor dem write) + den Settings-Hub-Nav
-  // automatisch ableiten.
+  // No r.screen/r.nav: the `mask` entry on the key lets
+  // buildConfigFeatureSchema derive the configEdit screen (••••••-masked,
+  // config:write:set encrypts before the write) + the settings hub nav
+  // automatically.
 
   r.translations({
     keys: {
@@ -96,5 +96,5 @@ export const billingFeature = defineFeature(FEATURE, (r) => {
   });
 });
 
-// Re-exports damit tests die handles ohne re-typing nutzen können.
+// Re-exports so tests can use the handles without re-typing.
 export { stripeApiKeyHandle };

package/samples/recipes/lane-routing/src/feature.ts

@@ -24,11 +24,11 @@ import { z } from "zod";
 export const renderedReceipts: Array<{ customerName: string; amount: number }> = [];
 export const sentConfirmations: Array<{ customerName: string; amount: number }> = [];
 
-// Entity-Dekl sichert den qualified-name-Prefix "orders:write:order:create"
-// für den Write-Handler unten und damit den Job-Trigger auf diesem Event.
-// Persistenz passiert im Custom-Handler nicht (id ist hardcoded für den
-// Sample-Test) — in einer echten App würde ein entityWriteHandler in die DB
-// schreiben.
+// The entity declaration secures the qualified-name prefix "orders:write:order:create"
+// for the write handler below and thereby the job trigger on this event.
+// Persistence does not happen in the custom handler (id is hardcoded for the
+// sample test) — in a real app an entityWriteHandler would write to the
+// DB.
 const orderEntity = createEntity({
   table: "read_orders",
   fields: {

package/samples/recipes/legal-pages/src/feature.ts

@@ -1,37 +1,37 @@
-// Legal-Pages Sample
+// Legal-pages sample
 //
-// DACH-Apps (DE/AT/CH) sind verpflichtet ein Impressum (TMG/DDG §5) und
-// eine Datenschutzerklärung (DSGVO Art. 13) öffentlich zugänglich zu
-// haben. Das ist 1) für jede App identisch und 2) nervig manuell pro
-// App neu zu basteln.
+// DACH apps (DE/AT/CH) are required to make an imprint (TMG/DDG §5) and
+// a privacy policy (GDPR Art. 13) publicly accessible.
+// That is 1) identical for every app and 2) annoying to build
+// by hand per app.
 //
-// Lösung: zwei opt-in bundled-features kombinieren:
+// Solution: combine two opt-in bundled features:
 //
-//  - `template-resolver` — der Content-Store (Entity `template-resource`,
-//    kind `text-block` mit slug+locale+title+content, scoped per Tenant).
-//    Auch nutzbar für FAQ, About, ToS, Marketing-Snippets — nicht
-//    legal-spezifisch.
+//  - `template-resolver` — the content store (entity `template-resource`,
+//    kind `text-block` with slug+locale+title+content, scoped per tenant).
+//    Also usable for FAQ, About, ToS, marketing snippets — not
+//    legal-specific.
 //
-//  - `legal-pages`   — opt-in-Wrapper darauf, der vier feste Public-
-//    Routes (`/legal/impressum`, `/legal/datenschutz`, `/legal/imprint`,
-//    `/legal/privacy`) registriert und Markdown→HTML rendered. Plus
-//    Boot-Check der in Production hart fehlt wenn die DE-Pflicht-Blocks
-//    fehlen.
+//  - `legal-pages`   — opt-in wrapper on top of it that registers four fixed public
+//    routes (`/legal/impressum`, `/legal/datenschutz`, `/legal/imprint`,
+//    `/legal/privacy`) and renders Markdown→HTML. Plus a
+//    boot check that fails hard in production when the DE required blocks
+//    are missing.
 //
-// Tenant-Modell: 1 App = X Tenants = 1 Impressum. Alle Subdomains
-// teilen sich die SYSTEM_TENANT_ID-Version. Wer pro-Tenant-Impressums
-// braucht, muss sein eigenes Routing davorsetzen oder die by-slug-
-// query mit tenant-specific tenantId nutzen.
+// Tenant model: 1 app = X tenants = 1 imprint. All subdomains
+// share the SYSTEM_TENANT_ID version. If you need per-tenant imprints,
+// you have to put your own routing in front or use the by-slug
+// query with a tenant-specific tenantId.
 //
-// Voraussetzungen für Production:
-//  - `anonymousAccess` muss in runProdApp/runDevApp konfiguriert sein
-//    (defaultTenantId = SYSTEM_TENANT_ID), sonst antworten die
-//    legal-pages-Routes mit 503
-//  - `extraContext.templateResolver = createTemplateResolverApi(db, registry)` muss
-//    gewired sein, sonst wirft der Boot-Check mit Wiring-Hinweis
-//  - Beim ersten Boot müssen die TextBlocks geseedet sein —
-//    template-resolver/seeding `seedTextBlock` oder via API
-//    `template-resolver:write:set` mit TenantAdmin-Token
+// Prerequisites for production:
+//  - `anonymousAccess` must be configured in runProdApp/runDevApp
+//    (defaultTenantId = SYSTEM_TENANT_ID), otherwise the
+//    legal-pages routes answer with 503
+//  - `extraContext.templateResolver = createTemplateResolverApi(db, registry)` must be
+//    wired, otherwise the boot check throws with a wiring hint
+//  - On first boot the TextBlocks must be seeded —
+//    template-resolver/seeding `seedTextBlock` or via API
+//    `template-resolver:write:set` with a TenantAdmin token
 
 import {
   createLegalPagesFeature,
@@ -57,5 +57,5 @@ export const legalPagesFeature = createLegalPagesFeature({
   }),
 });
 
-// Re-exports für Tests + andere Demos
+// Re-exports for tests + other demos
 export { LEGAL_REQUIRED_BLOCKS, LEGAL_ROUTES, LEGAL_TERMS_ROUTES };

package/samples/recipes/record-detail-layout/src/feature.ts

@@ -11,8 +11,10 @@
 //      one `extension` section (a plugin-mounted component, fw#3234 padding-
 //      parity check — every tab kind must sit in the same Card padding, no
 //      section carries extra chrome of its own).
-//   4. A screen-level `actions` entry (fw#3234) renders next to the header,
-//      not inside any tab's Card.
+//   4. The payments tab's emptyState picks its text from the order record through `variants`.
+//   5. A screen-level `actions` entry (fw#3234) renders next to the header,
+//      not inside any tab's Card. `inlineActions` keeps download-invoice a visible
+//      button next to it where the page header would otherwise fold it into the menu.
 //
 // projectionDetail has no entity — it binds to an explicit query instead, so
 // every field name below (header, metrics, fields) is a column of that
@@ -108,6 +110,15 @@ export function createOrderDeskFeature(): FeatureDefinition {
               "method",
               "status",
             ],
+            emptyState: {
+              title: "order-desk.payments.empty",
+              variants: [
+                {
+                  when: { field: "status", eq: "pending" },
+                  title: "order-desk.payments.empty-pending",
+                },
+              ],
+            },
           },
           {
             id: "details",
@@ -132,7 +143,15 @@ export function createOrderDeskFeature(): FeatureDefinition {
           screen: "order-detail",
           icon: "refresh",
         },
+        {
+          kind: "navigate",
+          id: "download-invoice",
+          label: "order-desk.action.downloadInvoice",
+          screen: "order-detail",
+          icon: "download",
+        },
       ],
+      inlineActions: ["download-invoice"],
       access: { roles: ["Support", "Admin"] },
     });
   });

package/samples/recipes/seed-migration/scripts/smoke.ts

@@ -1,40 +1,40 @@
 // biome-ignore-all lint/suspicious/noConsole: CLI tool output
 //
-// Lokaler Smoke-Test für seed-migrations.
+// Local smoke test for seed migrations.
 //
-// Was er prüft (offline, ohne Pod-Deploy):
-//   1. Alle seed-files in ./seeds/ können dynamic-import geladen werden
-//      → catched syntax-errors + missing default-exports + falsche paths
-//   2. Jeder handler-QN den die seeds referenzieren ist in der echten
-//      App-Registry registriert → catched camelCase-typos + drift
-//      (Bug-Klasse 3 aus Phase 1 retro)
-//   3. Jeder system-user (mit oder ohne tenantIdOverride) hat Access auf
-//      die referenzierten Handler → catched access-rule-Drift
-//      (Bug-Klasse 4 aus Phase 1 retro)
+// What it checks (offline, without a pod deploy):
+//   1. All seed files in ./seeds/ can be loaded via dynamic import
+//      → catches syntax errors + missing default exports + wrong paths
+//   2. Every handler QN the seeds reference is registered in the real
+//      app registry → catches camelCase typos + drift
+//      (bug class 3 from the phase 1 retro)
+//   3. Every system user (with or without tenantIdOverride) has access to
+//      the referenced handlers → catches access rule drift
+//      (bug class 4 from the phase 1 retro)
 //
-// Schreibt NICHTS in die DB. Reine Read-only Validation.
+// Writes NOTHING to the DB. Pure read-only validation.
 //
 // Usage:
-//   bun scripts/smoke.ts                  (gegen ./seeds/)
+//   bun scripts/smoke.ts                  (against ./seeds/)
 //   bun scripts/smoke.ts --seeds-dir foo  (custom path)
 //
-// In CI: vor `build`-Step laufen lassen — fängt 80% der Phase-1-Bugs
-// lokal in <5 Sekunden statt nach 8-Minuten-Docker-Build im Pod-Boot.
+// In CI: run before the `build` step — catches 80% of the phase 1 bugs
+// locally in <5 seconds instead of after an 8-minute Docker build in the pod boot.
 
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
-// App-spezifisch: nimm die EFFEKTIVEN Features die deine App zur Runtime
-// nutzt. Im typischen Setup mit `runProdApp({ features, auth })`:
+// App-specific: take the EFFECTIVE features your app uses
+// at runtime. In the typical setup with `runProdApp({ features, auth })`:
 //
 //   import { composeFeatures } from "@cosmicdrift/kumiko-dev-server";
 //   import { APP_FEATURES } from "../src/run-config";
 //   const composed = composeFeatures(APP_FEATURES, { includeBundled: true, ... });
 //   const features = composed.features;
 //
-// Bei reiner App-Feature-Setup (kein auth-mode) reicht ein direkter
-// Import der App-Features. Hier im Recipe der minimale set für die
-// referenzierten Recipe-Seeds (tenant + config) — App-Author tauscht
-// gegen sein eigenes Feature-Set.
+// For a pure app-feature setup (no auth mode) a direct
+// import of the app features is enough. Here in the recipe the minimal set for the
+// referenced recipe seeds (tenant + config) — the app author swaps it
+// for their own feature set.
 import { createConfigFeature } from "@cosmicdrift/kumiko-bundled-features/config";
 import { createTenantFeature } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import {

package/samples/recipes/seed-migration/seeds/2026-01-01-initial-tenants.ts

@@ -1,22 +1,22 @@
-// Initial-Seed: Demo-Tenants anlegen.
+// Initial seed: create demo tenants.
 //
-// Note: in real apps wäre "initial tenants" wahrscheinlich nicht als
-// seed-migration sondern als `r.config({seeds})` oder `auth.admin`-
-// Config umgesetzt — die laufen jedes-Boot idempotent. Hier ist es als
-// seed-migration gezeigt um das Pattern zu demonstrieren.
+// Note: in real apps "initial tenants" would probably not be implemented as a
+// seed migration but as `r.config({seeds})` or `auth.admin`
+// config — those run idempotently on every boot. Here it is shown as a
+// seed migration to demonstrate the pattern.
 //
-// Pattern: jede seed-migration arbeitet write-only via `systemWriteAs`
-// damit alles als Event-Stream persistiert wird. Read-only Lookups
-// (find*) am Context oder direkt via ctx.db.
+// Pattern: every seed migration works write-only via `systemWriteAs`
+// so everything is persisted as an event stream. Read-only lookups
+// (find*) on the context or directly via ctx.db.
 
 import type { SeedMigration } from "@cosmicdrift/kumiko-framework/es-ops";
 
 export default {
   description: "initial demo tenants (alice-corp, beta-inc)",
   run: async (ctx) => {
-    // Idempotent-Check: wenn Tenants schon existieren (z.B. via auth.admin-
-    // seed), skip diese Migration. Verhindert Konflikt beim re-boot wenn
-    // jemand den Marker manuell gelöscht hat.
+    // Idempotency check: if tenants already exist (e.g. via an auth.admin
+    // seed), skip this migration. Prevents a conflict on re-boot if
+    // someone deleted the marker manually.
     const existing = await ctx.findTenants();
     if (existing.some((t) => t.tenantKey === "alice-corp")) return;
 

package/samples/recipes/seed-migration/seeds/2026-02-01-fix-admin-roles.ts

@@ -1,11 +1,11 @@
-// Driver-Pattern: ergänze fehlende Rolle auf existierenden Memberships.
-// Spiegelt den realen publicstatus-Bug 2026-05-20 (admin@publicstatus.eu
-// hatte "Admin" aber nicht "TenantAdmin" → text-content + legal-pages
-// access_denied weil bundled-features TenantAdmin erwarten).
+// Driver pattern: add a missing role to existing memberships.
+// Mirrors the real publicstatus bug of 2026-05-20 (admin@publicstatus.eu
+// had "Admin" but not "TenantAdmin" → text-content + legal-pages
+// access_denied because bundled-features expect TenantAdmin).
 //
-// Funktioniert für jede App mit dem gleichen Pattern: User-Lookup per
-// E-Mail → alle Memberships durchgehen → bei Bedarf via existierendem
-// updateMemberRoles-Handler korrigieren.
+// Works for any app with the same pattern: user lookup by
+// email → go through all memberships → correct via the existing
+// updateMemberRoles handler if needed.
 
 import type { SeedMigration } from "@cosmicdrift/kumiko-framework/es-ops";
 
@@ -25,12 +25,12 @@ export default {
           tenantId: m.tenantId,
           roles: Array.from(new Set([...m.roles, "TenantAdmin"])),
         },
-        // tenantIdOverride: stream-tenant aus kumiko_events.v1 — NICHT
-        // m.tenantId (payload-tenant). Beide stimmen oft überein, weichen
-        // aber ab wenn das Aggregate ursprünglich von einem fremden
-        // Executor angelegt wurde (seedTenantMembership by=systemAdmin —
-        // publicstatus-Pattern). findMembershipsOfUser liefert beide,
-        // kein eigener JOIN nötig.
+        // tenantIdOverride: stream tenant from kumiko_events.v1 — NOT
+        // m.tenantId (payload tenant). The two often match, but differ
+        // when the aggregate was originally created by a foreign
+        // executor (seedTenantMembership by=systemAdmin —
+        // publicstatus pattern). findMembershipsOfUser returns both,
+        // no separate JOIN needed.
         m.streamTenantId,
       );
     }

package/samples/recipes/user-data-rights/src/feature.ts

@@ -1,20 +1,20 @@
-// User-Data-Rights — Recipe
+// User-Data-Rights — recipe
 //
-// Wie eine App-Domain DSGVO-Pipeline integriert: pro Entity einen
-// (export, delete)-Hook ueber EXT_USER_DATA. Forget-Cron, Export-ZIP-Bau
-// und Magic-Link-Versand kommen vollstaendig aus user-data-rights —
-// App-Author schreibt nur die zwei Hooks pro Entity.
+// How an app domain integrates the GDPR pipeline: one
+// (export, delete) hook per entity via EXT_USER_DATA. Forget cron, export ZIP build
+// and magic link delivery come entirely from user-data-rights —
+// the app author writes only the two hooks per entity.
 //
-// Demo-Domain: minimaler Note-Service. Note hat (id, tenantId, authorId,
-// title, body). Pinst:
-//   1. Hook export liefert Note-Rows als JSON-Snippet ins Export-Bundle.
-//   2. Hook delete entfernt Note-Rows beim Forget-Cleanup-Cron.
+// Demo domain: minimal note service. A note has (id, tenantId, authorId,
+// title, body). Pins:
+//   1. The export hook delivers note rows as a JSON snippet into the export bundle.
+//   2. The delete hook removes note rows during the forget-cleanup cron.
 //
-// Was nicht im Recipe ist (siehe samples/apps/user-data-rights-demo
-// fuer eine vollstaendige App):
+// What is not in the recipe (see samples/apps/user-data-rights-demo
+// for a complete app):
 //   - Strategy-aware delete (anonymize vs hardDelete)
-//   - HTTP-Endpoints fuer create/list
-//   - Compliance-Profile-Wiring + Cron-Scheduling
+//   - HTTP endpoints for create/list
+//   - Compliance profile wiring + cron scheduling
 
 import {
   deleteMany,