@cosmicdrift/kumiko-samples 0.404.0 → 0.404.1

package/samples/recipes/cross-feature-events/README.md

@@ -68,6 +68,7 @@ The integration test pins three guarantees:
 ```bash
 bun kumiko test integration samples/cross-feature-events
 ```
+
 4. **Catch-up job** — `catch-up-job.integration.test.ts` places orders
    before the first dispatcher pass and checks that the `catchUp` job
    invoices each of them exactly once.

package/samples/recipes/crypto-shredding-hr/README.md

@@ -7,7 +7,7 @@ unreadable forever, and reads render the `[[erased]]` sentinel.
 
 The recipe ships a mini HR feature: an `employee` entity whose name and email
 are the employee's own PII, and an `hr-comment` entity whose body is
-encrypted under the key of the employee the comment is *about* — so a
+encrypted under the key of the employee the comment is _about_ — so a
 manager's comment dies with the employee's key, not the manager's.
 
 ## What it shows
@@ -41,7 +41,7 @@ manager's comment dies with the employee's key, not the manager's.
   than an alphabetically paginated one — not a plaintext sort column beside
   the encrypted one, which would survive the key erase and quietly undo the
   shredding.
-- **Forget = `kms.eraseKey(subject)`** — afterwards detail *and* list render
+- **Forget = `kms.eraseKey(subject)`** — afterwards detail _and_ list render
   `[[erased]]` for every protected field while the stored ciphertext bytes
   stay untouched.
 
@@ -62,7 +62,7 @@ deletion grace period.
 
 1. Create an employee → the executor creates a subject key on first insert
    and stores `displayName`/`email` as ciphertext.
-2. A comment about the employee is encrypted under the *employee's* key via
+2. A comment about the employee is encrypted under the _employee's_ key via
    `userOwned: { ownerField: "employeeId" }`.
 3. `kms.eraseKey({ kind: "user", userId })` — idempotent, tombstone stays
    for the audit trail.

package/samples/recipes/custom-fields-basic/README.md

@@ -3,7 +3,7 @@
 Let a tenant add their own fields to your entity at runtime — without
 writing a migration, without rebuilding your handler, without a code
 change. The recipe wires a `property` entity into the `custom-fields`
-bundle and drives a full *define → set → read* roundtrip.
+bundle and drives a full _define → set → read_ roundtrip.
 
 The result: the tenant defines `internalNumber: text`, sets it on a
 property, and reads it back flattened onto the row — looking exactly

package/samples/recipes/documents/README.md

@@ -0,0 +1,25 @@
+# Documents
+
+A document register on top of existing records: captured files with a category, linked to records, visible only to whoever may read those records.
+
+## What it shows
+
+- `createDocumentsFeature` (`@cosmicdrift/kumiko-bundled-features/documents`) with `categories`, `linkTargets` and `access` roles.
+- A `capture` rule turns a file field into a document source without the entity knowing about the documents feature: every saved `contract.file` is filed as a document of category `contract`, titled from the row, and linked to the contract's property.
+- Visibility follows the linked records: a document is visible to users who may read the linked records and the contract that owns the file. The `documents:query:for-record` query returns the documents of one record; a property reader sees none for the property because they may not read the contract that owns the file.
+
+## Source
+
+Feature entry point: `src/feature.ts`.
+
+```ts file=<rootDir>/_samples/recipes-documents/src/feature.ts
+```
+
+## Tests
+
+Needs a running Postgres and `TEST_DATABASE_URL` set (e.g. `postgres://postgres:postgres@127.0.0.1:5432/postgres`, see `demo/.env.example`).
+
+```bash
+cd samples/recipes/documents
+bun test
+```

package/samples/recipes/embedded-entity-form/package.json

@@ -5,10 +5,10 @@
   "dependencies": {
     "@cosmicdrift/kumiko-framework": "workspace:*",
     "@cosmicdrift/kumiko-renderer": "workspace:*",
-    "react": "^19.2.6"
+    "react": "^19.3.1"
   },
   "devDependencies": {
     "@cosmicdrift/kumiko-testing": "workspace:*",
-    "@types/react": "^19.2.14"
+    "@types/react": "^19.3.0"
   }
 }

package/samples/recipes/encrypted-tenant-config/README.md

@@ -10,10 +10,10 @@ the platform operator being able to read the plaintext from the DB.
 import { access, createTenantConfig } from "@cosmicdrift/kumiko-framework/engine";
 
 createTenantConfig("text", {
-  encrypted: true,        // ← ciphertext in the DB
-  write: access.admin,    // ← the tenant admin writes their own
-  read: access.admin,     // ← nobody else sees it
-  mask: { title: "billing.stripe-api-key", order: 1 },  // ← derives the edit screen + nav
+  encrypted: true, // ← ciphertext in the DB
+  write: access.admin, // ← the tenant admin writes their own
+  read: access.admin, // ← nobody else sees it
+  mask: { title: "billing.stripe-api-key", order: 1 }, // ← derives the edit screen + nav
 });
 ```
 
@@ -39,10 +39,10 @@ i18n key of the field label, `mask.order` its position.
 
 ## Vs. `r.secret` / `samples/recipes/secrets-demo`
 
-| Pattern | Scope | Use case |
-|---|---|---|
-| **`r.secret`** (envelope encryption, KEK rotation) | App-global | Platform-owned secrets (e.g. the master Stripe key that bills ALL customers). |
-| **`encrypted: true` config key** (this recipe) | Per-tenant | Customer-owned secrets. Customer sets, rotates, and never sees another customer's. Same envelope encryption + KEK keyring under the hood. |
+| Pattern                                            | Scope      | Use case                                                                                                                                  |
+| -------------------------------------------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
+| **`r.secret`** (envelope encryption, KEK rotation) | App-global | Platform-owned secrets (e.g. the master Stripe key that bills ALL customers).                                                             |
+| **`encrypted: true` config key** (this recipe)     | Per-tenant | Customer-owned secrets. Customer sets, rotates, and never sees another customer's. Same envelope encryption + KEK keyring under the hood. |
 
 Combinable: the platform uses `r.secret` for its internal secrets,
 and in parallel customers have their tenant-owned `encrypted: true`

package/samples/recipes/env-composition/README.md

@@ -21,16 +21,16 @@ instead of keeping a hand-written copy of every feature's variables.
 
 ## Blocks
 
-| Block | Where it lives | Registered by |
-| --- | --- | --- |
-| `kmsEnvSchema` | `crypto-shredding` | `createCryptoShreddingFeature()` |
-| `smtpEnvSchema` | `channel-email` | `createChannelEmailFeature()` |
-| `s3EnvSchema`, `createS3EnvSchema({ prefix })` | `file-provider-s3` | `createFileProviderS3Feature({ fromEnv: true })` |
-| `stripeEnvSchema({ prices })` | `subscription-stripe` | app (`extend`); the feature registers the bridge keys |
-| `paddleEnvSchema({ prices })` | `subscription-paddle` | app (`extend`); the feature registers the bridge keys |
-| `mfaTokenSecretsEnvSchema` | `auth-mfa` | `createAuthMfaFeature()` |
-| `buildInfoEnvSchema`, `demoAdminEnvSchema` | `foundation-shared` | app (`extend`) |
-| `prometheusMetricsEnvSchema` | `framework/observability` | app (`extend`) |
+| Block                                          | Where it lives            | Registered by                                         |
+| ---------------------------------------------- | ------------------------- | ----------------------------------------------------- |
+| `kmsEnvSchema`                                 | `crypto-shredding`        | `createCryptoShreddingFeature()`                      |
+| `smtpEnvSchema`                                | `channel-email`           | `createChannelEmailFeature()`                         |
+| `s3EnvSchema`, `createS3EnvSchema({ prefix })` | `file-provider-s3`        | `createFileProviderS3Feature({ fromEnv: true })`      |
+| `stripeEnvSchema({ prices })`                  | `subscription-stripe`     | app (`extend`); the feature registers the bridge keys |
+| `paddleEnvSchema({ prices })`                  | `subscription-paddle`     | app (`extend`); the feature registers the bridge keys |
+| `mfaTokenSecretsEnvSchema`                     | `auth-mfa`                | `createAuthMfaFeature()`                              |
+| `buildInfoEnvSchema`, `demoAdminEnvSchema`     | `foundation-shared`       | app (`extend`)                                        |
+| `prometheusMetricsEnvSchema`                   | `framework/observability` | app (`extend`)                                        |
 
 ## When to reach for it
 

package/samples/recipes/error-contract/README.md

@@ -14,15 +14,15 @@ Every Kumiko error class in a real handler context. A single feature `orders-lit
 
 ## The classes — when do I use which?
 
-| Class | HTTP | Use in handler |
-|---|---|---|
-| `ValidationError` | 400 | Automatic from Zod. Never throw manually, only for validation-hook errors. |
-| `AccessDeniedError` | 403 | "You're not allowed" — ownership, role check, field lock. |
-| `NotFoundError` | 404 | Entity doesn't exist. Automatic via `failNotFound(entity, id)`. |
-| `ConflictError` | 409 | State collision without a version (e.g. "paid orders can't be cancelled"). |
-| `VersionConflictError` | 409 | Optimistic lock — comes out of CrudExecutor automatically. You never throw it. |
-| `UnprocessableError` | 422 | Business rule violated. The reason string describes what. |
-| `InternalError` | 500 | You **don't throw it yourself**. The framework wraps unexpected throws automatically. |
+| Class                  | HTTP | Use in handler                                                                        |
+| ---------------------- | ---- | ------------------------------------------------------------------------------------- |
+| `ValidationError`      | 400  | Automatic from Zod. Never throw manually, only for validation-hook errors.            |
+| `AccessDeniedError`    | 403  | "You're not allowed" — ownership, role check, field lock.                             |
+| `NotFoundError`        | 404  | Entity doesn't exist. Automatic via `failNotFound(entity, id)`.                       |
+| `ConflictError`        | 409  | State collision without a version (e.g. "paid orders can't be cancelled").            |
+| `VersionConflictError` | 409  | Optimistic lock — comes out of CrudExecutor automatically. You never throw it.        |
+| `UnprocessableError`   | 422  | Business rule violated. The reason string describes what.                             |
+| `InternalError`        | 500  | You **don't throw it yourself**. The framework wraps unexpected throws automatically. |
 
 ## Convenience helpers
 

package/samples/recipes/event-sourcing/README.md

@@ -6,15 +6,15 @@ blocks Kumiko provides.
 
 ## What the sample shows
 
-| API | Purpose |
-|---|---|
-| `r.defineEvent(name, schema, { version, migrations })` | Event schema with version number + upcaster chain |
-| `ctx.events.append({ aggregateId, aggregateType, type, payload })` | Domain event on aggregate stream |
-| `r.projection(...)` | Single-stream read model, inline in the write TX |
-| `r.multiStreamProjection(...)` | Cross-aggregate read model, async via dispatcher |
-| `ctx.events.load(id, { asOf })` | Live aggregation with point-in-time |
-| `ctx.events.archive(id, { aggregateType })` | Archive a stream (Marten `ArchiveStream`) |
-| `ctx.dispatch.queryProjection(name)` | Tenant-scoped read-model query |
+| API                                                                | Purpose                                           |
+| ------------------------------------------------------------------ | ------------------------------------------------- |
+| `r.defineEvent(name, schema, { version, migrations })`             | Event schema with version number + upcaster chain |
+| `ctx.events.append({ aggregateId, aggregateType, type, payload })` | Domain event on aggregate stream                  |
+| `r.projection(...)`                                                | Single-stream read model, inline in the write TX  |
+| `r.multiStreamProjection(...)`                                     | Cross-aggregate read model, async via dispatcher  |
+| `ctx.events.load(id, { asOf })`                                    | Live aggregation with point-in-time               |
+| `ctx.events.archive(id, { aggregateType })`                        | Archive a stream (Marten `ArchiveStream`)         |
+| `ctx.dispatch.queryProjection(name)`                               | Tenant-scoped read-model query                    |
 
 ## Domain
 

package/samples/recipes/ledger-invoicing/README.md

@@ -38,12 +38,12 @@ invoicingFlow …`):
 Both recipes use the same primitive — accounts + balanced transactions — but
 record different things:
 
-| | [ledger-banking](../ledger-banking/) | ledger-invoicing |
-|---|---|---|
-| Accounts | all `asset` (bank accounts) | `asset` + `income` + `liability` |
-| A transaction is… | a transfer (cash moves) | an obligation (invoice) or its settlement |
-| Revenue recognised | n/a | at invoice time (accrual) |
-| Reports surfaced | balances | balances + P&L |
+|                    | [ledger-banking](../ledger-banking/) | ledger-invoicing                          |
+| ------------------ | ------------------------------------ | ----------------------------------------- |
+| Accounts           | all `asset` (bank accounts)          | `asset` + `income` + `liability`          |
+| A transaction is…  | a transfer (cash moves)              | an obligation (invoice) or its settlement |
+| Revenue recognised | n/a                                  | at invoice time (accrual)                 |
+| Reports surfaced   | balances                             | balances + P&L                            |
 
 ## Run
 

package/samples/recipes/legal-pages/README.md

@@ -162,12 +162,12 @@ page in `createLegalPagesLayout({ siteName })`.
 
 After the seed these URLs are immediately live:
 
-| URL | Content |
-|---|---|
-| `https://your-app.example/legal/impressum` | Impressum (DE) |
-| `https://your-app.example/legal/datenschutz` | Datenschutzerklärung (DE) |
-| `https://your-app.example/legal/imprint` | Imprint (EN, if seeded) |
-| `https://your-app.example/legal/privacy` | Privacy Policy (EN, if seeded) |
+| URL                                          | Content                        |
+| -------------------------------------------- | ------------------------------ |
+| `https://your-app.example/legal/impressum`   | Impressum (DE)                 |
+| `https://your-app.example/legal/datenschutz` | Datenschutzerklärung (DE)      |
+| `https://your-app.example/legal/imprint`     | Imprint (EN, if seeded)        |
+| `https://your-app.example/legal/privacy`     | Privacy Policy (EN, if seeded) |
 
 → Footer links are set per app (legal-pages does not ship a footer
 component — deliberately, every app has its own layout).
@@ -195,22 +195,22 @@ ACL: `["TenantAdmin", "SystemAdmin"]`. Cache header `public, max-age=300`
 When the required blocks (`imprint/de` + `privacy/de`) are missing
 from SYSTEM_TENANT:
 
-| Mode | Behavior |
-|---|---|
+| Mode                  | Behavior                                                    |
+| --------------------- | ----------------------------------------------------------- |
 | `NODE_ENV=production` | App boot throws an error with a slug list — container exits |
-| otherwise (dev/test) | `console.warn` with a slug list, app starts anyway |
+| otherwise (dev/test)  | `console.warn` with a slug list, app starts anyway          |
 
 → Safety net: no production deploy without populated legal pages.
 
 ## Troubleshooting
 
-| Symptom | Cause | Fix |
-|---|---|---|
-| Route returns `503 legal page unavailable` | `anonymousAccess` not configured in `runProdApp` | Set `anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID }` |
-| Boot check throws `ctx.templateResolver missing` | `extraContext.templateResolver` not wired | Set `extraContext: ({ db, registry }) => ({ templateResolver: createTemplateResolverApi(db, registry) })` |
-| Route returns `404 not configured` | Required block doesn't exist or has `content=null` | `seedTextBlock` with a content string |
-| Multi-tenant app: tenant subdomain shows an empty page | (Bug regression?) Routes should ALWAYS show SYSTEM_TENANT texts | The `legal-pages.integration.test.ts` test "SYSTEM_TENANT routing" covers this — should be green |
-| `<script>` tags in a Markdown body land 1:1 in the HTML | Deliberately accepted right now — see [legal-pages/README.md XSS section](../../../packages/bundled-features/src/legal-pages/README.md#xss--currently-not-secured-by-design) | DOMPurify is a Phase 2 once a multi-author setup arrives |
+| Symptom                                                 | Cause                                                                                                                                                                        | Fix                                                                                                       |
+| ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
+| Route returns `503 legal page unavailable`              | `anonymousAccess` not configured in `runProdApp`                                                                                                                             | Set `anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID }`                                              |
+| Boot check throws `ctx.templateResolver missing`        | `extraContext.templateResolver` not wired                                                                                                                                    | Set `extraContext: ({ db, registry }) => ({ templateResolver: createTemplateResolverApi(db, registry) })` |
+| Route returns `404 not configured`                      | Required block doesn't exist or has `content=null`                                                                                                                           | `seedTextBlock` with a content string                                                                     |
+| Multi-tenant app: tenant subdomain shows an empty page  | (Bug regression?) Routes should ALWAYS show SYSTEM_TENANT texts                                                                                                              | The `legal-pages.integration.test.ts` test "SYSTEM_TENANT routing" covers this — should be green          |
+| `<script>` tags in a Markdown body land 1:1 in the HTML | Deliberately accepted right now — see [legal-pages/README.md XSS section](../../../packages/bundled-features/src/legal-pages/README.md#xss--currently-not-secured-by-design) | DOMPurify is a Phase 2 once a multi-author setup arrives                                                  |
 
 ## Cross-refs
 

package/samples/recipes/managed-config/README.md

@@ -6,15 +6,19 @@ backings and two scopes, without a hand-written screen, nav, or env-wiring map.
 
 Two keys, deliberately different:
 
-| Key | Scope | Backing | Story |
-|---|---|---|---|
+| Key               | Scope    | Backing   | Story                                                                                                                                                                                      |
+| ----------------- | -------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | `payment-api-key` | `system` | `secrets` | Platform-owned secret (one Stripe key bills all tenants). Stored envelope-encrypted in the secrets store, masked in every query, revealed only for the owning feature's `ctx.config` read. |
-| `smtp-host` | `tenant` | config | Platform default that a tenant admin overrides. Cascade resolves `tenant-row → system-row → default`; one tenant's override never leaks to another. |
+| `smtp-host`       | `tenant` | config    | Platform default that a tenant admin overrides. Cascade resolves `tenant-row → system-row → default`; one tenant's override never leaks to another.                                        |
 
 ## Pattern
 
 ```ts illustration
-import { access, createSystemConfig, createTenantConfig } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  createSystemConfig,
+  createTenantConfig,
+} from "@cosmicdrift/kumiko-framework/engine";
 
 r.config({
   keys: {
@@ -48,7 +52,7 @@ r.config({
   valid for `scope: "system"` — secrets are flat per `(tenant, key)` with no
   cascade, so a tenant override would be incoherent and is rejected at boot.
 - **`env: "SMTP_HOST"`** — at boot (`runProdApp`) the env var seeds the key's
-  default as an app-override, below any `system-row`. The env var *is* the
+  default as an app-override, below any `system-row`. The env var _is_ the
   default; no manual `AppConfigOverrides` map, no re-typing in the admin UI.
 - **`mask`** — the key surfaces automatically in the self-populating settings
   hub: `buildConfigFeatureSchema` derives a `configEdit` screen + a child nav
@@ -86,14 +90,14 @@ the config backing only needs the `ctx.services.secrets` context shown above.
 
 ## Vs. the neighbouring recipes
 
-| Pattern | Storage | Cascade | Use case |
-|---|---|---|---|
-| **`encrypted: true` config key** (`encrypted-tenant-config`) | `config_values`, AES ciphertext | system → tenant | Per-tenant customer secret, no KEK rotation/audit. |
-| **`backing: "secrets"` config key** (this recipe) | secrets envelope, system tenant | none (system-only) | Platform-owned secret needing rotation + audit-on-read, declared as a config key. |
-| **`r.secret`** (`secrets-demo`) | secrets envelope | none | Same storage, but addressed directly — no config key, no settings-hub entry. |
+| Pattern                                                      | Storage                         | Cascade            | Use case                                                                          |
+| ------------------------------------------------------------ | ------------------------------- | ------------------ | --------------------------------------------------------------------------------- |
+| **`encrypted: true` config key** (`encrypted-tenant-config`) | `config_values`, AES ciphertext | system → tenant    | Per-tenant customer secret, no KEK rotation/audit.                                |
+| **`backing: "secrets"` config key** (this recipe)            | secrets envelope, system tenant | none (system-only) | Platform-owned secret needing rotation + audit-on-read, declared as a config key. |
+| **`r.secret`** (`secrets-demo`)                              | secrets envelope                | none               | Same storage, but addressed directly — no config key, no settings-hub entry.      |
 
 `backing: "secrets"` is the bridge: you get the secrets store's guarantees
-*and* the config feature's declarative surface (masking, settings hub, the same
+_and_ the config feature's declarative surface (masking, settings hub, the same
 `config:write:set` write path).
 
 ## Flow

package/samples/recipes/managed-pages/README.md

@@ -139,14 +139,14 @@ exact same helpers.
 
 ## Security posture
 
-| Threat | Mitigation |
-|---|---|
-| `<script>`/raw HTML in a page body | `renderSafeMarkdown` escapes raw HTML (Markdown-only) |
-| Cross-tenant content on a shared CDN | `Vary: Host` + per-tenant `resolveApexTenant` |
-| Draft leak to anonymous visitors | published-only; drafts → 404 |
+| Threat                                                    | Mitigation                                                          |
+| --------------------------------------------------------- | ------------------------------------------------------------------- |
+| `<script>`/raw HTML in a page body                        | `renderSafeMarkdown` escapes raw HTML (Markdown-only)               |
+| Cross-tenant content on a shared CDN                      | `Vary: Host` + per-tenant `resolveApexTenant`                       |
+| Draft leak to anonymous visitors                          | published-only; drafts → 404                                        |
 | `@import`/`url()`/`expression()`/`</style>` in custom CSS | allowlist-by-construction sanitizer (rebuilt from validated tokens) |
-| Scope-escape / overlay onto host chrome | scope-prefix + `position`/`isolation`/`overflow` containment |
-| Untrusted tenant abusing CSS | tier-gate (`managed-pages-css`) + `allowCustomCss` opt-in |
+| Scope-escape / overlay onto host chrome                   | scope-prefix + `position`/`isolation`/`overflow` containment        |
+| Untrusted tenant abusing CSS                              | tier-gate (`managed-pages-css`) + `allowCustomCss` opt-in           |
 
 Custom-CSS sanitization for untrusted tenants is **best-effort defense-in-depth**:
 a tenant can still restyle its **own** page area within the clip. Keep it

package/samples/recipes/pdf-audit-export/package.json

@@ -8,6 +8,6 @@
   },
   "devDependencies": {
     "@cosmicdrift/kumiko-testing": "workspace:*",
-    "unpdf": "^1.8.1"
+    "unpdf": "^1.9.1"
   }
 }

package/samples/recipes/pipeline-basics/README.md

@@ -7,18 +7,18 @@ behaves end-to-end against the worktree's framework source.
 
 ## What's inside
 
-| Step | Where it shows up |
-|---|---|
-| `r.step.aggregate.create` | `product:create` |
-| `r.step.aggregate.update` | `product:rename`, `product:adjust-stock`, `product:bulk-adjust` |
-| `r.step.aggregate.appendEvent` | `product:adjust-stock`, `product:archive`, `report:archive-low-stock-products` |
-| `r.step.read.findOne` | `product:rename`, `product:adjust-stock`, `product:bulk-adjust` |
-| `r.step.read.findMany` | `report:archive-low-stock-products` |
-| `r.step.compute` | `product:adjust-stock`, `product:bulk-adjust` |
-| `r.step.branch` | `product:rename`, `product:adjust-stock` |
-| `r.step.forEach` | `product:bulk-adjust`, `report:archive-low-stock-products` |
-| `r.step.return` | every handler |
-| `r.step.unsafeProjectionUpsert` | `product:adjust-stock` |
+| Step                            | Where it shows up                                                              |
+| ------------------------------- | ------------------------------------------------------------------------------ |
+| `r.step.aggregate.create`       | `product:create`                                                               |
+| `r.step.aggregate.update`       | `product:rename`, `product:adjust-stock`, `product:bulk-adjust`                |
+| `r.step.aggregate.appendEvent`  | `product:adjust-stock`, `product:archive`, `report:archive-low-stock-products` |
+| `r.step.read.findOne`           | `product:rename`, `product:adjust-stock`, `product:bulk-adjust`                |
+| `r.step.read.findMany`          | `report:archive-low-stock-products`                                            |
+| `r.step.compute`                | `product:adjust-stock`, `product:bulk-adjust`                                  |
+| `r.step.branch`                 | `product:rename`, `product:adjust-stock`                                       |
+| `r.step.forEach`                | `product:bulk-adjust`, `report:archive-low-stock-products`                     |
+| `r.step.return`                 | every handler                                                                  |
+| `r.step.unsafeProjectionUpsert` | `product:adjust-stock`                                                         |
 | `r.step.unsafeProjectionDelete` | `product:adjust-stock`, `product:archive`, `report:archive-low-stock-products` |
 
 ## Domain
@@ -84,7 +84,7 @@ engine APIs land in a published release.
   in the pure event-sourcing shape — it appends a domain event
   (`product-stock-adjusted`) and lets the inline
   `product-stock-counter` projection update `currentStock`. The
-  alternative (calling `aggregate.update` *and* `appendEvent` in
+  alternative (calling `aggregate.update` _and_ `appendEvent` in
   one handler) inflates the stream-version mid-handler and trips
   optimistic-locking on the next call. The other handlers
   (`rename`, `bulk-adjust`) use `aggregate.update` directly

package/samples/recipes/public-share-token/README.md

@@ -20,11 +20,11 @@ the URL carries a share token).
 
 ## Handlers
 
-| QN | Access |
-|---|---|
+| QN                                     | Access                      |
+| -------------------------------------- | --------------------------- |
 | `public-share:write:share-link:create` | authenticated (`openToAll`) |
-| `public-share:write:share-link:revoke` | owner |
-| `public-share:query:share-by-token` | anonymous + authenticated |
+| `public-share:write:share-link:revoke` | owner                       |
+| `public-share:query:share-by-token`    | anonymous + authenticated   |
 
 ## Run tests
 

package/samples/recipes/record-detail-layout/package.json

@@ -9,14 +9,14 @@
   "dependencies": {
     "@cosmicdrift/kumiko-framework": "workspace:*",
     "@cosmicdrift/kumiko-renderer": "workspace:*",
-    "react": "^19.2.6"
+    "react": "^19.3.1"
   },
   "devDependencies": {
     "@cosmicdrift/kumiko-server-runtime": "workspace:*",
     "@cosmicdrift/kumiko-testing": "workspace:*",
-    "@playwright/test": "^1.62.1",
+    "@playwright/test": "^1.64.1",
     "@tailwindcss/cli": "^4.3.3",
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.3.0",
     "tailwindcss": "^4.3.3"
   }
 }

package/samples/recipes/security-baseline/README.md

@@ -45,7 +45,10 @@ mounts `sessions` as part of its own require-chain. Combine both directly;
 `dedupeFeatures()` collapses the two identical `sessions` instances at boot:
 
 ```ts illustration
-import { composeGdprStack, composeSecurityStack } from "@cosmicdrift/kumiko-dev-server/compose-stacks";
+import {
+  composeGdprStack,
+  composeSecurityStack,
+} from "@cosmicdrift/kumiko-dev-server/compose-stacks";
 
 export const APP_FEATURES = [
   // ...config, user, tenant, auth-foundation...

package/samples/recipes/session-revocation/README.md

@@ -25,7 +25,7 @@ const server = buildServer({
     }),
     // ... other features
   ]),
-  context: { db, /* ... */ },
+  context: { db /* ... */ },
   jwtSecret: process.env.JWT_SECRET,
   auth: {
     membershipQuery: "tenant:query:memberships",

package/samples/recipes/tenant-settings/README.md

@@ -56,12 +56,12 @@ role vocabulary overrides those instead of forking the feature.
 
 ## Why the schema needs a special case
 
-`buildInsertSchema` always makes `currency` required *inside* a money field's
+`buildInsertSchema` always makes `currency` required _inside_ a money field's
 value object, even when the field itself is optional — a caller literally
 cannot submit `{ amount: 1000 }` against the plain `defineEntityCreateHandler`.
 `defineCreateWithTenantDefaults` swaps in its own schema (`.extend()` over the
 same `buildInsertSchema` output, with just the declared `currencyFields`
-relaxed) so the caller *can* omit `currency`, then fills it from
+relaxed) so the caller _can_ omit `currency`, then fills it from
 `ctx.config(TenantSettingsConfig.currency)` before delegating to the same
 `executor.create()` the generic factory uses.
 
@@ -74,13 +74,13 @@ changes them from **Settings → Tenant → Default Currency / Default Locale**.
 
 ## Flow
 
-1. No tenant override yet → a new invoice gets the *feature's own* default
+1. No tenant override yet → a new invoice gets the _feature's own_ default
    (`"EUR"`/`"en"`, set via `createTenantSettingsFeature()`'s own defaults).
 2. Tenant sets `currency` to `"CHF"` and `locale` to `"de"` via the
    Settings-Hub (or `config:write:set` directly).
 3. A new invoice that doesn't specify `amount.currency`/`language` picks up
    `"CHF"`/`"de"` — no entity code changed, no second migration.
-4. A caller that *does* specify `amount.currency` still wins — the tenant
+4. A caller that _does_ specify `amount.currency` still wins — the tenant
    setting only fills gaps, it never overrides an explicit value.
 
 ## Tests

package/samples/recipes/tier-admin/README.md

@@ -9,7 +9,7 @@ toggleable features unlock in the same request.
 ## What it shows
 
 - **`tier-engine:write:set-tenant-tier`** — a SystemAdmin assigns a tier
-  to *any* tenant, cross-tenant. Stamps `source: "manual"` so a future
+  to _any_ tenant, cross-tenant. Stamps `source: "manual"` so a future
   Stripe → tier sync won't overwrite the grant.
 - **`tier-engine:query:get-tenant-tier`** — SystemAdmin reads back which
   tier a tenant is on plus its source (`"manual"` vs `"billing"`).
@@ -50,7 +50,7 @@ notes-export → r.toggleable() domain feature unlocked by pro tier
 path bypasses the `postSave` entity-hook the resolver normally uses to
 invalidate the cache after a tier-assignment change. Without an explicit
 cache update the grant would persist (next request would see it) but
-*this* request still sees the old tier — surprising for an operator who
+_this_ request still sees the old tier — surprising for an operator who
 just clicked "set tier to pro".
 
 The feature wires `onAssigned` into `createSetTenantTierWrite` for

package/samples/recipes/user-data-rights/README.md

@@ -17,13 +17,13 @@ defineFeature("notes", (r) => {
   r.useExtension(EXT_USER_DATA, "note", {
     export: async (ctx) => ({
       entity: "note",
-      rows: await ctx.db.select().from(notesTable)
-        .where(and(eq(notesTable.tenantId, ctx.tenantId),
-                   eq(notesTable.authorId, ctx.userId))),
+      rows: await ctx.db
+        .select()
+        .from(notesTable)
+        .where(and(eq(notesTable.tenantId, ctx.tenantId), eq(notesTable.authorId, ctx.userId))),
     }),
     delete: async (ctx, strategy) => {
-      const where = and(eq(notesTable.tenantId, ctx.tenantId),
-                        eq(notesTable.authorId, ctx.userId));
+      const where = and(eq(notesTable.tenantId, ctx.tenantId), eq(notesTable.authorId, ctx.userId));
       if (strategy === "anonymize") {
         await ctx.db.update(notesTable).set({ authorId: null }).where(where);
       } else {
@@ -36,21 +36,21 @@ defineFeature("notes", (r) => {
 
 ## What runs automatically
 
-| Article | What happens | Trigger |
-|---|---|---|
+| Article      | What happens                                   | Trigger                                |
+| ------------ | ---------------------------------------------- | -------------------------------------- |
 | Art. 15 + 20 | Notes snippet in export ZIP + magic-link email | `runUserExport` (via `request-export`) |
-| Art. 17 | Notes deleted or anonymized after grace | `runForgetCleanup` cron |
-| Art. 18 | Restriction blocks login while active | Auth middleware |
-| Operator | Brute-force detection on magic-link endpoint | Edge rate-limit + audit log |
+| Art. 17      | Notes deleted or anonymized after grace        | `runForgetCleanup` cron                |
+| Art. 18      | Restriction blocks login while active          | Auth middleware                        |
+| Operator     | Brute-force detection on magic-link endpoint   | Edge rate-limit + audit log            |
 
 ## Strategy-aware delete
 
 `retention.policyFor("note")` resolves per entity:
 
-| Profile | Strategy | Effect |
-|---|---|---|
-| `eu-dsgvo` (default) | `delete` | Notes hard-deleted |
-| `de-hr-dsgvo-hgb` | `anonymize` for HR entities | `authorId=null`, row kept for multi-user refs |
+| Profile              | Strategy                    | Effect                                        |
+| -------------------- | --------------------------- | --------------------------------------------- |
+| `eu-dsgvo` (default) | `delete`                    | Notes hard-deleted                            |
+| `de-hr-dsgvo-hgb`    | `anonymize` for HR entities | `authorId=null`, row kept for multi-user refs |
 
 The integration test pins both paths.
 
@@ -91,7 +91,9 @@ const result = await runRetentionCleanup({
   registry: stack.registry,
   tenantId,
   preloadedTenantPreset: null,
-  now: getTemporal().Now.instant().add({ hours: 31 * 24 }), // keepFor 30d + 1 day
+  now: getTemporal()
+    .Now.instant()
+    .add({ hours: 31 * 24 }), // keepFor 30d + 1 day
   files: createFileContext(() => Promise.resolve(provider)), // the stack's storage provider
 });
 // result.hardDeleted === 1, bytes and file_refs row gone
@@ -99,10 +101,10 @@ const result = await runRetentionCleanup({
 
 ## Full app vs this recipe
 
-| | This recipe | [user-data-rights-demo](/en/samples/apps-user-data-rights-demo/) |
-|---|---|---|
-| Scope | One hook pattern | Runnable app + todos + files |
-| Boot | Integration test only | `bun dev` on port 4291 |
+|       | This recipe           | [user-data-rights-demo](/en/samples/apps-user-data-rights-demo/) |
+| ----- | --------------------- | ---------------------------------------------------------------- |
+| Scope | One hook pattern      | Runnable app + todos + files                                     |
+| Boot  | Integration test only | `bun dev` on port 4291                                           |
 
 ## Dependencies
 

package/samples/recipes/wizard-form/package.json

@@ -10,14 +10,14 @@
     "@cosmicdrift/kumiko-bundled-features": "workspace:*",
     "@cosmicdrift/kumiko-framework": "workspace:*",
     "@cosmicdrift/kumiko-renderer": "workspace:*",
-    "react": "^19.2.6"
+    "react": "^19.3.1"
   },
   "devDependencies": {
     "@cosmicdrift/kumiko-server-runtime": "workspace:*",
     "@cosmicdrift/kumiko-testing": "workspace:*",
-    "@playwright/test": "^1.62.1",
+    "@playwright/test": "^1.64.1",
     "@tailwindcss/cli": "^4.3.3",
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.3.0",
     "tailwindcss": "^4.3.3"
   }
 }