@cosmicdrift/kumiko-samples 0.404.0 → 0.405.0

package/packages/bundled-features/src/user-data-rights/run-user-export.ts

@@ -1,4 +1,4 @@
-import { createFallbackLogger, type Logger } from "@cosmicdrift/kumiko-framework/logging";
+import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 // User data export pipeline — GDPR Art. 15 (access) +
 // Art. 20 (data portability).
 //
@@ -29,7 +29,6 @@ import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import {
   collectEncryptedFieldNames,
   configuredEntityFieldEncryption,
-  createTenantDb,
   decryptEntityFieldValues,
   selectMany,
 } from "@cosmicdrift/kumiko-framework/db";
@@ -44,12 +43,9 @@ import {
   type UserDataExportSnippet,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { runInSystemRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
-import {
-  createEscapeHatchReporter,
-  UNATTRIBUTED_ACTOR,
-} from "@cosmicdrift/kumiko-framework/pipeline";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { tenantMembershipsTable } from "../tenant/index.ts";
+import { buildHookDb } from "./build-hook-db.ts";
 import { buildFileRefZipPath } from "./zip-path.ts";
 
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
@@ -108,31 +104,6 @@ interface HookEntry {
   readonly escapeHatchReason: string | undefined;
 }
 
-function buildHookDb(
-  db: DbRunner,
-  tenantId: TenantId,
-  entry: HookEntry,
-  args: Pick<RunUserExportArgs, "escapeHatchAuditSink" | "escapeHatchAuditLog" | "actor">,
-) {
-  const report = createEscapeHatchReporter({
-    handler: `${EXT_USER_DATA}:${entry.entityName}`,
-    tenantId,
-    actor: args.actor ?? UNATTRIBUTED_ACTOR,
-    sink: args.escapeHatchAuditSink,
-    log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
-  });
-  return createTenantDb({
-    db,
-    tenantId,
-    mode: "tenant",
-    grants: {
-      unsafeRaw:
-        entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-      report,
-    },
-  });
-}
-
 /**
  * Pure function: invokes all EXT_USER_DATA hooks for each tenant
  * membership and collects snippets into a UserExportBundle.

package/packages/bundled-features/src/user-data-rights/token-helpers.ts

@@ -13,10 +13,8 @@
 // **Multi-use within TTL:** The token is NOT "consumed" on download, so the user
 // can download repeatedly until expiresAt. This matches Google-Takeout (7d) and
 // Facebook-Data-Download (4d).
-//
-// **Universal Web-Crypto API:** crypto.getRandomValues + crypto.subtle.digest
-// runs identically in Bun, Node 19+, and browsers, avoiding platform-specific
-// imports.
+
+import { hashOpaqueToken } from "@cosmicdrift/kumiko-framework/crypto";
 
 /**
  * Generates a new download token. The plain token is sent to the user by email;
@@ -41,9 +39,7 @@ export async function generateDownloadToken(): Promise<{
  * database (no constant-time comparison, see the header comment).
  */
 export async function hashDownloadToken(plain: string): Promise<string> {
-  const encoded = new TextEncoder().encode(plain);
-  const digest = await crypto.subtle.digest("SHA-256", encoded);
-  return uint8ArrayToHex(new Uint8Array(digest));
+  return hashOpaqueToken(plain);
 }
 
 function uint8ArrayToBase64Url(bytes: Uint8Array): string {
@@ -54,11 +50,3 @@ function uint8ArrayToBase64Url(bytes: Uint8Array): string {
   }
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-
-function uint8ArrayToHex(bytes: Uint8Array): string {
-  let out = "";
-  for (let i = 0; i < bytes.length; i++) {
-    out += (bytes[i] as number).toString(16).padStart(2, "0"); // @cast-boundary dynamic-key
-  }
-  return out;
-}

package/packages/bundled-features/src/user-data-rights/web/privacy-center-screen.tsx

@@ -19,6 +19,7 @@ import {
 import { postWithDownload } from "@cosmicdrift/kumiko-renderer/web";
 import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { type ReactNode, useEffect, useState } from "react";
+import { type SectionStatus, StatusBanner } from "../../shared/web/status-banner.tsx";
 import {
   EXPORT_JOB_STATUS,
   type ExportJobStatus,
@@ -41,12 +42,6 @@ type ExportStatusResult =
   | { readonly hasJob: false }
   | { readonly hasJob: true; readonly job: ExportJob };
 
-type SectionStatus =
-  | { kind: "idle" }
-  | { kind: "submitting" }
-  | { kind: "success"; messageKey: string }
-  | { kind: "error"; messageKey: string };
-
 // Dispatcher failures include i18nKey only when the handler sets one; read it
 // at the boundary with a generic fallback.
 function failureKey(error: unknown): string {
@@ -63,18 +58,6 @@ export function formatDate(iso: string | null | undefined): string {
   return tIndex > 0 ? iso.slice(0, tIndex) : iso;
 }
 
-function StatusBanner({ status }: { readonly status: SectionStatus }): ReactNode {
-  const t = useTranslation();
-  const { Banner } = usePrimitives();
-  if (status.kind === "success") {
-    return <Banner variant="info">{t(status.messageKey)}</Banner>;
-  }
-  if (status.kind === "error") {
-    return <Banner variant="error">{t(status.messageKey)}</Banner>;
-  }
-  return null;
-}
-
 // Mounted by the renderer's ExtensionSectionMount (already wrapped in
 // <Section title={...} testId="section-extension-...">) — takes no props of
 // its own, ExtensionSectionProps (entityName/entityId/...) are unused since

package/packages/bundled-features/src/user-data-rights/web/public-deletion-gate.tsx

@@ -32,6 +32,7 @@ export function makePublicDeletionGate(
   routes: PublicDeletionRoutes,
 ): ComponentType<{ children: ReactNode }> {
   const shell = routes.shell ?? centeredShell;
+  // biome-ignore lint/correctness/noComponentHookFactories: setup-time factory, called once per userDataRightsClient(); gates only receive children, so routes are bound here
   function PublicDeletionGate({ children }: { readonly children: ReactNode }): ReactNode {
     const path = window.location.pathname;
     if (path === routes.requestPath) return shell(<RequestAccountDeletionScreen />);

package/packages/bundled-features/src/user-profile/web/profile-screen.tsx

@@ -16,14 +16,9 @@ import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { type ReactNode, useState } from "react";
 import { AuthHandlers } from "../../auth-email-password/web/constants.ts";
 import { requestEmailVerification } from "../../auth-email-password/web/index.ts";
+import { type SectionStatus, StatusBanner } from "../../shared/web/status-banner.tsx";
 import { UserProfileHandlers } from "./constants.ts";
 
-type SectionStatus =
-  | { kind: "idle" }
-  | { kind: "submitting" }
-  | { kind: "success"; messageKey: string }
-  | { kind: "error"; messageKey: string };
-
 // Dispatcher failures carry an i18nKey only when the handler sets one —
 // boundary read with a generic fallback.
 function failureKey(error: unknown): string {
@@ -31,18 +26,6 @@ function failureKey(error: unknown): string {
   return typeof key === "string" ? key : "profile.errors.generic";
 }
 
-function StatusBanner({ status }: { readonly status: SectionStatus }): ReactNode {
-  const t = useTranslation();
-  const { Banner } = usePrimitives();
-  if (status.kind === "success") {
-    return <Banner variant="info">{t(status.messageKey)}</Banner>;
-  }
-  if (status.kind === "error") {
-    return <Banner variant="error">{t(status.messageKey)}</Banner>;
-  }
-  return null;
-}
-
 // Mounted by the renderer's ExtensionSectionMount (already wrapped in
 // <Section title={...} testId="section-extension-...">) — takes no props of
 // its own. Deliberately NOT a <Form>: RenderEdit already renders a host

package/samples/apps/admin-console/README.md

@@ -24,11 +24,11 @@ Port 4177 is hardcoded in the `dev` script. The server reads the root
 All three log into the dev tenant "Admin Console Demo" (tenant key
 `demo`). Passwords are in `src/app/auth-constants.ts`.
 
-| Email | Role | Sees |
-|---|---|---|
-| `sysadmin@admin-console.local` | global `SystemAdmin`, tenant `Admin` | tenant-admin and platform workspaces |
-| `tenant-admin@admin-console.local` | tenant `TenantAdmin` | tenant-admin workspace only |
-| `regular@admin-console.local` | tenant `User` | no admin workspace |
+| Email                              | Role                                 | Sees                                 |
+| ---------------------------------- | ------------------------------------ | ------------------------------------ |
+| `sysadmin@admin-console.local`     | global `SystemAdmin`, tenant `Admin` | tenant-admin and platform workspaces |
+| `tenant-admin@admin-console.local` | tenant `TenantAdmin`                 | tenant-admin workspace only          |
+| `regular@admin-console.local`      | tenant `User`                        | no admin workspace                   |
 
 The SystemAdmin comes from the `auth.admin` bootstrap in
 `src/app/server.ts`; the other two are created by `seedRoleUsers` in

package/samples/apps/admin-console/package.json

@@ -11,9 +11,9 @@
     "@cosmicdrift/kumiko-dev-server": "workspace:*",
     "@cosmicdrift/kumiko-framework": "workspace:*",
     "@cosmicdrift/kumiko-renderer": "workspace:*",
-    "lucide-react": "^1.14.0",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
+    "lucide-react": "^1.65.0",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "@cosmicdrift/kumiko-locale-de": "workspace:*"
   }
 }

package/samples/apps/cap-billing-demo/README.md

@@ -9,9 +9,9 @@ The sample doubles as **living documentation** for the pattern: read the code to
 A tiny newsletter app with two tiers:
 
 | Tier | Newsletters per month | Soft warning at | Hard block at |
-|------|-----------|-------------------|-----------------|
-| free | 10 | 11 (110%) | 12 (120%) |
-| pro | 100 | 110 (110%) | 120 (120%) |
+| ---- | --------------------- | --------------- | ------------- |
+| free | 10                    | 11 (110%)       | 12 (120%)     |
+| pro  | 100                   | 110 (110%)      | 120 (120%)    |
 
 Mails land in an **in-memory transport** (`mail-transport-inmemory`).
 There's no real SMTP server — perfect for the demo, no Mailpit/Mailcrab
@@ -87,12 +87,12 @@ cd samples/apps/cap-billing-demo
 bun dev             # → http://localhost:4290
 ```
 
-| Login | Value |
-|-------|------|
-| URL | `http://localhost:4290` |
-| Email | `admin@cap-demo.local` |
-| Password | `changeme` |
-| Tenant | "Cap-Billing-Demo" |
+| Login    | Value                   |
+| -------- | ----------------------- |
+| URL      | `http://localhost:4290` |
+| Email    | `admin@cap-demo.local`  |
+| Password | `changeme`              |
+| Tenant   | "Cap-Billing-Demo"      |
 
 In the browser, use the Designer/Admin UI to set the config key
 `newsletter:config:tier` to `"free"` or `"pro"` and trigger the
@@ -110,13 +110,13 @@ omitted to keep the focus on cap+tier.
 
 The sample is intentionally minimal. For a production app, swap:
 
-| Demo component | Production replacement |
-|-----------------|-------------------|
-| `mail-transport-inmemory` | `mail-transport-smtp` (BYOK) or a custom plugin |
-| Hardcoded `DEMO_TIER_MAP` | stays — tier definitions are static, the subscription row only writes the `tier` key |
+| Demo component                      | Production replacement                                                                                                      |
+| ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
+| `mail-transport-inmemory`           | `mail-transport-smtp` (BYOK) or a custom plugin                                                                             |
+| Hardcoded `DEMO_TIER_MAP`           | stays — tier definitions are static, the subscription row only writes the `tier` key                                        |
 | Tier switch via webhook (test-only) | mount a real plugin: `createSubscriptionStripeFeature(...)` and/or `createSubscriptionMollieFeature(...)` in the run config |
-| 2 tiers (free/pro) | any number, see `samples/apps/platform/src/tier-map.ts` for a 4-tier example |
-| Newsletter domain | your own feature with `withCapEnforcement(handler, capResolver)` |
+| 2 tiers (free/pro)                  | any number, see `samples/apps/platform/src/tier-map.ts` for a 4-tier example                                                |
+| Newsletter domain                   | your own feature with `withCapEnforcement(handler, capResolver)`                                                            |
 
 The **plugin API switch** between demo and production is a single
 config value: `mail-foundation:config:provider` flips from

package/samples/apps/config-demo/README.md

@@ -26,13 +26,13 @@ The server reads the root `.env` (`--env-file=../../../.env`).
 
 `src/features/demo/feature.ts` declares five keys with `r.config()`:
 
-| Key | Scope | Type | Default | Write access |
-|---|---|---|---|---|
-| `siteName` | tenant | text | `My Site` | all |
-| `themeColor` | tenant | text | `#000000` | all |
-| `maxUploadSize` | tenant | number, bounds 1 to 1000 | `10` | all |
-| `emailNotifications` | user | boolean | `true` | all |
-| `autoApprove` | system | boolean | `false` | `access.systemAdmin` |
+| Key                  | Scope  | Type                     | Default   | Write access         |
+| -------------------- | ------ | ------------------------ | --------- | -------------------- |
+| `siteName`           | tenant | text                     | `My Site` | all                  |
+| `themeColor`         | tenant | text                     | `#000000` | all                  |
+| `maxUploadSize`      | tenant | number, bounds 1 to 1000 | `10`      | all                  |
+| `emailNotifications` | user   | boolean                  | `true`    | all                  |
+| `autoApprove`        | system | boolean                  | `false`   | `access.systemAdmin` |
 
 ### Seeds
 

package/samples/apps/config-demo/package.json

@@ -13,8 +13,8 @@
     "@cosmicdrift/kumiko-dev-server": "workspace:*",
     "@cosmicdrift/kumiko-renderer": "workspace:*",
     "@cosmicdrift/kumiko-framework": "workspace:*",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "@cosmicdrift/kumiko-locale-de": "workspace:*"
   }
 }

package/samples/apps/marketing-demo/README.md

@@ -2,8 +2,8 @@
 
 Sample app that produces marketing screenshots for
 [kumiko.rocks](https://kumiko.rocks). Two small internal tools (asset tracker
-+ helpdesk) on a single Kumiko instance — a DACH-persona proof that the
-same framework stack covers two tools without separate codebases.
+- helpdesk) on a single Kumiko instance — a DACH-persona proof that the
+  same framework stack covers two tools without separate codebases.
 
 **No auth** — like the showcase, in auto-mint-JWT mode. Straight to
 the edit/list screen without a login. To exercise auth paths, see

package/samples/apps/marketing-demo/package.json

@@ -14,8 +14,8 @@
     "@cosmicdrift/kumiko-renderer": "workspace:*",
     "@cosmicdrift/kumiko-framework": "workspace:*",
     "@cosmicdrift/kumiko-types": "workspace:*",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "@cosmicdrift/kumiko-locale-de": "workspace:*"
   }
 }

package/samples/apps/showcase/package.json

@@ -13,9 +13,9 @@
     "@cosmicdrift/kumiko-dev-server": "workspace:*",
     "@cosmicdrift/kumiko-renderer": "workspace:*",
     "@cosmicdrift/kumiko-framework": "workspace:*",
-    "lucide-react": "^1.14.0",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
+    "lucide-react": "^1.65.0",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "@cosmicdrift/kumiko-locale-de": "workspace:*"
   },
   "devDependencies": {

package/samples/apps/styleguide/package.json

@@ -5,8 +5,8 @@
     "@cosmicdrift/kumiko-dev-server": "workspace:*",
     "@cosmicdrift/kumiko-renderer": "workspace:*",
     "@cosmicdrift/kumiko-framework": "workspace:*",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "@cosmicdrift/kumiko-locale-de": "workspace:*"
   },
   "description": "Styleguide-Gallery: rendert die Auto-UI-Bausteine, Screenshot-Runner schießt sie in 3 Themes für die Doku",

package/samples/apps/ui-walkthrough/README.md

@@ -31,14 +31,14 @@ bun kumiko dev
 cd samples/apps/ui-walkthrough && bun dev   # http://localhost:4173, admin@kumiko.dev / kumiko-admin
 ```
 
-| Mask | Route |
-| --- | --- |
-| Liste | `/lease-list` (pager check: `/lease-list-short`, 3 rows) |
-| Detail | click "Max Nachmieter" (`/lease-detail/00000000-0000-4000-8000-000000003103`), tab "Positionen" |
-| Drawer | Positionen tab, button "Miete anpassen" |
-| Formular | `/vehicle-list`, click "Octavia" (`/vehicle-edit`) |
-| Wizard | `/vehicle-list`, row menu "Schritt für Schritt" (`/vehicle-wizard`), 3x "Weiter" for step 4 |
-| Mobile | `/campaign-list` at 390 px width |
+| Mask     | Route                                                                                           |
+| -------- | ----------------------------------------------------------------------------------------------- |
+| Liste    | `/lease-list` (pager check: `/lease-list-short`, 3 rows)                                        |
+| Detail   | click "Max Nachmieter" (`/lease-detail/00000000-0000-4000-8000-000000003103`), tab "Positionen" |
+| Drawer   | Positionen tab, button "Miete anpassen"                                                         |
+| Formular | `/vehicle-list`, click "Octavia" (`/vehicle-edit`)                                              |
+| Wizard   | `/vehicle-list`, row menu "Schritt für Schritt" (`/vehicle-wizard`), 3x "Weiter" for step 4     |
+| Mobile   | `/campaign-list` at 390 px width                                                                |
 
 Screenshots (light 1440x900, mobile 390x844, dark for liste and detail):
 
@@ -102,4 +102,3 @@ bun kumiko test e2e samples/apps/ui-walkthrough
 
 Six Playwright specs: smoke + create flow + update flow + 4 generated
 specs (from the registry-driven E2E generator).
-

package/samples/apps/ui-walkthrough/package.json

@@ -16,8 +16,8 @@
     "@cosmicdrift/kumiko-renderer-mail-html": "workspace:*",
     "@cosmicdrift/kumiko-renderer-puppeteer-client": "workspace:*",
     "@cosmicdrift/kumiko-server-runtime": "workspace:*",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "zod": "^4.6.7",
     "@cosmicdrift/kumiko-locale-de": "workspace:*",
     "@cosmicdrift/kumiko-locale-es": "workspace:*"

package/samples/apps/use-all-bundled/README.md

@@ -12,8 +12,8 @@ from any real app. This sample is the gate.
 
 The `use-all-bundled-smoke` job guards `release`. It boots the sample with `KUMIKO_DRY_RUN_ENV=boot` (no DB) so feature-wiring bugs surface before publish.
 
-| Job | What it catches |
-|---|---|
+| Job                     | What it catches                                                                                                                                                                  |
+| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `use-all-bundled-smoke` | feature-wiring bugs: `Object.entries(undefined)`, self-extension, missing-requires, schema-Validators, `composeFeatures` failures. **No DB**. Boot exits after `createRegistry`. |
 
 DB-backed boot (schema apply for every bundled feature against real Postgres + Redis, dispatcher round-trip) is gated by `src/__tests__/full-stack-boot.integration.test.ts` in the non-blocking `integration` CI-job. The prod-only paths (`assertSchemaCurrent`, `GET /health`) run in `packages/dev-server`'s `run-prod-app.integration.test.ts` — not against this sample's feature set.

package/samples/apps/use-all-bundled/package.json

@@ -25,8 +25,8 @@
     "@cosmicdrift/kumiko-renderer-puppeteer-client": "workspace:*",
     "@cosmicdrift/kumiko-server-runtime": "workspace:*",
     "@cosmicdrift/kumiko-types": "workspace:*",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "zod": "^4.6.7",
     "@cosmicdrift/kumiko-locale-de": "workspace:*",
     "@cosmicdrift/kumiko-locale-es": "workspace:*",

package/samples/apps/use-all-bundled/scripts/gen-sample-index.ts

@@ -232,6 +232,19 @@ function scanSamples(): Map<string, MutableFeatureRow> {
   return byFeature;
 }
 
+// The docs site builds sample pages from READMEs only; a primarySample without one
+// makes feature-reference link to a page that does not exist.
+export function assertPrimarySampleHasReadme(
+  feature: string,
+  slug: string,
+  readmeExists: boolean,
+): void {
+  if (readmeExists) return;
+  throw new Error(
+    `sample-index.overrides.json: feature "${feature}" has primarySample "${slug}" but ${slug}/README.md does not exist. Add a README.md to that sample (the docs site only generates sample pages from READMEs) or point primarySample at a sample that has one.`,
+  );
+}
+
 export function loadOverrides(): SampleIndexOverrides {
   if (!existsSync(OVERRIDES_PATH)) return {};
   return JSON.parse(readFileSync(OVERRIDES_PATH, "utf-8")) as SampleIndexOverrides;
@@ -257,7 +270,11 @@ export function buildSampleIndex(): SampleIndex {
     const primarySample = override?.primarySample ?? dedicated[0];
     let readmeSummary: string | undefined;
     if (primarySample) {
-      readmeSummary = extractReadmeSummary(join(sampleDirFromSlug(primarySample), "README.md"));
+      const readmePath = join(sampleDirFromSlug(primarySample), "README.md");
+      if (override?.primarySample) {
+        assertPrimarySampleHasReadme(name, primarySample, existsSync(readmePath));
+      }
+      readmeSummary = extractReadmeSummary(readmePath);
     }
 
     features[name] = {

package/samples/apps/user-data-rights-demo/README.md

@@ -14,12 +14,12 @@ the integration test top-to-bottom and you've understood the contract.
 A tiny todo app where each user has private todos. The demo proves that
 DSGVO requests work end-to-end:
 
-| Article | Endpoint / Runner | What it does |
-|---------|-----------|----------------|
-| **Art. 15** | `user-data-rights:query:my-audit-log` | User sees own framework events (auth, deletion-request, restriction). Domain entities like todos appear in the **export bundle** (Art. 20), not the audit-log — only handlers using `ctx.events.append` show up here. |
-| **Art. 15+20** | `user-data-rights:write:request-export` | ZIP with user-profile + fileRefs + todos + signed download magic-link |
-| **Art. 17** | `user-data-rights:write:request-deletion` | Soft-delete with grace period; cron anonymizes user + deletes todos |
-| **Art. 18** | `user-data-rights:write:restrict-account` | Auth-middleware blocks logins until lift-restriction |
+| Article        | Endpoint / Runner                         | What it does                                                                                                                                                                                                          |
+| -------------- | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Art. 15**    | `user-data-rights:query:my-audit-log`     | User sees own framework events (auth, deletion-request, restriction). Domain entities like todos appear in the **export bundle** (Art. 20), not the audit-log — only handlers using `ctx.events.append` show up here. |
+| **Art. 15+20** | `user-data-rights:write:request-export`   | ZIP with user-profile + fileRefs + todos + signed download magic-link                                                                                                                                                 |
+| **Art. 17**    | `user-data-rights:write:request-deletion` | Soft-delete with grace period; cron anonymizes user + deletes todos                                                                                                                                                   |
+| **Art. 18**    | `user-data-rights:write:restrict-account` | Auth-middleware blocks logins until lift-restriction                                                                                                                                                                  |
 
 ## Architecture in 3 layers
 
@@ -80,12 +80,12 @@ cd samples/apps/user-data-rights-demo
 bun dev             # → http://localhost:4291
 ```
 
-| Login | Value |
-|-------|------|
-| URL | `http://localhost:4291` |
-| Email | `admin@user-data-rights.local` |
-| Password | `changeme` |
-| Tenant | "User-Data-Rights Demo" |
+| Login    | Value                          |
+| -------- | ------------------------------ |
+| URL      | `http://localhost:4291`        |
+| Email    | `admin@user-data-rights.local` |
+| Password | `changeme`                     |
+| Tenant   | "User-Data-Rights Demo"        |
 
 In the browser, use the dispatcher to create a few todos, then call
 `user-data-rights:write:request-export` — the worker queues a job and

package/samples/apps/workspaces/package.json

@@ -11,8 +11,8 @@
     "@cosmicdrift/kumiko-dev-server": "workspace:*",
     "@cosmicdrift/kumiko-renderer": "workspace:*",
     "@cosmicdrift/kumiko-framework": "workspace:*",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "@cosmicdrift/kumiko-locale-de": "workspace:*"
   },
   "devDependencies": {

package/samples/recipes/apex-landing/README.md

@@ -10,9 +10,9 @@ spec also paints a product-board mock (`hero-app.png`), uses it in the hero
 
 `buildLandingPage`'s `head.schemaJson` combines `organizationSchema` +
 `webPageSchema` (from the `seo` feature) into one `@graph` block — Organization
-+ WebPage nodes in a single `<script type="application/ld+json">`, which
-`renderApexPage` already knows how to emit. This is the seam an app extends
-with `faqPageSchema` for an FAQ section, or its own custom schema.org type.
+- WebPage nodes in a single `<script type="application/ld+json">`, which
+  `renderApexPage` already knows how to emit. This is the seam an app extends
+  with `faqPageSchema` for an FAQ section, or its own custom schema.org type.
 
 ## Site discovery: sitemap.xml / llms.txt
 

package/samples/recipes/apex-landing/package.json

@@ -12,6 +12,6 @@
   },
   "devDependencies": {
     "@cosmicdrift/kumiko-testing": "workspace:*",
-    "@playwright/test": "^1.62.1"
+    "@playwright/test": "^1.64.1"
   }
 }

package/samples/recipes/apex-surface-auth/README.md

@@ -28,11 +28,15 @@ A typical app has two mounts sharing locale and primitives:
 
 ```tsx illustration
 import {
-  ForgotPasswordScreen, SignupScreen, createLoginRoute,
-  AuthShellProvider, emailPasswordClient,
+  ForgotPasswordScreen,
+  SignupScreen,
+  createLoginRoute,
+  AuthShellProvider,
+  emailPasswordClient,
 } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/web";
 import {
-  RequestAccountDeletionScreen, ConfirmAccountDeletionScreen,
+  RequestAccountDeletionScreen,
+  ConfirmAccountDeletionScreen,
 } from "@cosmicdrift/kumiko-bundled-features/user-data-rights/web";
 import { createPublicSurface } from "@cosmicdrift/kumiko-renderer/web";
 
@@ -43,7 +47,7 @@ import { createPublicSurface } from "@cosmicdrift/kumiko-renderer/web";
 const LoginRoute = createLoginRoute({ loginScreenProps: { signupHref: "/signup" } });
 
 createPublicSurface({
-  clientFeatures: [emailPasswordClient()],   // SessionProvider + i18n
+  clientFeatures: [emailPasswordClient()], // SessionProvider + i18n
   shell: ({ children }) => (
     <MarketingChrome>
       <AuthShellProvider shell={(card) => <div className="py-12 flex justify-center">{card}</div>}>
@@ -52,10 +56,10 @@ createPublicSurface({
     </MarketingChrome>
   ),
   routes: [
-    { path: "/login",           component: <LoginRoute /> },
-    { path: "/signup",          component: <SignupScreen loginHref="/login" /> },
+    { path: "/login", component: <LoginRoute /> },
+    { path: "/signup", component: <SignupScreen loginHref="/login" /> },
     { path: "/forgot-password", component: <ForgotPasswordScreen loginHref="/login" /> },
-    { path: "/delete-account",         component: <RequestAccountDeletionScreen /> },
+    { path: "/delete-account", component: <RequestAccountDeletionScreen /> },
     { path: "/delete-account/confirm", component: <ConfirmAccountDeletionScreen /> },
   ],
   fallback: <LoginRoute />,
@@ -90,8 +94,8 @@ runProdApp({
 
 GDPR Art. 17 applies when the user **cannot log in** (lockout). The flow is
 email-verified (magic link), not login-gated. The HMAC token carries `userId`
-+ expiry (no DB table); purpose `"deletion-request"` blocks replay on other
-token endpoints. Second confirm is idempotent (`user_not_in_active_state`).
+- expiry (no DB table); purpose `"deletion-request"` blocks replay on other
+  token endpoints. Second confirm is idempotent (`user_not_in_active_state`).
 
 ## Tests
 

package/samples/recipes/auth-mfa/README.md

@@ -22,9 +22,7 @@ const mfaFeature = createAuthMfaFeature({
   issuer: "Your App",
 });
 const sessionCallbacks = createSessionCallbacks({ db });
-bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(
-  sessionCallbacks.sessionRevokeAllOthers,
-);
+bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(sessionCallbacks.sessionRevokeAllOthers);
 
 const server = buildServer({
   registry: buildRegistry([
@@ -37,7 +35,7 @@ const server = buildServer({
     mfaFeature,
     // ... other features
   ]),
-  context: { db, /* ... */ },
+  context: { db /* ... */ },
   jwtSecret: process.env.JWT_SECRET,
   auth: {
     membershipQuery: "tenant:query:memberships",

package/samples/recipes/auth-mfa/package.json

@@ -6,10 +6,10 @@
     "@cosmicdrift/kumiko-bundled-features": "workspace:*",
     "@cosmicdrift/kumiko-framework": "workspace:*",
     "@cosmicdrift/kumiko-renderer": "workspace:*",
-    "react": "^19.2.6"
+    "react": "^19.3.1"
   },
   "devDependencies": {
     "@cosmicdrift/kumiko-testing": "workspace:*",
-    "@types/react": "^19.2.14"
+    "@types/react": "^19.3.0"
   }
 }

package/samples/recipes/boot-check/README.md

@@ -12,7 +12,7 @@ never mounted, and nothing caught it — until now.
   ctx exposing every mounted feature. Throw to fail the boot with a clear,
   feature-prefixed message.
 - **Conditional invariants `r.requires` can't express** — the check only
-  fails when *this* feature's own shape demands it (has a PII field), not
+  fails when _this_ feature's own shape demands it (has a PII field), not
   unconditionally. A plain `r.requires({ features: ["user-data-hook"] })` would fail even
   for a prompt-store variant with no PII fields at all.
 - **`validateBoot`** — the framework's boot-time validator, run directly
@@ -38,7 +38,7 @@ user-data-hook → companion feature the check requires when PII is present
 
 ## When to reach for it
 
-You're writing a feature whose validity depends on *another* feature being
+You're writing a feature whose validity depends on _another_ feature being
 mounted, but only under a condition your feature alone can evaluate (e.g.
 "only if I have PII fields", "only if I expose more than N screens"). If the
 requirement is unconditional, `r.requires`/`r.optionalRequires` is simpler