@cosmicdrift/kumiko-bundled-features 0.368.0 → 0.370.0

package/dist/channel-email/env.js

@@ -0,0 +1,27 @@
+import * as z from "zod";
+/** Env block `createSmtpTransportFromEnv` reads. All optional: without
+ *  `SMTP_HOST` no app-level transport is built and auth mail flows stay off. */
+export const smtpEnvSchema = z.object({
+    SMTP_HOST: z.string().min(1).optional().describe("SMTP host; unset disables app-level mail."),
+    SMTP_PORT: z
+        .string()
+        .regex(/^\d+$/, "must be a port number")
+        .optional()
+        .describe("SMTP port (default 587)."),
+    SMTP_SECURE: z
+        .enum(["true", "false"])
+        .optional()
+        .describe('Implicit TLS ("true") or STARTTLS/plain ("false", default).'),
+    SMTP_USER: z.string().min(1).optional().describe("SMTP auth user; auth needs SMTP_PASS too."),
+    SMTP_PASS: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("SMTP auth password.")
+        .meta({ kumiko: { pulumi: { secret: true } } }),
+    SMTP_FROM: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Sender address; the app's fallback sender applies when unset."),
+});

package/dist/channel-email/feature.d.ts

@@ -1,3 +1,14 @@
-import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type EmailChannelOptions } from "./email-channel.js";
-export declare function createChannelEmailFeature(options: EmailChannelOptions): FeatureDefinition;
+import { type EmailChannelOptions } from "./email-channel.ts";
+export declare function createChannelEmailFeature(options: EmailChannelOptions): import("@cosmicdrift/kumiko-framework/env").FeatureWithEnvSchema<import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+}, {
+    SMTP_HOST: import("zod").ZodOptional<import("zod").ZodString>;
+    SMTP_PORT: import("zod").ZodOptional<import("zod").ZodString>;
+    SMTP_SECURE: import("zod").ZodOptional<import("zod").ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>;
+    SMTP_USER: import("zod").ZodOptional<import("zod").ZodString>;
+    SMTP_PASS: import("zod").ZodOptional<import("zod").ZodString>;
+    SMTP_FROM: import("zod").ZodOptional<import("zod").ZodString>;
+}>;

package/dist/channel-email/feature.js

@@ -1,16 +1,19 @@
 import { DELIVERY_CHANNEL_EXTENSION, EMAIL_CHANNEL_NAME, } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import { createEmailChannel } from "./email-channel.js";
+import { smtpEnvSchema } from "./env.js";
 export function createChannelEmailFeature(options) {
     const channel = createEmailChannel(options);
-    return defineFeature("channel-email", (r) => {
-        r.describe("Wires an `EmailTransport` (typically `mail-transport-smtp` in production, `createInMemoryTransport()` in tests) into the delivery system as the `email` channel. Requires `delivery`; pass an `EmailChannelOptions` with a `transport` and a `resolveEmail` function that maps a user ID to their email address. Mails render from stored templates (`renderer-mail-html`): a notification routed to this channel needs `template` + `meta` on `r.notification`, otherwise its delivery fails. Pass `tenantTransport: tenantMailTransport` (from `mail-foundation`) to send each tenant's mail through its own configured provider: a broken provider fails the send, a tenant without one uses the app `transport`. Notifications declared with `unsubscribe: true` get a signed `data.unsubscribeUrl` from delivery, which turns into the `List-Unsubscribe` headers.");
+    const feature = defineFeature("channel-email", (r) => {
+        r.describe("Wires an `EmailTransport` (typically `mail-transport-smtp` in production, `createInMemoryTransport()` in tests) into the delivery system as the `email` channel. Requires `delivery`; pass an `EmailChannelOptions` with a `transport` and a `resolveEmail` function that maps a user ID to their email address. Mails render from stored templates (`renderer-mail-html`): a notification routed to this channel needs `template` + `meta` on `r.notification`, otherwise its delivery fails. Pass `tenantTransport: tenantMailTransport` (from `mail-foundation`) to send the notifications declared with `tenantTransport: true` through the sending tenant's own configured provider: a broken provider fails the send, a tenant without one uses the app `transport`; every other notification (password reset, sign-in) always goes through the app `transport`. `transport` may be left out when `tenantTransport` is set; a mail that then has no transport fails with `missing_credentials`. Notifications declared with `unsubscribe: true` get a signed `data.unsubscribeUrl` from delivery, which turns into the `List-Unsubscribe` headers.");
         r.uiHints({
             displayLabel: "Email Channel",
             category: "notifications",
             recommended: false,
         });
         r.requires({ features: ["delivery"] });
+        r.envSchema(smtpEnvSchema);
         r.translations({ keys: { "delivery.channel.email": { en: "Email" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, EMAIL_CHANNEL_NAME, {
             mode: channel.mode,
@@ -19,4 +22,5 @@ export function createChannelEmailFeature(options) {
             send: channel.send,
         });
     });
+    return featureWithEnvSchema(feature, smtpEnvSchema);
 }

package/dist/channel-email/index.d.ts

@@ -1,5 +1,6 @@
-export { createEmailChannel, type EmailChannelOptions } from "./email-channel.js";
-export { createChannelEmailFeature } from "./feature.js";
-export { guardEmailMessage, withPiiCiphertextGuard } from "./pii-guard.js";
-export { createSmtpTransport, createSmtpTransportFromEnv, type SmtpEnv, type SmtpTransportOptions, } from "./smtp-transport.js";
-export { createInMemoryTransport, type EmailAttachment, type EmailAttachmentRef, type EmailMessage, type EmailTransport, } from "./types.js";
+export { createEmailChannel, type EmailChannelOptions, type TenantTransportResolver, } from "./email-channel.ts";
+export { smtpEnvSchema } from "./env.ts";
+export { createChannelEmailFeature } from "./feature.ts";
+export { guardEmailMessage, withPiiCiphertextGuard } from "./pii-guard.ts";
+export { createSmtpTransport, createSmtpTransportFromEnv, type SmtpEnv, type SmtpTransportOptions, } from "./smtp-transport.ts";
+export { createInMemoryTransport, type EmailAttachment, type EmailAttachmentRef, type EmailMessage, type EmailTransport, } from "./types.ts";

package/dist/channel-email/index.js

@@ -1,4 +1,5 @@
-export { createEmailChannel } from "./email-channel.js";
+export { createEmailChannel, } from "./email-channel.js";
+export { smtpEnvSchema } from "./env.js";
 export { createChannelEmailFeature } from "./feature.js";
 export { guardEmailMessage, withPiiCiphertextGuard } from "./pii-guard.js";
 export { createSmtpTransport, createSmtpTransportFromEnv, } from "./smtp-transport.js";

package/dist/channel-email/pii-guard.d.ts

@@ -1,3 +1,3 @@
-import type { EmailMessage, EmailTransport } from "./types.js";
+import type { EmailMessage, EmailTransport } from "./types.ts";
 export declare function guardEmailMessage(message: EmailMessage): EmailMessage;
 export declare function withPiiCiphertextGuard(transport: EmailTransport): EmailTransport;

package/dist/channel-email/smtp-transport.d.ts

@@ -1,4 +1,4 @@
-import type { EmailTransport } from "./types.js";
+import type { EmailTransport } from "./types.ts";
 export type SmtpTransportOptions = {
     /** SMTP-Server-Host (z.B. "smtp.gmail.com", "in-v3.mailjet.com",
      *  "localhost" für Mailhog/MailCatcher in dev). */

package/dist/channel-email/types.d.ts

@@ -1,4 +1,4 @@
-import type { EmailAttachmentRef, FileAttachmentRef, InlineAttachmentRef, RenderedPdfAttachmentRef } from "../delivery/index.js";
+import type { EmailAttachmentRef, FileAttachmentRef, InlineAttachmentRef, RenderedPdfAttachmentRef } from "../delivery/index.ts";
 export type { EmailAttachmentRef };
 export type EmailAttachment = (InlineAttachmentRef | FileAttachmentRef | Pick<RenderedPdfAttachmentRef, "kind" | "templateSlug">) & {
     readonly content: Uint8Array;

package/dist/channel-in-app/in-app-channel.d.ts

@@ -1,2 +1,2 @@
-import type { DeliveryChannel } from "../delivery/index.js";
+import type { DeliveryChannel } from "../delivery/index.ts";
 export declare const inAppChannel: DeliveryChannel;

package/dist/channel-in-app/index.d.ts

@@ -1,4 +1,4 @@
-export { CHANNEL_IN_APP_FEATURE, InAppHandlers, InAppQueries } from "./constants.js";
-export { createChannelInAppFeature } from "./feature.js";
-export { inAppChannel } from "./in-app-channel.js";
-export { inAppMessagesTable } from "./tables.js";
+export { CHANNEL_IN_APP_FEATURE, InAppHandlers, InAppQueries } from "./constants.ts";
+export { createChannelInAppFeature } from "./feature.ts";
+export { inAppChannel } from "./in-app-channel.ts";
+export { inAppMessagesTable } from "./tables.ts";

package/dist/channel-push/feature.d.ts

@@ -1,3 +1,3 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type PushChannelOptions } from "./push-channel.js";
+import { type PushChannelOptions } from "./push-channel.ts";
 export declare function createChannelPushFeature(options: PushChannelOptions): FeatureDefinition;

package/dist/channel-push/index.d.ts

@@ -1,3 +1,3 @@
-export { createChannelPushFeature } from "./feature.js";
-export { createPushChannel, type PushChannelOptions } from "./push-channel.js";
-export { createInMemoryPushTransport, type PushMessage, type PushTransport } from "./types.js";
+export { createChannelPushFeature } from "./feature.ts";
+export { createPushChannel, type PushChannelOptions } from "./push-channel.ts";
+export { createInMemoryPushTransport, type PushMessage, type PushTransport } from "./types.ts";

package/dist/channel-push/push-channel.d.ts

@@ -1,6 +1,6 @@
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { DeliveryChannel } from "../delivery/index.js";
-import type { PushTransport } from "./types.js";
+import type { DeliveryChannel } from "../delivery/index.ts";
+import type { PushTransport } from "./types.ts";
 export type PushChannelOptions = {
     readonly transport: PushTransport;
     readonly resolveToken: (userId: string, ctx: {

package/dist/channel-slack/feature.d.ts

@@ -1,3 +1,3 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type SlackChannelOptions } from "./slack-channel.js";
+import { type SlackChannelOptions } from "./slack-channel.ts";
 export declare function createChannelSlackFeature(options?: SlackChannelOptions): FeatureDefinition;

package/dist/channel-slack/index.d.ts

@@ -1,2 +1,2 @@
-export { createChannelSlackFeature } from "./feature.js";
-export { createSlackChannel, SLACK_DEFAULT_ALLOWED_HOSTS, SLACK_SECRET_KEYS, type SlackChannelOptions, } from "./slack-channel.js";
+export { createChannelSlackFeature } from "./feature.ts";
+export { createSlackChannel, SLACK_DEFAULT_ALLOWED_HOSTS, SLACK_SECRET_KEYS, type SlackChannelOptions, } from "./slack-channel.ts";

package/dist/channel-slack/slack-channel.d.ts

@@ -1,4 +1,4 @@
-import { type ChatWebhookChannelOptions, type DeliveryChannel } from "../delivery/index.js";
+import { type ChatWebhookChannelOptions, type DeliveryChannel } from "../delivery/index.ts";
 export type SlackChannelOptions = ChatWebhookChannelOptions;
 export declare const SLACK_SECRET_KEYS: {
     readonly webhookPrefix: "channel-slack:webhooks.";

package/dist/channel-teams/feature.d.ts

@@ -1,3 +1,3 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type TeamsChannelOptions } from "./teams-channel.js";
+import { type TeamsChannelOptions } from "./teams-channel.ts";
 export declare function createChannelTeamsFeature(options?: TeamsChannelOptions): FeatureDefinition;

package/dist/channel-teams/index.d.ts

@@ -1,2 +1,2 @@
-export { createChannelTeamsFeature } from "./feature.js";
-export { createTeamsChannel, TEAMS_DEFAULT_ALLOWED_HOSTS, TEAMS_SECRET_KEYS, type TeamsChannelOptions, } from "./teams-channel.js";
+export { createChannelTeamsFeature } from "./feature.ts";
+export { createTeamsChannel, TEAMS_DEFAULT_ALLOWED_HOSTS, TEAMS_SECRET_KEYS, type TeamsChannelOptions, } from "./teams-channel.ts";

package/dist/channel-teams/teams-channel.d.ts

@@ -1,4 +1,4 @@
-import { type ChatSendResult, type ChatWebhookChannelOptions, type ChatWebhookResponse, type DeliveryChannel } from "../delivery/index.js";
+import { type ChatSendResult, type ChatWebhookChannelOptions, type ChatWebhookResponse, type DeliveryChannel } from "../delivery/index.ts";
 export type TeamsChannelOptions = ChatWebhookChannelOptions;
 export declare const TEAMS_SECRET_KEYS: {
     readonly webhookPrefix: "channel-teams:webhooks.";

package/dist/channel-telegram/feature.d.ts

@@ -1,3 +1,3 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type TelegramChannelOptions } from "./telegram-channel.js";
+import { type TelegramChannelOptions } from "./telegram-channel.ts";
 export declare function createChannelTelegramFeature(options?: TelegramChannelOptions): FeatureDefinition;

package/dist/channel-telegram/index.d.ts

@@ -1,2 +1,2 @@
-export { createChannelTelegramFeature } from "./feature.js";
-export { createTelegramChannel, isTelegramBotToken, isTelegramChatId, TELEGRAM_DEFAULT_API_BASE_URL, TELEGRAM_SECRET_KEYS, type TelegramChannelOptions, } from "./telegram-channel.js";
+export { createChannelTelegramFeature } from "./feature.ts";
+export { createTelegramChannel, isTelegramBotToken, isTelegramChatId, TELEGRAM_DEFAULT_API_BASE_URL, TELEGRAM_SECRET_KEYS, type TelegramChannelOptions, } from "./telegram-channel.ts";

package/dist/channel-telegram/telegram-channel.d.ts

@@ -1,4 +1,4 @@
-import { type DeliveryChannel } from "../delivery/index.js";
+import { type DeliveryChannel } from "../delivery/index.ts";
 export type TelegramChannelOptions = {
     readonly apiBaseUrl?: string;
     readonly allowedHosts?: readonly string[];

package/dist/compliance-profiles/feature.d.ts

@@ -1,5 +1,5 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-export { tenantComplianceProfileEntity, tenantComplianceProfileTable, } from "./schema/profile-selection.js";
+export { tenantComplianceProfileEntity, tenantComplianceProfileTable, } from "./schema/profile-selection.ts";
 export type ComplianceProfilesFeatureOptions = {
     readonly access?: readonly string[];
 };

package/dist/compliance-profiles/index.d.ts

@@ -1,3 +1,3 @@
-export { COMPLIANCE_PROFILE_SCREEN_ID, COMPLIANCE_PROFILES_FEATURE, ComplianceProfileHandlers, ComplianceProfileQueries, } from "./constants.js";
-export { type ComplianceProfilesFeatureOptions, createComplianceProfilesFeature, tenantComplianceProfileEntity, tenantComplianceProfileTable, } from "./feature.js";
-export { resolveProfileForTenant } from "./resolve-for-tenant.js";
+export { COMPLIANCE_PROFILE_SCREEN_ID, COMPLIANCE_PROFILES_FEATURE, ComplianceProfileHandlers, ComplianceProfileQueries, } from "./constants.ts";
+export { type ComplianceProfilesFeatureOptions, createComplianceProfilesFeature, tenantComplianceProfileEntity, tenantComplianceProfileTable, } from "./feature.ts";
+export { resolveProfileForTenant } from "./resolve-for-tenant.ts";

package/dist/compliance-profiles/web/index.d.ts

@@ -1,2 +1,2 @@
-export { type ComplianceProfilesClientOptions, complianceProfilesClient, } from "./client-plugin.js";
-export { ComplianceProfileCatalog } from "./compliance-profile-catalog.js";
+export { type ComplianceProfilesClientOptions, complianceProfilesClient, } from "./client-plugin.tsx";
+export { ComplianceProfileCatalog } from "./compliance-profile-catalog.tsx";

package/dist/compliance-profiles-ops/index.d.ts

@@ -5,11 +5,3 @@ export declare function createComplianceProfilesOpsFeature(): import("@cosmicdri
         };
     };
 };
-/** @deprecated Use createComplianceProfilesOpsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const complianceProfilesOpsFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: {
-        queries: {
-            tenantsMissingProfile: import("@cosmicdrift/kumiko-types/handlers").HandlerRef;
-        };
-    };
-};

package/dist/compliance-profiles-ops/index.js

@@ -28,5 +28,3 @@ export function createComplianceProfilesOpsFeature() {
         return { queries };
     }, { dedupeOptions: {} });
 }
-/** @deprecated Use createComplianceProfilesOpsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const complianceProfilesOpsFeature = createComplianceProfilesOpsFeature();

package/dist/config/feature.d.ts

@@ -1,7 +1,7 @@
 import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { type ConfigAccessor, type ConfigAccessorFactory, type ConfigSecretsReader, type FeatureDefinition, type HandlerContext, type Registry, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
-import type { ConfigResolver } from "./resolver.js";
+import type { ConfigResolver } from "./resolver.ts";
 export type ConfigContext = {
     readonly config: ConfigAccessor;
 };

package/dist/config/handlers/reencrypt.job.d.ts

@@ -1,5 +1,5 @@
 import { type JobHandlerFn } from "@cosmicdrift/kumiko-framework/engine";
-import { type ChunkedMigrationStopReason } from "../../shared/index.js";
+import { type ChunkedMigrationStopReason } from "../../shared/index.ts";
 export type ReencryptJobPayload = {
     readonly maxDurationMs?: number;
     readonly maxFailures?: number;

package/dist/config/index.d.ts

@@ -1,14 +1,14 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
 import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
-export { CONFIG_FEATURE, ConfigErrors, ConfigHandlers, ConfigQueries, } from "./constants.js";
-export type { ConfigContext } from "./feature.js";
-export { createConfigAccessor, createConfigAccessorFactory, createConfigFeature, } from "./feature.js";
-export type { ReadinessMissingKey, RequiredKeyGate } from "./handlers/readiness.query.js";
-export { buildProviderSelectionGate, collectMissingRequiredConfig, } from "./handlers/readiness.query.js";
-export type { AppConfigOverrides, ConfigResolver } from "./resolver.js";
-export { buildEnvConfigOverrides, createConfigResolver, validateAppOverrides } from "./resolver.js";
-export { configValueEntity, configValuesTable } from "./table.js";
+export { CONFIG_FEATURE, ConfigErrors, ConfigHandlers, ConfigQueries, } from "./constants.ts";
+export type { ConfigContext } from "./feature.ts";
+export { createConfigAccessor, createConfigAccessorFactory, createConfigFeature, } from "./feature.ts";
+export type { ReadinessMissingKey, RequiredKeyGate } from "./handlers/readiness.query.ts";
+export { buildProviderSelectionGate, collectMissingRequiredConfig, } from "./handlers/readiness.query.ts";
+export type { AppConfigOverrides, ConfigResolver } from "./resolver.ts";
+export { buildEnvConfigOverrides, createConfigResolver, validateAppOverrides } from "./resolver.ts";
+export { configValueEntity, configValuesTable } from "./table.ts";
 export declare function seedAllConfigValues(registry: Registry, db: DbConnection, cipher?: EnvelopeCipher): Promise<{
     created: number;
     skipped: number;

package/dist/config/web/client-plugin.d.ts

@@ -1,5 +1,5 @@
 import { type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-import { CONFIG_FEATURE } from "../constants.js";
+import { CONFIG_FEATURE } from "../constants.ts";
 export type ConfigClientOptions = {
     /** Key-wise overrides over the default bundles (de/en). */
     readonly translations?: TranslationsByLocale;

package/dist/config/web/i18n.js

@@ -27,9 +27,8 @@ export const defaultTranslations = {
         "config.errors.invalidScope": "This scope is not allowed for this key.",
         "config.errors.unknownKey": "Unknown configuration key.",
         "config.errors.unknownExtensionPlugin": "This provider is not available.",
-        "config.settings.extensionSelectorHint": "Choose a provider and save. Its settings appear below.",
+        "config.settings.extensionSelectorHint": "Choose a provider. Its settings appear below and are saved together with it.",
         "config.settings.provider": "Provider",
-        "config.settings.saveProvider": "Save provider",
         "config.settings.audience.system": "Applies to every tenant unless a tenant sets its own value.",
         "config.settings.audience.tenant": "Applies to everyone in this tenant. Platform defaults are shown where nothing is set here.",
         "config.settings.audience.user": "Only applies to you.",

package/dist/config/web/index.d.ts

@@ -1,2 +1,2 @@
-export { type ConfigClientFeature, type ConfigClientOptions, configClient, } from "./client-plugin.js";
-export { defaultTranslations } from "./i18n.js";
+export { type ConfigClientFeature, type ConfigClientOptions, configClient, } from "./client-plugin.ts";
+export { defaultTranslations } from "./i18n.ts";

package/dist/crypto-shredding/env/index.d.ts

@@ -0,0 +1,21 @@
+import * as z from "zod";
+/** Env block of the subject-key KMS: the platform KEK (and its rotation
+ *  predecessor), the blind-index key, the DEK store, and the Key Manager
+ *  coordinates for slots delivered as `<NAME>_CIPHERTEXT`. Every field is
+ *  optional here; an app that requires crypto-shredding in production enforces
+ *  the all-or-none set in its own boot wiring. */
+export declare const kmsEnvSchema: z.ZodObject<{
+    PLATFORM_KEK: z.ZodOptional<z.ZodString>;
+    SUBJECT_KEYS_DATABASE_URL: z.ZodOptional<z.ZodString>;
+    KUMIKO_BLIND_INDEX_KEY: z.ZodOptional<z.ZodString>;
+    PLATFORM_KEK_VERSION: z.ZodOptional<z.ZodString>;
+    PLATFORM_KEK_PREVIOUS: z.ZodOptional<z.ZodString>;
+    PLATFORM_KEK_PREVIOUS_VERSION: z.ZodOptional<z.ZodString>;
+    PLATFORM_KEK_CIPHERTEXT: z.ZodOptional<z.ZodString>;
+    PLATFORM_KEK_PREVIOUS_CIPHERTEXT: z.ZodOptional<z.ZodString>;
+    KUMIKO_BLIND_INDEX_KEY_CIPHERTEXT: z.ZodOptional<z.ZodString>;
+    KUMIKO_SECRETS_MASTER_KEY_V1_CIPHERTEXT: z.ZodOptional<z.ZodString>;
+    PLATFORM_KEK_KMS_KEY_ID: z.ZodOptional<z.ZodString>;
+    PLATFORM_KEK_KMS_TOKEN: z.ZodOptional<z.ZodString>;
+    PLATFORM_KEK_KMS_REGION: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;

package/dist/crypto-shredding/env/index.js

@@ -0,0 +1,78 @@
+import * as z from "zod";
+const GENERATED_KEY = { generator: "openssl rand -base64 32", secret: true };
+/** Env block of the subject-key KMS: the platform KEK (and its rotation
+ *  predecessor), the blind-index key, the DEK store, and the Key Manager
+ *  coordinates for slots delivered as `<NAME>_CIPHERTEXT`. Every field is
+ *  optional here; an app that requires crypto-shredding in production enforces
+ *  the all-or-none set in its own boot wiring. */
+export const kmsEnvSchema = z.object({
+    PLATFORM_KEK: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("KEK (base64, 32 bytes) that wraps the subject DEKs in the subject-keys store. Losing it makes every encrypted PII field unreadable.")
+        .meta({ kumiko: { kms: true, pulumi: GENERATED_KEY } }),
+    SUBJECT_KEYS_DATABASE_URL: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Connection URL of the subject-keys database (DEK store). Comes from the database secret, never from Pulumi config."),
+    KUMIKO_BLIND_INDEX_KEY: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("HMAC key (base64, 32 bytes) for blind-index columns, the equality lookups on encrypted fields. Kept separate from the KEK.")
+        .meta({ kumiko: { kms: true, pulumi: GENERATED_KEY } }),
+    PLATFORM_KEK_VERSION: z
+        .string()
+        .regex(/^\d+$/, "must be a generation number")
+        .optional()
+        .describe("Active KEK generation (default 1)."),
+    PLATFORM_KEK_PREVIOUS: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("KEK of the previous generation (base64), set only during a rotation.")
+        .meta({ kumiko: { kms: true } }),
+    PLATFORM_KEK_PREVIOUS_VERSION: z
+        .string()
+        .regex(/^\d+$/, "must be a generation number")
+        .optional()
+        .describe("Generation number of the previous KEK."),
+    PLATFORM_KEK_CIPHERTEXT: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Key Manager ciphertext of PLATFORM_KEK, used when PLATFORM_KEK is unset. Not a Pulumi secret: it is useless without the Key Manager key."),
+    PLATFORM_KEK_PREVIOUS_CIPHERTEXT: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Key Manager ciphertext of PLATFORM_KEK_PREVIOUS, rotation only."),
+    KUMIKO_BLIND_INDEX_KEY_CIPHERTEXT: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Key Manager ciphertext of KUMIKO_BLIND_INDEX_KEY, wrapped by the same key as the KEK."),
+    KUMIKO_SECRETS_MASTER_KEY_V1_CIPHERTEXT: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Key Manager ciphertext of KUMIKO_SECRETS_MASTER_KEY_V1, wrapped by the same key as the KEK."),
+    PLATFORM_KEK_KMS_KEY_ID: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Scaleway Key Manager key id the ciphertexts were wrapped with."),
+    PLATFORM_KEK_KMS_TOKEN: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Scaleway API secret key for the decrypt call. Scope it to KeyManagerKeyDecrypt; a broader key trades the KEK for infrastructure access.")
+        .meta({ kumiko: { pulumi: { secret: true } } }),
+    PLATFORM_KEK_KMS_REGION: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Key Manager region. Default fr-par."),
+});

package/dist/crypto-shredding/feature.d.ts

@@ -1,2 +1,17 @@
-import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-export declare function createCryptoShreddingFeature(): FeatureDefinition;
+export declare function createCryptoShreddingFeature(): import("@cosmicdrift/kumiko-framework/env").FeatureWithEnvSchema<import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+}, {
+    PLATFORM_KEK: import("zod").ZodOptional<import("zod").ZodString>;
+    SUBJECT_KEYS_DATABASE_URL: import("zod").ZodOptional<import("zod").ZodString>;
+    KUMIKO_BLIND_INDEX_KEY: import("zod").ZodOptional<import("zod").ZodString>;
+    PLATFORM_KEK_VERSION: import("zod").ZodOptional<import("zod").ZodString>;
+    PLATFORM_KEK_PREVIOUS: import("zod").ZodOptional<import("zod").ZodString>;
+    PLATFORM_KEK_PREVIOUS_VERSION: import("zod").ZodOptional<import("zod").ZodString>;
+    PLATFORM_KEK_CIPHERTEXT: import("zod").ZodOptional<import("zod").ZodString>;
+    PLATFORM_KEK_PREVIOUS_CIPHERTEXT: import("zod").ZodOptional<import("zod").ZodString>;
+    KUMIKO_BLIND_INDEX_KEY_CIPHERTEXT: import("zod").ZodOptional<import("zod").ZodString>;
+    KUMIKO_SECRETS_MASTER_KEY_V1_CIPHERTEXT: import("zod").ZodOptional<import("zod").ZodString>;
+    PLATFORM_KEK_KMS_KEY_ID: import("zod").ZodOptional<import("zod").ZodString>;
+    PLATFORM_KEK_KMS_TOKEN: import("zod").ZodOptional<import("zod").ZodString>;
+    PLATFORM_KEK_KMS_REGION: import("zod").ZodOptional<import("zod").ZodString>;
+}>;

package/dist/crypto-shredding/feature.js

@@ -1,13 +1,16 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import { CRYPTO_SHREDDING_FEATURE_NAME } from "./constants.js";
+import { kmsEnvSchema } from "./env/index.js";
 import { forgetSubjectWrite, subjectForgetDeniedSchema, subjectForgottenSchema, } from "./handlers/forget-subject.write.js";
 export function createCryptoShreddingFeature() {
-    return defineFeature(CRYPTO_SHREDDING_FEATURE_NAME, (r) => {
+    const feature = defineFeature(CRYPTO_SHREDDING_FEATURE_NAME, (r) => {
         r.describe("Operator-level crypto-shredding trigger. `forget-subject` erases a user or tenant subject key in the configured KMS adapter, making every PII field encrypted under it permanently unreadable (reads render the `[[erased]]` sentinel), and appends a `subject-forgotten` audit event. Requires a KMS adapter (`runProdApp({ kms })`). The automated Art.-17 deletion pipeline in `user-data-rights` erases keys itself; this command covers manual forgets (authority requests, operator recovery, tenant destroy).");
         r.uiHints({
             displayLabel: "Crypto-Shredding",
             category: "compliance",
         });
+        r.envSchema(kmsEnvSchema);
         // `reason` is operator free text and may name the subject, yet stays plaintext: the forget
         // erases the subject key before the audit append, so a forget of the actor's own tenant
         // would fail to seal the reason under that tenant's key.
@@ -15,4 +18,5 @@ export function createCryptoShreddingFeature() {
         r.defineEvent("forget-denied", subjectForgetDeniedSchema, { piiFields: "none" });
         r.writeHandler(forgetSubjectWrite);
     }, { dedupeOptions: {} });
+    return featureWithEnvSchema(feature, kmsEnvSchema);
 }

package/dist/crypto-shredding/index.d.ts

@@ -1,3 +1,4 @@
-export { CRYPTO_SHREDDING_AGGREGATE_TYPE, CRYPTO_SHREDDING_FEATURE_NAME, SUBJECT_FORGET_DENIED_EVENT_NAME, SUBJECT_FORGOTTEN_EVENT_NAME, } from "./constants.js";
-export { createCryptoShreddingFeature } from "./feature.js";
-export { forgetSubjectSchema, subjectForgetDeniedSchema, subjectForgottenSchema, subjectIdSchema, } from "./handlers/forget-subject.write.js";
+export { CRYPTO_SHREDDING_AGGREGATE_TYPE, CRYPTO_SHREDDING_FEATURE_NAME, SUBJECT_FORGET_DENIED_EVENT_NAME, SUBJECT_FORGOTTEN_EVENT_NAME, } from "./constants.ts";
+export { kmsEnvSchema } from "./env/index.ts";
+export { createCryptoShreddingFeature } from "./feature.ts";
+export { forgetSubjectSchema, subjectForgetDeniedSchema, subjectForgottenSchema, subjectIdSchema, } from "./handlers/forget-subject.write.ts";

package/dist/crypto-shredding/index.js

@@ -1,3 +1,4 @@
 export { CRYPTO_SHREDDING_AGGREGATE_TYPE, CRYPTO_SHREDDING_FEATURE_NAME, SUBJECT_FORGET_DENIED_EVENT_NAME, SUBJECT_FORGOTTEN_EVENT_NAME, } from "./constants.js";
+export { kmsEnvSchema } from "./env/index.js";
 export { createCryptoShreddingFeature } from "./feature.js";
 export { forgetSubjectSchema, subjectForgetDeniedSchema, subjectForgottenSchema, subjectIdSchema, } from "./handlers/forget-subject.write.js";

package/dist/custom-fields/feature.d.ts

@@ -45,21 +45,4 @@ export type CustomFieldsFeatureOptions = {
 };
 export declare function resolveFieldDefinitionListRoles(opts: Pick<CustomFieldsFeatureOptions, "valueWriteRoles" | "fieldDefinitionListRoles" | "fieldDefinitionWriteRoles">): readonly string[];
 export declare function createCustomFieldsFeature(opts?: CustomFieldsFeatureOptions): typeof defaultCustomFieldsFeature;
-/** @deprecated Use createCustomFieldsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const customFieldsFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: {
-        setEvent: import("@cosmicdrift/kumiko-types/handlers").EventDef<{
-            fieldKey: string;
-            value?: unknown;
-        }, "custom-fields:event:custom-field-set">;
-        clearedEvent: import("@cosmicdrift/kumiko-types/handlers").EventDef<{
-            fieldKey: string;
-        }, "custom-fields:event:custom-field-cleared">;
-        fieldDefinitionDeletedEvent: import("@cosmicdrift/kumiko-types/handlers").EventDef<{
-            entityName: string;
-            fieldKey: string;
-            tenantId?: string | undefined;
-        }, "custom-fields:event:field-definition-deleted">;
-    };
-};
 export {};

package/dist/custom-fields/feature.js

@@ -173,5 +173,3 @@ export function createCustomFieldsFeature(opts = {}) {
         fieldDefinitionListRoles: resolveFieldDefinitionListRoles(opts),
     }));
 }
-/** @deprecated Use createCustomFieldsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const customFieldsFeature = createCustomFieldsFeature();

package/dist/custom-fields/index.d.ts

@@ -1,10 +1,10 @@
-export { fieldDefinitionAggregateId } from "./aggregate-id.js";
-export { CUSTOM_FIELDS_EXTENSION, CUSTOM_FIELDS_FEATURE_NAME, FIELD_DEFINITION_CREATED_EVENT, FIELD_DEFINITION_UPDATED_EVENT, SUPPORTED_FIELD_TYPES, type SupportedFieldType, } from "./constants.js";
-export { fieldDefinitionEntity } from "./entity.js";
-export { type CustomFieldClearedPayload, type CustomFieldSetPayload, customFieldClearedSchema, customFieldSetSchema, } from "./events.js";
-export { type CustomFieldsFeatureOptions, createCustomFieldsFeature, customFieldsFeature, } from "./feature.js";
-export { type ClearCustomFieldPayload, clearCustomFieldPayloadSchema, } from "./handlers/clear-custom-field.write.js";
-export { type SetCustomFieldPayload, setCustomFieldPayloadSchema, } from "./handlers/set-custom-field.write.js";
-export { isFieldDefinitionRow, parseSerializedField, } from "./lib/parse-serialized-field.js";
-export { type DefineFieldPayload, type DeleteFieldPayload, defineFieldPayloadSchema, deleteFieldPayloadSchema, } from "./schemas.js";
-export { customFieldsField, wireCustomFieldsFor } from "./wire-for-entity.js";
+export { fieldDefinitionAggregateId } from "./aggregate-id.ts";
+export { CUSTOM_FIELDS_EXTENSION, CUSTOM_FIELDS_FEATURE_NAME, FIELD_DEFINITION_CREATED_EVENT, FIELD_DEFINITION_UPDATED_EVENT, SUPPORTED_FIELD_TYPES, type SupportedFieldType, } from "./constants.ts";
+export { fieldDefinitionEntity } from "./entity.ts";
+export { type CustomFieldClearedPayload, type CustomFieldSetPayload, customFieldClearedSchema, customFieldSetSchema, } from "./events.ts";
+export { type CustomFieldsFeatureOptions, createCustomFieldsFeature, } from "./feature.ts";
+export { type ClearCustomFieldPayload, clearCustomFieldPayloadSchema, } from "./handlers/clear-custom-field.write.ts";
+export { type SetCustomFieldPayload, setCustomFieldPayloadSchema, } from "./handlers/set-custom-field.write.ts";
+export { isFieldDefinitionRow, parseSerializedField, } from "./lib/parse-serialized-field.ts";
+export { type DefineFieldPayload, type DeleteFieldPayload, defineFieldPayloadSchema, deleteFieldPayloadSchema, } from "./schemas.ts";
+export { customFieldsField, wireCustomFieldsFor } from "./wire-for-entity.ts";

package/dist/custom-fields/index.js

@@ -2,7 +2,7 @@ export { fieldDefinitionAggregateId } from "./aggregate-id.js";
 export { CUSTOM_FIELDS_EXTENSION, CUSTOM_FIELDS_FEATURE_NAME, FIELD_DEFINITION_CREATED_EVENT, FIELD_DEFINITION_UPDATED_EVENT, SUPPORTED_FIELD_TYPES, } from "./constants.js";
 export { fieldDefinitionEntity } from "./entity.js";
 export { customFieldClearedSchema, customFieldSetSchema, } from "./events.js";
-export { createCustomFieldsFeature, customFieldsFeature, } from "./feature.js";
+export { createCustomFieldsFeature, } from "./feature.js";
 export { clearCustomFieldPayloadSchema, } from "./handlers/clear-custom-field.write.js";
 export { setCustomFieldPayloadSchema, } from "./handlers/set-custom-field.write.js";
 export { isFieldDefinitionRow, parseSerializedField, } from "./lib/parse-serialized-field.js";

package/dist/custom-fields/lib/define-or-resurrect.d.ts

@@ -1,6 +1,6 @@
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { fieldDefinitionExecutor } from "../executor.js";
-import type { FieldDefinitionColumns } from "./field-definition-row.js";
+import { fieldDefinitionExecutor } from "../executor.ts";
+import type { FieldDefinitionColumns } from "./field-definition-row.ts";
 type DefineUser = Parameters<typeof fieldDefinitionExecutor.create>[1];
 type DefineDb = Parameters<typeof fieldDefinitionExecutor.create>[2];
 type WriteResult = Awaited<ReturnType<typeof fieldDefinitionExecutor.create>>;

package/dist/custom-fields/lib/field-access.d.ts

@@ -1,6 +1,6 @@
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { type SerializedFieldShape } from "./parse-serialized-field.js";
+import { type SerializedFieldShape } from "./parse-serialized-field.ts";
 export type FieldAccessCheckResult = {
     ok: true;
 } | {

package/dist/custom-fields/lib/field-definition-row.d.ts

@@ -1,4 +1,4 @@
-import type { DefineFieldPayload } from "../schemas.js";
+import type { DefineFieldPayload } from "../schemas.ts";
 export interface FieldDefinitionColumns {
     readonly entityName: string;
     readonly fieldKey: string;

package/dist/custom-fields/lib/quota.d.ts

@@ -1 +1 @@
-export { countTenantFieldDefinitions } from "../db/queries/quota.js";
+export { countTenantFieldDefinitions } from "../db/queries/quota.ts";