@cosmicdrift/kumiko-bundled-features 0.369.0 → 0.370.0

package/dist/personal-access-tokens/screens.d.ts

@@ -1,5 +1,5 @@
 import { type ProjectionListScreenDefinition, type SecretMintScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import type { PatScopeConfig } from "./scopes.js";
+import type { PatScopeConfig } from "./scopes.ts";
 export declare const patListScreen: ProjectionListScreenDefinition;
 export declare function patGrantOptions(scopes: PatScopeConfig): string[];
 export declare function createPatMintScreen(scopes: PatScopeConfig): SecretMintScreenDefinition;

package/dist/presets/dsgvo-self-service.d.ts

@@ -1,8 +1,10 @@
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type UserDataRightsOptions } from "../user-data-rights/index.js";
+import { type UserDataRightsOptions } from "../user-data-rights/index.ts";
 export type DsgvoSelfServiceOptions = {
     /** Passed through to createUserDataRightsFeature — export/deletion mail
      *  callbacks + Apex deletion HMAC. Default {} (no-op mail side). */
     readonly userDataRights?: UserDataRightsOptions;
 };
+/** @deprecated Removed in the next release. Use `composeGdprStack({ selfService: { userDataRights } })`
+ *  from `@cosmicdrift/kumiko-dev-server/compose-stacks`. */
 export declare function dsgvoSelfServiceFeatures(opts?: DsgvoSelfServiceOptions): FeatureDefinition[];

package/dist/presets/dsgvo-self-service.js

@@ -11,6 +11,8 @@ import { createUserProfileFeature } from "../user-profile/index.js";
 // comment. text-content + legal-pages stay out deliberately — legal-pages
 // has an app-specific wrapLayout, text-content is a standalone foundation;
 // both are spread in by the app itself.
+/** @deprecated Removed in the next release. Use `composeGdprStack({ selfService: { userDataRights } })`
+ *  from `@cosmicdrift/kumiko-dev-server/compose-stacks`. */
 export function dsgvoSelfServiceFeatures(opts = {}) {
     return [
         createDataRetentionFeature(),

package/dist/presets/index.d.ts

@@ -1,2 +1,2 @@
-export { type DsgvoSelfServiceOptions, dsgvoSelfServiceFeatures } from "./dsgvo-self-service.js";
-export { type SecurityBaselineOptions, securityBaselineFeatures } from "./security-baseline.js";
+export { type DsgvoSelfServiceOptions, dsgvoSelfServiceFeatures } from "./dsgvo-self-service.ts";
+export { type SecurityBaselineOptions, securityBaselineFeatures } from "./security-baseline.ts";

package/dist/presets/security-baseline.d.ts

@@ -2,4 +2,6 @@ import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 export type SecurityBaselineOptions = {
     readonly includeSessions?: boolean;
 };
+/** @deprecated Removed in the next release. Use `composeSecurityStack({ includeSessions })`
+ *  from `@cosmicdrift/kumiko-dev-server/compose-stacks`. */
 export declare function securityBaselineFeatures(opts?: SecurityBaselineOptions): FeatureDefinition[];

package/dist/presets/security-baseline.js

@@ -3,6 +3,8 @@ import { createCryptoShreddingFeature } from "../crypto-shredding/index.js";
 import { createRateLimitingFeature } from "../rate-limiting/index.js";
 import { createSessionsFeature } from "../sessions/index.js";
 // Host app must mount user, tenant, auth-foundation (sessions/audit requires).
+/** @deprecated Removed in the next release. Use `composeSecurityStack({ includeSessions })`
+ *  from `@cosmicdrift/kumiko-dev-server/compose-stacks`. */
 export function securityBaselineFeatures(opts = {}) {
     return [
         ...(opts.includeSessions !== false ? [createSessionsFeature()] : []),

package/dist/rate-limiting/index.d.ts

@@ -1,2 +1,2 @@
-export { RATE_LIMITING_FEATURE, RateLimitErrors, RateLimitQueries } from "./constants.js";
-export { createRateLimitingFeature } from "./feature.js";
+export { RATE_LIMITING_FEATURE, RateLimitErrors, RateLimitQueries } from "./constants.ts";
+export { createRateLimitingFeature } from "./feature.ts";

package/dist/readiness/feature.d.ts

@@ -5,11 +5,3 @@ export declare function createReadinessFeature(): import("@cosmicdrift/kumiko-ty
         };
     };
 };
-/** @deprecated Use createReadinessFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const readinessFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: {
-        queries: {
-            status: import("@cosmicdrift/kumiko-types/handlers").HandlerRef;
-        };
-    };
-};

package/dist/readiness/feature.js

@@ -25,5 +25,3 @@ export function createReadinessFeature() {
         return { queries };
     }, { dedupeOptions: {} });
 }
-/** @deprecated Use createReadinessFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const readinessFeature = createReadinessFeature();

package/dist/readiness/index.d.ts

@@ -1,3 +1,3 @@
-export { READINESS_FEATURE, ReadinessQueries } from "./constants.js";
-export { createReadinessFeature, readinessFeature } from "./feature.js";
-export type { ReadinessMissingSecret } from "./handlers/status.query.js";
+export { READINESS_FEATURE, ReadinessQueries } from "./constants.ts";
+export { createReadinessFeature } from "./feature.ts";
+export type { ReadinessMissingSecret } from "./handlers/status.query.ts";

package/dist/readiness/index.js

@@ -1,2 +1,2 @@
 export { READINESS_FEATURE, ReadinessQueries } from "./constants.js";
-export { createReadinessFeature, readinessFeature } from "./feature.js";
+export { createReadinessFeature } from "./feature.js";

package/dist/renderer-foundation/api.d.ts

@@ -1,6 +1,6 @@
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { type RenderKind } from "./constants.js";
-import { type RendererPlugin } from "./types.js";
+import { type RenderKind } from "./constants.ts";
+import { type RendererPlugin } from "./types.ts";
 export type RendererFoundationApi = {
     /**
      * Selects + returns a RendererPlugin for (tenantId × kind). Callers

package/dist/renderer-foundation/constants.d.ts

@@ -1,4 +1,4 @@
-import type { RenderKind as RenderKindLocal } from "../template-resolver/index.js";
+import type { RenderKind as RenderKindLocal } from "../template-resolver/index.ts";
 export declare const RENDERER_EXTENSION: "renderer";
-export { CONTENT_FORMATS, type ContentFormat, RENDER_KINDS, type RenderKind, } from "../template-resolver/index.js";
+export { CONTENT_FORMATS, type ContentFormat, RENDER_KINDS, type RenderKind, } from "../template-resolver/index.ts";
 export declare const DEFAULT_PLUGIN_BY_KIND: Readonly<Record<RenderKindLocal, string>>;

package/dist/renderer-foundation/feature.d.ts

@@ -1,5 +1,5 @@
 import { type Registry } from "@cosmicdrift/kumiko-framework/engine";
-import { type RendererPlugin } from "./types.js";
+import { type RendererPlugin } from "./types.ts";
 export declare function createRendererFoundationFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: {};
 };

package/dist/renderer-foundation/index.d.ts

@@ -1,5 +1,5 @@
-export { attachmentFileNameSchema } from "../shared/index.js";
-export { createRendererFoundationApi, type RendererFoundationApi, requireRendererFoundation, } from "./api.js";
-export { CONTENT_FORMATS, type ContentFormat, DEFAULT_PLUGIN_BY_KIND, RENDER_KINDS, RENDERER_EXTENSION, type RenderKind, } from "./constants.js";
-export { collectRendererPlugins, createRendererFoundationFeature } from "./feature.js";
-export { type DocumentPayload, type DocumentPdfDraft, type DocumentPdfPayload, type DocumentPreview, type DocumentPreviewRequest, type FileAttachmentRef, type ImageOptions, type InlineAttachmentRef, isRendererRegistrationPlugin, type MailAttachmentRef, type MailDraft, type MailPayload, type PdfOptions, type RenderedPdfAttachmentRef, type RenderedTemplateRef, type RendererContext, RendererError, type RendererPlugin, type RendererRegistrationPlugin, type RenderProvenance, type RenderRequest, type RenderResponse, } from "./types.js";
+export { attachmentFileNameSchema } from "../shared/index.ts";
+export { createRendererFoundationApi, type RendererFoundationApi, requireRendererFoundation, } from "./api.ts";
+export { CONTENT_FORMATS, type ContentFormat, DEFAULT_PLUGIN_BY_KIND, RENDER_KINDS, RENDERER_EXTENSION, type RenderKind, } from "./constants.ts";
+export { collectRendererPlugins, createRendererFoundationFeature } from "./feature.ts";
+export { type DocumentPayload, type DocumentPdfDraft, type DocumentPdfPayload, type DocumentPreview, type DocumentPreviewRequest, type FileAttachmentRef, type ImageOptions, type InlineAttachmentRef, isRendererRegistrationPlugin, type MailAttachmentRef, type MailChrome, type MailChromeLink, type MailChromeRequest, type MailDraft, type MailPayload, type PdfOptions, type RenderedPdfAttachmentRef, type RenderedTemplateRef, type RendererContext, RendererError, type RendererPlugin, type RendererRegistrationPlugin, type RenderProvenance, type RenderRequest, type RenderResponse, } from "./types.ts";

package/dist/renderer-foundation/types.d.ts

@@ -1,8 +1,8 @@
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { ConfigAccessor, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
-import type { LinkedResourceEntry, MailTemplateMeta, PdfPageFormat, PdfTemplateMeta, TemplateScope } from "../template-resolver/index.js";
-import { type ContentFormat, RENDERER_EXTENSION, type RenderKind } from "./constants.js";
+import type { LinkedResourceEntry, MailTemplateMeta, PdfPageFormat, PdfTemplateMeta, TemplateScope } from "../template-resolver/index.ts";
+import { type ContentFormat, RENDERER_EXTENSION, type RenderKind } from "./constants.ts";
 export type RenderRequest = {
     kind: "mail";
     payload: MailPayload;
@@ -142,12 +142,34 @@ export type RendererContext = {
     /** Only plugins that embed resource bytes (PDF) need it; without it images are dropped. */
     readonly filesForTenant?: (tenantId: string) => FileContext | undefined;
 };
+export type MailChromeLink = {
+    readonly label: string;
+    readonly url: string;
+};
+/** The tenant's mail look with every text resolved for one locale, for pages a
+ *  recipient reaches from a mail link. URLs are http(s) only, the logo https only,
+ *  the accent color a #rrggbb hex. */
+export type MailChrome = {
+    readonly tenantName: string;
+    readonly brandSuffix: string;
+    readonly logoUrl?: string;
+    readonly accentColor?: string;
+    readonly siteUrl?: string;
+    readonly footerText?: string;
+    readonly imprint?: MailChromeLink;
+    readonly privacy?: MailChromeLink;
+};
+export type MailChromeRequest = {
+    readonly locale: string;
+};
 export type RendererPlugin = {
     readonly name: string;
     readonly kinds: ReadonlyArray<RenderKind>;
     render(req: RenderRequest, ctx: RendererContext): Promise<RenderResponse>;
     /** Optional: plugins that print documents offer a preview that never reaches the print service. */
     previewDocument?(req: DocumentPreviewRequest, ctx: RendererContext): Promise<DocumentPreview>;
+    /** Optional: mail plugins hand out their brand row and footer for pages outside a mail. */
+    readMailChrome?(req: MailChromeRequest, ctx: RendererContext): Promise<MailChrome>;
 };
 export declare class RendererError extends Error {
     readonly code: "no_plugin_for_kind" | "invalid_payload" | "unavailable" | "other";

package/dist/renderer-pdf/feature.d.ts

@@ -1,4 +1,4 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type RenderRequest, type RenderResponse } from "../renderer-foundation/index.js";
+import { type RenderRequest, type RenderResponse } from "../renderer-foundation/index.ts";
 export declare function renderTablePdfRequest(req: RenderRequest): Promise<RenderResponse>;
 export declare function createRendererPdfFeature(): FeatureDefinition;

package/dist/renderer-pdf/index.d.ts

@@ -1,2 +1,2 @@
-export { createRendererPdfFeature } from "./feature.js";
-export { type PdfTableColumn, type PdfTableDocument, type PdfTableOptions, type PdfTableResult, pdfTableDocumentSchema, renderTablePdf, } from "./render-table-pdf.js";
+export { createRendererPdfFeature } from "./feature.ts";
+export { type PdfTableColumn, type PdfTableDocument, type PdfTableOptions, type PdfTableResult, pdfTableDocumentSchema, renderTablePdf, } from "./render-table-pdf.ts";

package/dist/renderer-pdf/render-table-pdf.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import type { PdfPageFormat } from "../template-resolver/index.js";
+import type { PdfPageFormat } from "../template-resolver/index.ts";
 declare const pdfTableColumnSchema: z.ZodReadonly<z.ZodObject<{
     header: z.ZodString;
     weight: z.ZodOptional<z.ZodNumber>;

package/dist/secrets/constants.d.ts

@@ -6,4 +6,11 @@ export declare const SECRETS_ERROR_KEYS: {
     readonly writeDenied: "secrets.errors.writeDenied";
     readonly invalidValue: "secrets.errors.invalidValue";
 };
+export declare const SecretsHandlers: {
+    readonly set: "secrets:write:set";
+    readonly delete: "secrets:write:delete";
+};
+export declare const SecretsQueries: {
+    readonly list: "secrets:query:list";
+};
 export declare const INVALID_SECRET_VALUE_CODE: "invalid_secret_value";

package/dist/secrets/constants.js

@@ -14,4 +14,11 @@ export const SECRETS_ERROR_KEYS = {
     writeDenied: "secrets.errors.writeDenied",
     invalidValue: "secrets.errors.invalidValue",
 };
+export const SecretsHandlers = {
+    set: "secrets:write:set",
+    delete: "secrets:write:delete",
+};
+export const SecretsQueries = {
+    list: "secrets:query:list",
+};
 export const INVALID_SECRET_VALUE_CODE = "invalid_secret_value";

package/dist/secrets/db/queries/read.d.ts

@@ -1,4 +1,4 @@
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { StoredEnvelope } from "../../table.js";
+import type { StoredEnvelope } from "../../table.ts";
 export declare function selectTenantSecretEnvelope(db: DbRunner, tenantId: TenantId, key: string): Promise<StoredEnvelope | undefined>;

package/dist/secrets/feature.d.ts

@@ -1,4 +1,5 @@
 import { type AccessRule, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import * as z from "zod";
 /**
@@ -20,8 +21,8 @@ export declare const secretsEnvSchema: z.ZodObject<{
     KUMIKO_SECRETS_MASTER_KEY_V1: z.ZodString;
     KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: z.ZodDefault<z.ZodString>;
 }, z.core.$strip>;
-export { createSecretsContext, type SecretsContext, type SecretsContextOptions, TENANT_SECRET_READ_EVENT, } from "./secrets-context.js";
-export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./table.js";
+export { createSecretsContext, type SecretsContext, type SecretsContextOptions, TENANT_SECRET_READ_EVENT, } from "./secrets-context.ts";
+export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./table.ts";
 export declare const JOIN_REQUEST_TRANSACTION_REASON = "the secret write runs on the request transaction so a failing batch rolls it back together with the config writes";
 export declare function requireSecretsContext(ctx: {
     readonly secrets?: SecretsContext;
@@ -43,4 +44,4 @@ export type SecretsFeatureOptions = {
     /** Shorthand for { access: { roles } }. Mutually exclusive with `access`. */
     readonly roles?: readonly string[];
 };
-export declare function createSecretsFeature(opts?: SecretsFeatureOptions): FeatureDefinition;
+export declare function createSecretsFeature(opts?: SecretsFeatureOptions): FeatureWithEnvSchema<FeatureDefinition, typeof secretsEnvSchema.shape>;

package/dist/secrets/feature.js

@@ -1,4 +1,5 @@
 import { defineFeature, SYSTEM_ROLE, } from "@cosmicdrift/kumiko-framework/engine";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { SETTINGS_HUB_I18N } from "@cosmicdrift/kumiko-framework/i18n";
 import * as z from "zod";
@@ -104,8 +105,8 @@ function withSystemWriter(rule) {
 export function createSecretsFeature(opts = {}) {
     const access = resolveSecretsAccess(opts);
     const writeAccess = withSystemWriter(access);
-    return defineFeature(SECRETS_FEATURE_NAME, (r) => {
-        r.describe('Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins). Server-side code writes a tenant secret with `dispatchSystemWrite({ handlerQn: "secrets:write:set", payload, tenantId })`: set and delete also admit the in-process system identity, so such writes pass the same declared-key and value checks.');
+    const feature = defineFeature(SECRETS_FEATURE_NAME, (r) => {
+        r.describe('Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins). Server-side code writes a tenant secret with `dispatchSystemWrite({ handlerQn: SecretsHandlers.set, payload, tenantId })`: set and delete also admit the in-process system identity, so such writes pass the same declared-key and value checks.');
         r.uiHints({
             displayLabel: "Tenant Secrets",
             category: "infrastructure",
@@ -161,4 +162,5 @@ export function createSecretsFeature(opts = {}) {
         // ops-tool (see docs/plans/architecture/event-dispatcher.md §retention).
         // No per-feature retention-job anymore.
     });
+    return featureWithEnvSchema(feature, secretsEnvSchema);
 }

package/dist/secrets/handlers/delete.write.js

@@ -2,7 +2,7 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.js";
-import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
+import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../constants.js";
 import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite } from "../write-gate.js";
 export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
@@ -16,7 +16,7 @@ export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
         access,
         escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
         handler: async (event, ctx) => {
-            const secrets = requireSecretsContext(ctx, "secrets:write:delete").withRunner(ctx.db.unsafeRaw());
+            const secrets = requireSecretsContext(ctx, SecretsHandlers.delete).withRunner(ctx.db.unsafeRaw());
             const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key, {
                 allowUndeclared: true,
             });

package/dist/secrets/handlers/rotate.job.d.ts

@@ -1,6 +1,6 @@
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { JobContext } from "@cosmicdrift/kumiko-framework/engine";
-import { type ChunkedMigrationStopReason } from "../../shared/index.js";
+import { type ChunkedMigrationStopReason } from "../../shared/index.ts";
 export type RotateJobPayload = {
     readonly batchSize?: number;
     readonly maxDurationMs?: number;

package/dist/secrets/handlers/set.write.js

@@ -1,7 +1,7 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.js";
-import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
+import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../constants.js";
 import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite, checkSecretValue } from "../write-gate.js";
 export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
@@ -23,7 +23,7 @@ export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
         access,
         escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
         handler: async (event, ctx) => {
-            const secrets = requireSecretsContext(ctx, "secrets:write:set").withRunner(ctx.db.unsafeRaw());
+            const secrets = requireSecretsContext(ctx, SecretsHandlers.set).withRunner(ctx.db.unsafeRaw());
             const { key, value, redactedPreview, hint } = event.payload;
             // Preview-priority: explicit payload param > feature-declared redact
             // (via r.secret()) > generic default. A feature that declared a

package/dist/secrets/index.d.ts

@@ -1,7 +1,7 @@
-export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, } from "./constants.js";
-export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, type SecretsContext, type SecretsContextOptions, type SecretsFeatureOptions, type StoredEnvelope, type StoredMetadata, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
-export { createDeleteHandler } from "./handlers/delete.write.js";
-export { createListHandler } from "./handlers/list.query.js";
-export { type RotateJobPayload, type RotateJobResult, rotateJob, } from "./handlers/rotate.job.js";
-export { createSetHandler } from "./handlers/set.write.js";
-export { isInvalidSecretValueError } from "./write-gate.js";
+export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, SecretsHandlers, SecretsQueries, } from "./constants.ts";
+export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, type SecretsContext, type SecretsContextOptions, type SecretsFeatureOptions, type StoredEnvelope, type StoredMetadata, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.ts";
+export { createDeleteHandler } from "./handlers/delete.write.ts";
+export { createListHandler } from "./handlers/list.query.ts";
+export { type RotateJobPayload, type RotateJobResult, rotateJob, } from "./handlers/rotate.job.ts";
+export { createSetHandler } from "./handlers/set.write.ts";
+export { isInvalidSecretValueError } from "./write-gate.ts";

package/dist/secrets/index.js

@@ -1,4 +1,4 @@
-export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, } from "./constants.js";
+export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, SecretsHandlers, SecretsQueries, } from "./constants.js";
 export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
 export { createDeleteHandler } from "./handlers/delete.write.js";
 export { createListHandler } from "./handlers/list.query.js";

package/dist/secrets/secrets-context.d.ts

@@ -1,7 +1,7 @@
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type DekCache, type MasterKeyProvider, type SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import * as z from "zod";
-import { type SecretValueSchemaSource } from "./write-gate.js";
+import { type SecretValueSchemaSource } from "./write-gate.ts";
 export type { Secret, SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 export type SecretsContextOptions = {
     readonly db: DbConnection;

package/dist/seo/feature.d.ts

@@ -1,7 +1,7 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { SEO_DEFAULT_PATHS } from "./constants.js";
-import { type RobotsPolicy } from "./robots-txt.js";
-import { type SitemapEntry } from "./sitemap.js";
+import { SEO_DEFAULT_PATHS } from "./constants.ts";
+import { type RobotsPolicy } from "./robots-txt.ts";
+import { type SitemapEntry } from "./sitemap.ts";
 export type ManagedPagesDiscoveryOptions = {
     /** Same per-host tenant resolver the app already passes to
      *  createManagedPagesFeature — needed to X-Tenant-scope the anonymous

package/dist/seo/index.d.ts

@@ -1,6 +1,6 @@
-export { SEO_CONFIG_KEYS, SEO_CONFIG_QN, SEO_DEFAULT_PATHS, SEO_FEATURE } from "./constants.js";
-export { createSeoFeature, type ManagedPagesDiscoveryOptions, runSeoBootCheck, type SeoBootCheckCtx, type SeoOptions, } from "./feature.js";
-export { buildLlmsTxt, type LlmsTxtInput, type LlmsTxtLink, type LlmsTxtSection, } from "./llms-txt.js";
-export { buildRobotsTxt, type RobotsPolicy } from "./robots-txt.js";
-export { type FaqItem, faqPageSchema, type OrganizationSchemaInput, organizationSchema, type WebPageSchemaInput, webPageSchema, } from "./schema-builders.js";
-export { buildSitemapXml, type SitemapEntry } from "./sitemap.js";
+export { SEO_CONFIG_KEYS, SEO_CONFIG_QN, SEO_DEFAULT_PATHS, SEO_FEATURE } from "./constants.ts";
+export { createSeoFeature, type ManagedPagesDiscoveryOptions, runSeoBootCheck, type SeoBootCheckCtx, type SeoOptions, } from "./feature.ts";
+export { buildLlmsTxt, type LlmsTxtInput, type LlmsTxtLink, type LlmsTxtSection, } from "./llms-txt.ts";
+export { buildRobotsTxt, type RobotsPolicy } from "./robots-txt.ts";
+export { type FaqItem, faqPageSchema, type OrganizationSchemaInput, organizationSchema, type WebPageSchemaInput, webPageSchema, } from "./schema-builders.ts";
+export { buildSitemapXml, type SitemapEntry } from "./sitemap.ts";

package/dist/sessions/feature.d.ts

@@ -1,5 +1,5 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type SessionAllOthersRevoker, type SessionMassRevoker } from "./session-callbacks.js";
+import { type SessionAllOthersRevoker, type SessionMassRevoker } from "./session-callbacks.ts";
 export type SessionsFeatureOptions = {
     readonly autoRevokeOnPasswordChange?: SessionMassRevoker;
     readonly expiresInMs?: number;

package/dist/sessions/index.d.ts

@@ -1,8 +1,8 @@
-export { DEFAULT_SESSION_CACHE_TTL_MS, DEFAULT_SESSION_EXPIRY_MS, SESSION_MINE_SCREEN_ID, SESSIONS_FEATURE, SessionErrors, SessionHandlers, SessionQueries, } from "./constants.js";
-export type { BindAutoRevokeOnPasswordChange, SessionsFeatureOptions } from "./feature.js";
-export { bindAutoRevokeFromFeature, createSessionsFeature } from "./feature.js";
-export { userSessionEntity, userSessionTable } from "./schema/user-session.js";
-export type { SessionCallbacks, SessionCallbacksOptions, SessionMassRevoker, } from "./session-callbacks.js";
-export { createSessionCallbacks, isPrincipalBlocked } from "./session-callbacks.js";
-export type { SessionRevokedPayload } from "./session-revoked-event.js";
-export { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN, SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema, } from "./session-revoked-event.js";
+export { DEFAULT_SESSION_CACHE_TTL_MS, DEFAULT_SESSION_EXPIRY_MS, SESSION_MINE_SCREEN_ID, SESSIONS_FEATURE, SessionErrors, SessionHandlers, SessionQueries, } from "./constants.ts";
+export type { BindAutoRevokeOnPasswordChange, SessionsFeatureOptions } from "./feature.ts";
+export { bindAutoRevokeFromFeature, createSessionsFeature } from "./feature.ts";
+export { userSessionEntity, userSessionTable } from "./schema/user-session.ts";
+export type { SessionCallbacks, SessionCallbacksOptions, SessionMassRevoker, } from "./session-callbacks.ts";
+export { createSessionCallbacks, isPrincipalBlocked } from "./session-callbacks.ts";
+export type { SessionRevokedPayload } from "./session-revoked-event.ts";
+export { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN, SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema, } from "./session-revoked-event.ts";

package/dist/sessions/session-callbacks.d.ts

@@ -1,7 +1,7 @@
 import type { SessionChecker, SessionCreator, SessionMassRevoker, SessionRevoker } from "@cosmicdrift/kumiko-framework/api";
 export type { SessionMassRevoker } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { isPrincipalBlocked } from "../user/index.js";
+import { isPrincipalBlocked } from "../user/index.ts";
 export { isPrincipalBlocked };
 export type SessionAllOthersRevoker = (userId: string, currentSid: string | undefined) => Promise<number>;
 export type SessionCallbacksOptions = {

package/dist/sessions/testing.d.ts

@@ -1,7 +1,7 @@
 import type { AuthRoutesConfig, SessionCreator } from "@cosmicdrift/kumiko-framework/api";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import type { LateBoundHolder } from "@cosmicdrift/kumiko-testing/helpers";
-import type { SessionCallbacks, SessionMassRevoker } from "./session-callbacks.js";
+import type { SessionCallbacks, SessionMassRevoker } from "./session-callbacks.ts";
 export type BoundSessionCallbacks = {
     /** auth-config fragment: creator + revoker + checker, all late-bound. */
     asAuthConfig(): Pick<AuthRoutesConfig, "sessionCreator" | "sessionRevoker" | "sessionChecker">;

package/dist/shared/index.d.ts

@@ -1,31 +1,31 @@
-export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
-export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.js";
-export { attachmentFileNameSchema, sanitizePdfAttachmentFileName, } from "./attachment-file-name.js";
-export { type ChunkedMigrationOptions, type ChunkedMigrationResult, type ChunkedMigrationStopReason, type MigrationRowOutcome, runChunkedMigration, } from "./chunked-entity-migration.js";
-export { classifyStoredEnvelope, type StoredEnvelopeClassification, } from "./classify-stored-envelope.js";
-export { decryptStoredPii } from "./decrypt-stored-pii.js";
-export { encryptForDirectWrite } from "./encrypt-for-direct-write.js";
-export { entitiesOf } from "./entities-of.js";
-export { isWithinGracePeriod } from "./grace-period.js";
-export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
-export { isTenantDb } from "./is-tenant-db.js";
-export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.js";
-export { mailHeading, mailParagraph, mailRepeatedRows } from "./mail-template-body.js";
-export { mapWithConcurrency } from "./map-with-concurrency.js";
-export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
-export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
-export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
-export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
-export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.js";
-export { requireForTenant } from "./require-for-tenant.js";
-export { extensionForResourceContentType, isResourceImageContentType, isResourceImageFormat, RESOURCE_IMAGE_FORMATS, type ResourceImageContentType, type ResourceImageFormat, } from "./resource-image-formats.js";
-export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
-export { runInSubTransaction } from "./run-in-sub-transaction.js";
-export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";
-export { sessionTimezoneField } from "./session-timezone-field.js";
-export { assertNotSvg, MAX_INPUT_PIXELS, SHARP_INPUT_OPTIONS } from "./sharp-input-limits.js";
-export { peekTokenSubject, signToken, TokenPurpose, type VerifyResult, verifyToken, } from "./signed-token.js";
-export { EXT_SIGNUP_HANDOVER, findSignupHandoverProvider, isSignupHandoverProvider, SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE, type SignupHandoverBinding, type SignupHandoverProvider, } from "./signup-handover.js";
-export { createSingleUseTokenStore, hashSingleUseToken } from "./single-use-token-store.js";
-export type { SystemQueryFn } from "./system-query.js";
-export { type BurnResult, burnToken, unburnToken } from "./token-burn-store.js";
+export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.ts";
+export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.ts";
+export { attachmentFileNameSchema, sanitizePdfAttachmentFileName, } from "./attachment-file-name.ts";
+export { type ChunkedMigrationOptions, type ChunkedMigrationResult, type ChunkedMigrationStopReason, type MigrationRowOutcome, runChunkedMigration, } from "./chunked-entity-migration.ts";
+export { classifyStoredEnvelope, type StoredEnvelopeClassification, } from "./classify-stored-envelope.ts";
+export { decryptStoredPii } from "./decrypt-stored-pii.ts";
+export { encryptForDirectWrite } from "./encrypt-for-direct-write.ts";
+export { entitiesOf } from "./entities-of.ts";
+export { isWithinGracePeriod } from "./grace-period.ts";
+export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.ts";
+export { isTenantDb } from "./is-tenant-db.ts";
+export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.ts";
+export { mailHeading, mailParagraph, mailRepeatedRows } from "./mail-template-body.ts";
+export { mapWithConcurrency } from "./map-with-concurrency.ts";
+export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.ts";
+export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.ts";
+export { rateLimitedTextResponse } from "./rate-limited-text-response.ts";
+export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.ts";
+export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.ts";
+export { requireForTenant } from "./require-for-tenant.ts";
+export { extensionForResourceContentType, isResourceImageContentType, isResourceImageFormat, RESOURCE_IMAGE_FORMATS, type ResourceImageContentType, type ResourceImageFormat, } from "./resource-image-formats.ts";
+export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.ts";
+export { runInSubTransaction } from "./run-in-sub-transaction.ts";
+export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.ts";
+export { sessionTimezoneField } from "./session-timezone-field.ts";
+export { assertNotSvg, MAX_INPUT_PIXELS, SHARP_INPUT_OPTIONS } from "./sharp-input-limits.ts";
+export { peekTokenSubject, signToken, TokenPurpose, type VerifyResult, verifyToken, } from "./signed-token.ts";
+export { EXT_SIGNUP_HANDOVER, findSignupHandoverProvider, isSignupHandoverProvider, SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE, type SignupHandoverBinding, type SignupHandoverProvider, } from "./signup-handover.ts";
+export { createSingleUseTokenStore, hashSingleUseToken } from "./single-use-token-store.ts";
+export type { SystemQueryFn } from "./system-query.ts";
+export { type BurnResult, burnToken, unburnToken } from "./token-burn-store.ts";

package/dist/step-dispatcher/dispatch-payload.d.ts

@@ -1,6 +1,6 @@
 import * as z from "zod";
-import { type MailSpec } from "./mail-runner.js";
-import { type WebhookSpec } from "./webhook-runner.js";
+import { type MailSpec } from "./mail-runner.ts";
+import { type WebhookSpec } from "./webhook-runner.ts";
 export declare const dispatchRequestedPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     stepKind: z.ZodLiteral<"webhook.send">;
     url: z.ZodString;

package/dist/step-dispatcher/index.d.ts

@@ -1,3 +1,3 @@
-export { createStepDispatcherFeature, STEP_DISPATCH_AGGREGATE_TYPE, stepDispatcherEnvSchema, } from "./feature.js";
-export { type MailDispatchResult, type MailSpec, mailSpecSchema, performMailDispatch, setMailRunner, } from "./mail-runner.js";
-export { performWebhookDispatch, readAllowedPrivateWebhookHostsFromEnv, setWebhookFetch, setWebhookHostLookup, WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR, WEBHOOK_AUTH_SECRET_KEY_PREFIX, type WebhookDispatchDeps, type WebhookDispatchResult, type WebhookSpec, webhookAuthSecretKey, webhookSpecSchema, } from "./webhook-runner.js";
+export { createStepDispatcherFeature, STEP_DISPATCH_AGGREGATE_TYPE, stepDispatcherEnvSchema, } from "./feature.ts";
+export { type MailDispatchResult, type MailSpec, mailSpecSchema, performMailDispatch, setMailRunner, } from "./mail-runner.ts";
+export { performWebhookDispatch, readAllowedPrivateWebhookHostsFromEnv, setWebhookFetch, setWebhookHostLookup, WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR, WEBHOOK_AUTH_SECRET_KEY_PREFIX, type WebhookDispatchDeps, type WebhookDispatchResult, type WebhookSpec, webhookAuthSecretKey, webhookSpecSchema, } from "./webhook-runner.ts";

package/dist/subscription-mollie/feature.d.ts

@@ -1,7 +1,7 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { type MolliePriceConfig } from "./plugin-methods.js";
-import { type MollieClientShape } from "./verify-webhook.js";
+import { type MolliePriceConfig } from "./plugin-methods.ts";
+import { type MollieClientShape } from "./verify-webhook.ts";
 /**
  * Env-vars contract for the `subscription-mollie` feature.
  * Apps load `MOLLIE_API_KEY` from env and forward it to

package/dist/subscription-mollie/index.d.ts

@@ -1,3 +1,3 @@
-export { MOLLIE_PROVIDER_NAME, SUBSCRIPTION_MOLLIE_FEATURE } from "./constants.js";
-export { createSubscriptionMollieFeature, type SubscriptionMollieOptions, subscriptionMollieEnvSchema, } from "./feature.js";
-export type { MolliePriceConfig } from "./plugin-methods.js";
+export { MOLLIE_PROVIDER_NAME, SUBSCRIPTION_MOLLIE_FEATURE } from "./constants.ts";
+export { createSubscriptionMollieFeature, type SubscriptionMollieOptions, subscriptionMollieEnvSchema, } from "./feature.ts";
+export type { MolliePriceConfig } from "./plugin-methods.ts";

package/dist/subscription-mollie/verify-webhook.d.ts

@@ -1,6 +1,6 @@
 import { type SubscriptionEvent, type SubscriptionEventType, type SubscriptionStatus } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import type { Payment as MolliePayment, Subscription as MollieSubscription } from "@mollie/api-client";
-import type { MolliePriceConfig } from "./plugin-methods.js";
+import type { MolliePriceConfig } from "./plugin-methods.ts";
 /** Minimal-Subset des Mollie-Clients, das der Plugin nutzt — separat
  *  damit Tests ohne den vollen MollieClient mocken können. Adapter in
  *  feature.ts bridged das gegen den echten SDK. */

package/dist/subscription-stripe/feature.d.ts

@@ -1,4 +1,5 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import * as z from "zod";
 /**
  * Env-vars contract for the `subscription-stripe` feature — now a **bridge
@@ -12,6 +13,20 @@ export declare const subscriptionStripeEnvSchema: z.ZodObject<{
     STRIPE_WEBHOOK_SECRET: z.ZodOptional<z.ZodString>;
     STRIPE_API_KEY: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+type StripePriceEnvShape<TPrice extends string> = {
+    [Key in `STRIPE_PRICE_${TPrice}`]: z.ZodOptional<z.ZodString>;
+};
+/** Stripe env block plus one `STRIPE_PRICE_<NAME>` slot per price the app
+ *  maps to a tier, e.g. `stripeEnvSchema({ prices: ["PRO", "TEAM"] })`.
+ *  Shares its bridge fields with `subscriptionStripeEnvSchema`, so spreading
+ *  it into `composeEnvSchema({ extend })` next to the mounted feature is no
+ *  key clash. */
+export declare function stripeEnvSchema<const TPrice extends string>(options: {
+    readonly prices: readonly TPrice[];
+}): z.ZodObject<{
+    STRIPE_WEBHOOK_SECRET: z.ZodOptional<z.ZodString>;
+    STRIPE_API_KEY: z.ZodOptional<z.ZodString>;
+} & StripePriceEnvShape<TPrice> extends infer T ? { -readonly [P in keyof T]: T[P]; } : never, z.core.$strip>;
 export type SubscriptionStripeOptions = {
     /** Bridge-fallback webhook-secret. Optional: v2 liest aus dem
      *  `subscription-stripe:config:webhook-secret`-Key (backing:"secrets").
@@ -47,4 +62,5 @@ export type SubscriptionStripeOptions = {
  * registriert den Plugin gegen billing-foundation's "subscriptionProvider"-
  * extension unter entityName "stripe".
  */
-export declare function createSubscriptionStripeFeature(options?: SubscriptionStripeOptions): FeatureDefinition;
+export declare function createSubscriptionStripeFeature(options?: SubscriptionStripeOptions): FeatureWithEnvSchema<FeatureDefinition, typeof subscriptionStripeEnvSchema.shape>;
+export {};