@cosmicdrift/kumiko-samples 0.368.0 → 0.370.0

package/packages/bundled-features/src/channel-discord/index.ts

@@ -4,5 +4,5 @@ export {
   DISCORD_SECRET_KEYS,
   DISCORD_WEBHOOK_PATH_PREFIX,
   type DiscordChannelOptions,
-} from "./discord-channel.js";
-export { createChannelDiscordFeature } from "./feature.js";
+} from "./discord-channel.ts";
+export { createChannelDiscordFeature } from "./feature.ts";

package/packages/bundled-features/src/channel-email/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.370.0",
+    "type": "improvement",
+    "title": "smtpEnvSchema declares the SMTP_* variables",
+    "detail": "smtpEnvSchema covers SMTP_HOST, SMTP_PORT, SMTP_SECURE, SMTP_USER, SMTP_PASS and SMTP_FROM, all optional, and createChannelEmailFeature registers it. It lives next to createSmtpTransportFromEnv, which reads these variables."
+  },
+  {
+    "version": "0.369.0",
+    "type": "breaking",
+    "title": "The tenant mail transport applies per notification",
+    "detail": "r.notification(name, { tenantTransport: true }) marks a notification whose mails go through the tenant's own mail transport. channel-email consults its tenantTransport resolver only for these (also under a renamedFrom name); every other notification, such as password reset or sign-in mails, always takes the app transport, even when the tenant has a provider. With tenantTransport set, transport may be omitted: a mail that then has no transport fails with missing_credentials instead of throwing. The template test mail (template-resolver send-test) now gets the tenant config in its channel context and uses the template's notification, so it leaves through the same transport as the real mail.",
+    "migration": "Apps that pass tenantTransport to createChannelEmailFeature add `tenantTransport: true` to every r.notification whose mails should go through the tenant's provider; without the flag those mails now go through the app transport. Apps without an app SMTP server can drop transport and keep tenantTransport."
+  },
   {
     "version": "0.367.0",
     "type": "improvement",

package/packages/bundled-features/src/channel-email/email-channel.ts

@@ -6,6 +6,7 @@ import {
   type AttachmentOrigin,
   type ChannelContext,
   type ChannelMessage,
+  currentNotificationType,
   DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE,
   DELIVERY_UNSUBSCRIBE_PATH,
   type DeliveryChannel,
@@ -15,10 +16,10 @@ import {
   MAX_EMAIL_ATTACHMENTS,
   type RenderedMessage,
   renderedPdfAttachmentRefSchema,
-} from "../delivery/index.js";
-import { decryptStoredPii, extensionForResourceContentType } from "../shared/index.js";
-import { guardEmailMessage } from "./pii-guard.js";
-import type { EmailAttachment, EmailTransport } from "./types.js";
+} from "../delivery/index.ts";
+import { decryptStoredPii, extensionForResourceContentType } from "../shared/index.ts";
+import { guardEmailMessage } from "./pii-guard.ts";
+import type { EmailAttachment, EmailTransport } from "./types.ts";
 
 // Envelope (From / Reply-To / threading headers) rides on the channel data —
 // the notification's email template echoes it out of the notify() call, since
@@ -163,18 +164,36 @@ async function resolveAttachments(
   return { kind: "resolved", attachments: resolved };
 }
 
-export type EmailChannelOptions = {
-  /** The app-wide transport, used for every tenant `tenantTransport` returns null for. */
-  readonly transport: EmailTransport;
-  /** Resolves the sending tenant's own transport, null when it has none. Built per send and
-   *  never cached, so a provider change applies to the next mail; a throw fails the send. */
-  readonly tenantTransport?: (ctx: ChannelContext) => Promise<EmailTransport | null>;
+/** Resolves the sending tenant's own transport, null when it has none. Built per send and
+ *  never cached, so a provider change applies to the next mail; a throw fails the send. */
+export type TenantTransportResolver = (ctx: ChannelContext) => Promise<EmailTransport | null>;
+
+// The app transport may only be left out when tenant transports exist: a channel with
+// neither could never send.
+type EmailChannelTransports =
+  | {
+      /** The app-wide transport for every mail that does not go through a tenant transport. */
+      readonly transport: EmailTransport;
+      /** Used only for notifications declared with `tenantTransport: true`. */
+      readonly tenantTransport?: TenantTransportResolver;
+    }
+  | {
+      readonly transport?: undefined;
+      readonly tenantTransport: TenantTransportResolver;
+    };
+
+export type EmailChannelOptions = EmailChannelTransports & {
   readonly resolveEmail: (
     userId: string,
     ctx: { db: unknown; tenantId: TenantId },
   ) => Promise<string | null>;
 };
 
+function isTenantTransportNotification(ctx: ChannelContext, notificationType: string): boolean {
+  const current = currentNotificationType(ctx.registry, notificationType);
+  return ctx.registry.getAllNotifications().get(current)?.tenantTransport === true;
+}
+
 export function createEmailChannel(options: EmailChannelOptions): DeliveryChannel {
   const { transport, resolveEmail, tenantTransport } = options;
 
@@ -213,8 +232,12 @@ export function createEmailChannel(options: EmailChannelOptions): DeliveryChanne
     };
   }
 
-  async function transportFor(ctx: ChannelContext): Promise<EmailTransport> {
+  async function transportFor(
+    message: ChannelMessage,
+    ctx: ChannelContext,
+  ): Promise<EmailTransport | undefined> {
     if (tenantTransport === undefined) return transport;
+    if (!isTenantTransportNotification(ctx, message.notificationType)) return transport;
     return (await tenantTransport(ctx)) ?? transport;
   }
 
@@ -260,7 +283,15 @@ export function createEmailChannel(options: EmailChannelOptions): DeliveryChanne
         return { status: "failed", error: "send_failed", address };
       }
       const resolvedAttachments = resolution.attachments;
-      const sendTransport = await transportFor(ctx);
+      const sendTransport = await transportFor(message, ctx);
+      if (sendTransport === undefined) {
+        // Configuration, not a transient error: a retry cannot conjure a transport.
+        createFallbackLogger("delivery").warn("no mail transport for this mail, send failed", {
+          tenantId: ctx.tenantId,
+          notificationType: message.notificationType,
+        });
+        return { status: "failed", error: "missing_credentials", address };
+      }
       await sendTransport.send(
         guardEmailMessage({
           to: address,

package/packages/bundled-features/src/channel-email/env.ts

@@ -0,0 +1,28 @@
+import * as z from "zod";
+
+/** Env block `createSmtpTransportFromEnv` reads. All optional: without
+ *  `SMTP_HOST` no app-level transport is built and auth mail flows stay off. */
+export const smtpEnvSchema = z.object({
+  SMTP_HOST: z.string().min(1).optional().describe("SMTP host; unset disables app-level mail."),
+  SMTP_PORT: z
+    .string()
+    .regex(/^\d+$/, "must be a port number")
+    .optional()
+    .describe("SMTP port (default 587)."),
+  SMTP_SECURE: z
+    .enum(["true", "false"])
+    .optional()
+    .describe('Implicit TLS ("true") or STARTTLS/plain ("false", default).'),
+  SMTP_USER: z.string().min(1).optional().describe("SMTP auth user; auth needs SMTP_PASS too."),
+  SMTP_PASS: z
+    .string()
+    .min(1)
+    .optional()
+    .describe("SMTP auth password.")
+    .meta({ kumiko: { pulumi: { secret: true } } }),
+  SMTP_FROM: z
+    .string()
+    .min(1)
+    .optional()
+    .describe("Sender address; the app's fallback sender applies when unset."),
+});

package/packages/bundled-features/src/channel-email/feature.ts

@@ -2,15 +2,17 @@ import {
   DELIVERY_CHANNEL_EXTENSION,
   EMAIL_CHANNEL_NAME,
 } from "@cosmicdrift/kumiko-bundled-features/delivery";
-import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { createEmailChannel, type EmailChannelOptions } from "./email-channel.js";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
+import { createEmailChannel, type EmailChannelOptions } from "./email-channel.ts";
+import { smtpEnvSchema } from "./env.ts";
 
-export function createChannelEmailFeature(options: EmailChannelOptions): FeatureDefinition {
+export function createChannelEmailFeature(options: EmailChannelOptions) {
   const channel = createEmailChannel(options);
 
-  return defineFeature("channel-email", (r) => {
+  const feature = defineFeature("channel-email", (r) => {
     r.describe(
-      "Wires an `EmailTransport` (typically `mail-transport-smtp` in production, `createInMemoryTransport()` in tests) into the delivery system as the `email` channel. Requires `delivery`; pass an `EmailChannelOptions` with a `transport` and a `resolveEmail` function that maps a user ID to their email address. Mails render from stored templates (`renderer-mail-html`): a notification routed to this channel needs `template` + `meta` on `r.notification`, otherwise its delivery fails. Pass `tenantTransport: tenantMailTransport` (from `mail-foundation`) to send each tenant's mail through its own configured provider: a broken provider fails the send, a tenant without one uses the app `transport`. Notifications declared with `unsubscribe: true` get a signed `data.unsubscribeUrl` from delivery, which turns into the `List-Unsubscribe` headers.",
+      "Wires an `EmailTransport` (typically `mail-transport-smtp` in production, `createInMemoryTransport()` in tests) into the delivery system as the `email` channel. Requires `delivery`; pass an `EmailChannelOptions` with a `transport` and a `resolveEmail` function that maps a user ID to their email address. Mails render from stored templates (`renderer-mail-html`): a notification routed to this channel needs `template` + `meta` on `r.notification`, otherwise its delivery fails. Pass `tenantTransport: tenantMailTransport` (from `mail-foundation`) to send the notifications declared with `tenantTransport: true` through the sending tenant's own configured provider: a broken provider fails the send, a tenant without one uses the app `transport`; every other notification (password reset, sign-in) always goes through the app `transport`. `transport` may be left out when `tenantTransport` is set; a mail that then has no transport fails with `missing_credentials`. Notifications declared with `unsubscribe: true` get a signed `data.unsubscribeUrl` from delivery, which turns into the `List-Unsubscribe` headers.",
     );
     r.uiHints({
       displayLabel: "Email Channel",
@@ -18,6 +20,7 @@ export function createChannelEmailFeature(options: EmailChannelOptions): Feature
       recommended: false,
     });
     r.requires({ features: ["delivery"] });
+    r.envSchema(smtpEnvSchema);
 
     r.translations({ keys: { "delivery.channel.email": { en: "Email" } } });
     r.useExtension(DELIVERY_CHANNEL_EXTENSION, EMAIL_CHANNEL_NAME, {
@@ -27,4 +30,5 @@ export function createChannelEmailFeature(options: EmailChannelOptions): Feature
       send: channel.send,
     });
   });
+  return featureWithEnvSchema(feature, smtpEnvSchema);
 }

package/packages/bundled-features/src/channel-email/index.ts

@@ -1,16 +1,21 @@
-export { createEmailChannel, type EmailChannelOptions } from "./email-channel.js";
-export { createChannelEmailFeature } from "./feature.js";
-export { guardEmailMessage, withPiiCiphertextGuard } from "./pii-guard.js";
+export {
+  createEmailChannel,
+  type EmailChannelOptions,
+  type TenantTransportResolver,
+} from "./email-channel.ts";
+export { smtpEnvSchema } from "./env.ts";
+export { createChannelEmailFeature } from "./feature.ts";
+export { guardEmailMessage, withPiiCiphertextGuard } from "./pii-guard.ts";
 export {
   createSmtpTransport,
   createSmtpTransportFromEnv,
   type SmtpEnv,
   type SmtpTransportOptions,
-} from "./smtp-transport.js";
+} from "./smtp-transport.ts";
 export {
   createInMemoryTransport,
   type EmailAttachment,
   type EmailAttachmentRef,
   type EmailMessage,
   type EmailTransport,
-} from "./types.js";
+} from "./types.ts";

package/packages/bundled-features/src/channel-email/pii-guard.ts

@@ -1,5 +1,5 @@
 import { PII_CIPHERTEXT_PREFIX } from "@cosmicdrift/kumiko-framework/crypto";
-import type { EmailMessage, EmailTransport } from "./types.js";
+import type { EmailMessage, EmailTransport } from "./types.ts";
 
 const isProductionEnv = () => process.env["NODE_ENV"] === "production";
 // Version-agnostic: catches both the current PII_CIPHERTEXT_PREFIX and any

package/packages/bundled-features/src/channel-email/smtp-transport.ts

@@ -18,7 +18,7 @@
 
 import { createTransport, type Transporter } from "nodemailer";
 import addressparser from "nodemailer/lib/addressparser";
-import type { EmailAttachment, EmailMessage, EmailTransport } from "./types.js";
+import type { EmailAttachment, EmailMessage, EmailTransport } from "./types.ts";
 
 export type SmtpTransportOptions = {
   /** SMTP-Server-Host (z.B. "smtp.gmail.com", "in-v3.mailjet.com",

package/packages/bundled-features/src/channel-email/types.ts

@@ -3,7 +3,7 @@ import type {
   FileAttachmentRef,
   InlineAttachmentRef,
   RenderedPdfAttachmentRef,
-} from "../delivery/index.js";
+} from "../delivery/index.ts";
 
 export type { EmailAttachmentRef };
 

package/packages/bundled-features/src/channel-in-app/feature.ts

@@ -1,11 +1,11 @@
 import { DELIVERY_CHANNEL_EXTENSION } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { inboxQuery } from "./handlers/inbox.query.js";
-import { markAllReadWrite } from "./handlers/mark-all-read.write.js";
-import { markReadWrite } from "./handlers/mark-read.write.js";
-import { unreadCountQuery } from "./handlers/unread-count.query.js";
-import { inAppChannel } from "./in-app-channel.js";
-import { inAppMessagesTableMeta } from "./tables.js";
+import { inboxQuery } from "./handlers/inbox.query.ts";
+import { markAllReadWrite } from "./handlers/mark-all-read.write.ts";
+import { markReadWrite } from "./handlers/mark-read.write.ts";
+import { unreadCountQuery } from "./handlers/unread-count.query.ts";
+import { inAppChannel } from "./in-app-channel.ts";
+import { inAppMessagesTableMeta } from "./tables.ts";
 
 export function createChannelInAppFeature(): FeatureDefinition {
   return defineFeature("channel-in-app", (r) => {

package/packages/bundled-features/src/channel-in-app/handlers/inbox.query.ts

@@ -1,7 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { inAppMessagesTable } from "../tables.js";
+import { inAppMessagesTable } from "../tables.ts";
 
 export const inboxQuery = defineQueryHandler({
   name: "inbox",

package/packages/bundled-features/src/channel-in-app/handlers/mark-all-read.write.ts

@@ -1,7 +1,7 @@
 import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { inAppMessagesTable } from "../tables.js";
+import { inAppMessagesTable } from "../tables.ts";
 
 export const markAllReadWrite = defineWriteHandler({
   name: "markAllRead",

package/packages/bundled-features/src/channel-in-app/handlers/mark-read.write.ts

@@ -2,7 +2,7 @@ import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { inAppMessagesTable } from "../tables.js";
+import { inAppMessagesTable } from "../tables.ts";
 
 export const markReadWrite = defineWriteHandler({
   name: "markRead",

package/packages/bundled-features/src/channel-in-app/handlers/unread-count.query.ts

@@ -1,7 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { inAppMessagesTable } from "../tables.js";
+import { inAppMessagesTable } from "../tables.ts";
 
 export const unreadCountQuery = defineQueryHandler({
   name: "unreadCount",

package/packages/bundled-features/src/channel-in-app/in-app-channel.ts

@@ -1,6 +1,6 @@
 import { tenantChannel } from "@cosmicdrift/kumiko-framework/engine";
-import type { DeliveryChannel } from "../delivery/index.js";
-import { inAppMessagesTable } from "./tables.js";
+import type { DeliveryChannel } from "../delivery/index.ts";
+import { inAppMessagesTable } from "./tables.ts";
 
 export const inAppChannel: DeliveryChannel = {
   name: "inApp",

package/packages/bundled-features/src/channel-in-app/index.ts

@@ -1,4 +1,4 @@
-export { CHANNEL_IN_APP_FEATURE, InAppHandlers, InAppQueries } from "./constants.js";
-export { createChannelInAppFeature } from "./feature.js";
-export { inAppChannel } from "./in-app-channel.js";
-export { inAppMessagesTable } from "./tables.js";
+export { CHANNEL_IN_APP_FEATURE, InAppHandlers, InAppQueries } from "./constants.ts";
+export { createChannelInAppFeature } from "./feature.ts";
+export { inAppChannel } from "./in-app-channel.ts";
+export { inAppMessagesTable } from "./tables.ts";

package/packages/bundled-features/src/channel-push/feature.ts

@@ -1,6 +1,6 @@
 import { DELIVERY_CHANNEL_EXTENSION } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { createPushChannel, type PushChannelOptions } from "./push-channel.js";
+import { createPushChannel, type PushChannelOptions } from "./push-channel.ts";
 
 export function createChannelPushFeature(options: PushChannelOptions): FeatureDefinition {
   const channel = createPushChannel(options);

package/packages/bundled-features/src/channel-push/index.ts

@@ -1,3 +1,3 @@
-export { createChannelPushFeature } from "./feature.js";
-export { createPushChannel, type PushChannelOptions } from "./push-channel.js";
-export { createInMemoryPushTransport, type PushMessage, type PushTransport } from "./types.js";
+export { createChannelPushFeature } from "./feature.ts";
+export { createPushChannel, type PushChannelOptions } from "./push-channel.ts";
+export { createInMemoryPushTransport, type PushMessage, type PushTransport } from "./types.ts";

package/packages/bundled-features/src/channel-push/push-channel.ts

@@ -1,6 +1,6 @@
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { DeliveryChannel } from "../delivery/index.js";
-import type { PushTransport } from "./types.js";
+import type { DeliveryChannel } from "../delivery/index.ts";
+import type { PushTransport } from "./types.ts";
 
 export type PushChannelOptions = {
   readonly transport: PushTransport;

package/packages/bundled-features/src/channel-slack/feature.ts

@@ -9,7 +9,7 @@ import {
   createSlackChannel,
   SLACK_DEFAULT_ALLOWED_HOSTS,
   type SlackChannelOptions,
-} from "./slack-channel.js";
+} from "./slack-channel.ts";
 
 export function createChannelSlackFeature(options: SlackChannelOptions = {}): FeatureDefinition {
   return defineFeature("channel-slack", (r) => {

package/packages/bundled-features/src/channel-slack/index.ts

@@ -1,7 +1,7 @@
-export { createChannelSlackFeature } from "./feature.js";
+export { createChannelSlackFeature } from "./feature.ts";
 export {
   createSlackChannel,
   SLACK_DEFAULT_ALLOWED_HOSTS,
   SLACK_SECRET_KEYS,
   type SlackChannelOptions,
-} from "./slack-channel.js";
+} from "./slack-channel.ts";

package/packages/bundled-features/src/channel-slack/slack-channel.ts

@@ -3,7 +3,7 @@ import {
   chatMessageText,
   createChatWebhookChannel,
   type DeliveryChannel,
-} from "../delivery/index.js";
+} from "../delivery/index.ts";
 
 export type SlackChannelOptions = ChatWebhookChannelOptions;
 

package/packages/bundled-features/src/channel-teams/feature.ts

@@ -9,7 +9,7 @@ import {
   createTeamsChannel,
   TEAMS_DEFAULT_ALLOWED_HOSTS,
   type TeamsChannelOptions,
-} from "./teams-channel.js";
+} from "./teams-channel.ts";
 
 export function createChannelTeamsFeature(options: TeamsChannelOptions = {}): FeatureDefinition {
   return defineFeature("channel-teams", (r) => {

package/packages/bundled-features/src/channel-teams/index.ts

@@ -1,7 +1,7 @@
-export { createChannelTeamsFeature } from "./feature.js";
+export { createChannelTeamsFeature } from "./feature.ts";
 export {
   createTeamsChannel,
   TEAMS_DEFAULT_ALLOWED_HOSTS,
   TEAMS_SECRET_KEYS,
   type TeamsChannelOptions,
-} from "./teams-channel.js";
+} from "./teams-channel.ts";

package/packages/bundled-features/src/channel-teams/teams-channel.ts

@@ -4,7 +4,7 @@ import {
   type ChatWebhookResponse,
   createChatWebhookChannel,
   type DeliveryChannel,
-} from "../delivery/index.js";
+} from "../delivery/index.ts";
 
 export type TeamsChannelOptions = ChatWebhookChannelOptions;
 

package/packages/bundled-features/src/channel-telegram/feature.ts

@@ -5,7 +5,7 @@ import {
   createTelegramChannel,
   isTelegramBotToken,
   type TelegramChannelOptions,
-} from "./telegram-channel.js";
+} from "./telegram-channel.ts";
 
 export function createChannelTelegramFeature(
   options: TelegramChannelOptions = {},

package/packages/bundled-features/src/channel-telegram/index.ts

@@ -1,4 +1,4 @@
-export { createChannelTelegramFeature } from "./feature.js";
+export { createChannelTelegramFeature } from "./feature.ts";
 export {
   createTelegramChannel,
   isTelegramBotToken,
@@ -6,4 +6,4 @@ export {
   TELEGRAM_DEFAULT_API_BASE_URL,
   TELEGRAM_SECRET_KEYS,
   type TelegramChannelOptions,
-} from "./telegram-channel.js";
+} from "./telegram-channel.ts";

package/packages/bundled-features/src/channel-telegram/telegram-channel.ts

@@ -6,7 +6,7 @@ import {
   postChatWebhook,
   toChannelResult,
   truncateChars,
-} from "../delivery/index.js";
+} from "../delivery/index.ts";
 
 export type TelegramChannelOptions = {
   // App-level override (tests, self-hosted Bot API server); never tenant config.

package/packages/bundled-features/src/compliance-profiles/feature.ts

@@ -8,19 +8,19 @@ import {
   COMPLIANCE_PROFILE_CATALOG_EXTENSION_NAME,
   COMPLIANCE_PROFILE_SCREEN_ID,
   ComplianceProfileHandlers,
-} from "./constants.js";
-import { forTenantQuery } from "./handlers/for-tenant.query.js";
-import { listProfilesQuery } from "./handlers/list-profiles.query.js";
-import { createNeedsProfileQuery } from "./handlers/needs-profile.query.js";
-import { setProfileWrite } from "./handlers/set-profile.write.js";
-import { subProcessorsQuery } from "./handlers/sub-processors.query.js";
-import { COMPLIANCE_PROFILES_I18N } from "./i18n.js";
-import { tenantComplianceProfileEntity } from "./schema/profile-selection.js";
+} from "./constants.ts";
+import { forTenantQuery } from "./handlers/for-tenant.query.ts";
+import { listProfilesQuery } from "./handlers/list-profiles.query.ts";
+import { createNeedsProfileQuery } from "./handlers/needs-profile.query.ts";
+import { setProfileWrite } from "./handlers/set-profile.write.ts";
+import { subProcessorsQuery } from "./handlers/sub-processors.query.ts";
+import { COMPLIANCE_PROFILES_I18N } from "./i18n.ts";
+import { tenantComplianceProfileEntity } from "./schema/profile-selection.ts";
 
 export {
   tenantComplianceProfileEntity,
   tenantComplianceProfileTable,
-} from "./schema/profile-selection.js";
+} from "./schema/profile-selection.ts";
 
 // compliance-profiles — Tenant-weite DSGVO/Compliance-Profile-Wahl.
 //

package/packages/bundled-features/src/compliance-profiles/handlers/for-tenant.query.ts

@@ -6,8 +6,8 @@ import {
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { parseComplianceProfileOverride } from "../_internal/parse-override.js";
-import { tenantComplianceProfileTable } from "../schema/profile-selection.js";
+import { parseComplianceProfileOverride } from "../_internal/parse-override.ts";
+import { tenantComplianceProfileTable } from "../schema/profile-selection.ts";
 
 // Liefert das effektive Compliance-Profile fuer den aktuellen Tenant.
 // Macht den exposesApi-Marker aus feature.ts mit echtem Inhalt.

package/packages/bundled-features/src/compliance-profiles/handlers/needs-profile.query.ts

@@ -3,7 +3,7 @@ import type { ComplianceProfileKey } from "@cosmicdrift/kumiko-framework/complia
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { tenantComplianceProfileTable } from "../schema/profile-selection.js";
+import { tenantComplianceProfileTable } from "../schema/profile-selection.ts";
 
 // Onboarding banner trigger for tenant admin.
 //

package/packages/bundled-features/src/compliance-profiles/handlers/set-profile.write.ts

@@ -10,11 +10,11 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { requireForTenant } from "../../shared/index.js";
+import { requireForTenant } from "../../shared/index.ts";
 import {
   tenantComplianceProfileEntity,
   tenantComplianceProfileTable,
-} from "../schema/profile-selection.js";
+} from "../schema/profile-selection.ts";
 
 const crud = createEventStoreExecutor(tenantComplianceProfileTable, tenantComplianceProfileEntity, {
   entityName: "tenant-compliance-profile",

package/packages/bundled-features/src/compliance-profiles/index.ts

@@ -3,11 +3,11 @@ export {
   COMPLIANCE_PROFILES_FEATURE,
   ComplianceProfileHandlers,
   ComplianceProfileQueries,
-} from "./constants.js";
+} from "./constants.ts";
 export {
   type ComplianceProfilesFeatureOptions,
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
   tenantComplianceProfileTable,
-} from "./feature.js";
-export { resolveProfileForTenant } from "./resolve-for-tenant.js";
+} from "./feature.ts";
+export { resolveProfileForTenant } from "./resolve-for-tenant.ts";

package/packages/bundled-features/src/compliance-profiles/resolve-for-tenant.ts

@@ -16,9 +16,9 @@ import {
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { isTenantDb } from "../shared/index.js";
-import { parseComplianceProfileOverride } from "./_internal/parse-override.js";
-import { tenantComplianceProfileTable } from "./schema/profile-selection.js";
+import { isTenantDb } from "../shared/index.ts";
+import { parseComplianceProfileOverride } from "./_internal/parse-override.ts";
+import { tenantComplianceProfileTable } from "./schema/profile-selection.ts";
 
 export interface ResolveProfileForTenantArgs {
   // data-retention's resolveTenantRetentionPreset forwards this via

package/packages/bundled-features/src/compliance-profiles/seeding.ts

@@ -30,7 +30,7 @@ import {
 import {
   tenantComplianceProfileEntity,
   tenantComplianceProfileTable,
-} from "./schema/profile-selection.js";
+} from "./schema/profile-selection.ts";
 
 const executor = createEventStoreExecutor(
   tenantComplianceProfileTable,

package/packages/bundled-features/src/compliance-profiles/web/client-plugin.tsx

@@ -4,9 +4,9 @@ import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
 import {
   COMPLIANCE_PROFILE_CATALOG_EXTENSION_NAME,
   COMPLIANCE_PROFILES_FEATURE,
-} from "../constants.js";
-import { ComplianceProfileCatalog } from "./compliance-profile-catalog.js";
-import { defaultTranslations } from "./i18n.js";
+} from "../constants.ts";
+import { ComplianceProfileCatalog } from "./compliance-profile-catalog.tsx";
+import { defaultTranslations } from "./i18n.ts";
 
 export type ComplianceProfilesClientOptions = {
   readonly translations?: TranslationsByLocale;

package/packages/bundled-features/src/compliance-profiles/web/compliance-profile-catalog.tsx

@@ -10,7 +10,7 @@ import {
   useTranslation,
 } from "@cosmicdrift/kumiko-renderer";
 import type { ReactNode } from "react";
-import { ComplianceProfileQueries } from "../constants.js";
+import { ComplianceProfileQueries } from "../constants.ts";
 
 type ProfileSummary = {
   readonly key: string;

package/packages/bundled-features/src/compliance-profiles/web/index.ts

@@ -2,5 +2,5 @@
 export {
   type ComplianceProfilesClientOptions,
   complianceProfilesClient,
-} from "./client-plugin.js";
-export { ComplianceProfileCatalog } from "./compliance-profile-catalog.js";
+} from "./client-plugin.tsx";
+export { ComplianceProfileCatalog } from "./compliance-profile-catalog.tsx";

package/packages/bundled-features/src/compliance-profiles-ops/changes.json

@@ -0,0 +1,10 @@
+[
+  {
+    "version": "0.370.0",
+    "type": "breaking",
+    "title": "The deprecated complianceProfilesOpsFeature constant is removed",
+    "detail": "complianceProfilesOpsFeature was kept next to createComplianceProfilesOpsFeature() for one release. Mount the feature by calling createComplianceProfilesOpsFeature().",
+    "migration": "Run bun kumiko-upgrade --apply. It replaces complianceProfilesOpsFeature with createComplianceProfilesOpsFeature().",
+    "codemod": "scripts/codemod/feature-factory.ts"
+  }
+]

package/packages/bundled-features/src/compliance-profiles-ops/handlers/tenants-missing-profile.query.ts

@@ -2,8 +2,8 @@ import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { defineQueryHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { tenantComplianceProfileTable } from "../../compliance-profiles/index.js";
-import { decryptTenantNames, tenantTable } from "../../tenant/index.js";
+import { tenantComplianceProfileTable } from "../../compliance-profiles/index.ts";
+import { decryptTenantNames, tenantTable } from "../../tenant/index.ts";
 
 // SystemAdmin platform-wide counterpart to needs-profile (#2089).
 //