@cosmicdrift/kumiko-samples 0.369.0 → 0.370.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.369.0",
+  "version": "0.370.0",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.369.0",
+  "version": "0.370.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -32,6 +32,7 @@
     "./compliance-profiles-ops": "./src/compliance-profiles-ops/index.ts",
     "./config": "./src/config/index.ts",
     "./crypto-shredding": "./src/crypto-shredding/index.ts",
+    "./crypto-shredding/env": "./src/crypto-shredding/env/index.ts",
     "./config/web": "./src/config/web/index.ts",
     "./data-retention": "./src/data-retention/index.ts",
     "./readiness": "./src/readiness/index.ts",
@@ -75,7 +76,6 @@
     "./file-provider-s3": "./src/file-provider-s3/index.ts",
     "./file-provider-s3/lib": "./src/file-provider-s3/lib/index.ts",
     "./document-ingest-foundation": "./src/document-ingest-foundation/index.ts",
-    "./file-provider-s3-env": "./src/file-provider-s3-env/index.ts",
     "./file-provider-inmemory": "./src/file-provider-inmemory/index.ts",
     "./file-derivatives": "./src/file-derivatives/index.ts",
     "./derivatives-sharp": "./src/derivatives-sharp/index.ts",
@@ -118,7 +118,6 @@
     "./channel-teams": "./src/channel-teams/index.ts",
     "./channel-telegram": "./src/channel-telegram/index.ts",
     "./renderer-pdf": "./src/renderer-pdf/index.ts",
-    "./files-provider-s3": "./src/files-provider-s3/index.ts",
     "./rate-limiting": "./src/rate-limiting/index.ts",
     "./presets": "./src/presets/index.ts",
     "./secrets": "./src/secrets/index.ts",
@@ -137,7 +136,10 @@
     "./template-resolver/testing": "./src/template-resolver/testing.ts",
     "./template-resolver/web": "./src/template-resolver/web/index.ts",
     "./renderer-foundation": "./src/renderer-foundation/index.ts",
+    "./account-security": "./src/account-security/index.ts",
+    "./host-routing": "./src/host-routing/index.ts",
     "./legal-pages": "./src/legal-pages/index.ts",
+    "./legal-pages/constants": "./src/legal-pages/constants.ts",
     "./legal-pages/web": "./src/legal-pages/web/index.ts",
     "./waitlist": "./src/waitlist/index.ts",
     "./page-render": "./src/page-render/index.ts",
@@ -234,6 +236,10 @@
         "types": "./dist/crypto-shredding/index.d.ts",
         "default": "./dist/crypto-shredding/index.js"
       },
+      "./crypto-shredding/env": {
+        "types": "./dist/crypto-shredding/env/index.d.ts",
+        "default": "./dist/crypto-shredding/env/index.js"
+      },
       "./config/web": {
         "types": "./dist/config/web/index.d.ts",
         "default": "./dist/config/web/index.js"
@@ -406,10 +412,6 @@
         "types": "./dist/document-ingest-foundation/index.d.ts",
         "default": "./dist/document-ingest-foundation/index.js"
       },
-      "./file-provider-s3-env": {
-        "types": "./dist/file-provider-s3-env/index.d.ts",
-        "default": "./dist/file-provider-s3-env/index.js"
-      },
       "./file-provider-inmemory": {
         "types": "./dist/file-provider-inmemory/index.d.ts",
         "default": "./dist/file-provider-inmemory/index.js"
@@ -578,10 +580,6 @@
         "types": "./dist/renderer-pdf/index.d.ts",
         "default": "./dist/renderer-pdf/index.js"
       },
-      "./files-provider-s3": {
-        "types": "./dist/files-provider-s3/index.d.ts",
-        "default": "./dist/files-provider-s3/index.js"
-      },
       "./rate-limiting": {
         "types": "./dist/rate-limiting/index.d.ts",
         "default": "./dist/rate-limiting/index.js"
@@ -654,10 +652,22 @@
         "types": "./dist/renderer-foundation/index.d.ts",
         "default": "./dist/renderer-foundation/index.js"
       },
+      "./account-security": {
+        "types": "./dist/account-security/index.d.ts",
+        "default": "./dist/account-security/index.js"
+      },
+      "./host-routing": {
+        "types": "./dist/host-routing/index.d.ts",
+        "default": "./dist/host-routing/index.js"
+      },
       "./legal-pages": {
         "types": "./dist/legal-pages/index.d.ts",
         "default": "./dist/legal-pages/index.js"
       },
+      "./legal-pages/constants": {
+        "types": "./dist/legal-pages/constants.d.ts",
+        "default": "./dist/legal-pages/constants.js"
+      },
       "./legal-pages/web": {
         "types": "./dist/legal-pages/web/index.d.ts",
         "default": "./dist/legal-pages/web/index.js"

package/packages/bundled-features/src/account-security/README.md

@@ -0,0 +1,31 @@
+# account-security
+
+Self-service dashboard for the signed-in user. It composes the screens of
+[`auth-mfa`](../auth-mfa/) (enable MFA, regenerate recovery codes, disable MFA)
+and [`sessions`](../sessions/) (own sessions with revoke) into one screen,
+`account-security:screen:account-security`. The feature owns no handlers; the
+embedded screens keep their own handler access.
+
+## Setup
+
+```typescript
+import { createAccountSecurityFeature } from "@cosmicdrift/kumiko-bundled-features/account-security";
+import { createAuthMfaFeature } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
+import { createSessionsFeature } from "@cosmicdrift/kumiko-bundled-features/sessions";
+
+const features = [
+  createSessionsFeature(),
+  createAuthMfaFeature({ /* secrets, issuer */ }),
+  createAccountSecurityFeature(),
+];
+```
+
+## Options
+
+| Option | Default | Effect |
+| --- | --- | --- |
+| `access` | `openToAll` | Who may open the dashboard, e.g. `{ roles: ["Admin", "Editor"] }` |
+| `nav` | none | `{ order?, parent? }` adds a sidebar entry. Without it the screen is dormant and apps link it from the user menu |
+
+The MFA panels switch on `auth-mfa:query:status` (`enabled`), exported as
+`accountSecurityMfaStatusVisibility`.

package/packages/bundled-features/src/account-security/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.370.0",
+    "type": "improvement",
+    "title": "createAccountSecurityFeature bundles the self-service screen for MFA and own sessions",
+    "detail": "createAccountSecurityFeature({ nav?, access? }) registers account-security:screen:account-security, a dashboard that embeds the auth-mfa enable, regenerate and disable screens and the sessions list of the signed-in user. It owns no handlers; mount it next to auth-mfa and sessions, or let composeAuthStack({ mfa }) mount it. Without nav the screen is dormant (no sidebar entry); nav takes { order?, parent? } with order 90 by default. access defaults to every signed-in user. Apps with a local copy of this screen replace it with the bundled feature."
+  }
+]

package/packages/bundled-features/src/account-security/constants.ts

@@ -0,0 +1,6 @@
+// @runtime client
+
+export const ACCOUNT_SECURITY_FEATURE = "account-security";
+export const ACCOUNT_SECURITY_SCREEN_ID = "account-security";
+export const ACCOUNT_SECURITY_SCREEN_QN = `${ACCOUNT_SECURITY_FEATURE}:screen:${ACCOUNT_SECURITY_SCREEN_ID}`;
+export const ACCOUNT_SECURITY_NAV_LABEL = `${ACCOUNT_SECURITY_FEATURE}:nav.accountSecurity`;

package/packages/bundled-features/src/account-security/feature.ts

@@ -0,0 +1,100 @@
+import {
+  type AccessRule,
+  defineFeature,
+  type FeatureDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  AuthMfaQueries,
+  MFA_DISABLE_SCREEN_ID,
+  MFA_ENABLE_SCREEN_ID,
+  MFA_REGENERATE_RECOVERY_SCREEN_ID,
+} from "../auth-mfa/index.ts";
+import { SESSION_MINE_SCREEN_ID } from "../sessions/index.ts";
+import {
+  ACCOUNT_SECURITY_FEATURE,
+  ACCOUNT_SECURITY_NAV_LABEL,
+  ACCOUNT_SECURITY_SCREEN_ID,
+  ACCOUNT_SECURITY_SCREEN_QN,
+} from "./constants.ts";
+import { ACCOUNT_SECURITY_I18N } from "./i18n.ts";
+
+export interface AccountSecurityNavOptions {
+  readonly order?: number;
+  readonly parent?: string;
+}
+
+export interface AccountSecurityFeatureOptions {
+  // Who may open the dashboard. The embedded auth-mfa and sessions screens keep
+  // their own handler access, so narrowing here only hides the entry point.
+  readonly access?: AccessRule;
+  // Without a nav entry the screen stays dormant: apps reach it from a user
+  // menu or profile link instead of the sidebar.
+  readonly nav?: AccountSecurityNavOptions;
+}
+
+const DEFAULT_ACCESS: AccessRule = {
+  openToAll: { reason: "signed-in users manage their own account security" },
+};
+
+const DEFAULT_NAV_ORDER = 90;
+
+export const accountSecurityMfaStatusVisibility = {
+  query: AuthMfaQueries.status,
+  field: "enabled",
+} as const;
+
+export function createAccountSecurityFeature(
+  options: AccountSecurityFeatureOptions = {},
+): FeatureDefinition {
+  const { access = DEFAULT_ACCESS, nav } = options;
+  return defineFeature(ACCOUNT_SECURITY_FEATURE, (r) => {
+    r.describe(
+      "Self-service account dashboard: MFA enrollment, recovery codes and the user's own sessions, composed from the auth-mfa and sessions screens.",
+    );
+    r.requires({ features: ["sessions"] });
+    r.requires({ features: ["auth-mfa"] });
+    r.translations({ keys: ACCOUNT_SECURITY_I18N });
+
+    r.screen({
+      id: ACCOUNT_SECURITY_SCREEN_ID,
+      type: "dashboard",
+      access,
+      dormant: nav === undefined,
+      panels: [
+        {
+          kind: "screen",
+          id: "mfa-enable",
+          screen: `auth-mfa:screen:${MFA_ENABLE_SCREEN_ID}`,
+          visibleWhen: { ...accountSecurityMfaStatusVisibility, eq: false },
+        },
+        {
+          kind: "screen",
+          id: "mfa-regenerate",
+          screen: `auth-mfa:screen:${MFA_REGENERATE_RECOVERY_SCREEN_ID}`,
+          visibleWhen: { ...accountSecurityMfaStatusVisibility, eq: true },
+        },
+        {
+          kind: "screen",
+          id: "mfa-disable",
+          screen: `auth-mfa:screen:${MFA_DISABLE_SCREEN_ID}`,
+          visibleWhen: { ...accountSecurityMfaStatusVisibility, eq: true },
+        },
+        { kind: "screen", id: "sessions", screen: `sessions:screen:${SESSION_MINE_SCREEN_ID}` },
+      ],
+    });
+
+    if (nav !== undefined) {
+      // Explicit property assignments: the feature-AST parser reads neither
+      // `??`, shorthand properties nor a conditional spread, and the boot validator treats
+      // `parent: undefined` as a top-level entry.
+      const { order: navOrder = DEFAULT_NAV_ORDER, parent: navParent } = nav;
+      r.nav({
+        id: ACCOUNT_SECURITY_SCREEN_ID,
+        label: ACCOUNT_SECURITY_NAV_LABEL,
+        screen: ACCOUNT_SECURITY_SCREEN_QN,
+        order: navOrder,
+        parent: navParent,
+      });
+    }
+  });
+}

package/packages/bundled-features/src/account-security/i18n.ts

@@ -0,0 +1,9 @@
+// @runtime client
+// Server-registered so the framework projects these keys into the client bundle.
+
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const ACCOUNT_SECURITY_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:account-security.title": { de: "Konto & Sicherheit", en: "Account & Security" },
+  "account-security:nav.accountSecurity": { de: "Konto & Sicherheit", en: "Account & Security" },
+};

package/packages/bundled-features/src/account-security/index.ts

@@ -0,0 +1,13 @@
+export {
+  ACCOUNT_SECURITY_FEATURE,
+  ACCOUNT_SECURITY_NAV_LABEL,
+  ACCOUNT_SECURITY_SCREEN_ID,
+  ACCOUNT_SECURITY_SCREEN_QN,
+} from "./constants.ts";
+export {
+  type AccountSecurityFeatureOptions,
+  type AccountSecurityNavOptions,
+  accountSecurityMfaStatusVisibility,
+  createAccountSecurityFeature,
+} from "./feature.ts";
+export { ACCOUNT_SECURITY_I18N } from "./i18n.ts";

package/packages/bundled-features/src/admin-shell/feature.ts

@@ -7,22 +7,22 @@ import {
   defineFeature,
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_METRICS, type MetricDefinition } from "../metrics/index.js";
+import { DEFAULT_METRICS, type MetricDefinition } from "../metrics/index.ts";
 import {
   ADMIN_SHELL_FEATURE,
   DEFAULT_PLATFORM_WORKSPACE_ID,
   DEFAULT_TENANT_WORKSPACE_ID,
   PLATFORM_OVERVIEW_SCREEN_ID,
   TENANT_OVERVIEW_SCREEN_ID,
-} from "./constants.js";
-import { ADMIN_SHELL_I18N } from "./i18n.js";
+} from "./constants.ts";
+import { ADMIN_SHELL_I18N } from "./i18n.ts";
 import {
   OVERVIEW_TIME_RANGE,
   PLATFORM_SCOPE,
   PLATFORM_TENANT_FILTER,
   platformOverviewPanels,
   tenantOverviewPanels,
-} from "./overview-panels.js";
+} from "./overview-panels.ts";
 
 export type CreateAdminShellOptions = {
   /** Short workspace id for tenant operators (URL segment). Default `tenant-admin`. */

package/packages/bundled-features/src/admin-shell/index.ts

@@ -4,9 +4,9 @@ export {
   DEFAULT_TENANT_WORKSPACE_ID,
   PLATFORM_OVERVIEW_SCREEN_ID,
   TENANT_OVERVIEW_SCREEN_ID,
-} from "./constants.js";
-export { type CreateAdminShellOptions, createAdminShellFeature } from "./feature.js";
-export { ADMIN_SHELL_I18N } from "./i18n.js";
+} from "./constants.ts";
+export { type CreateAdminShellOptions, createAdminShellFeature } from "./feature.ts";
+export { ADMIN_SHELL_I18N } from "./i18n.ts";
 export {
   isOverviewQueryAllowed,
   type OverviewWorkspaceKind,
@@ -14,4 +14,4 @@ export {
   PLATFORM_OVERVIEW_ALLOWED_QUERIES,
   TENANT_OVERVIEW_ALLOWED_QUERIES,
   TENANT_OVERVIEW_FORBIDDEN_QUERIES,
-} from "./overview-allowlist.js";
+} from "./overview-allowlist.ts";

package/packages/bundled-features/src/admin-shell/overview-allowlist.ts

@@ -1,9 +1,9 @@
 // Hard-coded query allowlists for overview-home screens — security boundary
 // against privilege escalation via accidental cross-workspace fetches.
 
-import { CapOverviewQueries } from "../cap-overview/index.js";
-import { JobQueries } from "../jobs/index.js";
-import { METRICS_FEATURE, METRICS_SYSTEM_FEATURE } from "../metrics/index.js";
+import { CapOverviewQueries } from "../cap-overview/index.ts";
+import { JobQueries } from "../jobs/index.ts";
+import { METRICS_FEATURE, METRICS_SYSTEM_FEATURE } from "../metrics/index.ts";
 
 export type OverviewWorkspaceKind = "tenant" | "platform";
 

package/packages/bundled-features/src/admin-shell/overview-panels.ts

@@ -11,9 +11,9 @@ import type {
   DashboardStatPanel,
   DashboardTimeRangeDefinition,
 } from "@cosmicdrift/kumiko-framework/ui-types";
-import { CapOverviewQueries } from "../cap-overview/index.js";
-import { JobQueries } from "../jobs/index.js";
-import { type MetricDefinition, type MetricScope, metricQueryName } from "../metrics/index.js";
+import { CapOverviewQueries } from "../cap-overview/index.ts";
+import { JobQueries } from "../jobs/index.ts";
+import { type MetricDefinition, type MetricScope, metricQueryName } from "../metrics/index.ts";
 
 const I = "admin-shell:overview";
 

package/packages/bundled-features/src/admin-shell/web/client-plugin.tsx

@@ -1,8 +1,8 @@
 // @runtime client
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
-import { ADMIN_SHELL_FEATURE } from "../constants.js";
-import { defaultTranslations } from "./i18n.js";
+import { ADMIN_SHELL_FEATURE } from "../constants.ts";
+import { defaultTranslations } from "./i18n.ts";
 
 export type AdminShellClientOptions = {
   readonly translations?: TranslationsByLocale;

package/packages/bundled-features/src/admin-shell/web/i18n.ts

@@ -5,7 +5,7 @@ import {
   type TranslationsByLocale,
   translationsByLocaleFromKeys,
 } from "@cosmicdrift/kumiko-renderer";
-import { ADMIN_SHELL_I18N } from "../i18n.js";
+import { ADMIN_SHELL_I18N } from "../i18n.ts";
 
 export const defaultTranslations: TranslationsByLocale =
   translationsByLocaleFromKeys(ADMIN_SHELL_I18N);

package/packages/bundled-features/src/admin-shell/web/index.ts

@@ -1,2 +1,2 @@
 // @runtime client
-export { type AdminShellClientOptions, adminShellClient } from "./client-plugin.js";
+export { type AdminShellClientOptions, adminShellClient } from "./client-plugin.tsx";

package/packages/bundled-features/src/agent-tools/agent-doc-lint.ts

@@ -13,7 +13,7 @@ import {
   toKebab,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { systemOnlyPropertyNames } from "./agent-manifest.js";
+import { systemOnlyPropertyNames } from "./agent-manifest.ts";
 
 export const AgentDocGapKinds = {
   handlerSchemaNotExpressible: "handler-schema-not-expressible",

package/packages/bundled-features/src/agent-tools/agent-manifest.ts

@@ -20,7 +20,7 @@ import {
 import { translationValueOtherText } from "@cosmicdrift/kumiko-framework/ui-types";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
-import { recordManifestDenyQns } from "./manifest-deny-qns.js";
+import { recordManifestDenyQns } from "./manifest-deny-qns.ts";
 import type {
   AgentManifest,
   AgentManifestEntity,
@@ -32,7 +32,7 @@ import type {
   AgentManifestScreen,
   AgentManifestWorkspace,
   RegistryManifestView,
-} from "./types.js";
+} from "./types.ts";
 
 /** The manifest surfaces one string per locale — a plural entry reads as its
  *  CLDR `other` form since the manifest has no `count` to select a category. */

package/packages/bundled-features/src/agent-tools/feature.ts

@@ -3,7 +3,7 @@ import {
   findAgentDocGaps,
   findHandlerTranslationGaps,
   formatAgentDocGap,
-} from "./agent-doc-lint.js";
+} from "./agent-doc-lint.ts";
 
 export const AGENT_TOOLS_FEATURE_NAME = "agent-tools";
 

package/packages/bundled-features/src/agent-tools/index.ts

@@ -1,15 +1,15 @@
-export type { AgentDocGap, AgentDocGapKind } from "./agent-doc-lint.js";
+export type { AgentDocGap, AgentDocGapKind } from "./agent-doc-lint.ts";
 export {
   AgentDocGapKinds,
   findAgentDocGaps,
   findHandlerTranslationGaps,
   formatAgentDocGap,
-} from "./agent-doc-lint.js";
-export { buildAgentManifest } from "./agent-manifest.js";
-export { AGENT_TOOLS_FEATURE_NAME, createAgentToolsFeature } from "./feature.js";
-export { buildToolCatalog, OPEN_FORM_TOOL_NAME, toolNameForQn } from "./tool-catalog.js";
-export type { ToolCallRequest, ToolCallResult, ToolDispatcher } from "./tool-dispatch.js";
-export { dispatchToolCall } from "./tool-dispatch.js";
+} from "./agent-doc-lint.ts";
+export { buildAgentManifest } from "./agent-manifest.ts";
+export { AGENT_TOOLS_FEATURE_NAME, createAgentToolsFeature } from "./feature.ts";
+export { buildToolCatalog, OPEN_FORM_TOOL_NAME, toolNameForQn } from "./tool-catalog.ts";
+export type { ToolCallRequest, ToolCallResult, ToolDispatcher } from "./tool-dispatch.ts";
+export { dispatchToolCall } from "./tool-dispatch.ts";
 export type {
   AgentManifest,
   AgentManifestEntity,
@@ -27,4 +27,4 @@ export type {
   ToolCatalogOptions,
   ToolDefinition,
   ToolDispatchDescriptor,
-} from "./types.js";
+} from "./types.ts";

package/packages/bundled-features/src/agent-tools/manifest-deny-qns.ts

@@ -1,4 +1,4 @@
-import type { AgentManifest } from "./types.js";
+import type { AgentManifest } from "./types.ts";
 
 // The deny list is deliberately not a manifest field (the manifest is prompt
 // payload), so the catalog builder learns it through this side channel to

package/packages/bundled-features/src/agent-tools/tool-catalog.ts

@@ -5,8 +5,8 @@ import type {
   QueryHandlerDef,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { hasAccess, normalizeAccessEntry } from "@cosmicdrift/kumiko-framework/engine";
-import { FILTER_OPS, isRecord } from "./filter-ops.js";
-import { assertCatalogMirrorsManifestDenyQns } from "./manifest-deny-qns.js";
+import { FILTER_OPS, isRecord } from "./filter-ops.ts";
+import { assertCatalogMirrorsManifestDenyQns } from "./manifest-deny-qns.ts";
 import type {
   AgentManifest,
   AgentManifestEntity,
@@ -18,7 +18,7 @@ import type {
   ToolCatalogOptions,
   ToolDefinition,
   ToolDispatchDescriptor,
-} from "./types.js";
+} from "./types.ts";
 
 const MAX_TOOL_NAME_LENGTH = 64;
 

package/packages/bundled-features/src/agent-tools/tool-dispatch.ts

@@ -3,8 +3,8 @@ import { isKumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import { runAsDirectCallEntry } from "@cosmicdrift/kumiko-framework/internal/request-context";
 import { createFallbackLogger, type Logger } from "@cosmicdrift/kumiko-framework/logging";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
-import { FILTER_OPS, isRecord } from "./filter-ops.js";
-import type { ToolDispatchDescriptor } from "./types.js";
+import { FILTER_OPS, isRecord } from "./filter-ops.ts";
+import type { ToolDispatchDescriptor } from "./types.ts";
 
 /** Narrow view of `Dispatcher` (packages/framework/src/pipeline/dispatcher.ts) — kept out of
  *  `ToolDispatchDescriptor`'s reach and small enough for tests to build a plain object instead

package/packages/bundled-features/src/audit/feature.ts

@@ -11,12 +11,12 @@ import {
   AUDIT_LOG_SCREEN_ID,
   AuditQueries,
   DEFAULT_ESCAPE_HATCH_RETENTION_DAYS,
-} from "./constants.js";
-import { escapeHatchUsedSchema } from "./escape-hatch-audit-sink.js";
-import { detailsQuery } from "./handlers/details.query.js";
-import { listQuery } from "./handlers/list.query.js";
-import { AUDIT_I18N } from "./i18n.js";
-import { runEscapeHatchRetention } from "./run-escape-hatch-retention.js";
+} from "./constants.ts";
+import { escapeHatchUsedSchema } from "./escape-hatch-audit-sink.ts";
+import { detailsQuery } from "./handlers/details.query.ts";
+import { listQuery } from "./handlers/list.query.ts";
+import { AUDIT_I18N } from "./i18n.ts";
+import { runEscapeHatchRetention } from "./run-escape-hatch-retention.ts";
 
 // Audit feature — exposes a filtered read over the framework's event log.
 //

package/packages/bundled-features/src/audit/handlers/details.query.ts

@@ -7,9 +7,9 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import * as z from "zod";
-import { redactPiiCiphertext } from "../../shared/index.js";
-import { AUDIT_SCOPE_VALUES } from "../constants.js";
-import { resolveAuditScopeFilter } from "./resolve-audit-tenant.js";
+import { redactPiiCiphertext } from "../../shared/index.ts";
+import { AUDIT_SCOPE_VALUES } from "../constants.ts";
+import { resolveAuditScopeFilter } from "./resolve-audit-tenant.ts";
 
 export const detailsQuery = defineQueryHandler({
   name: "details",

package/packages/bundled-features/src/audit/handlers/list.query.ts

@@ -17,9 +17,9 @@ import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { redactPiiCiphertext } from "../../shared/index.js";
-import { AUDIT_SCOPE_VALUES } from "../constants.js";
-import { resolveAuditScopeFilter } from "./resolve-audit-tenant.js";
+import { redactPiiCiphertext } from "../../shared/index.ts";
+import { AUDIT_SCOPE_VALUES } from "../constants.ts";
+import { resolveAuditScopeFilter } from "./resolve-audit-tenant.ts";
 
 const MAX_LIMIT = 100;
 

package/packages/bundled-features/src/audit/handlers/resolve-audit-tenant.ts

@@ -2,7 +2,7 @@ import { mayOverrideTenant, type SessionUser } from "@cosmicdrift/kumiko-framewo
 import { AccessDeniedError, FrameworkReasons } from "@cosmicdrift/kumiko-framework/errors";
 import { APP_INSTANCE_STREAM_TYPE } from "@cosmicdrift/kumiko-framework/event-store";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-types/identifiers";
-import { type AuditScope, AuditScopes } from "../constants.js";
+import { type AuditScope, AuditScopes } from "../constants.ts";
 
 export type AuditScopeFilter = { readonly tenantId: string; readonly aggregateType?: string };
 

package/packages/bundled-features/src/audit/index.ts

@@ -1,3 +1,3 @@
-export { AUDIT_FEATURE, AuditQueries } from "./constants.js";
-export { createEscapeHatchAuditSink, ESCAPE_HATCH_USED_EVENT } from "./escape-hatch-audit-sink.js";
-export { createAuditFeature } from "./feature.js";
+export { AUDIT_FEATURE, AuditQueries } from "./constants.ts";
+export { createEscapeHatchAuditSink, ESCAPE_HATCH_USED_EVENT } from "./escape-hatch-audit-sink.ts";
+export { createAuditFeature } from "./feature.ts";

package/packages/bundled-features/src/audit/run-escape-hatch-retention.ts

@@ -18,16 +18,16 @@ import {
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { pruneEvents } from "@cosmicdrift/kumiko-framework/pipeline";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { resolveProfileForTenant } from "../compliance-profiles/index.js";
-import { createConfigAccessor } from "../config/index.js";
+import { resolveProfileForTenant } from "../compliance-profiles/index.ts";
+import { createConfigAccessor } from "../config/index.ts";
 import {
   DEFAULT_ESCAPE_HATCH_RETENTION_DAYS,
   ESCAPE_HATCH_RETENTION_DAYS_KEY,
-} from "./constants.js";
+} from "./constants.ts";
 import {
   ESCAPE_HATCH_USE_AGGREGATE_TYPE,
   escapeHatchUsedSchema,
-} from "./escape-hatch-audit-sink.js";
+} from "./escape-hatch-audit-sink.ts";
 
 // pruneEvents opens its own transaction, so a runner that cannot begin one (a tx handle) is rejected instead of nested.
 export function isDbConnection(runner: DbRunner): runner is DbConnection {

package/packages/bundled-features/src/audit/web/client-plugin.tsx

@@ -1,8 +1,8 @@
 // @runtime client
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
-import { AUDIT_FEATURE } from "../constants.js";
-import { defaultTranslations } from "./i18n.js";
+import { AUDIT_FEATURE } from "../constants.ts";
+import { defaultTranslations } from "./i18n.ts";
 
 export type AuditClientOptions = {
   readonly translations?: TranslationsByLocale;

package/packages/bundled-features/src/audit/web/i18n.ts

@@ -3,6 +3,6 @@ import {
   type TranslationsByLocale,
   translationsByLocaleFromKeys,
 } from "@cosmicdrift/kumiko-renderer";
-import { AUDIT_I18N } from "../i18n.js";
+import { AUDIT_I18N } from "../i18n.ts";
 
 export const defaultTranslations: TranslationsByLocale = translationsByLocaleFromKeys(AUDIT_I18N);

package/packages/bundled-features/src/audit/web/index.ts

@@ -1,3 +1,3 @@
 // @runtime client
 
-export { type AuditClientOptions, auditClient } from "./client-plugin.js";
+export { type AuditClientOptions, auditClient } from "./client-plugin.tsx";