@cosmicdrift/kumiko-samples 0.369.0 → 0.370.0

package/packages/bundled-features/src/secrets/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.370.0",
+    "type": "improvement",
+    "title": "createSecretsFeature carries its env schema type",
+    "detail": "createSecretsFeature returns the feature typed with secretsEnvSchema, so composeEnvSchema types the KUMIKO_SECRETS_MASTER_KEY_* variables."
+  },
+  {
+    "version": "0.370.0",
+    "type": "improvement",
+    "title": "secrets exports SecretsHandlers (set, delete) and SecretsQueries (list) handler names",
+    "detail": "Apps dispatch secrets:write:set, secrets:write:delete and the list query through the exported constants like ConfigHandlers, instead of string literals."
+  },
   {
     "version": "0.369.0",
     "type": "fix",

package/packages/bundled-features/src/secrets/constants.ts

@@ -19,4 +19,13 @@ export const SECRETS_ERROR_KEYS = {
   invalidValue: "secrets.errors.invalidValue",
 } as const;
 
+export const SecretsHandlers = {
+  set: "secrets:write:set",
+  delete: "secrets:write:delete",
+} as const;
+
+export const SecretsQueries = {
+  list: "secrets:query:list",
+} as const;
+
 export const INVALID_SECRET_VALUE_CODE = "invalid_secret_value" as const;

package/packages/bundled-features/src/secrets/db/queries/read.ts

@@ -1,7 +1,7 @@
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { StoredEnvelope } from "../../table.js";
+import type { StoredEnvelope } from "../../table.ts";
 
 export async function selectTenantSecretEnvelope(
   db: DbRunner,

package/packages/bundled-features/src/secrets/feature.ts

@@ -5,18 +5,19 @@ import {
   type FeatureDefinition,
   SYSTEM_ROLE,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureWithEnvSchema, featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { SETTINGS_HUB_I18N } from "@cosmicdrift/kumiko-framework/i18n";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import * as z from "zod";
-import { DEFAULT_SECRETS_ACCESS } from "./constants.js";
-import { createDeleteHandler } from "./handlers/delete.write.js";
-import { createListHandler } from "./handlers/list.query.js";
-import { rotateJob } from "./handlers/rotate.job.js";
-import { createSetHandler } from "./handlers/set.write.js";
-import { SECRETS_I18N } from "./i18n.js";
-import { secretReadSchema } from "./secrets-context.js";
-import { tenantSecretEntity, tenantSecretsTable } from "./table.js";
+import { DEFAULT_SECRETS_ACCESS } from "./constants.ts";
+import { createDeleteHandler } from "./handlers/delete.write.ts";
+import { createListHandler } from "./handlers/list.query.ts";
+import { rotateJob } from "./handlers/rotate.job.ts";
+import { createSetHandler } from "./handlers/set.write.ts";
+import { SECRETS_I18N } from "./i18n.ts";
+import { secretReadSchema } from "./secrets-context.ts";
+import { tenantSecretEntity, tenantSecretsTable } from "./table.ts";
 
 const ROTATE_ESCAPE_HATCH_REASON = "re-encrypts every tenant's secrets with the new master key";
 
@@ -61,8 +62,8 @@ export {
   type SecretsContext,
   type SecretsContextOptions,
   TENANT_SECRET_READ_EVENT,
-} from "./secrets-context.js";
-export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./table.js";
+} from "./secrets-context.ts";
+export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./table.ts";
 
 // The settings form saves config values and secrets in one /api/batch; the secret
 // write has to join that transaction so a rejected command rolls it back too.
@@ -147,12 +148,14 @@ function withSystemWriter(rule: AccessRule): AccessRule {
   return { ...rule, roles: [SYSTEM_ROLE, ...rule.roles] };
 }
 
-export function createSecretsFeature(opts: SecretsFeatureOptions = {}): FeatureDefinition {
+export function createSecretsFeature(
+  opts: SecretsFeatureOptions = {},
+): FeatureWithEnvSchema<FeatureDefinition, typeof secretsEnvSchema.shape> {
   const access = resolveSecretsAccess(opts);
   const writeAccess = withSystemWriter(access);
-  return defineFeature(SECRETS_FEATURE_NAME, (r) => {
+  const feature: FeatureDefinition = defineFeature(SECRETS_FEATURE_NAME, (r) => {
     r.describe(
-      'Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins). Server-side code writes a tenant secret with `dispatchSystemWrite({ handlerQn: "secrets:write:set", payload, tenantId })`: set and delete also admit the in-process system identity, so such writes pass the same declared-key and value checks.',
+      'Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins). Server-side code writes a tenant secret with `dispatchSystemWrite({ handlerQn: SecretsHandlers.set, payload, tenantId })`: set and delete also admit the in-process system identity, so such writes pass the same declared-key and value checks.',
     );
     r.uiHints({
       displayLabel: "Tenant Secrets",
@@ -219,4 +222,5 @@ export function createSecretsFeature(opts: SecretsFeatureOptions = {}): FeatureD
     // ops-tool (see docs/plans/architecture/event-dispatcher.md §retention).
     // No per-feature retention-job anymore.
   });
+  return featureWithEnvSchema(feature, secretsEnvSchema);
 }

package/packages/bundled-features/src/secrets/handlers/delete.write.ts

@@ -1,10 +1,10 @@
 import { type AccessRule, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { announceSecretChange } from "../announce-secret-change.js";
-import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
-import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
-import { checkSecretKeyWrite } from "../write-gate.js";
+import { announceSecretChange } from "../announce-secret-change.ts";
+import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../constants.ts";
+import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.ts";
+import { checkSecretKeyWrite } from "../write-gate.ts";
 
 export function createDeleteHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
   return defineWriteHandler({
@@ -18,7 +18,7 @@ export function createDeleteHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS)
     access,
     escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
     handler: async (event, ctx) => {
-      const secrets = requireSecretsContext(ctx, "secrets:write:delete").withRunner(
+      const secrets = requireSecretsContext(ctx, SecretsHandlers.delete).withRunner(
         ctx.db.unsafeRaw(),
       );
       const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key, {

package/packages/bundled-features/src/secrets/handlers/list.query.ts

@@ -1,7 +1,7 @@
 import { type AccessRule, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
-import { tenantSecretsTable } from "../table.js";
+import { DEFAULT_SECRETS_ACCESS } from "../constants.ts";
+import { tenantSecretsTable } from "../table.ts";
 
 // Lists all secrets for the current tenant. Returns redactedPreview, never
 // the plaintext. Decryption would be pointless here anyway — this is the

package/packages/bundled-features/src/secrets/handlers/rotate.job.ts

@@ -31,8 +31,8 @@ import {
   encodeStoredEnvelope,
   rewrapDek,
 } from "@cosmicdrift/kumiko-framework/secrets";
-import { type ChunkedMigrationStopReason, runChunkedMigration } from "../../shared/index.js";
-import { type StoredEnvelope, tenantSecretEntity, tenantSecretsTable } from "../table.js";
+import { type ChunkedMigrationStopReason, runChunkedMigration } from "../../shared/index.ts";
+import { type StoredEnvelope, tenantSecretEntity, tenantSecretsTable } from "../table.ts";
 
 const DEFAULT_BATCH_SIZE = 100;
 const DEFAULT_MAX_FAILURES = 10;

package/packages/bundled-features/src/secrets/handlers/set.write.ts

@@ -1,9 +1,9 @@
 import { type AccessRule, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { announceSecretChange } from "../announce-secret-change.js";
-import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
-import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
-import { checkSecretKeyWrite, checkSecretValue } from "../write-gate.js";
+import { announceSecretChange } from "../announce-secret-change.ts";
+import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../constants.ts";
+import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.ts";
+import { checkSecretKeyWrite, checkSecretValue } from "../write-gate.ts";
 
 export function createSetHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
   return defineWriteHandler({
@@ -25,7 +25,7 @@ export function createSetHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
     access,
     escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
     handler: async (event, ctx) => {
-      const secrets = requireSecretsContext(ctx, "secrets:write:set").withRunner(
+      const secrets = requireSecretsContext(ctx, SecretsHandlers.set).withRunner(
         ctx.db.unsafeRaw(),
       );
       const { key, value, redactedPreview, hint } = event.payload;

package/packages/bundled-features/src/secrets/i18n.ts

@@ -1,4 +1,4 @@
-import { SECRETS_ERROR_KEYS } from "./constants.js";
+import { SECRETS_ERROR_KEYS } from "./constants.ts";
 
 export const SECRETS_I18N = {
   [SECRETS_ERROR_KEYS.unknownKey]: {

package/packages/bundled-features/src/secrets/index.ts

@@ -3,7 +3,9 @@ export {
   DEFAULT_SECRETS_ROLES,
   INVALID_SECRET_VALUE_CODE,
   SECRETS_ERROR_KEYS,
-} from "./constants.js";
+  SecretsHandlers,
+  SecretsQueries,
+} from "./constants.ts";
 export {
   createSecretsContext,
   createSecretsFeature,
@@ -18,13 +20,13 @@ export {
   secretsEnvSchema,
   TENANT_SECRET_READ_EVENT,
   tenantSecretsTable,
-} from "./feature.js";
-export { createDeleteHandler } from "./handlers/delete.write.js";
-export { createListHandler } from "./handlers/list.query.js";
+} from "./feature.ts";
+export { createDeleteHandler } from "./handlers/delete.write.ts";
+export { createListHandler } from "./handlers/list.query.ts";
 export {
   type RotateJobPayload,
   type RotateJobResult,
   rotateJob,
-} from "./handlers/rotate.job.js";
-export { createSetHandler } from "./handlers/set.write.js";
-export { isInvalidSecretValueError } from "./write-gate.js";
+} from "./handlers/rotate.job.ts";
+export { createSetHandler } from "./handlers/set.write.ts";
+export { isInvalidSecretValueError } from "./write-gate.ts";

package/packages/bundled-features/src/secrets/secrets-context.ts

@@ -37,18 +37,18 @@ import {
 } from "@cosmicdrift/kumiko-framework/secrets";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
-import { selectTenantSecretEnvelope } from "./db/queries/read.js";
+import { selectTenantSecretEnvelope } from "./db/queries/read.ts";
 import {
   type StoredEnvelope,
   type StoredMetadata,
   tenantSecretEntity,
   tenantSecretsTable,
-} from "./table.js";
+} from "./table.ts";
 import {
   invalidSecretValueError,
   isSecretValueValid,
   type SecretValueSchemaSource,
-} from "./write-gate.js";
+} from "./write-gate.ts";
 
 // Re-export the framework interface so consumers of bundled-features/secrets
 // don't need to reach into @cosmicdrift/kumiko-framework/secrets separately.

package/packages/bundled-features/src/secrets/write-gate.ts

@@ -11,7 +11,7 @@ import {
   type WriteFailure,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
-import { INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS } from "./constants.js";
+import { INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS } from "./constants.ts";
 
 // Fixed keys carry their definition (redact fn, writeRoles); namespace keys
 // only the namespace, which has no redact fn.

package/packages/bundled-features/src/seo/feature.ts

@@ -6,14 +6,14 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
-import { LEGAL_ROUTES } from "../legal-pages/index.js";
-import { cachedSecurePageResponse } from "../page-render/index.js";
-import { rateLimitedTextResponse, type SystemQueryFn } from "../shared/index.js";
-import { SEO_CONFIG_KEYS, SEO_DEFAULT_PATHS } from "./constants.js";
-import { seoConfigQuery } from "./handlers/seo-config.query.js";
-import { buildLlmsTxt } from "./llms-txt.js";
-import { buildRobotsTxt, type RobotsPolicy } from "./robots-txt.js";
-import { buildSitemapXml, type SitemapEntry } from "./sitemap.js";
+import { LEGAL_ROUTES } from "../legal-pages/index.ts";
+import { cachedSecurePageResponse } from "../page-render/index.ts";
+import { rateLimitedTextResponse, type SystemQueryFn } from "../shared/index.ts";
+import { SEO_CONFIG_KEYS, SEO_DEFAULT_PATHS } from "./constants.ts";
+import { seoConfigQuery } from "./handlers/seo-config.query.ts";
+import { buildLlmsTxt } from "./llms-txt.ts";
+import { buildRobotsTxt, type RobotsPolicy } from "./robots-txt.ts";
+import { buildSitemapXml, type SitemapEntry } from "./sitemap.ts";
 
 // 300s-shared-cache: sitemap/llms.txt change rarely (new page publish, not
 // per-request), longer than legal-pages/managed-pages' 60s content cache.

package/packages/bundled-features/src/seo/handlers/seo-config.query.ts

@@ -1,6 +1,6 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { SEO_CONFIG_QN } from "../constants.js";
+import { SEO_CONFIG_QN } from "../constants.ts";
 
 // Public read of the seo feature's own tenant-config values, for the
 // anonymous sitemap.xml/llms.txt routes (a Response is per-request; those

package/packages/bundled-features/src/seo/index.ts

@@ -1,18 +1,18 @@
-export { SEO_CONFIG_KEYS, SEO_CONFIG_QN, SEO_DEFAULT_PATHS, SEO_FEATURE } from "./constants.js";
+export { SEO_CONFIG_KEYS, SEO_CONFIG_QN, SEO_DEFAULT_PATHS, SEO_FEATURE } from "./constants.ts";
 export {
   createSeoFeature,
   type ManagedPagesDiscoveryOptions,
   runSeoBootCheck,
   type SeoBootCheckCtx,
   type SeoOptions,
-} from "./feature.js";
+} from "./feature.ts";
 export {
   buildLlmsTxt,
   type LlmsTxtInput,
   type LlmsTxtLink,
   type LlmsTxtSection,
-} from "./llms-txt.js";
-export { buildRobotsTxt, type RobotsPolicy } from "./robots-txt.js";
+} from "./llms-txt.ts";
+export { buildRobotsTxt, type RobotsPolicy } from "./robots-txt.ts";
 export {
   type FaqItem,
   faqPageSchema,
@@ -20,5 +20,5 @@ export {
   organizationSchema,
   type WebPageSchemaInput,
   webPageSchema,
-} from "./schema-builders.js";
-export { buildSitemapXml, type SitemapEntry } from "./sitemap.js";
+} from "./schema-builders.ts";
+export { buildSitemapXml, type SitemapEntry } from "./sitemap.ts";

package/packages/bundled-features/src/sessions/feature.ts

@@ -9,27 +9,27 @@ import {
   defineFeature,
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { USER_SESSION_ENTITY_NAME } from "./constants.js";
-import { cleanupJob } from "./handlers/cleanup.job.js";
-import { createDetailQuery } from "./handlers/detail.query.js";
-import { createListQuery } from "./handlers/list.query.js";
-import { mineQuery } from "./handlers/mine.query.js";
-import { revokeWrite } from "./handlers/revoke.write.js";
-import { revokeAllForUserWrite } from "./handlers/revoke-all-for-user.write.js";
-import { revokeAllOthersWrite } from "./handlers/revoke-all-others.write.js";
-import { SESSIONS_I18N } from "./i18n.js";
-import { userSessionEntity } from "./schema/user-session.js";
+import { USER_SESSION_ENTITY_NAME } from "./constants.ts";
+import { cleanupJob } from "./handlers/cleanup.job.ts";
+import { createDetailQuery } from "./handlers/detail.query.ts";
+import { createListQuery } from "./handlers/list.query.ts";
+import { mineQuery } from "./handlers/mine.query.ts";
+import { revokeWrite } from "./handlers/revoke.write.ts";
+import { revokeAllForUserWrite } from "./handlers/revoke-all-for-user.write.ts";
+import { revokeAllOthersWrite } from "./handlers/revoke-all-others.write.ts";
+import { SESSIONS_I18N } from "./i18n.ts";
+import { userSessionEntity } from "./schema/user-session.ts";
 import {
   createSessionDetailScreen,
   createSessionListScreen,
   sessionMineScreen,
-} from "./screens.js";
+} from "./screens.ts";
 import {
   createSessionCallbacks,
   type SessionAllOthersRevoker,
   type SessionMassRevoker,
-} from "./session-callbacks.js";
-import { SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema } from "./session-revoked-event.js";
+} from "./session-callbacks.ts";
+import { SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema } from "./session-revoked-event.ts";
 
 const CLEANUP_ESCAPE_HATCH_REASON = "deletes expired session rows of every tenant";
 

package/packages/bundled-features/src/sessions/handlers/cleanup.job.ts

@@ -20,7 +20,7 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { JobContext } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { deleteStaleSessionsBatch } from "../db/queries/cleanup.js";
+import { deleteStaleSessionsBatch } from "../db/queries/cleanup.ts";
 
 const DEFAULT_OLDER_THAN_DAYS = 30;
 const DEFAULT_BATCH_SIZE = 1000;

package/packages/bundled-features/src/sessions/handlers/detail.query.ts

@@ -1,8 +1,8 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { decryptStoredPii } from "../../shared/index.js";
-import { userSessionTable } from "../schema/user-session.js";
+import { decryptStoredPii } from "../../shared/index.ts";
+import { userSessionTable } from "../schema/user-session.ts";
 
 // Admin single-session inspector — mirrors list.query's decrypt handling for
 // the one-row case. ctx.db (TenantDb) applies tenant-scoping automatically.

package/packages/bundled-features/src/sessions/handlers/list.query.ts

@@ -6,8 +6,8 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
-import { decryptStoredPii } from "../../shared/index.js";
-import { userSessionTable } from "../schema/user-session.js";
+import { decryptStoredPii } from "../../shared/index.ts";
+import { userSessionTable } from "../schema/user-session.ts";
 
 // `sort` arrives raw from the client's query string. selectMany's orderBy
 // has no column-existence check — an unrecognised field just gets

package/packages/bundled-features/src/sessions/handlers/mine.query.ts

@@ -1,8 +1,8 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { definePagedQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { decryptStoredPii } from "../../shared/index.js";
-import { userSessionTable } from "../schema/user-session.js";
+import { decryptStoredPii } from "../../shared/index.ts";
+import { userSessionTable } from "../schema/user-session.ts";
 
 // "My live sessions" — the backing data for a devices/sessions UI. Returns
 // ONLY the current user's own, currently-live sessions, ordered by most-

package/packages/bundled-features/src/sessions/handlers/revoke-all-for-user.write.ts

@@ -6,12 +6,12 @@ import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { userSessionTable } from "../schema/user-session.js";
+import { userSessionTable } from "../schema/user-session.ts";
 import {
   SESSION_REVOKED_AGGREGATE_TYPE,
   SESSION_REVOKED_EVENT_QN,
   sessionRevokedSchema,
-} from "../session-revoked-event.js";
+} from "../session-revoked-event.ts";
 
 const REVOKE_ALL_SESSIONS_REASON =
   "revokes the target user's sessions in every tenant and appends the audit event on the SYSTEM stream";

package/packages/bundled-features/src/sessions/handlers/revoke-all-others.write.ts

@@ -4,12 +4,12 @@ import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { SessionErrors } from "../constants.js";
-import { userSessionTable } from "../schema/user-session.js";
+import { SessionErrors } from "../constants.ts";
+import { userSessionTable } from "../schema/user-session.ts";
 import {
   SESSION_REVOKED_AGGREGATE_TYPE,
   SESSION_REVOKED_EVENT_QN,
-} from "../session-revoked-event.js";
+} from "../session-revoked-event.ts";
 
 // "Sign out everywhere else" — keep the caller's current session, kill all
 // other live sessions for this user. Requires `user.sid` so "keep current"

package/packages/bundled-features/src/sessions/handlers/revoke.write.ts

@@ -4,12 +4,12 @@ import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { SessionErrors, USER_SESSION_ENTITY_NAME } from "../constants.js";
-import { userSessionTable } from "../schema/user-session.js";
+import { SessionErrors, USER_SESSION_ENTITY_NAME } from "../constants.ts";
+import { userSessionTable } from "../schema/user-session.ts";
 import {
   SESSION_REVOKED_AGGREGATE_TYPE,
   SESSION_REVOKED_EVENT_QN,
-} from "../session-revoked-event.js";
+} from "../session-revoked-event.ts";
 
 // Revoke a single session by id (= JWT jti). Three distinguishable outcomes:
 //

package/packages/bundled-features/src/sessions/index.ts

@@ -6,20 +6,20 @@ export {
   SessionErrors,
   SessionHandlers,
   SessionQueries,
-} from "./constants.js";
-export type { BindAutoRevokeOnPasswordChange, SessionsFeatureOptions } from "./feature.js";
-export { bindAutoRevokeFromFeature, createSessionsFeature } from "./feature.js";
-export { userSessionEntity, userSessionTable } from "./schema/user-session.js";
+} from "./constants.ts";
+export type { BindAutoRevokeOnPasswordChange, SessionsFeatureOptions } from "./feature.ts";
+export { bindAutoRevokeFromFeature, createSessionsFeature } from "./feature.ts";
+export { userSessionEntity, userSessionTable } from "./schema/user-session.ts";
 export type {
   SessionCallbacks,
   SessionCallbacksOptions,
   SessionMassRevoker,
-} from "./session-callbacks.js";
-export { createSessionCallbacks, isPrincipalBlocked } from "./session-callbacks.js";
-export type { SessionRevokedPayload } from "./session-revoked-event.js";
+} from "./session-callbacks.ts";
+export { createSessionCallbacks, isPrincipalBlocked } from "./session-callbacks.ts";
+export type { SessionRevokedPayload } from "./session-revoked-event.ts";
 export {
   SESSION_REVOKED_AGGREGATE_TYPE,
   SESSION_REVOKED_EVENT_QN,
   SESSION_REVOKED_EVENT_SHORT,
   sessionRevokedSchema,
-} from "./session-revoked-event.js";
+} from "./session-revoked-event.ts";

package/packages/bundled-features/src/sessions/schema/user-session.ts

@@ -5,7 +5,7 @@ import {
   createTextField,
   createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { USER_SESSION_ENTITY_NAME } from "../constants.js";
+import { USER_SESSION_ENTITY_NAME } from "../constants.ts";
 
 // userSession — one row per signed-in client (browser tab, mobile app).
 // The PRIMARY key is the sid — generated by the framework at login time and

package/packages/bundled-features/src/sessions/screens.ts

@@ -11,7 +11,7 @@ import {
   SESSION_MINE_SCREEN_ID,
   SessionHandlers,
   SessionQueries,
-} from "./constants.js";
+} from "./constants.ts";
 
 export const createSessionListScreen = (
   adminRoles: readonly string[] = access.admin,

package/packages/bundled-features/src/sessions/session-callbacks.ts

@@ -16,25 +16,25 @@ import { buildSessionRoles, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framewo
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId, parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { encryptForDirectWrite } from "../shared/index.js";
-import { tenantMembershipsTable } from "../tenant/index.js";
+import { encryptForDirectWrite } from "../shared/index.ts";
+import { tenantMembershipsTable } from "../tenant/index.ts";
 import {
   isPrincipalBlocked,
   isPrincipalRowBlocked,
   type UserStatus,
   userTable,
-} from "../user/index.js";
+} from "../user/index.ts";
 import {
   DEFAULT_SESSION_EXPIRY_MS,
   LAST_SEEN_REFRESH_MS,
   USER_SESSION_ENTITY_NAME,
-} from "./constants.js";
-import { userSessionEntity, userSessionTable } from "./schema/user-session.js";
+} from "./constants.ts";
+import { userSessionEntity, userSessionTable } from "./schema/user-session.ts";
 import {
   SESSION_REVOKED_AGGREGATE_TYPE,
   SESSION_REVOKED_EVENT_QN,
   sessionRevokedSchema,
-} from "./session-revoked-event.js";
+} from "./session-revoked-event.ts";
 
 // Re-exported so existing `../sessions` importers keep working unchanged.
 export { isPrincipalBlocked };

package/packages/bundled-features/src/sessions/testing.ts

@@ -20,7 +20,7 @@
 import type { AuthRoutesConfig, SessionCreator } from "@cosmicdrift/kumiko-framework/api";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import type { LateBoundHolder } from "@cosmicdrift/kumiko-testing/helpers";
-import type { SessionCallbacks, SessionMassRevoker } from "./session-callbacks.js";
+import type { SessionCallbacks, SessionMassRevoker } from "./session-callbacks.ts";
 
 export type BoundSessionCallbacks = {
   /** auth-config fragment: creator + revoker + checker, all late-bound. */