@cosmicdrift/kumiko-samples 0.369.0 → 0.371.0

package/packages/bundled-features/src/sessions/index.ts

@@ -6,20 +6,20 @@ export {
   SessionErrors,
   SessionHandlers,
   SessionQueries,
-} from "./constants.js";
-export type { BindAutoRevokeOnPasswordChange, SessionsFeatureOptions } from "./feature.js";
-export { bindAutoRevokeFromFeature, createSessionsFeature } from "./feature.js";
-export { userSessionEntity, userSessionTable } from "./schema/user-session.js";
+} from "./constants.ts";
+export type { BindAutoRevokeOnPasswordChange, SessionsFeatureOptions } from "./feature.ts";
+export { bindAutoRevokeFromFeature, createSessionsFeature } from "./feature.ts";
+export { userSessionEntity, userSessionTable } from "./schema/user-session.ts";
 export type {
   SessionCallbacks,
   SessionCallbacksOptions,
   SessionMassRevoker,
-} from "./session-callbacks.js";
-export { createSessionCallbacks, isPrincipalBlocked } from "./session-callbacks.js";
-export type { SessionRevokedPayload } from "./session-revoked-event.js";
+} from "./session-callbacks.ts";
+export { createSessionCallbacks, isPrincipalBlocked } from "./session-callbacks.ts";
+export type { SessionRevokedPayload } from "./session-revoked-event.ts";
 export {
   SESSION_REVOKED_AGGREGATE_TYPE,
   SESSION_REVOKED_EVENT_QN,
   SESSION_REVOKED_EVENT_SHORT,
   sessionRevokedSchema,
-} from "./session-revoked-event.js";
+} from "./session-revoked-event.ts";

package/packages/bundled-features/src/sessions/schema/user-session.ts

@@ -5,7 +5,7 @@ import {
   createTextField,
   createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { USER_SESSION_ENTITY_NAME } from "../constants.js";
+import { USER_SESSION_ENTITY_NAME } from "../constants.ts";
 
 // userSession — one row per signed-in client (browser tab, mobile app).
 // The PRIMARY key is the sid — generated by the framework at login time and

package/packages/bundled-features/src/sessions/screens.ts

@@ -11,7 +11,7 @@ import {
   SESSION_MINE_SCREEN_ID,
   SessionHandlers,
   SessionQueries,
-} from "./constants.js";
+} from "./constants.ts";
 
 export const createSessionListScreen = (
   adminRoles: readonly string[] = access.admin,

package/packages/bundled-features/src/sessions/session-callbacks.ts

@@ -16,25 +16,25 @@ import { buildSessionRoles, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framewo
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId, parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { encryptForDirectWrite } from "../shared/index.js";
-import { tenantMembershipsTable } from "../tenant/index.js";
+import { encryptForDirectWrite } from "../shared/index.ts";
+import { tenantMembershipsTable } from "../tenant/index.ts";
 import {
   isPrincipalBlocked,
   isPrincipalRowBlocked,
   type UserStatus,
   userTable,
-} from "../user/index.js";
+} from "../user/index.ts";
 import {
   DEFAULT_SESSION_EXPIRY_MS,
   LAST_SEEN_REFRESH_MS,
   USER_SESSION_ENTITY_NAME,
-} from "./constants.js";
-import { userSessionEntity, userSessionTable } from "./schema/user-session.js";
+} from "./constants.ts";
+import { userSessionEntity, userSessionTable } from "./schema/user-session.ts";
 import {
   SESSION_REVOKED_AGGREGATE_TYPE,
   SESSION_REVOKED_EVENT_QN,
   sessionRevokedSchema,
-} from "./session-revoked-event.js";
+} from "./session-revoked-event.ts";
 
 // Re-exported so existing `../sessions` importers keep working unchanged.
 export { isPrincipalBlocked };

package/packages/bundled-features/src/sessions/testing.ts

@@ -20,7 +20,7 @@
 import type { AuthRoutesConfig, SessionCreator } from "@cosmicdrift/kumiko-framework/api";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import type { LateBoundHolder } from "@cosmicdrift/kumiko-testing/helpers";
-import type { SessionCallbacks, SessionMassRevoker } from "./session-callbacks.js";
+import type { SessionCallbacks, SessionMassRevoker } from "./session-callbacks.ts";
 
 export type BoundSessionCallbacks = {
   /** auth-config fragment: creator + revoker + checker, all late-bound. */

package/packages/bundled-features/src/shared/index.ts

@@ -1,45 +1,45 @@
-export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
-export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.js";
+export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.ts";
+export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.ts";
 export {
   attachmentFileNameSchema,
   sanitizePdfAttachmentFileName,
-} from "./attachment-file-name.js";
+} from "./attachment-file-name.ts";
 export {
   type ChunkedMigrationOptions,
   type ChunkedMigrationResult,
   type ChunkedMigrationStopReason,
   type MigrationRowOutcome,
   runChunkedMigration,
-} from "./chunked-entity-migration.js";
+} from "./chunked-entity-migration.ts";
 export {
   classifyStoredEnvelope,
   type StoredEnvelopeClassification,
-} from "./classify-stored-envelope.js";
-export { decryptStoredPii } from "./decrypt-stored-pii.js";
-export { encryptForDirectWrite } from "./encrypt-for-direct-write.js";
-export { entitiesOf } from "./entities-of.js";
-export { isWithinGracePeriod } from "./grace-period.js";
-export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
-export { isTenantDb } from "./is-tenant-db.js";
-export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.js";
-export { mailHeading, mailParagraph, mailRepeatedRows } from "./mail-template-body.js";
-export { mapWithConcurrency } from "./map-with-concurrency.js";
+} from "./classify-stored-envelope.ts";
+export { decryptStoredPii } from "./decrypt-stored-pii.ts";
+export { encryptForDirectWrite } from "./encrypt-for-direct-write.ts";
+export { entitiesOf } from "./entities-of.ts";
+export { isWithinGracePeriod } from "./grace-period.ts";
+export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.ts";
+export { isTenantDb } from "./is-tenant-db.ts";
+export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.ts";
+export { mailHeading, mailParagraph, mailRepeatedRows } from "./mail-template-body.ts";
+export { mapWithConcurrency } from "./map-with-concurrency.ts";
 export {
   denyUnlessJoinRowParentVisible,
   hostRowIsGone,
   joinRowParentIsVisible,
   parentRowIsVisible,
-} from "./parent-visibility.js";
-export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
-export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
+} from "./parent-visibility.ts";
+export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.ts";
+export { rateLimitedTextResponse } from "./rate-limited-text-response.ts";
 export {
   redactBotTokens,
   redactEmailAddresses,
   redactErrorText,
   redactUrls,
-} from "./redact.js";
-export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.js";
-export { requireForTenant } from "./require-for-tenant.js";
+} from "./redact.ts";
+export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.ts";
+export { requireForTenant } from "./require-for-tenant.ts";
 export {
   extensionForResourceContentType,
   isResourceImageContentType,
@@ -47,23 +47,23 @@ export {
   RESOURCE_IMAGE_FORMATS,
   type ResourceImageContentType,
   type ResourceImageFormat,
-} from "./resource-image-formats.js";
+} from "./resource-image-formats.ts";
 export {
   type RowBoundGrantResult,
   redeemRowBoundGrant,
   signRowBoundGrant,
-} from "./row-bound-grant.js";
-export { runInSubTransaction } from "./run-in-sub-transaction.js";
-export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";
-export { sessionTimezoneField } from "./session-timezone-field.js";
-export { assertNotSvg, MAX_INPUT_PIXELS, SHARP_INPUT_OPTIONS } from "./sharp-input-limits.js";
+} from "./row-bound-grant.ts";
+export { runInSubTransaction } from "./run-in-sub-transaction.ts";
+export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.ts";
+export { sessionTimezoneField } from "./session-timezone-field.ts";
+export { assertNotSvg, MAX_INPUT_PIXELS, SHARP_INPUT_OPTIONS } from "./sharp-input-limits.ts";
 export {
   peekTokenSubject,
   signToken,
   TokenPurpose,
   type VerifyResult,
   verifyToken,
-} from "./signed-token.js";
+} from "./signed-token.ts";
 export {
   EXT_SIGNUP_HANDOVER,
   findSignupHandoverProvider,
@@ -71,7 +71,7 @@ export {
   SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE,
   type SignupHandoverBinding,
   type SignupHandoverProvider,
-} from "./signup-handover.js";
-export { createSingleUseTokenStore, hashSingleUseToken } from "./single-use-token-store.js";
-export type { SystemQueryFn } from "./system-query.js";
-export { type BurnResult, burnToken, unburnToken } from "./token-burn-store.js";
+} from "./signup-handover.ts";
+export { createSingleUseTokenStore, hashSingleUseToken } from "./single-use-token-store.ts";
+export type { SystemQueryFn } from "./system-query.ts";
+export { type BurnResult, burnToken, unburnToken } from "./token-burn-store.ts";

package/packages/bundled-features/src/shared/password-hashing.ts

@@ -1,5 +1,5 @@
 import { hash as argonHash, verify as argonVerify } from "@node-rs/argon2";
-import { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
+import { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.ts";
 
 // OWASP-recommended argon2id parameters (2024 guidance):
 //   memoryCost: 19 MiB, timeCost: 2, parallelism: 1

package/packages/bundled-features/src/shared/row-bound-grant.ts

@@ -32,7 +32,7 @@
 
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { peekTokenSubject, signToken, verifyToken } from "./signed-token.js";
+import { peekTokenSubject, signToken, verifyToken } from "./signed-token.ts";
 
 export type RowBoundGrantResult =
   | { readonly ok: true; readonly subject: string; readonly expiresAtMs: number }

package/packages/bundled-features/src/step-dispatcher/deliver-dispatch-request.ts

@@ -9,15 +9,15 @@ import {
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import type { MultiStreamApplyContext } from "@cosmicdrift/kumiko-framework/pipeline";
 import { SYSTEM_USER_ID, type TenantId } from "@cosmicdrift/kumiko-types/identifiers";
-import { redactEmailAddresses } from "../shared/index.js";
+import { redactEmailAddresses } from "../shared/index.ts";
 import {
   buildDispatchSpec,
   dispatchRequestedPayloadSchema,
   rawStepKindOf,
   readPayloadFields,
-} from "./dispatch-payload.js";
-import { type MailDispatchResult, performMailDispatch } from "./mail-runner.js";
-import { performWebhookDispatch } from "./webhook-runner.js";
+} from "./dispatch-payload.ts";
+import { type MailDispatchResult, performMailDispatch } from "./mail-runner.ts";
+import { performWebhookDispatch } from "./webhook-runner.ts";
 
 const log = createFallbackLogger("step-dispatcher");
 

package/packages/bundled-features/src/step-dispatcher/dispatch-payload.ts

@@ -6,8 +6,8 @@ import {
   PII_ERASED_SENTINEL,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import * as z from "zod";
-import { type MailSpec, mailSpecSchema } from "./mail-runner.js";
-import { type WebhookSpec, webhookSpecSchema } from "./webhook-runner.js";
+import { type MailSpec, mailSpecSchema } from "./mail-runner.ts";
+import { type WebhookSpec, webhookSpecSchema } from "./webhook-runner.ts";
 
 // PII fields of the flat payload are ciphertext under the per-dispatch
 // record key (system-event-pii.ts). `to`/`headersJson`/`bodyJson` are JSON

package/packages/bundled-features/src/step-dispatcher/feature.ts

@@ -24,16 +24,16 @@ import {
   deliverJobId,
   STEP_DISPATCHER_FEATURE,
   StepDispatcherJobs,
-} from "./constants.js";
+} from "./constants.ts";
 import {
   deliverDispatchRequest,
   eraseDispatchKey,
   isDispatchOutcome,
-} from "./deliver-dispatch-request.js";
+} from "./deliver-dispatch-request.ts";
 import {
   WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR,
   WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS,
-} from "./webhook-runner.js";
+} from "./webhook-runner.ts";
 
 export const stepDispatcherEnvSchema = z.object({
   [WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR]: z

package/packages/bundled-features/src/step-dispatcher/index.ts

@@ -2,14 +2,14 @@ export {
   createStepDispatcherFeature,
   STEP_DISPATCH_AGGREGATE_TYPE,
   stepDispatcherEnvSchema,
-} from "./feature.js";
+} from "./feature.ts";
 export {
   type MailDispatchResult,
   type MailSpec,
   mailSpecSchema,
   performMailDispatch,
   setMailRunner,
-} from "./mail-runner.js";
+} from "./mail-runner.ts";
 export {
   performWebhookDispatch,
   readAllowedPrivateWebhookHostsFromEnv,
@@ -22,4 +22,4 @@ export {
   type WebhookSpec,
   webhookAuthSecretKey,
   webhookSpecSchema,
-} from "./webhook-runner.js";
+} from "./webhook-runner.ts";

package/packages/bundled-features/src/step-dispatcher/webhook-runner.ts

@@ -31,7 +31,7 @@ import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { TenantId } from "@cosmicdrift/kumiko-types/identifiers";
 import * as z from "zod";
-import { isHostAllowlisted, readHostAllowlistFromEnv } from "../foundation-shared/index.js";
+import { isHostAllowlisted, readHostAllowlistFromEnv } from "../foundation-shared/index.ts";
 
 const log = createFallbackLogger("step-dispatcher");
 

package/packages/bundled-features/src/subscription-mollie/feature.ts

@@ -43,9 +43,9 @@ import type { SubscriptionProviderPlugin } from "@cosmicdrift/kumiko-bundled-fea
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { createMollieClient } from "@mollie/api-client";
 import * as z from "zod";
-import { MOLLIE_PROVIDER_NAME, SUBSCRIPTION_MOLLIE_FEATURE } from "./constants.js";
-import { createMollieCheckoutSession, type MolliePriceConfig } from "./plugin-methods.js";
-import { type MollieClientShape, verifyAndParseMollieWebhook } from "./verify-webhook.js";
+import { MOLLIE_PROVIDER_NAME, SUBSCRIPTION_MOLLIE_FEATURE } from "./constants.ts";
+import { createMollieCheckoutSession, type MolliePriceConfig } from "./plugin-methods.ts";
+import { type MollieClientShape, verifyAndParseMollieWebhook } from "./verify-webhook.ts";
 
 /**
  * Env-vars contract for the `subscription-mollie` feature.

package/packages/bundled-features/src/subscription-mollie/index.ts

@@ -5,10 +5,10 @@
 //   - mapMollieEventType / mapMollieStatus / extractMollieId (pure helpers,
 //     test-only — direct-import aus dem File wenn echt mal extern gebraucht)
 
-export { MOLLIE_PROVIDER_NAME, SUBSCRIPTION_MOLLIE_FEATURE } from "./constants.js";
+export { MOLLIE_PROVIDER_NAME, SUBSCRIPTION_MOLLIE_FEATURE } from "./constants.ts";
 export {
   createSubscriptionMollieFeature,
   type SubscriptionMollieOptions,
   subscriptionMollieEnvSchema,
-} from "./feature.js";
-export type { MolliePriceConfig } from "./plugin-methods.js";
+} from "./feature.ts";
+export type { MolliePriceConfig } from "./plugin-methods.ts";

package/packages/bundled-features/src/subscription-mollie/verify-webhook.ts

@@ -28,8 +28,8 @@ import type {
   Payment as MolliePayment,
   Subscription as MollieSubscription,
 } from "@mollie/api-client";
-import { MOLLIE_PROVIDER_NAME } from "./constants.js";
-import type { MolliePriceConfig } from "./plugin-methods.js";
+import { MOLLIE_PROVIDER_NAME } from "./constants.ts";
+import type { MolliePriceConfig } from "./plugin-methods.ts";
 
 const log = createFallbackLogger("subscription-mollie");
 

package/packages/bundled-features/src/subscription-stripe/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.370.0",
+    "type": "improvement",
+    "title": "stripeEnvSchema adds price slots to the Stripe env block",
+    "detail": "stripeEnvSchema({ prices: [\"PRO\", \"TEAM\"] }) returns the bridge keys plus one optional STRIPE_PRICE_<NAME> per price, each checked for the price_ prefix. Spread it into composeEnvSchema({ extend }) next to createSubscriptionStripeFeature; the shared bridge fields are no key clash."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/subscription-stripe/feature.ts

@@ -38,6 +38,7 @@ import {
   defineFeature,
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureWithEnvSchema, featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import * as z from "zod";
 import {
   STRIPE_API_KEY_CONFIG,
@@ -45,7 +46,7 @@ import {
   STRIPE_PROVIDER_NAME,
   STRIPE_WEBHOOK_SECRET_CONFIG,
   SUBSCRIPTION_STRIPE_FEATURE,
-} from "./constants.js";
+} from "./constants.ts";
 import {
   createStripeCancelSubscription,
   createStripeCheckoutSession,
@@ -54,9 +55,9 @@ import {
   createStripePriceCache,
   createStripeRetrievePrices,
   createStripeRetrieveSubscription,
-} from "./plugin-methods.js";
-import { createStripeRuntimes } from "./runtime.js";
-import { verifyAndParseStripeWebhook } from "./verify-webhook.js";
+} from "./plugin-methods.ts";
+import { createStripeRuntimes } from "./runtime.ts";
+import { verifyAndParseStripeWebhook } from "./verify-webhook.ts";
 
 /**
  * Env-vars contract for the `subscription-stripe` feature — now a **bridge
@@ -86,6 +87,32 @@ export const subscriptionStripeEnvSchema = z.object({
     .optional(),
 });
 
+type StripePriceEnvShape<TPrice extends string> = {
+  [Key in `STRIPE_PRICE_${TPrice}`]: z.ZodOptional<z.ZodString>;
+};
+
+/** Stripe env block plus one `STRIPE_PRICE_<NAME>` slot per price the app
+ *  maps to a tier, e.g. `stripeEnvSchema({ prices: ["PRO", "TEAM"] })`.
+ *  Shares its bridge fields with `subscriptionStripeEnvSchema`, so spreading
+ *  it into `composeEnvSchema({ extend })` next to the mounted feature is no
+ *  key clash. */
+export function stripeEnvSchema<const TPrice extends string>(options: {
+  readonly prices: readonly TPrice[];
+}) {
+  const priceShape = Object.fromEntries(
+    options.prices.map((price) => [
+      `STRIPE_PRICE_${price}`,
+      z
+        .string()
+        .regex(/^price_/, `STRIPE_PRICE_${price} must start with 'price_'`)
+        .optional()
+        .describe(`Stripe price id (\`price_...\`) of the ${price} plan.`),
+    ]),
+    // @cast-boundary schema-walk — Object.fromEntries widens to an index signature; the entries are exactly one optional string per listed price.
+  ) as StripePriceEnvShape<TPrice>;
+  return z.object({ ...subscriptionStripeEnvSchema.shape, ...priceShape });
+}
+
 export type SubscriptionStripeOptions = {
   /** Bridge-fallback webhook-secret. Optional: v2 liest aus dem
    *  `subscription-stripe:config:webhook-secret`-Key (backing:"secrets").
@@ -141,9 +168,9 @@ function validateOneOffPriceIds(priceIds: readonly string[]): void {
  */
 export function createSubscriptionStripeFeature(
   options: SubscriptionStripeOptions = {},
-): FeatureDefinition {
+): FeatureWithEnvSchema<FeatureDefinition, typeof subscriptionStripeEnvSchema.shape> {
   validateOneOffPriceIds(options.oneOffPriceIds ?? []);
-  return defineFeature(SUBSCRIPTION_STRIPE_FEATURE, (r) => {
+  const feature: FeatureDefinition = defineFeature(SUBSCRIPTION_STRIPE_FEATURE, (r) => {
     r.describe(
       'Stripe payment provider plugin for `billing-foundation`. Reads its Stripe API key + webhook secret from system config keys with `backing:"secrets"` (envelope-encrypted in the secrets store under the system tenant) and a `billingLive` **system config** flag — all at runtime, so keys rotate and prod goes live without a redeploy. The `mask` on each key derives the sysadmin settings screen + nav, so no app wires a hand-written config UI. Mount via `createSubscriptionStripeFeature({ priceToTier })`; the optional `apiKey`/`webhookSecret` options are env→secrets bridge fallbacks. The plugin always mounts — `createCheckoutSession` throws `feature_disabled` unless `billingLive` is true, so sk_test_ keys in prod never produce a live checkout. Implements webhook verify, checkout, portal, cancel, `retrievePrices` (10-minute TTL-cached price lookup for the billing-plans catalog), `createPlanSwitchSession` (auto-provisions a Customer-Portal configuration for switching an existing subscription to another plan tier — each tier needs its own Stripe product), `retrieveSubscription` (live provider-side snapshot for the `sync-subscriptions` backfill job, mapped identically to the webhook path), plus `isBillingEnabled` (billingLive + an api-key existence probe, no secret read).',
     );
@@ -248,4 +275,5 @@ export function createSubscriptionStripeFeature(
 
     return { configKeys };
   });
+  return featureWithEnvSchema(feature, subscriptionStripeEnvSchema);
 }

package/packages/bundled-features/src/subscription-stripe/index.ts

@@ -10,9 +10,10 @@ export {
   STRIPE_PROVIDER_NAME,
   StripeEventTypes,
   SUBSCRIPTION_STRIPE_FEATURE,
-} from "./constants.js";
+} from "./constants.ts";
 export {
   createSubscriptionStripeFeature,
   type SubscriptionStripeOptions,
+  stripeEnvSchema,
   subscriptionStripeEnvSchema,
-} from "./feature.js";
+} from "./feature.ts";

package/packages/bundled-features/src/subscription-stripe/plugin-methods.ts

@@ -27,8 +27,8 @@ import {
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import Stripe from "stripe";
-import type { StripeCtxRuntime } from "./runtime.js";
-import { isResourceMissingStripeError, mapStripeSubscriptionState } from "./verify-webhook.js";
+import type { StripeCtxRuntime } from "./runtime.ts";
+import { isResourceMissingStripeError, mapStripeSubscriptionState } from "./verify-webhook.ts";
 
 // =============================================================================
 // createCheckoutSession

package/packages/bundled-features/src/subscription-stripe/runtime.ts

@@ -35,7 +35,7 @@ import { FeatureDisabledError, UnconfiguredError } from "@cosmicdrift/kumiko-fra
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
 import Stripe from "stripe";
-import { SUBSCRIPTION_STRIPE_FEATURE } from "./constants.js";
+import { SUBSCRIPTION_STRIPE_FEATURE } from "./constants.ts";
 
 const API_KEY_HINT =
   "Set the Stripe API key via config:write:set on `subscription-stripe:config:api-key` (or seed it from STRIPE_API_KEY during the env bridge).";

package/packages/bundled-features/src/subscription-stripe/verify-webhook.ts

@@ -49,8 +49,8 @@ import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import Stripe from "stripe";
-import { STRIPE_PROVIDER_NAME, StripeEventTypes } from "./constants.js";
-import type { StripeWebhookRuntime } from "./runtime.js";
+import { STRIPE_PROVIDER_NAME, StripeEventTypes } from "./constants.ts";
+import type { StripeWebhookRuntime } from "./runtime.ts";
 
 const log = createFallbackLogger("subscription-stripe");
 

package/packages/bundled-features/src/tags/changes.json

@@ -1,4 +1,12 @@
 [
+  {
+    "version": "0.370.0",
+    "type": "breaking",
+    "title": "The deprecated tagsFeature constant is removed",
+    "detail": "tagsFeature was kept next to createTagsFeature() for one release. Mount the feature by calling createTagsFeature().",
+    "migration": "Run bun kumiko-upgrade --apply. It replaces tagsFeature with createTagsFeature().",
+    "codemod": "scripts/codemod/feature-factory.ts"
+  },
   {
     "version": "0.338.0",
     "type": "breaking",

package/packages/bundled-features/src/tags/executor.ts

@@ -1,5 +1,5 @@
 import { createEntityExecutor, type EntityDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { createTagAssignmentEntity, tagAssignmentEntity, tagEntity } from "./entity.js";
+import { createTagAssignmentEntity, tagAssignmentEntity, tagEntity } from "./entity.ts";
 
 // Shared executors for the tag + tag-assignment write-handlers.
 // createEntityExecutor is side-effect-free; instantiating once keeps the

package/packages/bundled-features/src/tags/feature.ts

@@ -27,17 +27,17 @@ import {
   type EntityDefinition,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.js";
-import { DEFAULT_TAG_ACCESS, TAGS_FEATURE_NAME } from "./constants.js";
-import { createTagAssignmentEntity, tagEntity } from "./entity.js";
-import { createTagAssignmentExecutor } from "./executor.js";
-import { createAssignTagHandler } from "./handlers/assign-tag.write.js";
-import { createCreateTagHandler } from "./handlers/create-tag.write.js";
-import { createDeleteTagHandler } from "./handlers/delete-tag.write.js";
-import { createRemoveTagHandler } from "./handlers/remove-tag.write.js";
-import { createUpdateTagHandler } from "./handlers/update-tag.write.js";
-import { TAGS_FEATURE_I18N } from "./i18n.js";
-import { createTagEditScreen, createTagListScreen } from "./screens.js";
+import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.ts";
+import { DEFAULT_TAG_ACCESS, TAGS_FEATURE_NAME } from "./constants.ts";
+import { createTagAssignmentEntity, tagEntity } from "./entity.ts";
+import { createTagAssignmentExecutor } from "./executor.ts";
+import { createAssignTagHandler } from "./handlers/assign-tag.write.ts";
+import { createCreateTagHandler } from "./handlers/create-tag.write.ts";
+import { createDeleteTagHandler } from "./handlers/delete-tag.write.ts";
+import { createRemoveTagHandler } from "./handlers/remove-tag.write.ts";
+import { createUpdateTagHandler } from "./handlers/update-tag.write.ts";
+import { TAGS_FEATURE_I18N } from "./i18n.ts";
+import { createTagEditScreen, createTagListScreen } from "./screens.ts";
 
 // Opt-in tier-gating: when set, the feature declares itself r.toggleable so the
 // dispatcher gate + feature-toggles + tier-engine can switch the WHOLE feature
@@ -207,6 +207,3 @@ export function createTagsFeature(opts: TagsFeatureOptions = {}): typeof default
     registerTags(r, access, opts.toggleable, opts.ownership, opts.parents),
   );
 }
-
-/** @deprecated Use createTagsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const tagsFeature = createTagsFeature();

package/packages/bundled-features/src/tags/handlers/assign-tag.write.ts

@@ -1,11 +1,11 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
-import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
-import { tagAssignmentAggregateId } from "../aggregate-id.js";
-import { DEFAULT_TAG_ACCESS } from "../constants.js";
-import { tagAssignmentExecutor, tagExecutor } from "../executor.js";
-import { type AssignTagPayload, assignTagPayloadSchema } from "../schemas.js";
+import { denyUnlessJoinRowParentVisible } from "../../shared/index.ts";
+import { tagAssignmentAggregateId } from "../aggregate-id.ts";
+import { DEFAULT_TAG_ACCESS } from "../constants.ts";
+import { tagAssignmentExecutor, tagExecutor } from "../executor.ts";
+import { type AssignTagPayload, assignTagPayloadSchema } from "../schemas.ts";
 
 // assign-tag — links a tag to a host entity by (entityType, entityId). The
 // assignment id is deterministic, so the row is unique per (tag, entity).

package/packages/bundled-features/src/tags/handlers/create-tag.write.ts

@@ -1,7 +1,7 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_TAG_ACCESS } from "../constants.js";
-import { tagExecutor } from "../executor.js";
-import { type CreateTagPayload, createTagPayloadSchema } from "../schemas.js";
+import { DEFAULT_TAG_ACCESS } from "../constants.ts";
+import { tagExecutor } from "../executor.ts";
+import { type CreateTagPayload, createTagPayloadSchema } from "../schemas.ts";
 
 // create-tag — adds a tag to the tenant's catalog. The framework mints a fresh
 // UUIDv7 id (no explicit id passed). Tag names are not unique by design: the

package/packages/bundled-features/src/tags/handlers/delete-tag.write.ts

@@ -1,7 +1,7 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_TAG_ACCESS } from "../constants.js";
-import { tagAssignmentExecutor, tagExecutor } from "../executor.js";
-import { type DeleteTagPayload, deleteTagPayloadSchema } from "../schemas.js";
+import { DEFAULT_TAG_ACCESS } from "../constants.ts";
+import { tagAssignmentExecutor, tagExecutor } from "../executor.ts";
+import { type DeleteTagPayload, deleteTagPayloadSchema } from "../schemas.ts";
 
 const CASCADE_PAGE = 200;
 

package/packages/bundled-features/src/tags/handlers/remove-tag.write.ts

@@ -1,9 +1,9 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
-import { tagAssignmentAggregateId } from "../aggregate-id.js";
-import { DEFAULT_TAG_ACCESS } from "../constants.js";
-import { tagAssignmentExecutor } from "../executor.js";
-import { type RemoveTagPayload, removeTagPayloadSchema } from "../schemas.js";
+import { denyUnlessJoinRowParentVisible } from "../../shared/index.ts";
+import { tagAssignmentAggregateId } from "../aggregate-id.ts";
+import { DEFAULT_TAG_ACCESS } from "../constants.ts";
+import { tagAssignmentExecutor } from "../executor.ts";
+import { type RemoveTagPayload, removeTagPayloadSchema } from "../schemas.ts";
 
 // remove-tag — unlinks a tag from a host entity. Idempotent: removing an
 // assignment that doesn't exist is already the requested end state (not

package/packages/bundled-features/src/tags/handlers/update-tag.write.ts

@@ -1,7 +1,7 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_TAG_ACCESS } from "../constants.js";
-import { tagExecutor } from "../executor.js";
-import { type UpdateTagPayload, updateTagPayloadSchema } from "../schemas.js";
+import { DEFAULT_TAG_ACCESS } from "../constants.ts";
+import { tagExecutor } from "../executor.ts";
+import { type UpdateTagPayload, updateTagPayloadSchema } from "../schemas.ts";
 
 // update-tag — edits a catalog tag (rename / recolor / re-scope). Optimistic-
 // locked: the client sends the `version` it read (mirrors tenant:update). Only