@cosmicdrift/kumiko-samples 0.369.0 → 0.371.0

package/packages/bundled-features/src/compliance-profiles/handlers/for-tenant.query.ts

@@ -6,8 +6,8 @@ import {
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { parseComplianceProfileOverride } from "../_internal/parse-override.js";
-import { tenantComplianceProfileTable } from "../schema/profile-selection.js";
+import { parseComplianceProfileOverride } from "../_internal/parse-override.ts";
+import { tenantComplianceProfileTable } from "../schema/profile-selection.ts";
 
 // Liefert das effektive Compliance-Profile fuer den aktuellen Tenant.
 // Macht den exposesApi-Marker aus feature.ts mit echtem Inhalt.

package/packages/bundled-features/src/compliance-profiles/handlers/needs-profile.query.ts

@@ -3,7 +3,7 @@ import type { ComplianceProfileKey } from "@cosmicdrift/kumiko-framework/complia
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { tenantComplianceProfileTable } from "../schema/profile-selection.js";
+import { tenantComplianceProfileTable } from "../schema/profile-selection.ts";
 
 // Onboarding banner trigger for tenant admin.
 //

package/packages/bundled-features/src/compliance-profiles/handlers/set-profile.write.ts

@@ -10,11 +10,11 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { requireForTenant } from "../../shared/index.js";
+import { requireForTenant } from "../../shared/index.ts";
 import {
   tenantComplianceProfileEntity,
   tenantComplianceProfileTable,
-} from "../schema/profile-selection.js";
+} from "../schema/profile-selection.ts";
 
 const crud = createEventStoreExecutor(tenantComplianceProfileTable, tenantComplianceProfileEntity, {
   entityName: "tenant-compliance-profile",

package/packages/bundled-features/src/compliance-profiles/index.ts

@@ -3,11 +3,11 @@ export {
   COMPLIANCE_PROFILES_FEATURE,
   ComplianceProfileHandlers,
   ComplianceProfileQueries,
-} from "./constants.js";
+} from "./constants.ts";
 export {
   type ComplianceProfilesFeatureOptions,
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
   tenantComplianceProfileTable,
-} from "./feature.js";
-export { resolveProfileForTenant } from "./resolve-for-tenant.js";
+} from "./feature.ts";
+export { resolveProfileForTenant } from "./resolve-for-tenant.ts";

package/packages/bundled-features/src/compliance-profiles/resolve-for-tenant.ts

@@ -16,9 +16,9 @@ import {
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { isTenantDb } from "../shared/index.js";
-import { parseComplianceProfileOverride } from "./_internal/parse-override.js";
-import { tenantComplianceProfileTable } from "./schema/profile-selection.js";
+import { isTenantDb } from "../shared/index.ts";
+import { parseComplianceProfileOverride } from "./_internal/parse-override.ts";
+import { tenantComplianceProfileTable } from "./schema/profile-selection.ts";
 
 export interface ResolveProfileForTenantArgs {
   // data-retention's resolveTenantRetentionPreset forwards this via

package/packages/bundled-features/src/compliance-profiles/seeding.ts

@@ -30,7 +30,7 @@ import {
 import {
   tenantComplianceProfileEntity,
   tenantComplianceProfileTable,
-} from "./schema/profile-selection.js";
+} from "./schema/profile-selection.ts";
 
 const executor = createEventStoreExecutor(
   tenantComplianceProfileTable,

package/packages/bundled-features/src/compliance-profiles/web/client-plugin.tsx

@@ -4,9 +4,9 @@ import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
 import {
   COMPLIANCE_PROFILE_CATALOG_EXTENSION_NAME,
   COMPLIANCE_PROFILES_FEATURE,
-} from "../constants.js";
-import { ComplianceProfileCatalog } from "./compliance-profile-catalog.js";
-import { defaultTranslations } from "./i18n.js";
+} from "../constants.ts";
+import { ComplianceProfileCatalog } from "./compliance-profile-catalog.tsx";
+import { defaultTranslations } from "./i18n.ts";
 
 export type ComplianceProfilesClientOptions = {
   readonly translations?: TranslationsByLocale;

package/packages/bundled-features/src/compliance-profiles/web/compliance-profile-catalog.tsx

@@ -10,7 +10,7 @@ import {
   useTranslation,
 } from "@cosmicdrift/kumiko-renderer";
 import type { ReactNode } from "react";
-import { ComplianceProfileQueries } from "../constants.js";
+import { ComplianceProfileQueries } from "../constants.ts";
 
 type ProfileSummary = {
   readonly key: string;

package/packages/bundled-features/src/compliance-profiles/web/index.ts

@@ -2,5 +2,5 @@
 export {
   type ComplianceProfilesClientOptions,
   complianceProfilesClient,
-} from "./client-plugin.js";
-export { ComplianceProfileCatalog } from "./compliance-profile-catalog.js";
+} from "./client-plugin.tsx";
+export { ComplianceProfileCatalog } from "./compliance-profile-catalog.tsx";

package/packages/bundled-features/src/compliance-profiles-ops/changes.json

@@ -0,0 +1,10 @@
+[
+  {
+    "version": "0.370.0",
+    "type": "breaking",
+    "title": "The deprecated complianceProfilesOpsFeature constant is removed",
+    "detail": "complianceProfilesOpsFeature was kept next to createComplianceProfilesOpsFeature() for one release. Mount the feature by calling createComplianceProfilesOpsFeature().",
+    "migration": "Run bun kumiko-upgrade --apply. It replaces complianceProfilesOpsFeature with createComplianceProfilesOpsFeature().",
+    "codemod": "scripts/codemod/feature-factory.ts"
+  }
+]

package/packages/bundled-features/src/compliance-profiles-ops/handlers/tenants-missing-profile.query.ts

@@ -2,8 +2,8 @@ import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { defineQueryHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { tenantComplianceProfileTable } from "../../compliance-profiles/index.js";
-import { decryptTenantNames, tenantTable } from "../../tenant/index.js";
+import { tenantComplianceProfileTable } from "../../compliance-profiles/index.ts";
+import { decryptTenantNames, tenantTable } from "../../tenant/index.ts";
 
 // SystemAdmin platform-wide counterpart to needs-profile (#2089).
 //

package/packages/bundled-features/src/compliance-profiles-ops/index.ts

@@ -11,7 +11,7 @@
 // per-tenant picker (the vast majority) stay unaffected.
 
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { tenantsMissingProfileQuery } from "./handlers/tenants-missing-profile.query.js";
+import { tenantsMissingProfileQuery } from "./handlers/tenants-missing-profile.query.ts";
 
 export function createComplianceProfilesOpsFeature() {
   return defineFeature(
@@ -38,6 +38,3 @@ export function createComplianceProfilesOpsFeature() {
     { dedupeOptions: {} },
   );
 }
-
-/** @deprecated Use createComplianceProfilesOpsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const complianceProfilesOpsFeature = createComplianceProfilesOpsFeature();

package/packages/bundled-features/src/config/db/queries/resolver.ts

@@ -1,7 +1,7 @@
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { configValuesTable } from "../../table.js";
+import { configValuesTable } from "../../table.ts";
 
 export type ConfigRow = {
   readonly id: string;

package/packages/bundled-features/src/config/feature.ts

@@ -14,17 +14,17 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
-import { cascadeQuery } from "./handlers/cascade.query.js";
-import { readinessQuery } from "./handlers/readiness.query.js";
-import { reencryptJob } from "./handlers/reencrypt.job.js";
-import { resetWrite } from "./handlers/reset.write.js";
-import { schemaQuery } from "./handlers/schema.query.js";
-import { selectedExtensionsQuery } from "./handlers/selected-extensions.query.js";
-import { setWrite } from "./handlers/set.write.js";
-import { valuesQuery } from "./handlers/values.query.js";
-import { CONFIG_FEATURE_I18N } from "./i18n.js";
-import type { ConfigResolver } from "./resolver.js";
-import { configValueEntity } from "./table.js";
+import { cascadeQuery } from "./handlers/cascade.query.ts";
+import { readinessQuery } from "./handlers/readiness.query.ts";
+import { reencryptJob } from "./handlers/reencrypt.job.ts";
+import { resetWrite } from "./handlers/reset.write.ts";
+import { schemaQuery } from "./handlers/schema.query.ts";
+import { selectedExtensionsQuery } from "./handlers/selected-extensions.query.ts";
+import { setWrite } from "./handlers/set.write.ts";
+import { valuesQuery } from "./handlers/values.query.ts";
+import { CONFIG_FEATURE_I18N } from "./i18n.ts";
+import type { ConfigResolver } from "./resolver.ts";
+import { configValueEntity } from "./table.ts";
 
 export type ConfigContext = { readonly config: ConfigAccessor };
 

package/packages/bundled-features/src/config/handlers/cascade.query.ts

@@ -5,9 +5,9 @@ import {
   isEncryptedAtRest,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { requireConfigResolver, requireSystemDb } from "../feature.js";
-import { MASKED, redactInheritedCascade, shouldRedactInherited } from "../read-redaction.js";
-import { hasConfigAccess } from "../write-helpers.js";
+import { requireConfigResolver, requireSystemDb } from "../feature.ts";
+import { MASKED, redactInheritedCascade, shouldRedactInherited } from "../read-redaction.ts";
+import { hasConfigAccess } from "../write-helpers.ts";
 
 export const cascadeQuery = defineQueryHandler({
   name: "cascade",

package/packages/bundled-features/src/config/handlers/readiness.query.ts

@@ -8,8 +8,8 @@ import {
   toKebab,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { requireConfigResolver, requireSystemDb } from "../feature.js";
-import { hasConfigAccess } from "../write-helpers.js";
+import { requireConfigResolver, requireSystemDb } from "../feature.ts";
+import { hasConfigAccess } from "../write-helpers.ts";
 
 export type ReadinessMissingKey = {
   readonly key: string;

package/packages/bundled-features/src/config/handlers/reencrypt.job.ts

@@ -44,8 +44,8 @@ import {
   type ChunkedMigrationStopReason,
   classifyStoredEnvelope,
   runChunkedMigration,
-} from "../../shared/index.js";
-import { configValueEntity, configValuesTable } from "../table.js";
+} from "../../shared/index.ts";
+import { configValueEntity, configValuesTable } from "../table.ts";
 
 const DEFAULT_MAX_FAILURES = 10;
 const SCAN_SLICE_SIZE = 100;

package/packages/bundled-features/src/config/handlers/reset.write.ts

@@ -6,9 +6,9 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { requireSystemDb } from "../feature.js";
-import { configValueEntity, configValuesTable } from "../table.js";
-import { findConfigRow, prepareConfigWrite } from "../write-helpers.js";
+import { requireSystemDb } from "../feature.ts";
+import { configValueEntity, configValuesTable } from "../table.ts";
+import { findConfigRow, prepareConfigWrite } from "../write-helpers.ts";
 
 const scopeEnum = z.enum([ConfigScopes.system, ConfigScopes.tenant, ConfigScopes.user]);
 

package/packages/bundled-features/src/config/handlers/schema.query.ts

@@ -1,6 +1,6 @@
 import { type ConfigKeyDefinition, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { hasConfigAccess } from "../write-helpers.js";
+import { hasConfigAccess } from "../write-helpers.ts";
 
 export const schemaQuery = defineQueryHandler({
   name: "schema",

package/packages/bundled-features/src/config/handlers/selected-extensions.query.ts

@@ -4,9 +4,9 @@ import {
   isEncryptedAtRest,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { requireConfigResolver, requireSystemDb } from "../feature.js";
-import { redactInheritedCascade, shouldRedactInherited } from "../read-redaction.js";
-import { hasConfigAccess } from "../write-helpers.js";
+import { requireConfigResolver, requireSystemDb } from "../feature.ts";
+import { redactInheritedCascade, shouldRedactInherited } from "../read-redaction.ts";
+import { hasConfigAccess } from "../write-helpers.ts";
 
 // Flat `{ [extensionName]: selectedPluginId }` so a settings dashboard can show
 // panels per selected provider (visibleWhen field = extension name).

package/packages/bundled-features/src/config/handlers/set.write.ts

@@ -18,9 +18,9 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { requireConfigEncryption, requireSystemDb } from "../feature.js";
-import { MASKED } from "../read-redaction.js";
-import { configValueEntity, configValuesTable } from "../table.js";
+import { requireConfigEncryption, requireSystemDb } from "../feature.ts";
+import { MASKED } from "../read-redaction.ts";
+import { configValueEntity, configValuesTable } from "../table.ts";
 import {
   findConfigRow,
   prepareConfigWrite,
@@ -30,7 +30,7 @@ import {
   validatePattern,
   validateScope,
   validateType,
-} from "../write-helpers.js";
+} from "../write-helpers.ts";
 
 const scopeEnum = z.enum([ConfigScopes.system, ConfigScopes.tenant, ConfigScopes.user]);
 

package/packages/bundled-features/src/config/handlers/values.query.ts

@@ -6,9 +6,9 @@ import {
   isEncryptedAtRest,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { requireConfigResolver, requireSystemDb } from "../feature.js";
-import { MASKED, redactInheritedCascade, shouldRedactInherited } from "../read-redaction.js";
-import { hasConfigAccess } from "../write-helpers.js";
+import { requireConfigResolver, requireSystemDb } from "../feature.ts";
+import { MASKED, redactInheritedCascade, shouldRedactInherited } from "../read-redaction.ts";
+import { hasConfigAccess } from "../write-helpers.ts";
 
 export const valuesQuery = defineQueryHandler({
   name: "values",

package/packages/bundled-features/src/config/index.ts

@@ -2,28 +2,28 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { seedConfigValues } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
 import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
-import { configValueEntity, configValuesTable } from "./table.js";
+import { configValueEntity, configValuesTable } from "./table.ts";
 
 export {
   CONFIG_FEATURE,
   ConfigErrors,
   ConfigHandlers,
   ConfigQueries,
-} from "./constants.js";
-export type { ConfigContext } from "./feature.js";
+} from "./constants.ts";
+export type { ConfigContext } from "./feature.ts";
 export {
   createConfigAccessor,
   createConfigAccessorFactory,
   createConfigFeature,
-} from "./feature.js";
-export type { ReadinessMissingKey, RequiredKeyGate } from "./handlers/readiness.query.js";
+} from "./feature.ts";
+export type { ReadinessMissingKey, RequiredKeyGate } from "./handlers/readiness.query.ts";
 export {
   buildProviderSelectionGate,
   collectMissingRequiredConfig,
-} from "./handlers/readiness.query.js";
-export type { AppConfigOverrides, ConfigResolver } from "./resolver.js";
-export { buildEnvConfigOverrides, createConfigResolver, validateAppOverrides } from "./resolver.js";
-export { configValueEntity, configValuesTable } from "./table.js";
+} from "./handlers/readiness.query.ts";
+export type { AppConfigOverrides, ConfigResolver } from "./resolver.ts";
+export { buildEnvConfigOverrides, createConfigResolver, validateAppOverrides } from "./resolver.ts";
+export { configValueEntity, configValuesTable } from "./table.ts";
 
 // Boot helper for runDevApp / runProdApp: pulls every ConfigSeedDef from
 // the registry and writes the matching system/tenant/user rows via the

package/packages/bundled-features/src/config/resolver.ts

@@ -19,8 +19,8 @@ import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import { assertUnreachable, parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
-import { selectConfigRowsForKeys, selectConfigRowsForScope } from "./db/queries/resolver.js";
-import { configValuesTable } from "./table.js";
+import { selectConfigRowsForKeys, selectConfigRowsForScope } from "./db/queries/resolver.ts";
+import { configValuesTable } from "./table.ts";
 
 type ConfigRow = {
   id: string;

package/packages/bundled-features/src/config/web/client-plugin.ts

@@ -1,7 +1,7 @@
 // @runtime client
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-import { CONFIG_FEATURE } from "../constants.js";
-import { defaultTranslations } from "./i18n.js";
+import { CONFIG_FEATURE } from "../constants.ts";
+import { defaultTranslations } from "./i18n.ts";
 
 export type ConfigClientOptions = {
   /** Key-wise overrides over the default bundles (de/en). */

package/packages/bundled-features/src/config/web/index.ts

@@ -3,5 +3,5 @@ export {
   type ConfigClientFeature,
   type ConfigClientOptions,
   configClient,
-} from "./client-plugin.js";
-export { defaultTranslations } from "./i18n.js";
+} from "./client-plugin.ts";
+export { defaultTranslations } from "./i18n.ts";

package/packages/bundled-features/src/config/write-helpers.ts

@@ -30,9 +30,9 @@ import {
 } from "@cosmicdrift/kumiko-framework/errors";
 import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import { assertUnreachable } from "@cosmicdrift/kumiko-framework/utils";
-import { ConfigErrors } from "./constants.js";
-import { decryptStoredValue } from "./resolver.js";
-import { configValuesTable } from "./table.js";
+import { ConfigErrors } from "./constants.ts";
+import { decryptStoredValue } from "./resolver.ts";
+import { configValuesTable } from "./table.ts";
 
 export type ConfigRowLookup = {
   readonly id: string;

package/packages/bundled-features/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.370.0",
+    "type": "improvement",
+    "title": "kmsEnvSchema declares the subject-key KMS variables",
+    "detail": "kmsEnvSchema lists the 13 KMS slots (PLATFORM_KEK, its rotation predecessor and versions, KUMIKO_BLIND_INDEX_KEY, SUBJECT_KEYS_DATABASE_URL, the _CIPHERTEXT twins and the Key Manager coordinates), all optional. createCryptoShreddingFeature registers it, so composeEnvSchema picks it up."
+  },
   {
     "version": "0.368.0",
     "type": "fix",

package/packages/bundled-features/src/crypto-shredding/env/index.ts

@@ -0,0 +1,94 @@
+import * as z from "zod";
+
+const GENERATED_KEY = { generator: "openssl rand -base64 32", secret: true } as const;
+
+/** Env block of the subject-key KMS: the platform KEK (and its rotation
+ *  predecessor), the blind-index key, the DEK store, and the Key Manager
+ *  coordinates for slots delivered as `<NAME>_CIPHERTEXT`. Every field is
+ *  optional here; an app that requires crypto-shredding in production enforces
+ *  the all-or-none set in its own boot wiring. */
+export const kmsEnvSchema = z.object({
+  PLATFORM_KEK: z
+    .string()
+    .min(1)
+    .optional()
+    .describe(
+      "KEK (base64, 32 bytes) that wraps the subject DEKs in the subject-keys store. Losing it makes every encrypted PII field unreadable.",
+    )
+    .meta({ kumiko: { kms: true, pulumi: GENERATED_KEY } }),
+  SUBJECT_KEYS_DATABASE_URL: z
+    .string()
+    .min(1)
+    .optional()
+    .describe(
+      "Connection URL of the subject-keys database (DEK store). Comes from the database secret, never from Pulumi config.",
+    ),
+  KUMIKO_BLIND_INDEX_KEY: z
+    .string()
+    .min(1)
+    .optional()
+    .describe(
+      "HMAC key (base64, 32 bytes) for blind-index columns, the equality lookups on encrypted fields. Kept separate from the KEK.",
+    )
+    .meta({ kumiko: { kms: true, pulumi: GENERATED_KEY } }),
+  PLATFORM_KEK_VERSION: z
+    .string()
+    .regex(/^\d+$/, "must be a generation number")
+    .optional()
+    .describe("Active KEK generation (default 1)."),
+  PLATFORM_KEK_PREVIOUS: z
+    .string()
+    .min(1)
+    .optional()
+    .describe("KEK of the previous generation (base64), set only during a rotation.")
+    .meta({ kumiko: { kms: true } }),
+  PLATFORM_KEK_PREVIOUS_VERSION: z
+    .string()
+    .regex(/^\d+$/, "must be a generation number")
+    .optional()
+    .describe("Generation number of the previous KEK."),
+  PLATFORM_KEK_CIPHERTEXT: z
+    .string()
+    .min(1)
+    .optional()
+    .describe(
+      "Key Manager ciphertext of PLATFORM_KEK, used when PLATFORM_KEK is unset. Not a Pulumi secret: it is useless without the Key Manager key.",
+    ),
+  PLATFORM_KEK_PREVIOUS_CIPHERTEXT: z
+    .string()
+    .min(1)
+    .optional()
+    .describe("Key Manager ciphertext of PLATFORM_KEK_PREVIOUS, rotation only."),
+  KUMIKO_BLIND_INDEX_KEY_CIPHERTEXT: z
+    .string()
+    .min(1)
+    .optional()
+    .describe(
+      "Key Manager ciphertext of KUMIKO_BLIND_INDEX_KEY, wrapped by the same key as the KEK.",
+    ),
+  KUMIKO_SECRETS_MASTER_KEY_V1_CIPHERTEXT: z
+    .string()
+    .min(1)
+    .optional()
+    .describe(
+      "Key Manager ciphertext of KUMIKO_SECRETS_MASTER_KEY_V1, wrapped by the same key as the KEK.",
+    ),
+  PLATFORM_KEK_KMS_KEY_ID: z
+    .string()
+    .min(1)
+    .optional()
+    .describe("Scaleway Key Manager key id the ciphertexts were wrapped with."),
+  PLATFORM_KEK_KMS_TOKEN: z
+    .string()
+    .min(1)
+    .optional()
+    .describe(
+      "Scaleway API secret key for the decrypt call. Scope it to KeyManagerKeyDecrypt; a broader key trades the KEK for infrastructure access.",
+    )
+    .meta({ kumiko: { pulumi: { secret: true } } }),
+  PLATFORM_KEK_KMS_REGION: z
+    .string()
+    .min(1)
+    .optional()
+    .describe("Key Manager region. Default fr-par."),
+});

package/packages/bundled-features/src/crypto-shredding/feature.ts

@@ -1,13 +1,15 @@
-import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { CRYPTO_SHREDDING_FEATURE_NAME } from "./constants.js";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
+import { CRYPTO_SHREDDING_FEATURE_NAME } from "./constants.ts";
+import { kmsEnvSchema } from "./env/index.ts";
 import {
   forgetSubjectWrite,
   subjectForgetDeniedSchema,
   subjectForgottenSchema,
-} from "./handlers/forget-subject.write.js";
+} from "./handlers/forget-subject.write.ts";
 
-export function createCryptoShreddingFeature(): FeatureDefinition {
-  return defineFeature(
+export function createCryptoShreddingFeature() {
+  const feature = defineFeature(
     CRYPTO_SHREDDING_FEATURE_NAME,
     (r) => {
       r.describe(
@@ -17,6 +19,7 @@ export function createCryptoShreddingFeature(): FeatureDefinition {
         displayLabel: "Crypto-Shredding",
         category: "compliance",
       });
+      r.envSchema(kmsEnvSchema);
 
       // `reason` is operator free text and may name the subject, yet stays plaintext: the forget
       // erases the subject key before the audit append, so a forget of the actor's own tenant
@@ -27,4 +30,5 @@ export function createCryptoShreddingFeature(): FeatureDefinition {
     },
     { dedupeOptions: {} },
   );
+  return featureWithEnvSchema(feature, kmsEnvSchema);
 }

package/packages/bundled-features/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -44,15 +44,15 @@ import {
 import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/search";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
-import { resolveRetentionPolicyForTenant } from "../../data-retention/index.js";
-import { eraseNoteBodiesReachingSubject } from "../../notes-history-user-data/index.js";
-import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.js";
-import { USER_STATUS, userTable } from "../../user/index.js";
+import { resolveRetentionPolicyForTenant } from "../../data-retention/index.ts";
+import { eraseNoteBodiesReachingSubject } from "../../notes-history-user-data/index.ts";
+import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.ts";
+import { USER_STATUS, userTable } from "../../user/index.ts";
 import {
   denyIfTargetOutsideAdminTenant,
   isSystemAdminActor,
   updateUserLifecycle,
-} from "../../user-data-rights/index.js";
+} from "../../user-data-rights/index.ts";
 import {
   CRYPTO_SHREDDING_AGGREGATE_TYPE,
   CRYPTO_SHREDDING_FEATURE_NAME,
@@ -62,7 +62,7 @@ import {
   TARGET_RECORD_NOT_ADMIN_TENANT,
   TARGET_RECORD_RETENTION_BLOCK_DELETE,
   TARGET_TENANT_NOT_ADMIN_TENANT,
-} from "../constants.js";
+} from "../constants.ts";
 
 export { subjectIdSchema };
 

package/packages/bundled-features/src/crypto-shredding/index.ts

@@ -3,11 +3,12 @@ export {
   CRYPTO_SHREDDING_FEATURE_NAME,
   SUBJECT_FORGET_DENIED_EVENT_NAME,
   SUBJECT_FORGOTTEN_EVENT_NAME,
-} from "./constants.js";
-export { createCryptoShreddingFeature } from "./feature.js";
+} from "./constants.ts";
+export { kmsEnvSchema } from "./env/index.ts";
+export { createCryptoShreddingFeature } from "./feature.ts";
 export {
   forgetSubjectSchema,
   subjectForgetDeniedSchema,
   subjectForgottenSchema,
   subjectIdSchema,
-} from "./handlers/forget-subject.write.js";
+} from "./handlers/forget-subject.write.ts";

package/packages/bundled-features/src/custom-fields/changes.json

@@ -1,4 +1,12 @@
 [
+  {
+    "version": "0.370.0",
+    "type": "breaking",
+    "title": "The deprecated customFieldsFeature constant is removed",
+    "detail": "customFieldsFeature was kept next to createCustomFieldsFeature() for one release. Mount the feature by calling createCustomFieldsFeature().",
+    "migration": "Run bun kumiko-upgrade --apply. It replaces customFieldsFeature with createCustomFieldsFeature().",
+    "codemod": "scripts/codemod/feature-factory.ts"
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/custom-fields/executor.ts

@@ -1,5 +1,5 @@
 import { createEntityExecutor } from "@cosmicdrift/kumiko-framework/engine";
-import { fieldDefinitionEntity } from "./entity.js";
+import { fieldDefinitionEntity } from "./entity.ts";
 
 // Single field-definition executor shared by the four define/delete handlers.
 // createEntityExecutor is side-effect-free; instantiating it once keeps the