@cosmicdrift/kumiko-bundled-features 0.307.0 → 0.309.0

package/src/auth-email-password/handlers/change-password.write.ts

@@ -4,7 +4,7 @@ import {
   defineWriteHandler,
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { hashPassword, verifyPassword } from "../../shared";
 import { UserHandlers, UserQueries } from "../../user";
 import { invalidCredentials } from "../errors";

package/src/auth-email-password/handlers/confirm-account-unlock.write.ts

@@ -4,7 +4,7 @@ import {
   UnprocessableError,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { AuthErrors } from "../constants";
 import { invalidUnlockToken } from "../errors";
 import { clearLockoutState } from "../lockout-store";

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -31,7 +31,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { decryptStoredPii, sessionLocaleField, sessionTimezoneField } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {

package/src/auth-email-password/handlers/invite-accept.write.ts

@@ -23,7 +23,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { decryptStoredPii } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
 import {

package/src/auth-email-password/handlers/invite-create.write.ts

@@ -22,7 +22,7 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link-Pattern), DB-row-owner ist tenant-feature
 import {
   INVITATION_STATUS,

package/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -31,7 +31,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { decryptStoredPii } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {

package/src/auth-email-password/handlers/login.write.ts

@@ -10,7 +10,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 import { verifyDummyPassword, verifyPassword } from "../../shared";
 import { USER_STATUS, UserQueries } from "../../user";
 import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row";

package/src/auth-email-password/handlers/logout.write.ts

@@ -1,5 +1,5 @@
 import { access, defineWriteHandler, stepsPipeline } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 
 // Logout — JWT is stateless, so server-side we only return OK. A future
 // revocation list / session table can land here without changing the

package/src/auth-email-password/handlers/reset-password.write.ts

@@ -1,6 +1,6 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { hashPassword } from "../../shared";
 import { AuthErrors } from "../constants";
 import { invalidResetToken } from "../errors";

package/src/auth-email-password/handlers/self-registration-status.query.ts

@@ -1,5 +1,5 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { AUTH_SELF_REGISTRATION_FEATURE } from "../self-registration-toggle";
 
 // Anonymous-readable status for the (unauthenticated) signup page: lets it

package/src/auth-email-password/handlers/signup-confirm.write.ts

@@ -29,7 +29,7 @@ import {
 import { ConflictError, InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateUniqueName } from "@cosmicdrift/kumiko-framework/random";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import signup-confirm reads tenants.key for slug-uniqueness check (TOCTOU + DB-unique-index zusammen)
 import { tenantTable } from "../../tenant/schema/tenant";
 import { invalidSignupToken, signupEmailAlreadyRegistered } from "../errors";

package/src/auth-email-password/handlers/signup-request.write.ts

@@ -25,7 +25,7 @@ import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { AUTH_SIGNUP_DEFAULT_TTL_MINUTES } from "../constants";
 import type { AuthMailLocale } from "../email-templates";
 import { renderActivationEmail } from "../email-templates";

package/src/auth-email-password/handlers/token-request-handler.ts

@@ -15,7 +15,7 @@
 import { createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import type { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { UserQueries } from "../../user";
 import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row";
 import type { AuthMailContent, AuthMailLocale, RenderTokenContentArgs } from "../email-templates";

package/src/auth-email-password/handlers/verify-email.write.ts

@@ -1,6 +1,6 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { AuthErrors } from "../constants";
 import { invalidVerificationToken } from "../errors";
 import { verifyVerificationToken } from "../verification-token";

package/src/auth-email-password/password-policy.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 
 // Top-10k common-password list (SecLists, MIT license). Filtered to length // kumiko-lint-ignore comment-lang "MIT" false-positives the DE-word regex
 // >=8, since shorter entries are already rejected by `.min(8)` below (keeps

package/src/auth-email-password/seeding.ts

@@ -14,6 +14,7 @@
 
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
+  configuredBlindIndexKey,
   configuredPiiSubjectKms,
   decryptPiiFieldValues,
   type LocalKeyKmsAdapter,
@@ -28,7 +29,7 @@ import { type SeedTenantHooks, seedTenant, seedTenantMembership } from "../tenan
 // kumiko-lint-ignore cross-feature-import signup create-only guard reads the user projection by email
 import { USER_STATUS, userTable } from "../user/schema/user";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
-import { seedUser } from "../user/seeding";
+import { reconcileSeededUserEmailVerified, seedUser } from "../user/seeding";
 
 // Re-export für ergonomische Single-Import-Site in tests/seed-scripts.
 // Das Auth-Feature ist der natürliche Aufrufer für "seed admin user mit
@@ -257,8 +258,8 @@ export async function seedAdmin(
 // seedAdminGuarded is a separate, additive boot-seed guard — NOT a change
 // to seedUser/seedAdmin/provisionSignupAccount, which also run on every
 // real self-signup request and can't afford a decrypt-scan fallback there.
-// Use this only where seedAdmin already runs (dev-boot / sample-server /
-// bootstrap scripts), never as a login or signup hot path.
+// It's what runProdApp/runDevApp call for their admin boot-seed; keep it
+// off the login/signup hot path.
 
 type ActiveUserRow = {
   readonly id: string;
@@ -332,10 +333,22 @@ export async function seedAdminGuarded(
   const kms = configuredPiiSubjectKms();
   if (kms === undefined) return seedAdmin(db, options);
 
+  // Without a bidx key every row seeded here gets a NULL email_bidx, which
+  // neither seedAdmin's lookup nor the partial unique index can ever see.
+  if (configuredBlindIndexKey() === undefined) {
+    throw new Error(
+      "seedAdminGuarded: a PII KMS is configured but no blind-index key — the email lookup would be blind and the seed would insert a duplicate admin. Configure KUMIKO_BLIND_INDEX_KEY.",
+    );
+  }
+
   const existingId = await findExistingUserIdForEmail(db, kms, options.email);
   if (existingId === undefined) return seedAdmin(db, options);
 
   const by = options.by ?? TestUsers.systemAdmin;
+  if (options.emailVerified === true) {
+    const existingRow = await fetchOne(db, userTable, { id: existingId });
+    if (existingRow) await reconcileSeededUserEmailVerified(db, existingRow, by);
+  }
   for (const m of options.memberships) {
     await seedTenant(db, { id: m.tenantId, key: m.tenantKey, name: m.tenantName, by });
     await seedTenantMembership(db, {

package/src/auth-mfa/__tests__/session-scoped-sse-revoke.integration.test.ts

@@ -45,7 +45,7 @@ import {
   createTestEnvelopeCipher,
   resetTestTables,
 } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
 import { createConfigFeature } from "../../config";

package/src/auth-mfa/handlers/disable.write.ts

@@ -1,7 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { findUserMfaRow } from "../db/queries";
 import { invalidTotpCode, mfaNotEnabled } from "../errors";
 import { userMfaEntity, userMfaTable } from "../schema/user-mfa";

package/src/auth-mfa/handlers/enable-confirm-preauth.write.ts

@@ -8,7 +8,7 @@ import {
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { burnToken, sessionLocaleField, sessionTimezoneField } from "../../shared";
 import { USER_STATUS, UserQueries } from "../../user";
 import { base32Decode } from "../base32";

package/src/auth-mfa/handlers/enable-confirm.write.ts

@@ -2,7 +2,7 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { burnToken } from "../../shared";
 import { base32Decode } from "../base32";
 import { findUserMfaRow } from "../db/queries";

package/src/auth-mfa/handlers/enable-start-preauth.write.ts

@@ -1,6 +1,6 @@
 import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { base32Encode } from "../base32";
 import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants";
 import { findUserMfaRow } from "../db/queries";

package/src/auth-mfa/handlers/enable-start.write.ts

@@ -1,5 +1,5 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { UserQueries } from "../../user";
 import { base32Encode } from "../base32";
 import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants";

package/src/auth-mfa/handlers/regenerate-recovery.write.ts

@@ -1,7 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { findUserMfaRow } from "../db/queries";
 import { invalidTotpCode, mfaNotEnabled } from "../errors";
 import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes";

package/src/auth-mfa/handlers/status.query.ts

@@ -1,6 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { userMfaTable } from "../schema/user-mfa";
 
 // "Is MFA enabled for me" — the one thing a settings screen needs before it

package/src/auth-mfa/handlers/verify.write.ts

@@ -7,7 +7,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 import { burnToken, sessionLocaleField, sessionTimezoneField } from "../../shared";
 import { USER_STATUS, UserQueries } from "../../user";
 import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../constants";

package/src/billing-foundation/billing-info-query.ts

@@ -16,7 +16,7 @@
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { HandlerContext, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { QnTypes, qn, SYSTEM_TENANT_ID, toKebab } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import SUBSCRIPTION_STRIPE_FEATURE is a plain string const in constants.ts (no imports); the barrel import (../subscription-stripe) would create a module cycle with billing-foundation via feature.ts → verify-webhook.ts, because billing-foundation/index.ts now re-exports billing-info-query.ts.
 import { SUBSCRIPTION_STRIPE_FEATURE } from "../subscription-stripe/constants";
 import { subscriptionAggregateId } from "./aggregate-id";

package/src/billing-foundation/events.ts

@@ -10,7 +10,7 @@
 // accounting-export, churn-analytics) listenen direkt auf den event-
 // type ohne payload-discriminator.
 
-import { z } from "zod";
+import * as z from "zod";
 import { BILLING_FOUNDATION_FEATURE, SubscriptionStatuses } from "./constants";
 
 // Aggregate-type für den event-store. Eine subscription pro Tenant ist

package/src/billing-foundation/handlers/create-checkout-session.write.ts

@@ -15,7 +15,7 @@
 // resolved den Tenant.
 
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { SUBSCRIPTION_PROVIDER_EXTENSION } from "../constants";
 import type { SubscriptionProviderPlugin } from "../types";
 

package/src/billing-foundation/handlers/create-portal-session.write.ts

@@ -15,7 +15,7 @@ import {
   decryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { subscriptionAggregateId } from "../aggregate-id";
 import { SUBSCRIPTION_PROVIDER_EXTENSION } from "../constants";
 import { SUBSCRIPTION_PII_FIELDS } from "../entities";

package/src/billing-foundation/handlers/list-subscriptions.query.ts

@@ -7,7 +7,7 @@ import {
   decryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { SUBSCRIPTION_PII_FIELDS } from "../entities";
 import { subscriptionsProjectionTable } from "../projection";
 

package/src/billing-foundation/handlers/process-event.write.ts

@@ -17,7 +17,7 @@ import {
   encryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { subscriptionAggregateId } from "../aggregate-id";
 import { SubscriptionEventTypes, SubscriptionStatuses } from "../constants";
 import { SUBSCRIPTION_PII_FIELDS, subscriptionEntity } from "../entities";

package/src/billing-foundation/handlers/process-payment-event.write.ts

@@ -15,7 +15,7 @@ import {
   encryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { paymentAggregateId } from "../aggregate-id";
 import { PAYMENT_PII_FIELDS, paymentEntity } from "../entities";
 import {

package/src/cap-counter/__tests__/cap-counter.integration.test.ts

@@ -23,7 +23,7 @@ import {
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import { CapCounterHandlers, CapCounterQueries } from "../constants";
 import {
   CapExceededError,

package/src/cap-counter/__tests__/stock-cap-guard.integration.test.ts

@@ -23,7 +23,7 @@ import {
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import { capCounterEntity } from "../entity";
 import { createStockCapGuard } from "../stock-cap-guard";
 

package/src/cap-counter/__tests__/with-cap-enforcement.integration.test.ts

@@ -24,7 +24,7 @@ import {
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import { bookCapUsage, readRollingCapUsage } from "../book-cap-usage";
 import { CapCounterQueries } from "../constants";
 import type { SoftHitNotifier } from "../enforce-cap";

package/src/cap-counter/book-cap-usage.ts

@@ -9,7 +9,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { capCounterAggregateId, rollingCapAggregateId } from "./aggregate-id";
 import { CAP_COUNTER_ROLLING_AGGREGATE_TYPE, ROLLING_INCREMENTED_EVENT_QN } from "./constants";
 import { capCounterEntity } from "./entity";

package/src/cap-counter/handlers/get-counter.query.ts

@@ -1,5 +1,5 @@
 import { createEntityExecutor, type QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { capCounterEntity } from "../entity";
 
 const { table } = createEntityExecutor("cap-counter", capCounterEntity);

package/src/cap-counter/handlers/increment-rolling.write.ts

@@ -19,7 +19,7 @@
 // N Tage aus diesem Stream.
 
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { rollingCapAggregateId } from "../aggregate-id";
 import { CAP_COUNTER_ROLLING_AGGREGATE_TYPE, ROLLING_INCREMENTED_EVENT_QN } from "../constants";
 

package/src/cap-counter/handlers/increment.write.ts

@@ -1,5 +1,5 @@
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { bookCapUsage } from "../book-cap-usage";
 
 const incrementSchema = z.object({

package/src/cap-counter/handlers/mark-soft-warned.write.ts

@@ -1,5 +1,5 @@
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { markCapSoftWarned } from "../book-cap-usage";
 
 // mark-soft-warned — sets lastSoftWarnedAt on the counter so subsequent

package/src/cap-overview/handlers/caps-usage.query.ts

@@ -6,7 +6,7 @@ import {
   type QueryHandlerDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { tierAssignmentEntity } from "../../tier-engine";
 import { MY_CAPS_ACCESS_ROLES } from "../access";
 import type { CapSpec, CapUsageWithMeta } from "../types";

package/src/cap-overview/handlers/tenant-caps-list.query.ts

@@ -2,7 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable, decodeCursor, encodeCursor } from "@cosmicdrift/kumiko-framework/db";
 import { definePagedQueryHandler, MAX_LIST_LIMIT } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { subscriptionsProjectionTable } from "../../billing-foundation";
 import { tenantTable } from "../../tenant";
 import { tierAssignmentEntity } from "../../tier-engine";

package/src/cap-overview/handlers/tenant-options.query.ts

@@ -1,7 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { tenantTable } from "../../tenant";
 
 type TenantRow = { readonly id: string; readonly name: string };

package/src/channel-in-app/handlers/inbox.query.ts

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { inAppMessagesTable } from "../tables";
 
 export const inboxQuery = defineQueryHandler({

package/src/channel-in-app/handlers/mark-all-read.write.ts

@@ -1,6 +1,6 @@
 import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { inAppMessagesTable } from "../tables";
 
 export const markAllReadWrite = defineWriteHandler({

package/src/channel-in-app/handlers/mark-read.write.ts

@@ -1,7 +1,7 @@
 import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { inAppMessagesTable } from "../tables";
 
 export const markReadWrite = defineWriteHandler({

package/src/channel-in-app/handlers/unread-count.query.ts

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { inAppMessagesTable } from "../tables";
 
 export const unreadCountQuery = defineQueryHandler({

package/src/compliance-profiles/handlers/for-tenant.query.ts

@@ -5,7 +5,7 @@ import {
   resolveComplianceProfile,
 } from "@cosmicdrift/kumiko-framework/compliance";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { parseComplianceProfileOverride } from "../_internal/parse-override";
 import { tenantComplianceProfileTable } from "../schema/profile-selection";
 

package/src/compliance-profiles/handlers/list-profiles.query.ts

@@ -5,7 +5,7 @@ import {
   SELECTABLE_PROFILE_KEYS,
 } from "@cosmicdrift/kumiko-framework/compliance";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 
 // Liefert alle waehlbaren Compliance-Profile fuer das Tenant-Onboarding.
 // Pure In-Memory-Read der Constants — keine DB-Abfrage. Kein Caching

package/src/compliance-profiles/handlers/needs-profile.query.ts

@@ -2,7 +2,7 @@ import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { ComplianceProfileKey } from "@cosmicdrift/kumiko-framework/compliance";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { tenantComplianceProfileTable } from "../schema/profile-selection";
 
 // Onboarding banner trigger for tenant admin.

package/src/compliance-profiles/handlers/set-profile.write.ts

@@ -15,7 +15,7 @@ import {
   validationErrorFromZod,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import {
   tenantComplianceProfileEntity,
   tenantComplianceProfileTable,

package/src/compliance-profiles/handlers/sub-processors.query.ts

@@ -6,7 +6,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/compliance";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { z } from "zod";
+import * as z from "zod";
 
 // Public Sub-Processor-Liste — anonymous accessible (Memory:
 // project_anonymous_access). Matched die DSGVO Art. 28(2) Pflicht

package/src/compliance-profiles-ops/handlers/tenants-missing-profile.query.ts

@@ -1,7 +1,7 @@
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { defineQueryHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { tenantComplianceProfileTable } from "../../compliance-profiles";
 import { tenantTable } from "../../tenant";
 

package/src/config/__tests__/backing-secrets.integration.test.ts

@@ -14,7 +14,7 @@ import {
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { z } from "zod";
+import * as z from "zod";
 import { createSecretsContext } from "../../secrets/secrets-context";
 import { tenantSecretsTable } from "../../secrets/table";
 import { ConfigHandlers, ConfigQueries } from "../constants";

package/src/config/__tests__/config.integration.test.ts

@@ -24,7 +24,7 @@ import {
   createTestEnvelopeCipher,
   expectErrorIncludes,
 } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import { ConfigHandlers, ConfigQueries } from "../constants";
 import { createConfigAccessor, createConfigAccessorFactory, createConfigFeature } from "../feature";
 import { type ConfigResolver, createConfigResolver, validateAppOverrides } from "../resolver";

package/src/config/__tests__/tz-resolution.integration.test.ts

@@ -11,7 +11,7 @@ import {
   type TestStack,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { z } from "zod";
+import * as z from "zod";
 import { createConfigAccessorFactory, createConfigFeature } from "../feature";
 import { createConfigResolver } from "../resolver";
 import { configValuesTable } from "../table";

package/src/config/handlers/cascade.query.ts

@@ -4,7 +4,7 @@ import {
   defineQueryHandler,
   isEncryptedAtRest,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { requireConfigResolver, requireSystemDb } from "../feature";
 import { MASKED, redactInheritedCascade, shouldRedactInherited } from "../read-redaction";
 import { hasConfigAccess } from "../write-helpers";