@cosmicdrift/kumiko-bundled-features 0.368.0 → 0.370.0

package/dist/account-security/constants.d.ts

@@ -0,0 +1,4 @@
+export declare const ACCOUNT_SECURITY_FEATURE = "account-security";
+export declare const ACCOUNT_SECURITY_SCREEN_ID = "account-security";
+export declare const ACCOUNT_SECURITY_SCREEN_QN = "account-security:screen:account-security";
+export declare const ACCOUNT_SECURITY_NAV_LABEL = "account-security:nav.accountSecurity";

package/dist/account-security/constants.js

@@ -0,0 +1,5 @@
+// @runtime client
+export const ACCOUNT_SECURITY_FEATURE = "account-security";
+export const ACCOUNT_SECURITY_SCREEN_ID = "account-security";
+export const ACCOUNT_SECURITY_SCREEN_QN = `${ACCOUNT_SECURITY_FEATURE}:screen:${ACCOUNT_SECURITY_SCREEN_ID}`;
+export const ACCOUNT_SECURITY_NAV_LABEL = `${ACCOUNT_SECURITY_FEATURE}:nav.accountSecurity`;

package/dist/account-security/feature.d.ts

@@ -0,0 +1,14 @@
+import { type AccessRule, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+export interface AccountSecurityNavOptions {
+    readonly order?: number;
+    readonly parent?: string;
+}
+export interface AccountSecurityFeatureOptions {
+    readonly access?: AccessRule;
+    readonly nav?: AccountSecurityNavOptions;
+}
+export declare const accountSecurityMfaStatusVisibility: {
+    readonly query: "auth-mfa:query:user-mfa:status";
+    readonly field: "enabled";
+};
+export declare function createAccountSecurityFeature(options?: AccountSecurityFeatureOptions): FeatureDefinition;

package/dist/account-security/feature.js

@@ -0,0 +1,62 @@
+import { defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
+import { AuthMfaQueries, MFA_DISABLE_SCREEN_ID, MFA_ENABLE_SCREEN_ID, MFA_REGENERATE_RECOVERY_SCREEN_ID, } from "../auth-mfa/index.js";
+import { SESSION_MINE_SCREEN_ID } from "../sessions/index.js";
+import { ACCOUNT_SECURITY_FEATURE, ACCOUNT_SECURITY_NAV_LABEL, ACCOUNT_SECURITY_SCREEN_ID, ACCOUNT_SECURITY_SCREEN_QN, } from "./constants.js";
+import { ACCOUNT_SECURITY_I18N } from "./i18n.js";
+const DEFAULT_ACCESS = {
+    openToAll: { reason: "signed-in users manage their own account security" },
+};
+const DEFAULT_NAV_ORDER = 90;
+export const accountSecurityMfaStatusVisibility = {
+    query: AuthMfaQueries.status,
+    field: "enabled",
+};
+export function createAccountSecurityFeature(options = {}) {
+    const { access = DEFAULT_ACCESS, nav } = options;
+    return defineFeature(ACCOUNT_SECURITY_FEATURE, (r) => {
+        r.describe("Self-service account dashboard: MFA enrollment, recovery codes and the user's own sessions, composed from the auth-mfa and sessions screens.");
+        r.requires({ features: ["sessions"] });
+        r.requires({ features: ["auth-mfa"] });
+        r.translations({ keys: ACCOUNT_SECURITY_I18N });
+        r.screen({
+            id: ACCOUNT_SECURITY_SCREEN_ID,
+            type: "dashboard",
+            access,
+            dormant: nav === undefined,
+            panels: [
+                {
+                    kind: "screen",
+                    id: "mfa-enable",
+                    screen: `auth-mfa:screen:${MFA_ENABLE_SCREEN_ID}`,
+                    visibleWhen: { ...accountSecurityMfaStatusVisibility, eq: false },
+                },
+                {
+                    kind: "screen",
+                    id: "mfa-regenerate",
+                    screen: `auth-mfa:screen:${MFA_REGENERATE_RECOVERY_SCREEN_ID}`,
+                    visibleWhen: { ...accountSecurityMfaStatusVisibility, eq: true },
+                },
+                {
+                    kind: "screen",
+                    id: "mfa-disable",
+                    screen: `auth-mfa:screen:${MFA_DISABLE_SCREEN_ID}`,
+                    visibleWhen: { ...accountSecurityMfaStatusVisibility, eq: true },
+                },
+                { kind: "screen", id: "sessions", screen: `sessions:screen:${SESSION_MINE_SCREEN_ID}` },
+            ],
+        });
+        if (nav !== undefined) {
+            // Explicit property assignments: the feature-AST parser reads neither
+            // `??`, shorthand properties nor a conditional spread, and the boot validator treats
+            // `parent: undefined` as a top-level entry.
+            const { order: navOrder = DEFAULT_NAV_ORDER, parent: navParent } = nav;
+            r.nav({
+                id: ACCOUNT_SECURITY_SCREEN_ID,
+                label: ACCOUNT_SECURITY_NAV_LABEL,
+                screen: ACCOUNT_SECURITY_SCREEN_QN,
+                order: navOrder,
+                parent: navParent,
+            });
+        }
+    });
+}

package/dist/account-security/i18n.d.ts

@@ -0,0 +1,6 @@
+type LocalizedString = {
+    readonly de: string;
+    readonly en: string;
+};
+export declare const ACCOUNT_SECURITY_I18N: Readonly<Record<string, LocalizedString>>;
+export {};

package/dist/account-security/i18n.js

@@ -0,0 +1,6 @@
+// @runtime client
+// Server-registered so the framework projects these keys into the client bundle.
+export const ACCOUNT_SECURITY_I18N = {
+    "screen:account-security.title": { de: "Konto & Sicherheit", en: "Account & Security" },
+    "account-security:nav.accountSecurity": { de: "Konto & Sicherheit", en: "Account & Security" },
+};

package/dist/account-security/index.d.ts

@@ -0,0 +1,3 @@
+export { ACCOUNT_SECURITY_FEATURE, ACCOUNT_SECURITY_NAV_LABEL, ACCOUNT_SECURITY_SCREEN_ID, ACCOUNT_SECURITY_SCREEN_QN, } from "./constants.ts";
+export { type AccountSecurityFeatureOptions, type AccountSecurityNavOptions, accountSecurityMfaStatusVisibility, createAccountSecurityFeature, } from "./feature.ts";
+export { ACCOUNT_SECURITY_I18N } from "./i18n.ts";

package/dist/account-security/index.js

@@ -0,0 +1,3 @@
+export { ACCOUNT_SECURITY_FEATURE, ACCOUNT_SECURITY_NAV_LABEL, ACCOUNT_SECURITY_SCREEN_ID, ACCOUNT_SECURITY_SCREEN_QN, } from "./constants.js";
+export { accountSecurityMfaStatusVisibility, createAccountSecurityFeature, } from "./feature.js";
+export { ACCOUNT_SECURITY_I18N } from "./i18n.js";

package/dist/admin-shell/feature.d.ts

@@ -1,5 +1,5 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type MetricDefinition } from "../metrics/index.js";
+import { type MetricDefinition } from "../metrics/index.ts";
 export type CreateAdminShellOptions = {
     /** Short workspace id for tenant operators (URL segment). Default `tenant-admin`. */
     readonly workspaceIds?: {

package/dist/admin-shell/index.d.ts

@@ -1,4 +1,4 @@
-export { ADMIN_SHELL_FEATURE, DEFAULT_PLATFORM_WORKSPACE_ID, DEFAULT_TENANT_WORKSPACE_ID, PLATFORM_OVERVIEW_SCREEN_ID, TENANT_OVERVIEW_SCREEN_ID, } from "./constants.js";
-export { type CreateAdminShellOptions, createAdminShellFeature } from "./feature.js";
-export { ADMIN_SHELL_I18N } from "./i18n.js";
-export { isOverviewQueryAllowed, type OverviewWorkspaceKind, overviewAllowedQueries, PLATFORM_OVERVIEW_ALLOWED_QUERIES, TENANT_OVERVIEW_ALLOWED_QUERIES, TENANT_OVERVIEW_FORBIDDEN_QUERIES, } from "./overview-allowlist.js";
+export { ADMIN_SHELL_FEATURE, DEFAULT_PLATFORM_WORKSPACE_ID, DEFAULT_TENANT_WORKSPACE_ID, PLATFORM_OVERVIEW_SCREEN_ID, TENANT_OVERVIEW_SCREEN_ID, } from "./constants.ts";
+export { type CreateAdminShellOptions, createAdminShellFeature } from "./feature.ts";
+export { ADMIN_SHELL_I18N } from "./i18n.ts";
+export { isOverviewQueryAllowed, type OverviewWorkspaceKind, overviewAllowedQueries, PLATFORM_OVERVIEW_ALLOWED_QUERIES, TENANT_OVERVIEW_ALLOWED_QUERIES, TENANT_OVERVIEW_FORBIDDEN_QUERIES, } from "./overview-allowlist.ts";

package/dist/admin-shell/overview-panels.d.ts

@@ -1,5 +1,5 @@
 import type { DashboardFilterDefinition, DashboardPanelDefinition, DashboardTimeRangeDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
-import { type MetricDefinition } from "../metrics/index.js";
+import { type MetricDefinition } from "../metrics/index.ts";
 export declare const OVERVIEW_TIME_RANGE: DashboardTimeRangeDefinition;
 export declare const PLATFORM_TENANT_FILTER: DashboardFilterDefinition;
 export declare const PLATFORM_SCOPE: {

package/dist/admin-shell/web/index.d.ts

@@ -1 +1 @@
-export { type AdminShellClientOptions, adminShellClient } from "./client-plugin.js";
+export { type AdminShellClientOptions, adminShellClient } from "./client-plugin.tsx";

package/dist/agent-tools/agent-manifest.d.ts

@@ -1,4 +1,4 @@
-import type { AgentManifest, AgentManifestOptions, RegistryManifestView } from "./types.js";
+import type { AgentManifest, AgentManifestOptions, RegistryManifestView } from "./types.ts";
 export declare function systemOnlyPropertyNames(jsonSchema: Record<string, unknown>): readonly string[];
 /** Registry snapshot → AI-agent manifest. Pure, deterministic, no I/O — mirrors
  *  `buildToolCatalog`'s contract, just describing the app's shape instead of

package/dist/agent-tools/index.d.ts

@@ -1,8 +1,8 @@
-export type { AgentDocGap, AgentDocGapKind } from "./agent-doc-lint.js";
-export { AgentDocGapKinds, findAgentDocGaps, findHandlerTranslationGaps, formatAgentDocGap, } from "./agent-doc-lint.js";
-export { buildAgentManifest } from "./agent-manifest.js";
-export { AGENT_TOOLS_FEATURE_NAME, createAgentToolsFeature } from "./feature.js";
-export { buildToolCatalog, OPEN_FORM_TOOL_NAME, toolNameForQn } from "./tool-catalog.js";
-export type { ToolCallRequest, ToolCallResult, ToolDispatcher } from "./tool-dispatch.js";
-export { dispatchToolCall } from "./tool-dispatch.js";
-export type { AgentManifest, AgentManifestEntity, AgentManifestFeature, AgentManifestField, AgentManifestHandler, AgentManifestNav, AgentManifestOptions, AgentManifestScreen, AgentManifestWorkspace, AgentToolMode, RegistryManifestView, RegistrySearchView, ToolCatalog, ToolCatalogOptions, ToolDefinition, ToolDispatchDescriptor, } from "./types.js";
+export type { AgentDocGap, AgentDocGapKind } from "./agent-doc-lint.ts";
+export { AgentDocGapKinds, findAgentDocGaps, findHandlerTranslationGaps, formatAgentDocGap, } from "./agent-doc-lint.ts";
+export { buildAgentManifest } from "./agent-manifest.ts";
+export { AGENT_TOOLS_FEATURE_NAME, createAgentToolsFeature } from "./feature.ts";
+export { buildToolCatalog, OPEN_FORM_TOOL_NAME, toolNameForQn } from "./tool-catalog.ts";
+export type { ToolCallRequest, ToolCallResult, ToolDispatcher } from "./tool-dispatch.ts";
+export { dispatchToolCall } from "./tool-dispatch.ts";
+export type { AgentManifest, AgentManifestEntity, AgentManifestFeature, AgentManifestField, AgentManifestHandler, AgentManifestNav, AgentManifestOptions, AgentManifestScreen, AgentManifestWorkspace, AgentToolMode, RegistryManifestView, RegistrySearchView, ToolCatalog, ToolCatalogOptions, ToolDefinition, ToolDispatchDescriptor, } from "./types.ts";

package/dist/agent-tools/manifest-deny-qns.d.ts

@@ -1,3 +1,3 @@
-import type { AgentManifest } from "./types.js";
+import type { AgentManifest } from "./types.ts";
 export declare function recordManifestDenyQns(manifest: AgentManifest, denyQns: ReadonlySet<string>): void;
 export declare function assertCatalogMirrorsManifestDenyQns(manifest: AgentManifest, catalogDenyQns: ReadonlySet<string>): void;

package/dist/agent-tools/tool-catalog.d.ts

@@ -1,4 +1,4 @@
-import type { AgentManifest, RegistrySearchView, ToolCatalog, ToolCatalogOptions } from "./types.js";
+import type { AgentManifest, RegistrySearchView, ToolCatalog, ToolCatalogOptions } from "./types.ts";
 /** Drops the `query`/`write` verb segment from a handler QN, joins the rest with `_`, and
  *  sanitizes to a valid tool-call identifier. Only the FIRST matching segment is dropped —
  *  QNs are `<feature>:query|write:<entity>:<verb>`, so the verb only ever appears once at that

package/dist/agent-tools/tool-dispatch.d.ts

@@ -1,6 +1,6 @@
 import type { SessionUser, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
-import type { ToolDispatchDescriptor } from "./types.js";
+import type { ToolDispatchDescriptor } from "./types.ts";
 /** Narrow view of `Dispatcher` (packages/framework/src/pipeline/dispatcher.ts) — kept out of
  *  `ToolDispatchDescriptor`'s reach and small enough for tests to build a plain object instead
  *  of a real Dispatcher. `write` reaches the real `<entity>:write` / write-handler pipeline with

package/dist/audit/handlers/resolve-audit-tenant.d.ts

@@ -1,5 +1,5 @@
 import { type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import { type AuditScope } from "../constants.js";
+import { type AuditScope } from "../constants.ts";
 export type AuditScopeFilter = {
     readonly tenantId: string;
     readonly aggregateType?: string;

package/dist/audit/index.d.ts

@@ -1,3 +1,3 @@
-export { AUDIT_FEATURE, AuditQueries } from "./constants.js";
-export { createEscapeHatchAuditSink, ESCAPE_HATCH_USED_EVENT } from "./escape-hatch-audit-sink.js";
-export { createAuditFeature } from "./feature.js";
+export { AUDIT_FEATURE, AuditQueries } from "./constants.ts";
+export { createEscapeHatchAuditSink, ESCAPE_HATCH_USED_EVENT } from "./escape-hatch-audit-sink.ts";
+export { createAuditFeature } from "./feature.ts";

package/dist/audit/web/index.d.ts

@@ -1 +1 @@
-export { type AuditClientOptions, auditClient } from "./client-plugin.js";
+export { type AuditClientOptions, auditClient } from "./client-plugin.tsx";

package/dist/auth-email-password/bootstrap.d.ts

@@ -4,7 +4,7 @@ import { type Registry, type TenantId, type WriteResult } from "@cosmicdrift/kum
 import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
 import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
-import type { GlobalRole } from "../user/constants.js";
+import type { GlobalRole } from "../user/constants.ts";
 export type BootstrapInvite = {
     readonly email: string;
     /** Membership role in the tenant, validated like a tenant-admin invite

package/dist/auth-email-password/feature.d.ts

@@ -1,10 +1,11 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import * as z from "zod";
-import type { AuthMailLocale } from "./email-templates.js";
-import { type InviteCreateOptions } from "./handlers/invite-create.write.js";
-import { type LoginHandlerOptions } from "./handlers/login.write.js";
-import { type RequestAccountUnlockOptions } from "./handlers/request-account-unlock.write.js";
-import { type SignupRequestOptions } from "./handlers/signup-request.write.js";
+import type { AuthMailLocale } from "./email-templates.ts";
+import { type InviteCreateOptions } from "./handlers/invite-create.write.ts";
+import { type LoginHandlerOptions } from "./handlers/login.write.ts";
+import { type RequestAccountUnlockOptions } from "./handlers/request-account-unlock.write.ts";
+import { type SignupRequestOptions } from "./handlers/signup-request.write.ts";
 /**
  * Env-vars contract for the `auth-email-password` feature.
  *
@@ -52,4 +53,4 @@ export type AuthEmailPasswordOptions = {
     readonly invite?: InviteOptions;
     readonly accountUnlock?: AccountUnlockOptions;
 };
-export declare function createAuthEmailPasswordFeature(opts?: AuthEmailPasswordOptions): FeatureDefinition;
+export declare function createAuthEmailPasswordFeature(opts?: AuthEmailPasswordOptions): FeatureWithEnvSchema<FeatureDefinition, typeof authEmailPasswordEnvSchema.shape>;

package/dist/auth-email-password/feature.js

@@ -1,4 +1,5 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import * as z from "zod";
 import { MIN_HMAC_SECRET_LENGTH } from "./constants.js";
 import { changePasswordWrite } from "./handlers/change-password.write.js";
@@ -62,7 +63,7 @@ export function createAuthEmailPasswordFeature(opts = {}) {
         throw new Error(`[auth-email-password] accountUnlock.hmacSecret must be ≥${MIN_HMAC_SECRET_LENGTH} chars (HMAC-SHA256 token signing)`);
     }
     const strictVerification = opts.emailVerification !== undefined && (opts.emailVerification.mode ?? "strict") === "strict";
-    return defineFeature("auth-email-password", (r) => {
+    const feature = defineFeature("auth-email-password", (r) => {
         r.describe("Provides email+password authentication: the always-on handlers are `login`, `changePassword`, and `logout`; optional flows — password reset, email verification, magic-link self-signup, tenant invite, and account-unlock — are registered only when you pass their respective option objects (`passwordReset`, `emailVerification`, `signup`, `invite`, `accountUnlock`) to `createAuthEmailPasswordFeature(opts)`. All five magic-link flows dispatch their mail through the `delivery` feature via `ctx.notify`, so mounting any of them additionally requires `delivery`. Tokens are HMAC-signed (reset/verify/unlock) or opaque-random in Redis (signup/invite). `accountUnlock` is the self-service escape hatch for `accountLockout`'s monotonic failure-counter (#1266): confirming the mailed token clears the Redis lockout state without touching the user entity. Requires the `user` and `tenant` features, and declares `JWT_SECRET` (≥ 32 chars) in `authEmailPasswordEnvSchema` so a missing secret surfaces at boot validation rather than on the first login attempt.");
         // kumiko-lint-ignore i18n-ui-strings uiHints labels are feature-registry metadata for the admin feature catalog, not yet wired to the i18n system, see #2312
         r.uiHints({
@@ -164,4 +165,5 @@ export function createAuthEmailPasswordFeature(opts = {}) {
         }
         return { handlers, queries };
     });
+    return featureWithEnvSchema(feature, authEmailPasswordEnvSchema);
 }

package/dist/auth-email-password/handlers/confirm-token-flow.d.ts

@@ -1,6 +1,6 @@
 import { type HandlerContext, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import type { AuthUserRow } from "../auth-user-row.js";
+import type { AuthUserRow } from "../auth-user-row.ts";
 export type ConfirmTokenFlowSpec<TSuccessData> = {
     readonly purpose: string;
     readonly redisRequiredMessage: string;

package/dist/auth-email-password/handlers/invite-accept-with-login.write.d.ts

@@ -1,6 +1,6 @@
 import { type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { type LoginHandlerOptions, type LoginResult } from "./login.write.js";
+import { type LoginHandlerOptions, type LoginResult } from "./login.write.ts";
 export type InviteAcceptWithLoginData = {
     readonly kind: "auth-session";
     readonly session: SessionUser;

package/dist/auth-email-password/handlers/invite-create.write.d.ts

@@ -1,6 +1,6 @@
 import * as z from "zod";
-import { type GlobalRole } from "../../user/constants.js";
-import type { AuthMailLocale } from "../email-templates.js";
+import { type GlobalRole } from "../../user/constants.ts";
+import type { AuthMailLocale } from "../email-templates.ts";
 export type InviteCreateData = {
     readonly kind: "invite-created";
     readonly invitationId: string;

package/dist/auth-email-password/handlers/invite-signup-complete.write.d.ts

@@ -1,6 +1,6 @@
 import { type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { type LoginHandlerOptions, type LoginResult } from "./login.write.js";
+import { type LoginHandlerOptions, type LoginResult } from "./login.write.ts";
 export type InviteSignupCompleteData = {
     readonly kind: "auth-session";
     readonly session: SessionUser;

package/dist/auth-email-password/handlers/login.write.d.ts

@@ -2,7 +2,7 @@ import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { type AuthUserRow } from "../auth-user-row.js";
+import { type AuthUserRow } from "../auth-user-row.ts";
 export type LoginHandlerOptions = {
     readonly strictEmailVerification?: boolean;
     readonly accountLockout?: {

package/dist/auth-email-password/handlers/request-account-unlock.write.d.ts

@@ -1,4 +1,4 @@
-import { type TokenRequestData, type TokenRequestOptions } from "./token-request-handler.js";
+import { type TokenRequestData, type TokenRequestOptions } from "./token-request-handler.ts";
 export type RequestAccountUnlockOptions = TokenRequestOptions;
 export type RequestUnlockData = TokenRequestData<"unlock-requested">;
 export declare function createRequestAccountUnlockHandler(opts: RequestAccountUnlockOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-account-unlock", import("zod").ZodObject<{

package/dist/auth-email-password/handlers/request-email-verification.write.d.ts

@@ -1,4 +1,4 @@
-import { type TokenRequestData, type TokenRequestOptions } from "./token-request-handler.js";
+import { type TokenRequestData, type TokenRequestOptions } from "./token-request-handler.ts";
 export type RequestEmailVerificationOptions = TokenRequestOptions;
 export type RequestVerificationData = TokenRequestData<"verification-requested">;
 export declare function createRequestEmailVerificationHandler(opts: RequestEmailVerificationOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-email-verification", import("zod").ZodObject<{

package/dist/auth-email-password/handlers/request-password-reset.write.d.ts

@@ -1,4 +1,4 @@
-import { type TokenRequestData, type TokenRequestOptions } from "./token-request-handler.js";
+import { type TokenRequestData, type TokenRequestOptions } from "./token-request-handler.ts";
 export type RequestPasswordResetOptions = TokenRequestOptions;
 export type RequestResetData = TokenRequestData<"reset-requested">;
 export declare function createRequestPasswordResetHandler(opts: RequestPasswordResetOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-password-reset", import("zod").ZodObject<{

package/dist/auth-email-password/handlers/signup-confirm.write.d.ts

@@ -1,6 +1,6 @@
 import { type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { type LoginHandlerOptions, type LoginResult } from "./login.write.js";
+import { type LoginHandlerOptions, type LoginResult } from "./login.write.ts";
 export type SignupConfirmData = {
     readonly kind: "auth-session";
     readonly session: SessionUser;

package/dist/auth-email-password/handlers/signup-request.write.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import type { AuthMailLocale } from "../email-templates.js";
+import type { AuthMailLocale } from "../email-templates.ts";
 export type SignupRequestData = {
     readonly kind: "signup-requested";
     readonly email: string;

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import { gateEnforceMfa, type LoginHandlerOptions } from "./login.write.js";
+import { gateEnforceMfa, type LoginHandlerOptions } from "./login.write.ts";
 export type SwitchTenantMfaGateData = {
     readonly kind: "mfa-gate-clear";
     readonly roles: readonly string[];

package/dist/auth-email-password/handlers/token-request-handler.d.ts

@@ -1,7 +1,7 @@
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { type AuthUserRow } from "../auth-user-row.js";
-import type { AuthMailLocale } from "../email-templates.js";
+import { type AuthUserRow } from "../auth-user-row.ts";
+import type { AuthMailLocale } from "../email-templates.ts";
 export type TokenRequestSuccess<K extends string> = {
     readonly kind: K;
     readonly email: string;

package/dist/auth-email-password/index.d.ts

@@ -1,13 +1,13 @@
-export { hashPassword, verifyPassword } from "../shared/password-hashing.js";
-export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.js";
-export type { BootstrapConfigValue, BootstrapDeps, BootstrapInvite, BootstrapInviteOutcome, BootstrapPlan, BootstrapReport, BootstrapSeedDeps, BootstrapSystemAdmin, BootstrapTenant, BootstrapTenantOutcome, } from "./bootstrap.js";
-export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.js";
-export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants.js";
-export type { AuthMailLocale } from "./email-templates.js";
-export type { AccountLockoutOptions, AccountUnlockOptions, AuthEmailPasswordOptions, EmailVerificationOptions, InviteOptions, PasswordResetOptions, SignupOptions, } from "./feature.js";
-export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.js";
-export { AuthMailNotificationTypes } from "./mail-notifications.js";
-export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature, } from "./self-registration-toggle.js";
-export { signToken, TokenPurpose, type VerifyResult, verifyToken } from "./signed-token.js";
-export { type IssuedSignupActivation, type IssueSignupActivationArgs, issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.js";
-export { invalidateExistingSignupToken, normalizeEmail, SIGNUP_TOKEN_KEY_PREFIXES, storeSignupToken, } from "./signup-token-store.js";
+export { hashPassword, verifyPassword } from "../shared/password-hashing.ts";
+export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.ts";
+export type { BootstrapConfigValue, BootstrapDeps, BootstrapInvite, BootstrapInviteOutcome, BootstrapPlan, BootstrapReport, BootstrapSeedDeps, BootstrapSystemAdmin, BootstrapTenant, BootstrapTenantOutcome, } from "./bootstrap.ts";
+export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.ts";
+export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants.ts";
+export type { AuthMailLocale } from "./email-templates.ts";
+export type { AccountLockoutOptions, AccountUnlockOptions, AuthEmailPasswordOptions, EmailVerificationOptions, InviteOptions, PasswordResetOptions, SignupOptions, } from "./feature.ts";
+export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.ts";
+export { AuthMailNotificationTypes } from "./mail-notifications.ts";
+export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature, } from "./self-registration-toggle.ts";
+export { signToken, TokenPurpose, type VerifyResult, verifyToken } from "./signed-token.ts";
+export { type IssuedSignupActivation, type IssueSignupActivationArgs, issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.ts";
+export { invalidateExistingSignupToken, normalizeEmail, SIGNUP_TOKEN_KEY_PREFIXES, storeSignupToken, } from "./signup-token-store.ts";

package/dist/auth-email-password/lockout-store.d.ts

@@ -1,4 +1,4 @@
-import { type LockoutCounterState } from "../shared/index.js";
+import { type LockoutCounterState } from "../shared/index.ts";
 export type LockoutState = LockoutCounterState;
 export declare const getLockoutState: (redis: import("ioredis").Redis, subjectId: string) => Promise<LockoutCounterState | null>;
 export declare const recordFailedAttempt: (redis: import("ioredis").Redis, subjectId: string, maxFailedAttempts: number, lockoutDurationMinutes: number) => Promise<LockoutCounterState>;

package/dist/auth-email-password/magic-link-mail.d.ts

@@ -1,5 +1,5 @@
 import type { NotifyFn } from "@cosmicdrift/kumiko-framework/engine";
-import { type AuthMailLocale } from "./email-templates.js";
+import { type AuthMailLocale } from "./email-templates.ts";
 export type MagicLinkMailSpec = {
     readonly handlerName: string;
     readonly notificationType: string;

package/dist/auth-email-password/seeding.d.ts

@@ -1,8 +1,8 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { type SeedTenantHooks } from "../tenant/seeding.js";
-export { seedTenant, seedTenantMembership } from "../tenant/seeding.js";
-export { seedUser } from "../user/seeding.js";
+import { type SeedTenantHooks } from "../tenant/seeding.ts";
+export { seedTenant, seedTenantMembership } from "../tenant/seeding.ts";
+export { seedUser } from "../user/seeding.ts";
 export type SeedUserWithPasswordOptions = {
     readonly email: string;
     readonly password: string;

package/dist/auth-email-password/signed-token.d.ts

@@ -1 +1 @@
-export * from "../shared/signed-token.js";
+export * from "../shared/signed-token.ts";

package/dist/auth-email-password/signup-token-store.d.ts

@@ -1,5 +1,5 @@
 import type { Redis } from "ioredis";
-import { type SignupHandoverBinding } from "../shared/index.js";
+import { type SignupHandoverBinding } from "../shared/index.ts";
 /** Email normalization — single source for every lookup layer (used
  *  internally by the store AND by callers that need a consistent form
  *  in the return body / mail send). Previously two places called

package/dist/auth-email-password/testing.d.ts

@@ -1 +1 @@
-export * from "./seeding.js";
+export * from "./seeding.ts";

package/dist/auth-email-password/web/auth-gate.d.ts

@@ -1,5 +1,5 @@
 import { type ComponentType, type ReactNode } from "react";
-import { type LoginScreenProps } from "./login-screen.js";
+import { type LoginScreenProps } from "./login-screen.tsx";
 export type MfaVerifyComponentProps = {
     readonly challengeToken: string;
     readonly onSuccess?: (landingPath?: string) => void;

package/dist/auth-email-password/web/client-plugin.d.ts

@@ -1,7 +1,7 @@
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ComponentType, ReactNode } from "react";
-import { type AuthGateOptions, type MfaSetupComponentProps, type MfaVerifyComponentProps } from "./auth-gate.js";
-import type { LoginScreenProps } from "./login-screen.js";
+import { type AuthGateOptions, type MfaSetupComponentProps, type MfaVerifyComponentProps } from "./auth-gate.tsx";
+import type { LoginScreenProps } from "./login-screen.tsx";
 export type EmailPasswordClientOptions = {
     /** Eigener Login-Screen. Default: der shadcn-stylte LoginScreen
      *  aus diesem Modul. Für Branding- oder Layout-Overrides einfach

package/dist/auth-email-password/web/index.d.ts

@@ -1,42 +1,42 @@
-export { defaultTranslations, mergeTranslations } from "../i18n.js";
-export type { AuthTokenFailure, CurrentUserProfile, LoginFailure, LoginRequest, LoginResponse, ResetPasswordFailure, SignupConfirmSuccess, TenantSummary, VerifyEmailFailure, } from "./auth-client.js";
-export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, toLoginResponse, verifyEmail, } from "./auth-client.js";
-export type { AuthCardProps, AuthShellRenderer } from "./auth-form-primitives.js";
-export { AuthCard, AuthShellProvider, useAuthShell } from "./auth-form-primitives.js";
-export type { AuthGateOptions, LoginRouteOptions, MfaSetupComponentProps, MfaVerifyComponentProps, SessionAuthGateOptions, } from "./auth-gate.js";
-export { createLoginRoute, makeAuthGate, makeSessionAuthGate } from "./auth-gate.js";
-export { buildLoginRedirectUrl, isSafeNextPath, NEXT_QUERY_PARAM, readNextFromSearch, } from "./auth-redirect.js";
-export type { EmailPasswordClientFeature, EmailPasswordClientOptions, } from "./client-plugin.js";
-export { emailPasswordClient } from "./client-plugin.js";
-export type { ConfirmAccountUnlockScreenProps } from "./confirm-account-unlock-screen.js";
-export { ConfirmAccountUnlockScreen } from "./confirm-account-unlock-screen.js";
-export type { DefaultTopbarActionsProps } from "./default-topbar-actions.js";
-export { DefaultTopbarActions } from "./default-topbar-actions.js";
-export type { ForgotPasswordScreenProps } from "./forgot-password-screen.js";
-export { ForgotPasswordScreen } from "./forgot-password-screen.js";
-export type { InviteAcceptScreenProps } from "./invite-accept-screen.js";
-export { InviteAcceptScreen } from "./invite-accept-screen.js";
-export type { AuthLegalLink, LoginScreenProps } from "./login-screen.js";
-export { LoginScreen } from "./login-screen.js";
-export type { RequestAccountUnlockScreenProps } from "./request-account-unlock-screen.js";
-export { RequestAccountUnlockScreen } from "./request-account-unlock-screen.js";
-export type { ResetPasswordScreenProps } from "./reset-password-screen.js";
-export { ResetPasswordScreen } from "./reset-password-screen.js";
-export type { SessionApi, SessionBootstrapFailure, SessionState, SessionStatus, } from "./session.js";
-export { hasLikelyAuthSession, SessionContext, SessionProvider, useSession } from "./session.js";
-export type { SessionBootstrapErrorScreenProps } from "./session-bootstrap-error.js";
-export { retryDelayMs, SessionBootstrapErrorScreen } from "./session-bootstrap-error.js";
-export type { SignupCompleteScreenProps } from "./signup-complete-screen.js";
-export { SignupCompleteScreen } from "./signup-complete-screen.js";
-export type { SignupScreenProps } from "./signup-screen.js";
-export { SignupScreen } from "./signup-screen.js";
-export type { TenantMenuItemsProps } from "./tenant-menu-items.js";
-export { TenantMenuItems } from "./tenant-menu-items.js";
-export type { TenantSwitcherProps } from "./tenant-switcher.js";
-export { TenantSwitcher } from "./tenant-switcher.js";
-export type { ShellUser } from "./use-shell-user.js";
-export { useShellUser } from "./use-shell-user.js";
-export type { UserMenuProps } from "./user-menu.js";
-export { UserMenu } from "./user-menu.js";
-export type { VerifyEmailScreenProps } from "./verify-email-screen.js";
-export { VerifyEmailScreen } from "./verify-email-screen.js";
+export { defaultTranslations, mergeTranslations } from "../i18n.ts";
+export type { AuthTokenFailure, CurrentUserProfile, LoginFailure, LoginRequest, LoginResponse, ResetPasswordFailure, SignupConfirmSuccess, TenantSummary, VerifyEmailFailure, } from "./auth-client.ts";
+export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, toLoginResponse, verifyEmail, } from "./auth-client.ts";
+export type { AuthCardProps, AuthShellRenderer } from "./auth-form-primitives.tsx";
+export { AuthCard, AuthShellProvider, useAuthShell } from "./auth-form-primitives.tsx";
+export type { AuthGateOptions, LoginRouteOptions, MfaSetupComponentProps, MfaVerifyComponentProps, SessionAuthGateOptions, } from "./auth-gate.tsx";
+export { createLoginRoute, makeAuthGate, makeSessionAuthGate } from "./auth-gate.tsx";
+export { buildLoginRedirectUrl, isSafeNextPath, NEXT_QUERY_PARAM, readNextFromSearch, } from "./auth-redirect.ts";
+export type { EmailPasswordClientFeature, EmailPasswordClientOptions, } from "./client-plugin.ts";
+export { emailPasswordClient } from "./client-plugin.ts";
+export type { ConfirmAccountUnlockScreenProps } from "./confirm-account-unlock-screen.tsx";
+export { ConfirmAccountUnlockScreen } from "./confirm-account-unlock-screen.tsx";
+export type { DefaultTopbarActionsProps } from "./default-topbar-actions.tsx";
+export { DefaultTopbarActions } from "./default-topbar-actions.tsx";
+export type { ForgotPasswordScreenProps } from "./forgot-password-screen.tsx";
+export { ForgotPasswordScreen } from "./forgot-password-screen.tsx";
+export type { InviteAcceptScreenProps } from "./invite-accept-screen.tsx";
+export { InviteAcceptScreen } from "./invite-accept-screen.tsx";
+export type { AuthLegalLink, LoginScreenProps } from "./login-screen.tsx";
+export { LoginScreen } from "./login-screen.tsx";
+export type { RequestAccountUnlockScreenProps } from "./request-account-unlock-screen.tsx";
+export { RequestAccountUnlockScreen } from "./request-account-unlock-screen.tsx";
+export type { ResetPasswordScreenProps } from "./reset-password-screen.tsx";
+export { ResetPasswordScreen } from "./reset-password-screen.tsx";
+export type { SessionApi, SessionBootstrapFailure, SessionState, SessionStatus, } from "./session.tsx";
+export { hasLikelyAuthSession, SessionContext, SessionProvider, useSession } from "./session.tsx";
+export type { SessionBootstrapErrorScreenProps } from "./session-bootstrap-error.tsx";
+export { retryDelayMs, SessionBootstrapErrorScreen } from "./session-bootstrap-error.tsx";
+export type { SignupCompleteScreenProps } from "./signup-complete-screen.tsx";
+export { SignupCompleteScreen } from "./signup-complete-screen.tsx";
+export type { SignupScreenProps } from "./signup-screen.tsx";
+export { SignupScreen } from "./signup-screen.tsx";
+export type { TenantMenuItemsProps } from "./tenant-menu-items.tsx";
+export { TenantMenuItems } from "./tenant-menu-items.tsx";
+export type { TenantSwitcherProps } from "./tenant-switcher.tsx";
+export { TenantSwitcher } from "./tenant-switcher.tsx";
+export type { ShellUser } from "./use-shell-user.ts";
+export { useShellUser } from "./use-shell-user.ts";
+export type { UserMenuProps } from "./user-menu.tsx";
+export { UserMenu } from "./user-menu.tsx";
+export type { VerifyEmailScreenProps } from "./verify-email-screen.tsx";
+export { VerifyEmailScreen } from "./verify-email-screen.tsx";

package/dist/auth-email-password/web/session-bootstrap-error.d.ts

@@ -1,5 +1,5 @@
 import { type ReactNode } from "react";
-import type { SessionBootstrapFailure } from "./session.js";
+import type { SessionBootstrapFailure } from "./session.tsx";
 export type SessionBootstrapErrorScreenProps = {
     readonly failure: SessionBootstrapFailure;
     readonly onRetry: () => Promise<void>;

package/dist/auth-email-password/web/session.d.ts

@@ -1,5 +1,5 @@
 import { type ReactNode } from "react";
-import { type CurrentUserProfile, type LoginRequest, type LoginResult, type TenantSummary } from "./auth-client.js";
+import { type CurrentUserProfile, type LoginRequest, type LoginResult, type TenantSummary } from "./auth-client.ts";
 export type SessionStatus = "loading" | "unauthenticated" | "authenticated" | "error";
 export type SessionBootstrapFailure = {
     readonly httpStatus: number | null;

package/dist/auth-email-password/web/signup-complete-screen.d.ts

@@ -1,5 +1,5 @@
 import { type ReactNode } from "react";
-import { type SignupConfirmSuccess } from "./auth-client.js";
+import { type SignupConfirmSuccess } from "./auth-client.ts";
 export type SignupCompleteScreenProps = {
     readonly title?: string;
     /** Override for the URL token — server-rendered apps can pass it. Default: `?token=...`. */