@cosmicdrift/kumiko-bundled-features 0.368.0 → 0.370.0

package/dist/auth-foundation/feature.d.ts

@@ -1,14 +1,10 @@
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { type Registry } from "@cosmicdrift/kumiko-framework/engine";
-import { type AuthProviderBuildDeps, type SessionStore, type TenantExistsFn, type TenantResolverFn, type TenantResolverTrust } from "./types.js";
-export { EXT_SESSION_STORE, EXT_TENANT_EXISTENCE, EXT_TENANT_RESOLVER, EXT_TOKEN_VERIFIER, } from "./types.js";
+import { type AuthProviderBuildDeps, type SessionStore, type TenantExistsFn, type TenantResolverFn, type TenantResolverTrust } from "./types.ts";
+export { EXT_SESSION_STORE, EXT_TENANT_EXISTENCE, EXT_TENANT_RESOLVER, EXT_TOKEN_VERIFIER, } from "./types.ts";
 export declare function createAuthFoundationFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };
-/** @deprecated Use createAuthFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const authFoundationFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: void;
-};
 /**
  * Tries every registered tokenVerifier provider's shape against `rawToken`
  * in registration order and calls the first match's verifier. Returns null

package/dist/auth-foundation/feature.js

@@ -49,8 +49,6 @@ export function createAuthFoundationFeature() {
         r.bootCheck(({ features }) => validateTenantExistenceMultiplicity(features));
     }, { dedupeOptions: {} });
 }
-/** @deprecated Use createAuthFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const authFoundationFeature = createAuthFoundationFeature();
 /**
  * Tries every registered tokenVerifier provider's shape against `rawToken`
  * in registration order and calls the first match's verifier. Returns null

package/dist/auth-foundation/index.d.ts

@@ -1,3 +1,3 @@
-export { authFoundationFeature, createAuthFoundationFeature, type ResolvedTenantResolver, resolveSessionStore, resolveTenantExistence, resolveTenantResolver, resolveTokenVerifier, } from "./feature.js";
-export { resolveAnonymousAccessFromRegistry } from "./resolve-anonymous-access.js";
-export { type AuthProviderBuildDeps, type AuthProviderPlugin, type AuthVerifier, EXT_SESSION_STORE, EXT_TENANT_EXISTENCE, EXT_TENANT_RESOLVER, EXT_TOKEN_VERIFIER, isAuthProviderPlugin, isSessionStoreProvider, isTenantExistenceProvider, isTenantResolverProvider, isTenantResolverTrust, isValidTokenShape, type SessionMassRevoker, type SessionStore, type SessionStoreProvider, type TenantExistenceProvider, type TenantExistsFn, type TenantResolverFn, type TenantResolverProvider, type TenantResolverTrust, type TokenShape, tokenShapeKey, tokenShapeMatches, } from "./types.js";
+export { createAuthFoundationFeature, type ResolvedTenantResolver, resolveSessionStore, resolveTenantExistence, resolveTenantResolver, resolveTokenVerifier, } from "./feature.ts";
+export { resolveAnonymousAccessFromRegistry } from "./resolve-anonymous-access.ts";
+export { type AuthProviderBuildDeps, type AuthProviderPlugin, type AuthVerifier, EXT_SESSION_STORE, EXT_TENANT_EXISTENCE, EXT_TENANT_RESOLVER, EXT_TOKEN_VERIFIER, isAuthProviderPlugin, isSessionStoreProvider, isTenantExistenceProvider, isTenantResolverProvider, isTenantResolverTrust, isValidTokenShape, type SessionMassRevoker, type SessionStore, type SessionStoreProvider, type TenantExistenceProvider, type TenantExistsFn, type TenantResolverFn, type TenantResolverProvider, type TenantResolverTrust, type TokenShape, tokenShapeKey, tokenShapeMatches, } from "./types.ts";

package/dist/auth-foundation/index.js

@@ -1,4 +1,4 @@
 // Public API of the auth-foundation bundled-feature.
-export { authFoundationFeature, createAuthFoundationFeature, resolveSessionStore, resolveTenantExistence, resolveTenantResolver, resolveTokenVerifier, } from "./feature.js";
+export { createAuthFoundationFeature, resolveSessionStore, resolveTenantExistence, resolveTenantResolver, resolveTokenVerifier, } from "./feature.js";
 export { resolveAnonymousAccessFromRegistry } from "./resolve-anonymous-access.js";
 export { EXT_SESSION_STORE, EXT_TENANT_EXISTENCE, EXT_TENANT_RESOLVER, EXT_TOKEN_VERIFIER, isAuthProviderPlugin, isSessionStoreProvider, isTenantExistenceProvider, isTenantResolverProvider, isTenantResolverTrust, isValidTokenShape, tokenShapeKey, tokenShapeMatches, } from "./types.js";

package/dist/auth-foundation/resolve-anonymous-access.d.ts

@@ -5,7 +5,7 @@
  */
 import type { AnonymousAccessConfig, AnonymousAccessResolved } from "@cosmicdrift/kumiko-framework/api";
 import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
-import type { AuthProviderBuildDeps } from "./types.js";
+import type { AuthProviderBuildDeps } from "./types.ts";
 export declare function resolveAnonymousAccessFromRegistry(base: AnonymousAccessResolved | AnonymousAccessConfig | undefined, deps: AuthProviderBuildDeps & {
     readonly registry: Registry;
 }): Promise<AnonymousAccessResolved | undefined>;

package/dist/auth-mfa/env.d.ts

@@ -0,0 +1,13 @@
+import * as z from "zod";
+/** Optional overrides for the two MFA token HMAC keys. Unset, both are
+ *  derived from the app's JWT secret, so one env var stays authoritative. */
+export declare const mfaTokenSecretsEnvSchema: z.ZodObject<{
+    MFA_SETUP_TOKEN_SECRET: z.ZodOptional<z.ZodString>;
+    MFA_CHALLENGE_TOKEN_SECRET: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const authMfaEnvSchema: z.ZodObject<{
+    KUMIKO_SECRETS_MASTER_KEY_V1: z.ZodString;
+    KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: z.ZodDefault<z.ZodString>;
+    MFA_SETUP_TOKEN_SECRET: z.ZodOptional<z.ZodString>;
+    MFA_CHALLENGE_TOKEN_SECRET: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;

package/dist/auth-mfa/env.js

@@ -0,0 +1,24 @@
+import * as z from "zod";
+import { secretsEnvSchema } from "../secrets/index.js";
+const MIN_TOKEN_SECRET_LENGTH = 32;
+function tokenSecretOverride(description) {
+    return z
+        .string()
+        .min(MIN_TOKEN_SECRET_LENGTH)
+        .optional()
+        .describe(`${description} Unset: derived from JWT_SECRET.`)
+        .meta({ kumiko: { pulumi: { generator: "openssl rand -hex 32", secret: true } } });
+}
+/** Optional overrides for the two MFA token HMAC keys. Unset, both are
+ *  derived from the app's JWT secret, so one env var stays authoritative. */
+export const mfaTokenSecretsEnvSchema = z.object({
+    MFA_SETUP_TOKEN_SECRET: tokenSecretOverride("HMAC key of the MFA enable-flow token."),
+    MFA_CHALLENGE_TOKEN_SECRET: tokenSecretOverride("HMAC key of the MFA login-challenge token."),
+});
+// Same field instances as `secrets`, so composeEnvSchema treats them as one
+// shared variable; an app mounting auth-mfa without `secrets` still gets the
+// KEK slot (and its _CIPHERTEXT twin) declared.
+export const authMfaEnvSchema = z.object({
+    ...secretsEnvSchema.shape,
+    ...mfaTokenSecretsEnvSchema.shape,
+});

package/dist/auth-mfa/errors.d.ts

@@ -1,5 +1,5 @@
 import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
-export { AuthMfaErrorCodes as AuthMfaErrors } from "./constants.js";
+export { AuthMfaErrorCodes as AuthMfaErrors } from "./constants.ts";
 export declare function mfaAlreadyEnabled(): WriteFailure;
 export declare function mfaNotEnabled(): WriteFailure;
 export declare function invalidSetupToken(): WriteFailure;

package/dist/auth-mfa/feature-exports.d.ts

@@ -0,0 +1,12 @@
+import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import type { MfaCodeVerifier } from "./mfa-code-verifier.ts";
+import type { MfaStatusChecker } from "./mfa-status-checker.ts";
+import type { MfaTokenSecretsEnv } from "./token-secrets.ts";
+export type BindMfaRevokeAllOtherSessions = (revoker: (userId: string, currentSid: string | undefined) => Promise<number>) => void;
+export declare function bindMfaRevokeAllOtherSessionsFromFeature(feature: FeatureDefinition): BindMfaRevokeAllOtherSessions | undefined;
+export declare function mfaStatusCheckerFromFeature(feature: FeatureDefinition): MfaStatusChecker | undefined;
+export declare function mfaVerifierFromFeature(feature: FeatureDefinition): MfaCodeVerifier | undefined;
+export type BindMfaTokenSecrets = (masterSecret: string, env: MfaTokenSecretsEnv) => void;
+export declare function bindMfaTokenSecretsFromFeature(feature: FeatureDefinition): BindMfaTokenSecrets | undefined;
+export type BindRevokeAllPatTokens = (revoker: (userId: string) => Promise<number>) => void;
+export declare function bindRevokeAllPatTokensFromFeature(feature: FeatureDefinition): BindRevokeAllPatTokens | undefined;

package/dist/auth-mfa/feature-exports.js

@@ -0,0 +1,72 @@
+// Reads the late-bind setter off a mounted auth-mfa feature's exports —
+// mirrors sessions' own bindAutoRevokeFromFeature. run{Prod,Dev}App call
+// this once the sessions feature (if mounted) has produced a concrete
+// sessionRevokeAllOthers callback.
+export function bindMfaRevokeAllOtherSessionsFromFeature(feature) {
+    const exports = feature.exports;
+    if (exports && typeof exports === "object" && "bindRevokeAllOtherSessions" in exports) {
+        const { bindRevokeAllOtherSessions } = exports;
+        if (typeof bindRevokeAllOtherSessions === "function") {
+            // @cast-boundary feature-exports — feature.exports is untyped by design
+            return bindRevokeAllOtherSessions;
+        }
+    }
+    return undefined;
+}
+// Reads the eagerly-built `checkMfaStatus` off a mounted auth-mfa feature's
+// exports — no bind-setter needed (see the comment where it's built).
+export function mfaStatusCheckerFromFeature(feature) {
+    const exports = feature.exports;
+    if (exports && typeof exports === "object" && "checkMfaStatus" in exports) {
+        const { checkMfaStatus } = exports;
+        if (typeof checkMfaStatus === "function") {
+            // @cast-boundary feature-exports — feature.exports is untyped by design
+            return checkMfaStatus;
+        }
+    }
+    return undefined;
+}
+// Reads the eagerly-built `verifyMfaCode` off a mounted auth-mfa feature's
+// exports — personal-access-tokens wires this in as its optional
+// mfaVerifier (re-auth gate for minting a token). Same no-bind-setter
+// reasoning as checkMfaStatus above.
+export function mfaVerifierFromFeature(feature) {
+    const exports = feature.exports;
+    if (exports && typeof exports === "object" && "verifyMfaCode" in exports) {
+        const { verifyMfaCode } = exports;
+        if (typeof verifyMfaCode === "function") {
+            // @cast-boundary feature-exports — feature.exports is untyped by design
+            return verifyMfaCode;
+        }
+    }
+    return undefined;
+}
+// Reads the token-secret binder off a mounted auth-mfa feature's exports.
+// run{Prod,Dev}App and setupTestStack call it with the JWT secret once the
+// env is validated, so a dry run never needs the master secret.
+export function bindMfaTokenSecretsFromFeature(feature) {
+    const exports = feature.exports;
+    if (exports && typeof exports === "object" && "bindTokenSecrets" in exports) {
+        const { bindTokenSecrets } = exports;
+        if (typeof bindTokenSecrets === "function") {
+            // @cast-boundary feature-exports — feature.exports is untyped by design
+            return bindTokenSecrets;
+        }
+    }
+    return undefined;
+}
+// Reads the late-bind setter off a mounted auth-mfa feature's exports —
+// run{Prod,Dev}App call this once the personal-access-tokens feature (if
+// mounted) has produced a concrete revoker, same wiring shape as
+// bindMfaRevokeAllOtherSessionsFromFeature.
+export function bindRevokeAllPatTokensFromFeature(feature) {
+    const exports = feature.exports;
+    if (exports && typeof exports === "object" && "bindRevokeAllPatTokens" in exports) {
+        const { bindRevokeAllPatTokens } = exports;
+        if (typeof bindRevokeAllPatTokens === "function") {
+            // @cast-boundary feature-exports — feature.exports is untyped by design
+            return bindRevokeAllPatTokens;
+        }
+    }
+    return undefined;
+}

package/dist/auth-mfa/feature.d.ts

@@ -1,17 +1,11 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type MfaRequiredPolicy } from "./config.js";
-import { type MfaCodeVerifier } from "./mfa-code-verifier.js";
-import { type MfaStatusChecker } from "./mfa-status-checker.js";
+import { type FeatureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
+import { type MfaRequiredPolicy } from "./config.ts";
+import { authMfaEnvSchema } from "./env.ts";
 export type AuthMfaFeatureOptions = {
-    readonly setupTokenSecret: string;
+    readonly setupTokenSecret?: string;
     readonly issuer: string;
-    readonly challengeTokenSecret: string;
+    readonly challengeTokenSecret?: string;
     readonly requiredPolicy?: MfaRequiredPolicy;
 };
-export type BindMfaRevokeAllOtherSessions = (revoker: (userId: string, currentSid: string | undefined) => Promise<number>) => void;
-export declare function bindMfaRevokeAllOtherSessionsFromFeature(feature: FeatureDefinition): BindMfaRevokeAllOtherSessions | undefined;
-export declare function mfaStatusCheckerFromFeature(feature: FeatureDefinition): MfaStatusChecker | undefined;
-export declare function mfaVerifierFromFeature(feature: FeatureDefinition): MfaCodeVerifier | undefined;
-export type BindRevokeAllPatTokens = (revoker: (userId: string) => Promise<number>) => void;
-export declare function bindRevokeAllPatTokensFromFeature(feature: FeatureDefinition): BindRevokeAllPatTokens | undefined;
-export declare function createAuthMfaFeature(opts: AuthMfaFeatureOptions): FeatureDefinition;
+export declare function createAuthMfaFeature(opts: AuthMfaFeatureOptions): FeatureWithEnvSchema<FeatureDefinition, typeof authMfaEnvSchema.shape>;

package/dist/auth-mfa/feature.js

@@ -1,6 +1,7 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { secretsEnvSchema } from "../secrets/index.js";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import { mfaRequiredConfigKey } from "./config.js";
+import { authMfaEnvSchema } from "./env.js";
 import { createDisableHandler } from "./handlers/disable.write.js";
 import { createEnableConfirmHandler } from "./handlers/enable-confirm.write.js";
 import { createEnableConfirmPreauthHandler } from "./handlers/enable-confirm-preauth.write.js";
@@ -15,77 +16,23 @@ import { createMfaCodeVerifier } from "./mfa-code-verifier.js";
 import { createMfaStatusChecker } from "./mfa-status-checker.js";
 import { userMfaEntity } from "./schema/user-mfa.js";
 import { mfaDisableScreen, mfaEnableScreen, mfaRegenerateRecoveryScreen } from "./screens.js";
+import { resolveMfaTokenSecretsFromEnv } from "./token-secrets.js";
 const REENCRYPT_ESCAPE_HATCH_REASON = "re-encrypts MFA secrets of every tenant's users with the new master key";
-// Reads the late-bind setter off a mounted auth-mfa feature's exports —
-// mirrors sessions' own bindAutoRevokeFromFeature. run{Prod,Dev}App call
-// this once the sessions feature (if mounted) has produced a concrete
-// sessionRevokeAllOthers callback.
-export function bindMfaRevokeAllOtherSessionsFromFeature(feature) {
-    const exports = feature.exports;
-    if (exports && typeof exports === "object" && "bindRevokeAllOtherSessions" in exports) {
-        const { bindRevokeAllOtherSessions } = exports;
-        if (typeof bindRevokeAllOtherSessions === "function") {
-            // @cast-boundary feature-exports — feature.exports is untyped by design
-            return bindRevokeAllOtherSessions;
-        }
-    }
-    return undefined;
-}
-// Reads the eagerly-built `checkMfaStatus` off a mounted auth-mfa feature's
-// exports — no bind-setter needed (see the comment where it's built).
-export function mfaStatusCheckerFromFeature(feature) {
-    const exports = feature.exports;
-    if (exports && typeof exports === "object" && "checkMfaStatus" in exports) {
-        const { checkMfaStatus } = exports;
-        if (typeof checkMfaStatus === "function") {
-            // @cast-boundary feature-exports — feature.exports is untyped by design
-            return checkMfaStatus;
-        }
-    }
-    return undefined;
-}
-// Reads the eagerly-built `verifyMfaCode` off a mounted auth-mfa feature's
-// exports — personal-access-tokens wires this in as its optional
-// mfaVerifier (re-auth gate for minting a token). Same no-bind-setter
-// reasoning as checkMfaStatus above.
-export function mfaVerifierFromFeature(feature) {
-    const exports = feature.exports;
-    if (exports && typeof exports === "object" && "verifyMfaCode" in exports) {
-        const { verifyMfaCode } = exports;
-        if (typeof verifyMfaCode === "function") {
-            // @cast-boundary feature-exports — feature.exports is untyped by design
-            return verifyMfaCode;
-        }
-    }
-    return undefined;
-}
-// Reads the late-bind setter off a mounted auth-mfa feature's exports —
-// run{Prod,Dev}App call this once the personal-access-tokens feature (if
-// mounted) has produced a concrete revoker, same wiring shape as
-// bindMfaRevokeAllOtherSessionsFromFeature.
-export function bindRevokeAllPatTokensFromFeature(feature) {
-    const exports = feature.exports;
-    if (exports && typeof exports === "object" && "bindRevokeAllPatTokens" in exports) {
-        const { bindRevokeAllPatTokens } = exports;
-        if (typeof bindRevokeAllPatTokens === "function") {
-            // @cast-boundary feature-exports — feature.exports is untyped by design
-            return bindRevokeAllPatTokens;
-        }
-    }
-    return undefined;
+function hasBothExplicitSecrets(opts) {
+    return (opts.setupTokenSecret !== undefined &&
+        opts.setupTokenSecret.trim() !== "" &&
+        opts.challengeTokenSecret !== undefined &&
+        opts.challengeTokenSecret.trim() !== "");
 }
 export function createAuthMfaFeature(opts) {
-    return defineFeature("auth-mfa", (r) => {
+    const feature = defineFeature("auth-mfa", (r) => {
         r.describe("TOTP-based two-factor authentication: enable/disable flow with QR-code setup, 8 single-use recovery codes, and (once wired into a login flow) a second login step after password verification. Secrets are envelope-encrypted at rest via the same MasterKeyProvider as `secrets`/`config`.");
         r.uiHints({
             displayLabel: "2FA / TOTP",
             category: "identity",
             recommended: true,
         });
-        // Same field instances as `secrets`, so composeEnvSchema treats them as one
-        // shared variable; an app mounting auth-mfa without `secrets` still gets the
-        // KEK slot (and its _CIPHERTEXT twin) declared.
-        r.envSchema(secretsEnvSchema);
+        r.envSchema(authMfaEnvSchema);
         r.requires({ features: ["user"] });
         r.requires({ features: ["config"] });
         // verify.write.ts dispatches "tenant:query:memberships" — without this
@@ -126,20 +73,48 @@ export function createAuthMfaFeature(opts) {
         // out of scope for the "MFA-enable/disable" finding this mirrors.
         let revokeAllPatTokens;
         const sharedPatRevoker = (userId) => revokeAllPatTokens?.(userId) ?? Promise.resolve(0);
+        // Handlers and the status checker read the secrets through these getters
+        // on each call, so the boot can bind them after env validation. Never
+        // spread these objects: a spread would read the getter eagerly.
+        let boundTokenSecrets = hasBothExplicitSecrets(opts)
+            ? resolveMfaTokenSecretsFromEnv("", {}, opts)
+            : undefined;
+        const tokenSecrets = () => {
+            if (boundTokenSecrets === undefined) {
+                throw new Error("[auth-mfa] token secrets are not bound: pass setupTokenSecret/challengeTokenSecret, or call bindMfaTokenSecretsFromFeature(feature)(masterSecret, env) in a custom boot (runProdApp, runDevApp and setupTestStack do this).");
+            }
+            return boundTokenSecrets;
+        };
+        const bindTokenSecrets = (masterSecret, env) => {
+            boundTokenSecrets = resolveMfaTokenSecretsFromEnv(masterSecret, env, opts);
+        };
         const handlers = {
-            enableStart: r.writeHandler(createEnableStartHandler({ setupTokenSecret: opts.setupTokenSecret, issuer: opts.issuer })),
+            enableStart: r.writeHandler(createEnableStartHandler({
+                get setupTokenSecret() {
+                    return tokenSecrets().setupTokenSecret;
+                },
+                issuer: opts.issuer,
+            })),
             enableStartPreauth: r.writeHandler(createEnableStartPreauthHandler({
-                challengeTokenSecret: opts.challengeTokenSecret,
-                setupTokenSecret: opts.setupTokenSecret,
+                get challengeTokenSecret() {
+                    return tokenSecrets().challengeTokenSecret;
+                },
+                get setupTokenSecret() {
+                    return tokenSecrets().setupTokenSecret;
+                },
                 issuer: opts.issuer,
             })),
             enableConfirm: r.writeHandler(createEnableConfirmHandler({
-                setupTokenSecret: opts.setupTokenSecret,
+                get setupTokenSecret() {
+                    return tokenSecrets().setupTokenSecret;
+                },
                 revokeAllOtherSessions: sharedRevoker,
                 revokeAllPatTokens: sharedPatRevoker,
             })),
             enableConfirmPreauth: r.writeHandler(createEnableConfirmPreauthHandler({
-                setupTokenSecret: opts.setupTokenSecret,
+                get setupTokenSecret() {
+                    return tokenSecrets().setupTokenSecret;
+                },
                 revokeAllOtherSessions: sharedRevoker,
                 revokeAllPatTokens: sharedPatRevoker,
             })),
@@ -148,7 +123,11 @@ export function createAuthMfaFeature(opts) {
                 revokeAllPatTokens: sharedPatRevoker,
             })),
             regenerateRecovery: r.writeHandler(createRegenerateRecoveryHandler({ revokeAllOtherSessions: sharedRevoker })),
-            verify: r.writeHandler(createMfaVerifyHandler({ challengeTokenSecret: opts.challengeTokenSecret })),
+            verify: r.writeHandler(createMfaVerifyHandler({
+                get challengeTokenSecret() {
+                    return tokenSecrets().challengeTokenSecret;
+                },
+            })),
         };
         const queries = {
             status: r.queryHandler(mfaStatusQuery),
@@ -158,7 +137,9 @@ export function createAuthMfaFeature(opts) {
         // from inside its own dispatcher call), not a raw db handle assembled
         // at app-boot time.
         const checkMfaStatus = createMfaStatusChecker({
-            challengeTokenSecret: opts.challengeTokenSecret,
+            get challengeTokenSecret() {
+                return tokenSecrets().challengeTokenSecret;
+            },
             ...(opts.requiredPolicy && { requiredPolicy: opts.requiredPolicy }),
         });
         // No late-bind needed — same reasoning as checkMfaStatus: only needs the
@@ -177,6 +158,8 @@ export function createAuthMfaFeature(opts) {
             checkMfaStatus,
             verifyMfaCode,
             bindRevokeAllPatTokens,
+            bindTokenSecrets,
         };
     });
+    return featureWithEnvSchema(feature, authMfaEnvSchema);
 }

package/dist/auth-mfa/handlers/reencrypt.job.d.ts

@@ -1,6 +1,6 @@
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { JobContext } from "@cosmicdrift/kumiko-framework/engine";
-import { type ChunkedMigrationStopReason } from "../../shared/index.js";
+import { type ChunkedMigrationStopReason } from "../../shared/index.ts";
 export type MfaReencryptJobPayload = {
     readonly batchSize?: number;
     readonly maxDurationMs?: number;

package/dist/auth-mfa/index.d.ts

@@ -1,9 +1,12 @@
-export { base32Decode } from "./base32.js";
-export { type MfaRequiredPolicy, mfaRequiredConfigHandle } from "./config.js";
-export { AUTH_MFA_FEATURE, AuthMfaHandlers, AuthMfaQueries, MFA_DISABLE_SCREEN_ID, MFA_ENABLE_SCREEN_ID, MFA_REGENERATE_RECOVERY_SCREEN_ID, } from "./constants.js";
-export type { AuthMfaFeatureOptions, BindMfaRevokeAllOtherSessions, BindRevokeAllPatTokens, } from "./feature.js";
-export { bindMfaRevokeAllOtherSessionsFromFeature, bindRevokeAllPatTokensFromFeature, createAuthMfaFeature, mfaStatusCheckerFromFeature, mfaVerifierFromFeature, } from "./feature.js";
-export type { MfaCodeVerifier, MfaCodeVerifyResult } from "./mfa-code-verifier.js";
-export type { MfaStatusChecker, MfaStatusCheckResult } from "./mfa-status-checker.js";
-export { userMfaEntity, userMfaTable } from "./schema/user-mfa.js";
-export { type MfaTokenSecretOverrides, type ResolvedMfaTokenSecrets, resolveMfaTokenSecrets, } from "./token-secrets.js";
+export { base32Decode } from "./base32.ts";
+export { type MfaRequiredPolicy, mfaRequiredConfigHandle } from "./config.ts";
+export { AUTH_MFA_FEATURE, AuthMfaHandlers, AuthMfaQueries, MFA_DISABLE_SCREEN_ID, MFA_ENABLE_SCREEN_ID, MFA_REGENERATE_RECOVERY_SCREEN_ID, } from "./constants.ts";
+export { authMfaEnvSchema, mfaTokenSecretsEnvSchema } from "./env.ts";
+export type { AuthMfaFeatureOptions } from "./feature.ts";
+export { createAuthMfaFeature } from "./feature.ts";
+export type { BindMfaRevokeAllOtherSessions, BindMfaTokenSecrets, BindRevokeAllPatTokens, } from "./feature-exports.ts";
+export { bindMfaRevokeAllOtherSessionsFromFeature, bindMfaTokenSecretsFromFeature, bindRevokeAllPatTokensFromFeature, mfaStatusCheckerFromFeature, mfaVerifierFromFeature, } from "./feature-exports.ts";
+export type { MfaCodeVerifier, MfaCodeVerifyResult } from "./mfa-code-verifier.ts";
+export type { MfaStatusChecker, MfaStatusCheckResult } from "./mfa-status-checker.ts";
+export { userMfaEntity, userMfaTable } from "./schema/user-mfa.ts";
+export { type MfaTokenSecretOverrides, type MfaTokenSecretsEnv, type ResolvedMfaTokenSecrets, resolveMfaTokenSecrets, resolveMfaTokenSecretsFromEnv, } from "./token-secrets.ts";

package/dist/auth-mfa/index.js

@@ -1,6 +1,8 @@
 export { base32Decode } from "./base32.js";
 export { mfaRequiredConfigHandle } from "./config.js";
 export { AUTH_MFA_FEATURE, AuthMfaHandlers, AuthMfaQueries, MFA_DISABLE_SCREEN_ID, MFA_ENABLE_SCREEN_ID, MFA_REGENERATE_RECOVERY_SCREEN_ID, } from "./constants.js";
-export { bindMfaRevokeAllOtherSessionsFromFeature, bindRevokeAllPatTokensFromFeature, createAuthMfaFeature, mfaStatusCheckerFromFeature, mfaVerifierFromFeature, } from "./feature.js";
+export { authMfaEnvSchema, mfaTokenSecretsEnvSchema } from "./env.js";
+export { createAuthMfaFeature } from "./feature.js";
+export { bindMfaRevokeAllOtherSessionsFromFeature, bindMfaTokenSecretsFromFeature, bindRevokeAllPatTokensFromFeature, mfaStatusCheckerFromFeature, mfaVerifierFromFeature, } from "./feature-exports.js";
 export { userMfaEntity, userMfaTable } from "./schema/user-mfa.js";
-export { resolveMfaTokenSecrets, } from "./token-secrets.js";
+export { resolveMfaTokenSecrets, resolveMfaTokenSecretsFromEnv, } from "./token-secrets.js";

package/dist/auth-mfa/mfa-challenge-token.d.ts

@@ -1,6 +1,6 @@
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { type HmacTokenVerifyResult } from "./hmac-token-codec.js";
+import { type HmacTokenVerifyResult } from "./hmac-token-codec.ts";
 export type MfaChallengePayload = {
     readonly userId: string;
     readonly tenantId: TenantId;

package/dist/auth-mfa/mfa-preauth-setup-token.d.ts

@@ -1,6 +1,6 @@
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { type HmacTokenVerifyResult } from "./hmac-token-codec.js";
+import { type HmacTokenVerifyResult } from "./hmac-token-codec.ts";
 export type MfaPreauthSetupPayload = {
     readonly userId: string;
     readonly tenantId: TenantId;

package/dist/auth-mfa/mfa-status-checker.d.ts

@@ -1,5 +1,5 @@
 import { type HandlerContext, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { type MfaRequiredPolicy } from "./config.js";
+import { type MfaRequiredPolicy } from "./config.ts";
 export type MfaStatusCheckResult = {
     readonly required: false;
 } | {

package/dist/auth-mfa/mfa-verify-attempts.d.ts

@@ -1,4 +1,4 @@
-import { type LockoutCounterState } from "../shared/index.js";
+import { type LockoutCounterState } from "../shared/index.ts";
 export type MfaVerifyLockoutState = LockoutCounterState;
 export declare const getMfaVerifyLockoutState: (redis: import("ioredis").Redis, subjectId: string) => Promise<LockoutCounterState | null>;
 export declare const recordFailedMfaVerifyAttempt: (redis: import("ioredis").Redis, subjectId: string, maxFailedAttempts: number, lockoutDurationMinutes: number) => Promise<LockoutCounterState>;

package/dist/auth-mfa/testing.d.ts

@@ -1 +1 @@
-export { currentTotpCode } from "./totp.js";
+export { currentTotpCode } from "./totp.ts";

package/dist/auth-mfa/token-secrets.d.ts

@@ -10,3 +10,10 @@ export type ResolvedMfaTokenSecrets = {
  *  overrides only when a deployment needs its own key for one of them —
  *  otherwise deriving keeps a single env var authoritative. */
 export declare function resolveMfaTokenSecrets(masterSecret: string, overrides?: MfaTokenSecretOverrides): ResolvedMfaTokenSecrets;
+export type MfaTokenSecretsEnv = {
+    readonly MFA_SETUP_TOKEN_SECRET?: string | undefined;
+    readonly MFA_CHALLENGE_TOKEN_SECRET?: string | undefined;
+};
+/** Precedence per secret: explicit option, then `MFA_*_TOKEN_SECRET` from
+ *  env, then derivation from `masterSecret`. Blank values count as absent. */
+export declare function resolveMfaTokenSecretsFromEnv(masterSecret: string, env: MfaTokenSecretsEnv, explicit?: MfaTokenSecretOverrides): ResolvedMfaTokenSecrets;

package/dist/auth-mfa/token-secrets.js

@@ -19,3 +19,16 @@ export function resolveMfaTokenSecrets(masterSecret, overrides = {}) {
         challengeTokenSecret: resolveSecret(overrides.challengeTokenSecret, () => derivePurposeSecret(masterSecret, CHALLENGE_TOKEN_PURPOSE)),
     };
 }
+function nonBlank(value) {
+    return value !== undefined && value.trim() !== "" ? value : undefined;
+}
+/** Precedence per secret: explicit option, then `MFA_*_TOKEN_SECRET` from
+ *  env, then derivation from `masterSecret`. Blank values count as absent. */
+export function resolveMfaTokenSecretsFromEnv(masterSecret, env, explicit = {}) {
+    const setupTokenSecret = nonBlank(explicit.setupTokenSecret) ?? nonBlank(env.MFA_SETUP_TOKEN_SECRET);
+    const challengeTokenSecret = nonBlank(explicit.challengeTokenSecret) ?? nonBlank(env.MFA_CHALLENGE_TOKEN_SECRET);
+    return resolveMfaTokenSecrets(masterSecret, {
+        ...(setupTokenSecret !== undefined && { setupTokenSecret }),
+        ...(challengeTokenSecret !== undefined && { challengeTokenSecret }),
+    });
+}

package/dist/auth-mfa/verify-factor.d.ts

@@ -1,5 +1,5 @@
 import type { Redis } from "ioredis";
-import type { UserMfaRow } from "./db/queries.js";
+import type { UserMfaRow } from "./db/queries.ts";
 export type MfaFactorVerifyResult = {
     readonly ok: true;
     readonly method: "totp";

package/dist/auth-mfa/web/index.d.ts

@@ -1,15 +1,15 @@
-export type { AuthMfaClientFeature, AuthMfaClientOptions } from "./client-plugin.js";
-export { authMfaClient } from "./client-plugin.js";
-export { defaultTranslations, mergeTranslations } from "./i18n.js";
-export type { MfaSetupPreauthStart, MfaSetupPreauthStartResult, MfaVerifyResult, } from "./mfa-client.js";
-export { confirmMfaSetupPreauth, startMfaSetupPreauth, verifyMfaChallenge } from "./mfa-client.js";
-export type { MfaDisableDialogProps } from "./mfa-disable-dialog.js";
-export { MfaDisableDialog } from "./mfa-disable-dialog.js";
-export type { MfaRecoveryCodesRevealProps } from "./mfa-recovery-codes-reveal.js";
-export { MfaRecoveryCodesReveal } from "./mfa-recovery-codes-reveal.js";
-export type { MfaRegenerateRecoveryDialogProps } from "./mfa-regenerate-recovery-dialog.js";
-export { MfaRegenerateRecoveryDialog } from "./mfa-regenerate-recovery-dialog.js";
-export type { MfaSetupPreauthScreenProps } from "./mfa-setup-preauth-screen.js";
-export { MfaSetupPreauthScreen } from "./mfa-setup-preauth-screen.js";
-export type { MfaVerifyScreenProps } from "./mfa-verify-screen.js";
-export { MfaVerifyScreen } from "./mfa-verify-screen.js";
+export type { AuthMfaClientFeature, AuthMfaClientOptions } from "./client-plugin.ts";
+export { authMfaClient } from "./client-plugin.ts";
+export { defaultTranslations, mergeTranslations } from "./i18n.ts";
+export type { MfaSetupPreauthStart, MfaSetupPreauthStartResult, MfaVerifyResult, } from "./mfa-client.ts";
+export { confirmMfaSetupPreauth, startMfaSetupPreauth, verifyMfaChallenge } from "./mfa-client.ts";
+export type { MfaDisableDialogProps } from "./mfa-disable-dialog.tsx";
+export { MfaDisableDialog } from "./mfa-disable-dialog.tsx";
+export type { MfaRecoveryCodesRevealProps } from "./mfa-recovery-codes-reveal.tsx";
+export { MfaRecoveryCodesReveal } from "./mfa-recovery-codes-reveal.tsx";
+export type { MfaRegenerateRecoveryDialogProps } from "./mfa-regenerate-recovery-dialog.tsx";
+export { MfaRegenerateRecoveryDialog } from "./mfa-regenerate-recovery-dialog.tsx";
+export type { MfaSetupPreauthScreenProps } from "./mfa-setup-preauth-screen.tsx";
+export { MfaSetupPreauthScreen } from "./mfa-setup-preauth-screen.tsx";
+export type { MfaVerifyScreenProps } from "./mfa-verify-screen.tsx";
+export { MfaVerifyScreen } from "./mfa-verify-screen.tsx";

package/dist/auth-mfa/web/mfa-client.d.ts

@@ -1,4 +1,4 @@
-import { type LoginFailure, type LoginResponse } from "../../auth-email-password/web/index.js";
+import { type LoginFailure, type LoginResponse } from "../../auth-email-password/web/index.ts";
 export type MfaVerifyResult = {
     readonly kind: "success";
     readonly data: LoginResponse;

package/dist/auth-mfa-user-data/index.d.ts

@@ -1,7 +1,3 @@
 export declare function createAuthMfaUserDataFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };
-/** @deprecated Use createAuthMfaUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const authMfaUserDataFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: void;
-};

package/dist/auth-mfa-user-data/index.js

@@ -17,5 +17,3 @@ export function createAuthMfaUserDataFeature() {
         });
     }, { dedupeOptions: {} });
 }
-/** @deprecated Use createAuthMfaUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const authMfaUserDataFeature = createAuthMfaUserDataFeature();

package/dist/billing-foundation/checkout-core.d.ts

@@ -1,7 +1,7 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
-import { getSubscriptionForTenant } from "./get-subscription-for-tenant.js";
-import type { BillingPlanCatalog, SubscriptionProviderPlugin } from "./types.js";
+import { getSubscriptionForTenant } from "./get-subscription-for-tenant.ts";
+import type { BillingPlanCatalog, SubscriptionProviderPlugin } from "./types.ts";
 /** Narrows a `readonly string[]` to the non-empty tuple shape `z.enum`
  *  needs. Callers only reach this with a catalog's `plans` — the feature
  *  factory already rejected an empty `plans` array at mount time, so the

package/dist/billing-foundation/consumer-protection/confirmation-mail.d.ts

@@ -1,5 +1,5 @@
-import type { CheckoutConsentRecordedPayload } from "../events.js";
-import { type ConsentLocale } from "./consent-text.js";
+import type { CheckoutConsentRecordedPayload } from "../events.ts";
+import { type ConsentLocale } from "./consent-text.ts";
 type ConfirmationLabels = {
     readonly subject: string;
     readonly intro: string;

package/dist/billing-foundation/consumer-protection/consent-gate.d.ts

@@ -1,6 +1,6 @@
 import { type HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import type { ConsumerProtectionOptions, ProviderPrice } from "../types.js";
+import type { ConsumerProtectionOptions, ProviderPrice } from "../types.ts";
 export type CheckoutMode = "subscription" | "payment";
 export declare const consentPayloadSchema: z.ZodObject<{
     earlyPerformanceRequested: z.ZodBoolean;

package/dist/billing-foundation/consumer-protection/consent-text.d.ts

@@ -1,5 +1,5 @@
-import type { ConsentLocale } from "./consent-locale.js";
-export { CONSENT_LOCALES, type ConsentLocale, FALLBACK_CONSENT_LOCALE, resolveConsentLocale, } from "./consent-locale.js";
+import type { ConsentLocale } from "./consent-locale.ts";
+export { CONSENT_LOCALES, type ConsentLocale, FALLBACK_CONSENT_LOCALE, resolveConsentLocale, } from "./consent-locale.ts";
 export type ConsentTexts = {
     readonly earlyPerformance: string;
     readonly withdrawalLoss: string;