@cosmicdrift/kumiko-samples 0.368.0 → 0.370.0

package/packages/bundled-features/src/auth-foundation/feature.ts

@@ -17,7 +17,7 @@ import {
   validateTenantExistenceMultiplicity,
   validateTenantResolverMultiplicity,
   validateTokenVerifierMultiplicity,
-} from "./boot-checks.js";
+} from "./boot-checks.ts";
 import {
   type AuthProviderBuildDeps,
   EXT_SESSION_STORE,
@@ -33,14 +33,14 @@ import {
   type TenantResolverFn,
   type TenantResolverTrust,
   tokenShapeMatches,
-} from "./types.js";
+} from "./types.ts";
 
 export {
   EXT_SESSION_STORE,
   EXT_TENANT_EXISTENCE,
   EXT_TENANT_RESOLVER,
   EXT_TOKEN_VERIFIER,
-} from "./types.js";
+} from "./types.ts";
 
 const FEATURE_NAME = "auth-foundation";
 
@@ -90,9 +90,6 @@ export function createAuthFoundationFeature() {
   );
 }
 
-/** @deprecated Use createAuthFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const authFoundationFeature = createAuthFoundationFeature();
-
 /**
  * Tries every registered tokenVerifier provider's shape against `rawToken`
  * in registration order and calls the first match's verifier. Returns null

package/packages/bundled-features/src/auth-foundation/index.ts

@@ -1,15 +1,14 @@
 // Public API of the auth-foundation bundled-feature.
 
 export {
-  authFoundationFeature,
   createAuthFoundationFeature,
   type ResolvedTenantResolver,
   resolveSessionStore,
   resolveTenantExistence,
   resolveTenantResolver,
   resolveTokenVerifier,
-} from "./feature.js";
-export { resolveAnonymousAccessFromRegistry } from "./resolve-anonymous-access.js";
+} from "./feature.ts";
+export { resolveAnonymousAccessFromRegistry } from "./resolve-anonymous-access.ts";
 export {
   type AuthProviderBuildDeps,
   type AuthProviderPlugin,
@@ -35,4 +34,4 @@ export {
   type TokenShape,
   tokenShapeKey,
   tokenShapeMatches,
-} from "./types.js";
+} from "./types.ts";

package/packages/bundled-features/src/auth-foundation/resolve-anonymous-access.ts

@@ -8,8 +8,8 @@ import type {
   AnonymousAccessResolved,
 } from "@cosmicdrift/kumiko-framework/api";
 import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
-import { resolveTenantExistence, resolveTenantResolver } from "./feature.js";
-import type { AuthProviderBuildDeps } from "./types.js";
+import { resolveTenantExistence, resolveTenantResolver } from "./feature.ts";
+import type { AuthProviderBuildDeps } from "./types.ts";
 
 export async function resolveAnonymousAccessFromRegistry(
   base: AnonymousAccessResolved | AnonymousAccessConfig | undefined,

package/packages/bundled-features/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.370.0",
+    "type": "improvement",
+    "title": "MFA token secrets are optional and bound at boot",
+    "detail": "setupTokenSecret and challengeTokenSecret on createAuthMfaFeature are optional. Unset, the boot binds them through bindMfaTokenSecretsFromFeature(feature)(masterSecret, env): MFA_SETUP_TOKEN_SECRET and MFA_CHALLENGE_TOKEN_SECRET from env when set, otherwise derived from the master secret. mfaTokenSecretsEnvSchema declares both variables and the feature registers it next to the secrets master-key slot. A handler called before the binding throws instead of signing with an empty key."
+  },
   {
     "version": "0.357.0",
     "type": "improvement",

package/packages/bundled-features/src/auth-mfa/db/queries.ts

@@ -5,7 +5,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
-import { userMfaEntity, userMfaTable } from "../schema/user-mfa.js";
+import { userMfaEntity, userMfaTable } from "../schema/user-mfa.ts";
 
 export type UserMfaRow = {
   readonly id: string;

package/packages/bundled-features/src/auth-mfa/env.ts

@@ -0,0 +1,28 @@
+import * as z from "zod";
+import { secretsEnvSchema } from "../secrets/index.ts";
+
+const MIN_TOKEN_SECRET_LENGTH = 32;
+
+function tokenSecretOverride(description: string) {
+  return z
+    .string()
+    .min(MIN_TOKEN_SECRET_LENGTH)
+    .optional()
+    .describe(`${description} Unset: derived from JWT_SECRET.`)
+    .meta({ kumiko: { pulumi: { generator: "openssl rand -hex 32", secret: true } } });
+}
+
+/** Optional overrides for the two MFA token HMAC keys. Unset, both are
+ *  derived from the app's JWT secret, so one env var stays authoritative. */
+export const mfaTokenSecretsEnvSchema = z.object({
+  MFA_SETUP_TOKEN_SECRET: tokenSecretOverride("HMAC key of the MFA enable-flow token."),
+  MFA_CHALLENGE_TOKEN_SECRET: tokenSecretOverride("HMAC key of the MFA login-challenge token."),
+});
+
+// Same field instances as `secrets`, so composeEnvSchema treats them as one
+// shared variable; an app mounting auth-mfa without `secrets` still gets the
+// KEK slot (and its _CIPHERTEXT twin) declared.
+export const authMfaEnvSchema = z.object({
+  ...secretsEnvSchema.shape,
+  ...mfaTokenSecretsEnvSchema.shape,
+});

package/packages/bundled-features/src/auth-mfa/errors.ts

@@ -3,9 +3,9 @@ import {
   type WriteFailure,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
-import { AuthMfaErrorCodes } from "./constants.js";
+import { AuthMfaErrorCodes } from "./constants.ts";
 
-export { AuthMfaErrorCodes as AuthMfaErrors } from "./constants.js";
+export { AuthMfaErrorCodes as AuthMfaErrors } from "./constants.ts";
 
 export function mfaAlreadyEnabled(): WriteFailure {
   return writeFailure(

package/packages/bundled-features/src/auth-mfa/feature-exports.ts

@@ -0,0 +1,100 @@
+import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import type { MfaCodeVerifier } from "./mfa-code-verifier.ts";
+import type { MfaStatusChecker } from "./mfa-status-checker.ts";
+import type { MfaTokenSecretsEnv } from "./token-secrets.ts";
+
+// Typed readers for what a mounted auth-mfa feature exposes on its untyped
+// exports; the boot runners and other features wire through these.
+
+export type BindMfaRevokeAllOtherSessions = (
+  revoker: (userId: string, currentSid: string | undefined) => Promise<number>,
+) => void;
+
+// Reads the late-bind setter off a mounted auth-mfa feature's exports —
+// mirrors sessions' own bindAutoRevokeFromFeature. run{Prod,Dev}App call
+// this once the sessions feature (if mounted) has produced a concrete
+// sessionRevokeAllOthers callback.
+export function bindMfaRevokeAllOtherSessionsFromFeature(
+  feature: FeatureDefinition,
+): BindMfaRevokeAllOtherSessions | undefined {
+  const exports = feature.exports;
+  if (exports && typeof exports === "object" && "bindRevokeAllOtherSessions" in exports) {
+    const { bindRevokeAllOtherSessions } = exports;
+    if (typeof bindRevokeAllOtherSessions === "function") {
+      // @cast-boundary feature-exports — feature.exports is untyped by design
+      return bindRevokeAllOtherSessions as BindMfaRevokeAllOtherSessions;
+    }
+  }
+  return undefined;
+}
+
+// Reads the eagerly-built `checkMfaStatus` off a mounted auth-mfa feature's
+// exports — no bind-setter needed (see the comment where it's built).
+export function mfaStatusCheckerFromFeature(
+  feature: FeatureDefinition,
+): MfaStatusChecker | undefined {
+  const exports = feature.exports;
+  if (exports && typeof exports === "object" && "checkMfaStatus" in exports) {
+    const { checkMfaStatus } = exports;
+    if (typeof checkMfaStatus === "function") {
+      // @cast-boundary feature-exports — feature.exports is untyped by design
+      return checkMfaStatus as MfaStatusChecker;
+    }
+  }
+  return undefined;
+}
+
+// Reads the eagerly-built `verifyMfaCode` off a mounted auth-mfa feature's
+// exports — personal-access-tokens wires this in as its optional
+// mfaVerifier (re-auth gate for minting a token). Same no-bind-setter
+// reasoning as checkMfaStatus above.
+export function mfaVerifierFromFeature(feature: FeatureDefinition): MfaCodeVerifier | undefined {
+  const exports = feature.exports;
+  if (exports && typeof exports === "object" && "verifyMfaCode" in exports) {
+    const { verifyMfaCode } = exports;
+    if (typeof verifyMfaCode === "function") {
+      // @cast-boundary feature-exports — feature.exports is untyped by design
+      return verifyMfaCode as MfaCodeVerifier;
+    }
+  }
+  return undefined;
+}
+
+export type BindMfaTokenSecrets = (masterSecret: string, env: MfaTokenSecretsEnv) => void;
+
+// Reads the token-secret binder off a mounted auth-mfa feature's exports.
+// run{Prod,Dev}App and setupTestStack call it with the JWT secret once the
+// env is validated, so a dry run never needs the master secret.
+export function bindMfaTokenSecretsFromFeature(
+  feature: FeatureDefinition,
+): BindMfaTokenSecrets | undefined {
+  const exports = feature.exports;
+  if (exports && typeof exports === "object" && "bindTokenSecrets" in exports) {
+    const { bindTokenSecrets } = exports;
+    if (typeof bindTokenSecrets === "function") {
+      // @cast-boundary feature-exports — feature.exports is untyped by design
+      return bindTokenSecrets as BindMfaTokenSecrets;
+    }
+  }
+  return undefined;
+}
+
+export type BindRevokeAllPatTokens = (revoker: (userId: string) => Promise<number>) => void;
+
+// Reads the late-bind setter off a mounted auth-mfa feature's exports —
+// run{Prod,Dev}App call this once the personal-access-tokens feature (if
+// mounted) has produced a concrete revoker, same wiring shape as
+// bindMfaRevokeAllOtherSessionsFromFeature.
+export function bindRevokeAllPatTokensFromFeature(
+  feature: FeatureDefinition,
+): BindRevokeAllPatTokens | undefined {
+  const exports = feature.exports;
+  if (exports && typeof exports === "object" && "bindRevokeAllPatTokens" in exports) {
+    const { bindRevokeAllPatTokens } = exports;
+    if (typeof bindRevokeAllPatTokens === "function") {
+      // @cast-boundary feature-exports — feature.exports is untyped by design
+      return bindRevokeAllPatTokens as BindRevokeAllPatTokens;
+    }
+  }
+  return undefined;
+}

package/packages/bundled-features/src/auth-mfa/feature.ts

@@ -1,21 +1,28 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { secretsEnvSchema } from "../secrets/index.js";
-import { type MfaRequiredPolicy, mfaRequiredConfigKey } from "./config.js";
-import { createDisableHandler } from "./handlers/disable.write.js";
-import { createEnableConfirmHandler } from "./handlers/enable-confirm.write.js";
-import { createEnableConfirmPreauthHandler } from "./handlers/enable-confirm-preauth.write.js";
-import { createEnableStartHandler } from "./handlers/enable-start.write.js";
-import { createEnableStartPreauthHandler } from "./handlers/enable-start-preauth.write.js";
-import { mfaReencryptJob } from "./handlers/reencrypt.job.js";
-import { createRegenerateRecoveryHandler } from "./handlers/regenerate-recovery.write.js";
-import { mfaStatusQuery } from "./handlers/status.query.js";
-import { createMfaVerifyHandler } from "./handlers/verify.write.js";
-import { AUTH_MFA_FEATURE_I18N } from "./i18n.js";
-import { createMfaCodeVerifier, type MfaCodeVerifier } from "./mfa-code-verifier.js";
-import { createMfaStatusChecker, type MfaStatusChecker } from "./mfa-status-checker.js";
-import { userMfaEntity } from "./schema/user-mfa.js";
-import { mfaDisableScreen, mfaEnableScreen, mfaRegenerateRecoveryScreen } from "./screens.js";
+import { type FeatureWithEnvSchema, featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
+import { type MfaRequiredPolicy, mfaRequiredConfigKey } from "./config.ts";
+import { authMfaEnvSchema } from "./env.ts";
+import type {
+  BindMfaRevokeAllOtherSessions,
+  BindMfaTokenSecrets,
+  BindRevokeAllPatTokens,
+} from "./feature-exports.ts";
+import { createDisableHandler } from "./handlers/disable.write.ts";
+import { createEnableConfirmHandler } from "./handlers/enable-confirm.write.ts";
+import { createEnableConfirmPreauthHandler } from "./handlers/enable-confirm-preauth.write.ts";
+import { createEnableStartHandler } from "./handlers/enable-start.write.ts";
+import { createEnableStartPreauthHandler } from "./handlers/enable-start-preauth.write.ts";
+import { mfaReencryptJob } from "./handlers/reencrypt.job.ts";
+import { createRegenerateRecoveryHandler } from "./handlers/regenerate-recovery.write.ts";
+import { mfaStatusQuery } from "./handlers/status.query.ts";
+import { createMfaVerifyHandler } from "./handlers/verify.write.ts";
+import { AUTH_MFA_FEATURE_I18N } from "./i18n.ts";
+import { createMfaCodeVerifier } from "./mfa-code-verifier.ts";
+import { createMfaStatusChecker } from "./mfa-status-checker.ts";
+import { userMfaEntity } from "./schema/user-mfa.ts";
+import { mfaDisableScreen, mfaEnableScreen, mfaRegenerateRecoveryScreen } from "./screens.ts";
+import { type ResolvedMfaTokenSecrets, resolveMfaTokenSecretsFromEnv } from "./token-secrets.ts";
 
 const REENCRYPT_ESCAPE_HATCH_REASON =
   "re-encrypts MFA secrets of every tenant's users with the new master key";
@@ -24,98 +31,36 @@ export type AuthMfaFeatureOptions = {
   // HMAC secret for the stateless enable-flow token (carries the generated
   // TOTP secret + recovery-code hashes between enable.start and
   // enable.confirm). Distinct secret from any other token flow in the app —
-  // do not reuse passwordReset.hmacSecret.
-  readonly setupTokenSecret: string;
+  // do not reuse passwordReset.hmacSecret. Unset: MFA_SETUP_TOKEN_SECRET or
+  // derived from the master secret when the boot binds the token secrets.
+  readonly setupTokenSecret?: string;
   // otpauth:// URI issuer — shown in the user's authenticator app next to
   // the account label ("Kumiko: jane@example.com").
   readonly issuer: string;
   // HMAC secret for the login-flow challenge token (carries {userId,
   // tenantId} between the password-check and /auth/mfa/verify). Distinct
   // secret from setupTokenSecret — a compromised setup-token secret must
-  // not also forge login challenges.
-  readonly challengeTokenSecret: string;
+  // not also forge login challenges. Unset: same fallback as setupTokenSecret.
+  readonly challengeTokenSecret?: string;
   // App-wide MFA enforcement default when no tenant row overrides it.
   // Tenant admins cannot change the policy (system-only write), so this plus
   // system writes is the only way to set it. Defaults to "optional".
   readonly requiredPolicy?: MfaRequiredPolicy;
 };
 
-export type BindMfaRevokeAllOtherSessions = (
-  revoker: (userId: string, currentSid: string | undefined) => Promise<number>,
-) => void;
-
-// Reads the late-bind setter off a mounted auth-mfa feature's exports —
-// mirrors sessions' own bindAutoRevokeFromFeature. run{Prod,Dev}App call
-// this once the sessions feature (if mounted) has produced a concrete
-// sessionRevokeAllOthers callback.
-export function bindMfaRevokeAllOtherSessionsFromFeature(
-  feature: FeatureDefinition,
-): BindMfaRevokeAllOtherSessions | undefined {
-  const exports = feature.exports;
-  if (exports && typeof exports === "object" && "bindRevokeAllOtherSessions" in exports) {
-    const { bindRevokeAllOtherSessions } = exports;
-    if (typeof bindRevokeAllOtherSessions === "function") {
-      // @cast-boundary feature-exports — feature.exports is untyped by design
-      return bindRevokeAllOtherSessions as BindMfaRevokeAllOtherSessions;
-    }
-  }
-  return undefined;
-}
-
-// Reads the eagerly-built `checkMfaStatus` off a mounted auth-mfa feature's
-// exports — no bind-setter needed (see the comment where it's built).
-export function mfaStatusCheckerFromFeature(
-  feature: FeatureDefinition,
-): MfaStatusChecker | undefined {
-  const exports = feature.exports;
-  if (exports && typeof exports === "object" && "checkMfaStatus" in exports) {
-    const { checkMfaStatus } = exports;
-    if (typeof checkMfaStatus === "function") {
-      // @cast-boundary feature-exports — feature.exports is untyped by design
-      return checkMfaStatus as MfaStatusChecker;
-    }
-  }
-  return undefined;
-}
-
-// Reads the eagerly-built `verifyMfaCode` off a mounted auth-mfa feature's
-// exports — personal-access-tokens wires this in as its optional
-// mfaVerifier (re-auth gate for minting a token). Same no-bind-setter
-// reasoning as checkMfaStatus above.
-export function mfaVerifierFromFeature(feature: FeatureDefinition): MfaCodeVerifier | undefined {
-  const exports = feature.exports;
-  if (exports && typeof exports === "object" && "verifyMfaCode" in exports) {
-    const { verifyMfaCode } = exports;
-    if (typeof verifyMfaCode === "function") {
-      // @cast-boundary feature-exports — feature.exports is untyped by design
-      return verifyMfaCode as MfaCodeVerifier;
-    }
-  }
-  return undefined;
-}
-
-export type BindRevokeAllPatTokens = (revoker: (userId: string) => Promise<number>) => void;
-
-// Reads the late-bind setter off a mounted auth-mfa feature's exports —
-// run{Prod,Dev}App call this once the personal-access-tokens feature (if
-// mounted) has produced a concrete revoker, same wiring shape as
-// bindMfaRevokeAllOtherSessionsFromFeature.
-export function bindRevokeAllPatTokensFromFeature(
-  feature: FeatureDefinition,
-): BindRevokeAllPatTokens | undefined {
-  const exports = feature.exports;
-  if (exports && typeof exports === "object" && "bindRevokeAllPatTokens" in exports) {
-    const { bindRevokeAllPatTokens } = exports;
-    if (typeof bindRevokeAllPatTokens === "function") {
-      // @cast-boundary feature-exports — feature.exports is untyped by design
-      return bindRevokeAllPatTokens as BindRevokeAllPatTokens;
-    }
-  }
-  return undefined;
+function hasBothExplicitSecrets(opts: AuthMfaFeatureOptions): boolean {
+  return (
+    opts.setupTokenSecret !== undefined &&
+    opts.setupTokenSecret.trim() !== "" &&
+    opts.challengeTokenSecret !== undefined &&
+    opts.challengeTokenSecret.trim() !== ""
+  );
 }
 
-export function createAuthMfaFeature(opts: AuthMfaFeatureOptions): FeatureDefinition {
-  return defineFeature("auth-mfa", (r) => {
+export function createAuthMfaFeature(
+  opts: AuthMfaFeatureOptions,
+): FeatureWithEnvSchema<FeatureDefinition, typeof authMfaEnvSchema.shape> {
+  const feature: FeatureDefinition = defineFeature("auth-mfa", (r) => {
     r.describe(
       "TOTP-based two-factor authentication: enable/disable flow with QR-code setup, 8 single-use recovery codes, and (once wired into a login flow) a second login step after password verification. Secrets are envelope-encrypted at rest via the same MasterKeyProvider as `secrets`/`config`.",
     );
@@ -124,10 +69,7 @@ export function createAuthMfaFeature(opts: AuthMfaFeatureOptions): FeatureDefini
       category: "identity",
       recommended: true,
     });
-    // Same field instances as `secrets`, so composeEnvSchema treats them as one
-    // shared variable; an app mounting auth-mfa without `secrets` still gets the
-    // KEK slot (and its _CIPHERTEXT twin) declared.
-    r.envSchema(secretsEnvSchema);
+    r.envSchema(authMfaEnvSchema);
     r.requires({ features: ["user"] });
     r.requires({ features: ["config"] });
     // verify.write.ts dispatches "tenant:query:memberships" — without this
@@ -183,27 +125,58 @@ export function createAuthMfaFeature(opts: AuthMfaFeatureOptions): FeatureDefini
     const sharedPatRevoker = (userId: string): Promise<number> =>
       revokeAllPatTokens?.(userId) ?? Promise.resolve(0);
 
+    // Handlers and the status checker read the secrets through these getters
+    // on each call, so the boot can bind them after env validation. Never
+    // spread these objects: a spread would read the getter eagerly.
+    let boundTokenSecrets: ResolvedMfaTokenSecrets | undefined = hasBothExplicitSecrets(opts)
+      ? resolveMfaTokenSecretsFromEnv("", {}, opts)
+      : undefined;
+    const tokenSecrets = (): ResolvedMfaTokenSecrets => {
+      if (boundTokenSecrets === undefined) {
+        throw new Error(
+          "[auth-mfa] token secrets are not bound: pass setupTokenSecret/challengeTokenSecret, or call bindMfaTokenSecretsFromFeature(feature)(masterSecret, env) in a custom boot (runProdApp, runDevApp and setupTestStack do this).",
+        );
+      }
+      return boundTokenSecrets;
+    };
+    const bindTokenSecrets: BindMfaTokenSecrets = (masterSecret, env) => {
+      boundTokenSecrets = resolveMfaTokenSecretsFromEnv(masterSecret, env, opts);
+    };
+
     const handlers = {
       enableStart: r.writeHandler(
-        createEnableStartHandler({ setupTokenSecret: opts.setupTokenSecret, issuer: opts.issuer }),
+        createEnableStartHandler({
+          get setupTokenSecret() {
+            return tokenSecrets().setupTokenSecret;
+          },
+          issuer: opts.issuer,
+        }),
       ),
       enableStartPreauth: r.writeHandler(
         createEnableStartPreauthHandler({
-          challengeTokenSecret: opts.challengeTokenSecret,
-          setupTokenSecret: opts.setupTokenSecret,
+          get challengeTokenSecret() {
+            return tokenSecrets().challengeTokenSecret;
+          },
+          get setupTokenSecret() {
+            return tokenSecrets().setupTokenSecret;
+          },
           issuer: opts.issuer,
         }),
       ),
       enableConfirm: r.writeHandler(
         createEnableConfirmHandler({
-          setupTokenSecret: opts.setupTokenSecret,
+          get setupTokenSecret() {
+            return tokenSecrets().setupTokenSecret;
+          },
           revokeAllOtherSessions: sharedRevoker,
           revokeAllPatTokens: sharedPatRevoker,
         }),
       ),
       enableConfirmPreauth: r.writeHandler(
         createEnableConfirmPreauthHandler({
-          setupTokenSecret: opts.setupTokenSecret,
+          get setupTokenSecret() {
+            return tokenSecrets().setupTokenSecret;
+          },
           revokeAllOtherSessions: sharedRevoker,
           revokeAllPatTokens: sharedPatRevoker,
         }),
@@ -218,7 +191,11 @@ export function createAuthMfaFeature(opts: AuthMfaFeatureOptions): FeatureDefini
         createRegenerateRecoveryHandler({ revokeAllOtherSessions: sharedRevoker }),
       ),
       verify: r.writeHandler(
-        createMfaVerifyHandler({ challengeTokenSecret: opts.challengeTokenSecret }),
+        createMfaVerifyHandler({
+          get challengeTokenSecret() {
+            return tokenSecrets().challengeTokenSecret;
+          },
+        }),
       ),
     };
 
@@ -231,7 +208,9 @@ export function createAuthMfaFeature(opts: AuthMfaFeatureOptions): FeatureDefini
     // from inside its own dispatcher call), not a raw db handle assembled
     // at app-boot time.
     const checkMfaStatus = createMfaStatusChecker({
-      challengeTokenSecret: opts.challengeTokenSecret,
+      get challengeTokenSecret() {
+        return tokenSecrets().challengeTokenSecret;
+      },
       ...(opts.requiredPolicy && { requiredPolicy: opts.requiredPolicy }),
     });
 
@@ -254,6 +233,8 @@ export function createAuthMfaFeature(opts: AuthMfaFeatureOptions): FeatureDefini
       checkMfaStatus,
       verifyMfaCode,
       bindRevokeAllPatTokens,
+      bindTokenSecrets,
     };
   });
+  return featureWithEnvSchema(feature, authMfaEnvSchema);
 }

package/packages/bundled-features/src/auth-mfa/handlers/disable.write.ts

@@ -2,10 +2,10 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { findUserMfaRow } from "../db/queries.js";
-import { invalidTotpCode, mfaNotEnabled } from "../errors.js";
-import { userMfaEntity, userMfaTable } from "../schema/user-mfa.js";
-import { verifyMfaFactor } from "../verify-factor.js";
+import { findUserMfaRow } from "../db/queries.ts";
+import { invalidTotpCode, mfaNotEnabled } from "../errors.ts";
+import { userMfaEntity, userMfaTable } from "../schema/user-mfa.ts";
+import { verifyMfaFactor } from "../verify-factor.ts";
 
 export type DisableOptions = {
   readonly revokeAllOtherSessions?: (

package/packages/bundled-features/src/auth-mfa/handlers/enable-confirm-preauth.write.ts

@@ -9,25 +9,25 @@ import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/error
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { burnToken, sessionLocaleField, sessionTimezoneField } from "../../shared/index.js";
-import { USER_STATUS, UserQueries } from "../../user/index.js";
-import { base32Decode } from "../base32.js";
-import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../constants.js";
-import { findUserMfaRow } from "../db/queries.js";
+import { burnToken, sessionLocaleField, sessionTimezoneField } from "../../shared/index.ts";
+import { USER_STATUS, UserQueries } from "../../user/index.ts";
+import { base32Decode } from "../base32.ts";
+import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../constants.ts";
+import { findUserMfaRow } from "../db/queries.ts";
 import {
   invalidSetupToken,
   invalidTotpCode,
   mfaAlreadyEnabled,
   tooManyAttempts,
-} from "../errors.js";
-import { verifyMfaSetupToken } from "../mfa-setup-token.js";
+} from "../errors.ts";
+import { verifyMfaSetupToken } from "../mfa-setup-token.ts";
 import {
   clearMfaVerifyAttempts,
   getMfaVerifyLockoutState,
   recordFailedMfaVerifyAttempt,
-} from "../mfa-verify-attempts.js";
-import { encodeRecoveryCodes, userMfaEntity, userMfaTable } from "../schema/user-mfa.js";
-import { verifyTotp } from "../totp.js";
+} from "../mfa-verify-attempts.ts";
+import { encodeRecoveryCodes, userMfaEntity, userMfaTable } from "../schema/user-mfa.ts";
+import { verifyTotp } from "../totp.ts";
 
 export type EnableConfirmPreauthOptions = {
   // Must match the secret enable-start-preauth.write.ts signs setupTokens

package/packages/bundled-features/src/auth-mfa/handlers/enable-confirm.write.ts

@@ -3,13 +3,13 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { burnToken } from "../../shared/index.js";
-import { base32Decode } from "../base32.js";
-import { findUserMfaRow } from "../db/queries.js";
-import { invalidSetupToken, invalidTotpCode, mfaAlreadyEnabled } from "../errors.js";
-import { verifyMfaSetupToken } from "../mfa-setup-token.js";
-import { encodeRecoveryCodes, userMfaEntity, userMfaTable } from "../schema/user-mfa.js";
-import { verifyTotp } from "../totp.js";
+import { burnToken } from "../../shared/index.ts";
+import { base32Decode } from "../base32.ts";
+import { findUserMfaRow } from "../db/queries.ts";
+import { invalidSetupToken, invalidTotpCode, mfaAlreadyEnabled } from "../errors.ts";
+import { verifyMfaSetupToken } from "../mfa-setup-token.ts";
+import { encodeRecoveryCodes, userMfaEntity, userMfaTable } from "../schema/user-mfa.ts";
+import { verifyTotp } from "../totp.ts";
 
 export type EnableConfirmOptions = {
   readonly setupTokenSecret: string;

package/packages/bundled-features/src/auth-mfa/handlers/enable-start-preauth.write.ts

@@ -1,15 +1,15 @@
 import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { base32Encode } from "../base32.js";
-import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants.js";
-import { findUserMfaRow } from "../db/queries.js";
-import { invalidChallengeToken, mfaAlreadyEnabled } from "../errors.js";
-import { verifyMfaPreauthSetupToken } from "../mfa-preauth-setup-token.js";
-import { signMfaSetupToken } from "../mfa-setup-token.js";
-import { buildOtpauthUri } from "../otpauth-uri.js";
-import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes.js";
-import { generateTotpSecret } from "../totp.js";
+import { base32Encode } from "../base32.ts";
+import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants.ts";
+import { findUserMfaRow } from "../db/queries.ts";
+import { invalidChallengeToken, mfaAlreadyEnabled } from "../errors.ts";
+import { verifyMfaPreauthSetupToken } from "../mfa-preauth-setup-token.ts";
+import { signMfaSetupToken } from "../mfa-setup-token.ts";
+import { buildOtpauthUri } from "../otpauth-uri.ts";
+import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes.ts";
+import { generateTotpSecret } from "../totp.ts";
 
 const ENABLE_START_PREAUTH_TENANT_REASON =
   "reads the MFA enrollment of the tenant named in the signed login/setup token, not the guest dispatch tenant";

package/packages/bundled-features/src/auth-mfa/handlers/enable-start.write.ts

@@ -1,14 +1,14 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { UserQueries } from "../../user/index.js";
-import { base32Encode } from "../base32.js";
-import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants.js";
-import { findUserMfaRow } from "../db/queries.js";
-import { mfaAlreadyEnabled } from "../errors.js";
-import { signMfaSetupToken } from "../mfa-setup-token.js";
-import { buildOtpauthUri } from "../otpauth-uri.js";
-import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes.js";
-import { generateTotpSecret } from "../totp.js";
+import { UserQueries } from "../../user/index.ts";
+import { base32Encode } from "../base32.ts";
+import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants.ts";
+import { findUserMfaRow } from "../db/queries.ts";
+import { mfaAlreadyEnabled } from "../errors.ts";
+import { signMfaSetupToken } from "../mfa-setup-token.ts";
+import { buildOtpauthUri } from "../otpauth-uri.ts";
+import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes.ts";
+import { generateTotpSecret } from "../totp.ts";
 
 export type EnableStartOptions = {
   readonly setupTokenSecret: string;

package/packages/bundled-features/src/auth-mfa/handlers/reencrypt.job.ts

@@ -43,8 +43,8 @@ import {
   type ChunkedMigrationStopReason,
   classifyStoredEnvelope,
   runChunkedMigration,
-} from "../../shared/index.js";
-import { userMfaEntity, userMfaTable } from "../schema/user-mfa.js";
+} from "../../shared/index.ts";
+import { userMfaEntity, userMfaTable } from "../schema/user-mfa.ts";
 
 const DEFAULT_BATCH_SIZE = 100;
 const DEFAULT_MAX_FAILURES = 10;