@cosmicdrift/kumiko-samples 0.369.0 → 0.370.0

package/packages/bundled-features/src/auth-email-password/bootstrap.ts

@@ -24,23 +24,23 @@ import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import type { Redis } from "ioredis";
 // kumiko-lint-ignore cross-feature-import bootstrap sets per-tenant config through the config feature's write handler
-import { ConfigHandlers } from "../config/constants.js";
+import { ConfigHandlers } from "../config/constants.ts";
 // kumiko-lint-ignore cross-feature-import bootstrap compares against the stored config row to stay idempotent
-import { configRowHoldsValue, findConfigRow } from "../config/write-helpers.js";
+import { configRowHoldsValue, findConfigRow } from "../config/write-helpers.ts";
 // kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
-import { TenantHandlers } from "../tenant/constants.js";
+import { TenantHandlers } from "../tenant/constants.ts";
 // kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
-import { INVITATION_STATUS, tenantInvitationsTable } from "../tenant/invitation-table.js";
+import { INVITATION_STATUS, tenantInvitationsTable } from "../tenant/invitation-table.ts";
 // kumiko-lint-ignore cross-feature-import bootstrap checks existing memberships
-import { tenantMembershipsTable } from "../tenant/membership-table.js";
+import { tenantMembershipsTable } from "../tenant/membership-table.ts";
 // kumiko-lint-ignore cross-feature-import bootstrap checks for an existing tenant
-import { tenantTable } from "../tenant/schema/tenant.js";
+import { tenantTable } from "../tenant/schema/tenant.ts";
 // kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
-import type { GlobalRole } from "../user/constants.js";
+import type { GlobalRole } from "../user/constants.ts";
 // kumiko-lint-ignore cross-feature-import bootstrap skips already activated users
-import { userTable } from "../user/schema/user.js";
-import { AuthHandlers } from "./constants.js";
-import { hasLiveInviteToken } from "./invite-token-store.js";
+import { userTable } from "../user/schema/user.ts";
+import { AuthHandlers } from "./constants.ts";
+import { hasLiveInviteToken } from "./invite-token-store.ts";
 
 export type BootstrapInvite = {
   readonly email: string;

package/packages/bundled-features/src/auth-email-password/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.370.0",
+    "type": "improvement",
+    "title": "createAuthEmailPasswordFeature carries its env schema type",
+    "detail": "createAuthEmailPasswordFeature returns the feature typed with authEmailPasswordEnvSchema, so composeEnvSchema types JWT_SECRET and JWT_ISSUER."
+  },
   {
     "version": "0.366.0",
     "type": "fix",

package/packages/bundled-features/src/auth-email-password/errors.ts

@@ -1,5 +1,5 @@
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { AuthErrors } from "./constants.js";
+import { AuthErrors } from "./constants.ts";
 
 // @wrapper-known error-helper
 export function invalidCredentials() {

package/packages/bundled-features/src/auth-email-password/feature.ts

@@ -1,42 +1,43 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureWithEnvSchema, featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import * as z from "zod";
-import { MIN_HMAC_SECRET_LENGTH } from "./constants.js";
-import type { AuthMailLocale } from "./email-templates.js";
-import { changePasswordWrite } from "./handlers/change-password.write.js";
-import { createConfirmAccountUnlockHandler } from "./handlers/confirm-account-unlock.write.js";
-import { createInviteAcceptHandler } from "./handlers/invite-accept.write.js";
-import { createInviteAcceptWithLoginHandler } from "./handlers/invite-accept-with-login.write.js";
+import { MIN_HMAC_SECRET_LENGTH } from "./constants.ts";
+import type { AuthMailLocale } from "./email-templates.ts";
+import { changePasswordWrite } from "./handlers/change-password.write.ts";
+import { createConfirmAccountUnlockHandler } from "./handlers/confirm-account-unlock.write.ts";
+import { createInviteAcceptHandler } from "./handlers/invite-accept.write.ts";
+import { createInviteAcceptWithLoginHandler } from "./handlers/invite-accept-with-login.write.ts";
 import {
   createInviteCreateHandler,
   createSystemInviteCreateHandler,
   type InviteCreateOptions,
-} from "./handlers/invite-create.write.js";
-import { inviteInfoQuery } from "./handlers/invite-info.query.js";
-import { createInviteSignupCompleteHandler } from "./handlers/invite-signup-complete.write.js";
-import { createLoginHandler, type LoginHandlerOptions } from "./handlers/login.write.js";
-import { logoutWrite } from "./handlers/logout.write.js";
+} from "./handlers/invite-create.write.ts";
+import { inviteInfoQuery } from "./handlers/invite-info.query.ts";
+import { createInviteSignupCompleteHandler } from "./handlers/invite-signup-complete.write.ts";
+import { createLoginHandler, type LoginHandlerOptions } from "./handlers/login.write.ts";
+import { logoutWrite } from "./handlers/logout.write.ts";
 import {
   createRequestAccountUnlockHandler,
   type RequestAccountUnlockOptions,
-} from "./handlers/request-account-unlock.write.js";
-import { createRequestEmailVerificationHandler } from "./handlers/request-email-verification.write.js";
-import { createRequestPasswordResetHandler } from "./handlers/request-password-reset.write.js";
-import { createResetPasswordHandler } from "./handlers/reset-password.write.js";
-import { selfRegistrationStatusQuery } from "./handlers/self-registration-status.query.js";
-import { createSignupConfirmHandler } from "./handlers/signup-confirm.write.js";
+} from "./handlers/request-account-unlock.write.ts";
+import { createRequestEmailVerificationHandler } from "./handlers/request-email-verification.write.ts";
+import { createRequestPasswordResetHandler } from "./handlers/request-password-reset.write.ts";
+import { createResetPasswordHandler } from "./handlers/reset-password.write.ts";
+import { selfRegistrationStatusQuery } from "./handlers/self-registration-status.query.ts";
+import { createSignupConfirmHandler } from "./handlers/signup-confirm.write.ts";
 import {
   createSignupRequestHandler,
   type SignupRequestOptions,
-} from "./handlers/signup-request.write.js";
-import { createSwitchTenantMfaGateHandler } from "./handlers/switch-tenant-mfa-gate.write.js";
-import { createVerifyEmailHandler } from "./handlers/verify-email.write.js";
-import { AUTH_EMAIL_PASSWORD_MAIL_I18N } from "./mail-i18n.js";
+} from "./handlers/signup-request.write.ts";
+import { createSwitchTenantMfaGateHandler } from "./handlers/switch-tenant-mfa-gate.write.ts";
+import { createVerifyEmailHandler } from "./handlers/verify-email.write.ts";
+import { AUTH_EMAIL_PASSWORD_MAIL_I18N } from "./mail-i18n.ts";
 import {
   AUTH_MAIL_VARIABLES,
   authMailLocalizedTemplate,
   INVITE_MAIL_VARIABLES,
   sendsMagicLinkMail,
-} from "./mail-notifications.js";
+} from "./mail-notifications.ts";
 
 /**
  * Env-vars contract for the `auth-email-password` feature.
@@ -151,7 +152,7 @@ export type AuthEmailPasswordOptions = {
 // membership resolution. No direct imports of foreign tables.
 export function createAuthEmailPasswordFeature(
   opts: AuthEmailPasswordOptions = {},
-): FeatureDefinition {
+): FeatureWithEnvSchema<FeatureDefinition, typeof authEmailPasswordEnvSchema.shape> {
   // ≥32 chars, symmetric to the JWT_SECRET env check: a short HMAC secret
   // makes reset/verify tokens forgeable — that's account takeover, so the
   // factory fails fast instead of trusting the caller.
@@ -174,7 +175,7 @@ export function createAuthEmailPasswordFeature(
   const strictVerification =
     opts.emailVerification !== undefined && (opts.emailVerification.mode ?? "strict") === "strict";
 
-  return defineFeature("auth-email-password", (r) => {
+  const feature: FeatureDefinition = defineFeature("auth-email-password", (r) => {
     r.describe(
       "Provides email+password authentication: the always-on handlers are `login`, `changePassword`, and `logout`; optional flows — password reset, email verification, magic-link self-signup, tenant invite, and account-unlock — are registered only when you pass their respective option objects (`passwordReset`, `emailVerification`, `signup`, `invite`, `accountUnlock`) to `createAuthEmailPasswordFeature(opts)`. All five magic-link flows dispatch their mail through the `delivery` feature via `ctx.notify`, so mounting any of them additionally requires `delivery`. Tokens are HMAC-signed (reset/verify/unlock) or opaque-random in Redis (signup/invite). `accountUnlock` is the self-service escape hatch for `accountLockout`'s monotonic failure-counter (#1266): confirming the mailed token clears the Redis lockout state without touching the user entity. Requires the `user` and `tenant` features, and declares `JWT_SECRET` (≥ 32 chars) in `authEmailPasswordEnvSchema` so a missing secret surfaces at boot validation rather than on the first login attempt.",
     );
@@ -293,4 +294,5 @@ export function createAuthEmailPasswordFeature(
 
     return { handlers, queries };
   });
+  return featureWithEnvSchema(feature, authEmailPasswordEnvSchema);
 }

package/packages/bundled-features/src/auth-email-password/handlers/change-password.write.ts

@@ -4,10 +4,10 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { hashPassword, verifyPassword } from "../../shared/index.js";
-import { UserHandlers, UserQueries } from "../../user/index.js";
-import { invalidCredentials } from "../errors.js";
-import { passwordSchema } from "../password-policy.js";
+import { hashPassword, verifyPassword } from "../../shared/index.ts";
+import { UserHandlers, UserQueries } from "../../user/index.ts";
+import { invalidCredentials } from "../errors.ts";
+import { passwordSchema } from "../password-policy.ts";
 
 // Change-password — authenticated. The user supplies their current password
 // (re-auth) and the new one. The new hash is written via ctx.writeAs(system)

package/packages/bundled-features/src/auth-email-password/handlers/confirm-account-unlock.write.ts

@@ -5,10 +5,10 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { AuthErrors } from "../constants.js";
-import { invalidUnlockToken } from "../errors.js";
-import { clearLockoutState } from "../lockout-store.js";
-import { verifyUnlockToken } from "../unlock-token.js";
+import { AuthErrors } from "../constants.ts";
+import { invalidUnlockToken } from "../errors.ts";
+import { clearLockoutState } from "../lockout-store.ts";
+import { verifyUnlockToken } from "../unlock-token.ts";
 
 export type ConfirmAccountUnlockOptions = {
   readonly hmacSecret: string;

package/packages/bundled-features/src/auth-email-password/handlers/confirm-token-flow.ts

@@ -32,10 +32,10 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import type { Redis } from "ioredis";
-import { burnToken, unburnToken } from "../../shared/index.js";
-import { UserHandlers, UserQueries } from "../../user/index.js";
-import type { AuthUserRow } from "../auth-user-row.js";
-import { parseAuthUserRow } from "../auth-user-row.js";
+import { burnToken, unburnToken } from "../../shared/index.ts";
+import { UserHandlers, UserQueries } from "../../user/index.ts";
+import type { AuthUserRow } from "../auth-user-row.ts";
+import { parseAuthUserRow } from "../auth-user-row.ts";
 
 export type ConfirmTokenFlowSpec<TSuccessData> = {
   // Short purpose-tag used in the burn-store key. Must NOT overlap with

package/packages/bundled-features/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -36,34 +36,34 @@ import {
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { decryptStoredPii, sessionLocaleField, sessionTimezoneField } from "../../shared/index.js";
+import { decryptStoredPii, sessionLocaleField, sessionTimezoneField } from "../../shared/index.ts";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {
   INVITATION_STATUS,
   tenantInvitationEntity,
   tenantInvitationsTable,
-} from "../../tenant/invitation-table.js";
+} from "../../tenant/invitation-table.ts";
 // kumiko-lint-ignore cross-feature-import membership grant for a privileged cross-tenant add
-import { grantInvitedMembershipRole } from "../../tenant/invited-membership.js";
+import { grantInvitedMembershipRole } from "../../tenant/invited-membership.ts";
 // kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
 import {
   grantInvitedGlobalRoles,
   parseInvitedGlobalRoles,
-} from "../../user/invited-global-roles.js";
+} from "../../user/invited-global-roles.ts";
 // kumiko-lint-ignore cross-feature-import login-style password-check
-import { userTable } from "../../user/schema/user.js";
+import { userTable } from "../../user/schema/user.ts";
 import {
   AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES,
   AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS,
-} from "../constants.js";
-import { invalidCredentials, invalidInviteToken, inviteEmailMismatch } from "../errors.js";
+} from "../constants.ts";
+import { invalidCredentials, invalidInviteToken, inviteEmailMismatch } from "../errors.ts";
 import {
   burnInviteToken,
   deleteInviteToken,
   getInvitationIdForToken,
   unburnInviteToken,
-} from "../invite-token-store.js";
-import { passwordSchema } from "../password-policy.js";
+} from "../invite-token-store.ts";
+import { passwordSchema } from "../password-policy.ts";
 import {
   gateEnforceAccountStatus,
   gateEnforceEmailVerified,
@@ -72,7 +72,7 @@ import {
   gateVerifyPassword,
   type LoginHandlerOptions,
   type LoginResult,
-} from "./login.write.js";
+} from "./login.write.ts";
 
 const InviteAcceptWithLoginSchema = z.object({
   token: z.string().min(1),

package/packages/bundled-features/src/auth-email-password/handlers/invite-accept.write.ts

@@ -28,29 +28,29 @@ import {
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { decryptStoredPii } from "../../shared/index.js";
+import { decryptStoredPii } from "../../shared/index.ts";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
 import {
   INVITATION_STATUS,
   tenantInvitationEntity,
   tenantInvitationsTable,
-} from "../../tenant/invitation-table.js";
+} from "../../tenant/invitation-table.ts";
 // kumiko-lint-ignore cross-feature-import membership grant for a privileged cross-tenant add (like provisionSignupAccount)
-import { grantInvitedMembershipRole } from "../../tenant/invited-membership.js";
+import { grantInvitedMembershipRole } from "../../tenant/invited-membership.ts";
 // kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
 import {
   grantInvitedGlobalRoles,
   parseInvitedGlobalRoles,
-} from "../../user/invited-global-roles.js";
+} from "../../user/invited-global-roles.ts";
 // kumiko-lint-ignore cross-feature-import auth handler reads user-row für email-match
-import { userTable } from "../../user/schema/user.js";
-import { invalidInviteToken, inviteEmailMismatch } from "../errors.js";
+import { userTable } from "../../user/schema/user.ts";
+import { invalidInviteToken, inviteEmailMismatch } from "../errors.ts";
 import {
   burnInviteToken,
   deleteInviteToken,
   getInvitationIdForToken,
   unburnInviteToken,
-} from "../invite-token-store.js";
+} from "../invite-token-store.ts";
 
 const InviteAcceptSchema = z.object({
   token: z.string().min(1),

package/packages/bundled-features/src/auth-email-password/handlers/invite-create.write.ts

@@ -40,26 +40,26 @@ import {
   INVITATION_STATUS,
   tenantInvitationEntity,
   tenantInvitationsTable,
-} from "../../tenant/invitation-table.js";
+} from "../../tenant/invitation-table.ts";
 // kumiko-lint-ignore cross-feature-import membership version read is owned by the tenant feature
-import { membershipVersionOf } from "../../tenant/invited-membership.js";
+import { membershipVersionOf } from "../../tenant/invited-membership.ts";
 // kumiko-lint-ignore cross-feature-import membership-role validation owned by tenant-feature
 import {
   findForbiddenMembershipRole,
   findForbiddenRoleAssignment,
   reservedMembershipRoleError,
   unassignableMembershipRoleError,
-} from "../../tenant/membership-roles.js";
+} from "../../tenant/membership-roles.ts";
 // kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
-import { GLOBAL_ROLE_OPTIONS, type GlobalRole } from "../../user/constants.js";
+import { GLOBAL_ROLE_OPTIONS, type GlobalRole } from "../../user/constants.ts";
 // kumiko-lint-ignore cross-feature-import invitee lookup by email reads the user row
-import { userTable } from "../../user/schema/user.js";
-import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants.js";
-import type { AuthMailLocale } from "../email-templates.js";
-import { inviteAlreadyAccepted } from "../errors.js";
-import { invalidateExistingInviteToken, storeInviteToken } from "../invite-token-store.js";
-import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
-import { AuthMailNotificationTypes } from "../mail-notifications.js";
+import { userTable } from "../../user/schema/user.ts";
+import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants.ts";
+import type { AuthMailLocale } from "../email-templates.ts";
+import { inviteAlreadyAccepted } from "../errors.ts";
+import { invalidateExistingInviteToken, storeInviteToken } from "../invite-token-store.ts";
+import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.ts";
+import { AuthMailNotificationTypes } from "../mail-notifications.ts";
 
 const InviteCreateSchema = z.object({
   email: z.email(),

package/packages/bundled-features/src/auth-email-password/handlers/invite-info.query.ts

@@ -9,13 +9,13 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { decryptStoredPii } from "../../shared/index.js";
+import { decryptStoredPii } from "../../shared/index.ts";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
-import { INVITATION_STATUS, tenantInvitationsTable } from "../../tenant/invitation-table.js";
+import { INVITATION_STATUS, tenantInvitationsTable } from "../../tenant/invitation-table.ts";
 // kumiko-lint-ignore cross-feature-import login-style account lookup, same as invite-accept-with-login
-import { userTable } from "../../user/schema/user.js";
-import { AuthErrors } from "../constants.js";
-import { getInvitationIdForToken } from "../invite-token-store.js";
+import { userTable } from "../../user/schema/user.ts";
+import { AuthErrors } from "../constants.ts";
+import { getInvitationIdForToken } from "../invite-token-store.ts";
 
 const InviteInfoSchema = z.object({
   token: z.string().min(1),

package/packages/bundled-features/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -32,35 +32,35 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { decryptStoredPii, registrationLocaleFromRequest } from "../../shared/index.js";
+import { decryptStoredPii, registrationLocaleFromRequest } from "../../shared/index.ts";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {
   INVITATION_STATUS,
   tenantInvitationEntity,
   tenantInvitationsTable,
-} from "../../tenant/invitation-table.js";
+} from "../../tenant/invitation-table.ts";
 // kumiko-lint-ignore cross-feature-import reserved-role check owned by tenant-feature
 import {
   findForbiddenMembershipRole,
   reservedMembershipRoleError,
-} from "../../tenant/membership-roles.js";
+} from "../../tenant/membership-roles.ts";
 // kumiko-lint-ignore cross-feature-import membership-seed-helper für privilegierten cross-tenant-add
-import { seedTenantMembership } from "../../tenant/seeding.js";
+import { seedTenantMembership } from "../../tenant/seeding.ts";
 // kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
-import { parseInvitedGlobalRoles } from "../../user/invited-global-roles.js";
+import { parseInvitedGlobalRoles } from "../../user/invited-global-roles.ts";
 // kumiko-lint-ignore cross-feature-import existence-check
-import { userTable } from "../../user/schema/user.js";
-import { invalidInviteToken } from "../errors.js";
+import { userTable } from "../../user/schema/user.ts";
+import { invalidInviteToken } from "../errors.ts";
 import {
   burnInviteToken,
   deleteInviteToken,
   getInvitationIdForToken,
   unburnInviteToken,
-} from "../invite-token-store.js";
-import { passwordSchema } from "../password-policy.js";
+} from "../invite-token-store.ts";
+import { passwordSchema } from "../password-policy.ts";
 // kumiko-lint-ignore cross-feature-import provisioning needs cross-feature seeding helpers
-import { seedUserWithPassword } from "../seeding.js";
-import { gateEnforceMfa, type LoginHandlerOptions, type LoginResult } from "./login.write.js";
+import { seedUserWithPassword } from "../seeding.ts";
+import { gateEnforceMfa, type LoginHandlerOptions, type LoginResult } from "./login.write.ts";
 
 const InviteSignupCompleteSchema = z.object({
   token: z.string().min(1),

package/packages/bundled-features/src/auth-email-password/handlers/login.write.ts

@@ -11,21 +11,21 @@ import {
 import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
-import { verifyDummyPassword, verifyPassword } from "../../shared/index.js";
-import { USER_STATUS, UserQueries } from "../../user/index.js";
-import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row.js";
+import { verifyDummyPassword, verifyPassword } from "../../shared/index.ts";
+import { USER_STATUS, UserQueries } from "../../user/index.ts";
+import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row.ts";
 import {
   AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES,
   AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS,
-} from "../constants.js";
+} from "../constants.ts";
 import {
   accountLocked,
   accountRestricted,
   emailNotVerified,
   invalidCredentials,
   noMembership,
-} from "../errors.js";
-import { clearLockoutState, getLockoutState, recordFailedAttempt } from "../lockout-store.js";
+} from "../errors.ts";
+import { clearLockoutState, getLockoutState, recordFailedAttempt } from "../lockout-store.ts";
 
 export type LoginHandlerOptions = {
   // When true, a valid (email + password) login fails with email_not_verified

package/packages/bundled-features/src/auth-email-password/handlers/request-account-unlock.write.ts

@@ -1,11 +1,11 @@
-import { AUTH_UNLOCK_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
-import { AuthMailNotificationTypes } from "../mail-notifications.js";
-import { signUnlockToken } from "../unlock-token.js";
+import { AUTH_UNLOCK_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.ts";
+import { AuthMailNotificationTypes } from "../mail-notifications.ts";
+import { signUnlockToken } from "../unlock-token.ts";
 import {
   createTokenRequestHandler,
   type TokenRequestData,
   type TokenRequestOptions,
-} from "./token-request-handler.js";
+} from "./token-request-handler.ts";
 
 export type RequestAccountUnlockOptions = TokenRequestOptions;
 

package/packages/bundled-features/src/auth-email-password/handlers/request-email-verification.write.ts

@@ -1,11 +1,11 @@
-import { AUTH_VERIFY_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
-import { AuthMailNotificationTypes } from "../mail-notifications.js";
-import { signVerificationToken } from "../verification-token.js";
+import { AUTH_VERIFY_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.ts";
+import { AuthMailNotificationTypes } from "../mail-notifications.ts";
+import { signVerificationToken } from "../verification-token.ts";
 import {
   createTokenRequestHandler,
   type TokenRequestData,
   type TokenRequestOptions,
-} from "./token-request-handler.js";
+} from "./token-request-handler.ts";
 
 export type RequestEmailVerificationOptions = TokenRequestOptions;
 

package/packages/bundled-features/src/auth-email-password/handlers/request-password-reset.write.ts

@@ -1,11 +1,11 @@
-import { AUTH_RESET_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
-import { AuthMailNotificationTypes } from "../mail-notifications.js";
-import { signResetToken } from "../reset-token.js";
+import { AUTH_RESET_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.ts";
+import { AuthMailNotificationTypes } from "../mail-notifications.ts";
+import { signResetToken } from "../reset-token.ts";
 import {
   createTokenRequestHandler,
   type TokenRequestData,
   type TokenRequestOptions,
-} from "./token-request-handler.js";
+} from "./token-request-handler.ts";
 
 export type RequestPasswordResetOptions = TokenRequestOptions;
 

package/packages/bundled-features/src/auth-email-password/handlers/reset-password.write.ts

@@ -1,12 +1,12 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { hashPassword } from "../../shared/index.js";
-import { AuthErrors } from "../constants.js";
-import { invalidResetToken } from "../errors.js";
-import { passwordSchema } from "../password-policy.js";
-import { verifyResetToken } from "../reset-token.js";
-import { runConfirmTokenFlow } from "./confirm-token-flow.js";
+import { hashPassword } from "../../shared/index.ts";
+import { AuthErrors } from "../constants.ts";
+import { invalidResetToken } from "../errors.ts";
+import { passwordSchema } from "../password-policy.ts";
+import { verifyResetToken } from "../reset-token.ts";
+import { runConfirmTokenFlow } from "./confirm-token-flow.ts";
 
 export type ResetPasswordOptions = {
   readonly hmacSecret: string;

package/packages/bundled-features/src/auth-email-password/handlers/self-registration-status.query.ts

@@ -1,6 +1,6 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { AUTH_SELF_REGISTRATION_FEATURE } from "../self-registration-toggle.js";
+import { AUTH_SELF_REGISTRATION_FEATURE } from "../self-registration-toggle.ts";
 
 // Anonymous-readable status for the (unauthenticated) signup page: lets it
 // hide its own link/form when an operator has flipped self-registration

package/packages/bundled-features/src/auth-email-password/handlers/signup-confirm.write.ts

@@ -43,13 +43,13 @@ import {
   registrationLocaleFromRequest,
   SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE,
   type SignupHandoverBinding,
-} from "../../shared/index.js";
+} from "../../shared/index.ts";
 // kumiko-lint-ignore cross-feature-import signup-confirm reads tenants.key for slug-uniqueness check (TOCTOU + DB-unique-index zusammen)
-import { tenantTable } from "../../tenant/schema/tenant.js";
-import { invalidSignupToken, signupEmailAlreadyRegistered } from "../errors.js";
-import { passwordSchema } from "../password-policy.js";
+import { tenantTable } from "../../tenant/schema/tenant.ts";
+import { invalidSignupToken, signupEmailAlreadyRegistered } from "../errors.ts";
+import { passwordSchema } from "../password-policy.ts";
 // kumiko-lint-ignore cross-feature-import provisioning needs cross-feature seeding helpers
-import { INITIAL_SIGNUP_ROLES, provisionSignupAccount } from "../seeding.js";
+import { INITIAL_SIGNUP_ROLES, provisionSignupAccount } from "../seeding.ts";
 import {
   burnSignupToken,
   deleteSignupHandover,
@@ -57,8 +57,8 @@ import {
   getEmailForSignupToken,
   getSignupHandover,
   unburnSignupToken,
-} from "../signup-token-store.js";
-import { gateEnforceMfa, type LoginHandlerOptions, type LoginResult } from "./login.write.js";
+} from "../signup-token-store.ts";
+import { gateEnforceMfa, type LoginHandlerOptions, type LoginResult } from "./login.write.ts";
 
 const SignupConfirmSchema = z.object({
   token: z.string().min(8),

package/packages/bundled-features/src/auth-email-password/handlers/signup-request.write.ts

@@ -24,13 +24,13 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { findSignupHandoverProvider, type SignupHandoverBinding } from "../../shared/index.js";
-import { AUTH_EMAIL_PAYLOAD_RATE_LIMITS } from "../email-rate-limits.js";
-import type { AuthMailLocale } from "../email-templates.js";
-import { resolveHandlerMailLocale } from "../magic-link-mail.js";
-import { AUTH_SELF_REGISTRATION_FEATURE } from "../self-registration-toggle.js";
-import { issueSignupActivation } from "../signup-activation.js";
-import { storeSignupHandover, takeOverSignupHandoverForResend } from "../signup-token-store.js";
+import { findSignupHandoverProvider, type SignupHandoverBinding } from "../../shared/index.ts";
+import { AUTH_EMAIL_PAYLOAD_RATE_LIMITS } from "../email-rate-limits.ts";
+import type { AuthMailLocale } from "../email-templates.ts";
+import { resolveHandlerMailLocale } from "../magic-link-mail.ts";
+import { AUTH_SELF_REGISTRATION_FEATURE } from "../self-registration-toggle.ts";
+import { issueSignupActivation } from "../signup-activation.ts";
+import { storeSignupHandover, takeOverSignupHandoverForResend } from "../signup-token-store.ts";
 
 const SignupRequestSchema = z.object({
   email: z.email(),

package/packages/bundled-features/src/auth-email-password/handlers/switch-tenant-mfa-gate.write.ts

@@ -7,10 +7,10 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
-import { UserQueries } from "../../user/index.js";
-import { parseAuthUserRow } from "../auth-user-row.js";
-import { noMembership } from "../errors.js";
-import { gateEnforceMfa, type LoginHandlerOptions } from "./login.write.js";
+import { UserQueries } from "../../user/index.ts";
+import { parseAuthUserRow } from "../auth-user-row.ts";
+import { noMembership } from "../errors.ts";
+import { gateEnforceMfa, type LoginHandlerOptions } from "./login.write.ts";
 
 const SwitchTenantMfaGateSchema = z.object({
   userId: z.string().min(1),

package/packages/bundled-features/src/auth-email-password/handlers/token-request-handler.ts

@@ -17,11 +17,11 @@ import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { UserQueries } from "../../user/index.js";
-import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row.js";
-import { AUTH_EMAIL_PAYLOAD_RATE_LIMITS } from "../email-rate-limits.js";
-import type { AuthMailLocale } from "../email-templates.js";
-import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
+import { UserQueries } from "../../user/index.ts";
+import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row.ts";
+import { AUTH_EMAIL_PAYLOAD_RATE_LIMITS } from "../email-rate-limits.ts";
+import type { AuthMailLocale } from "../email-templates.ts";
+import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.ts";
 
 const RequestTokenSchema = z.object({
   email: z.email(),

package/packages/bundled-features/src/auth-email-password/handlers/verify-email.write.ts

@@ -1,10 +1,10 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { AuthErrors } from "../constants.js";
-import { invalidVerificationToken } from "../errors.js";
-import { verifyVerificationToken } from "../verification-token.js";
-import { runConfirmTokenFlow } from "./confirm-token-flow.js";
+import { AuthErrors } from "../constants.ts";
+import { invalidVerificationToken } from "../errors.ts";
+import { verifyVerificationToken } from "../verification-token.ts";
+import { runConfirmTokenFlow } from "./confirm-token-flow.ts";
 
 export type VerifyEmailOptions = {
   readonly hmacSecret: string;