@cosmicdrift/kumiko-samples 0.369.0 → 0.371.0

package/packages/bundled-features/src/auth-mfa/handlers/enable-start.write.ts

@@ -1,14 +1,14 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { UserQueries } from "../../user/index.js";
-import { base32Encode } from "../base32.js";
-import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants.js";
-import { findUserMfaRow } from "../db/queries.js";
-import { mfaAlreadyEnabled } from "../errors.js";
-import { signMfaSetupToken } from "../mfa-setup-token.js";
-import { buildOtpauthUri } from "../otpauth-uri.js";
-import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes.js";
-import { generateTotpSecret } from "../totp.js";
+import { UserQueries } from "../../user/index.ts";
+import { base32Encode } from "../base32.ts";
+import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants.ts";
+import { findUserMfaRow } from "../db/queries.ts";
+import { mfaAlreadyEnabled } from "../errors.ts";
+import { signMfaSetupToken } from "../mfa-setup-token.ts";
+import { buildOtpauthUri } from "../otpauth-uri.ts";
+import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes.ts";
+import { generateTotpSecret } from "../totp.ts";
 
 export type EnableStartOptions = {
   readonly setupTokenSecret: string;

package/packages/bundled-features/src/auth-mfa/handlers/reencrypt.job.ts

@@ -43,8 +43,8 @@ import {
   type ChunkedMigrationStopReason,
   classifyStoredEnvelope,
   runChunkedMigration,
-} from "../../shared/index.js";
-import { userMfaEntity, userMfaTable } from "../schema/user-mfa.js";
+} from "../../shared/index.ts";
+import { userMfaEntity, userMfaTable } from "../schema/user-mfa.ts";
 
 const DEFAULT_BATCH_SIZE = 100;
 const DEFAULT_MAX_FAILURES = 10;

package/packages/bundled-features/src/auth-mfa/handlers/regenerate-recovery.write.ts

@@ -2,11 +2,11 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { findUserMfaRow } from "../db/queries.js";
-import { invalidTotpCode, mfaNotEnabled } from "../errors.js";
-import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes.js";
-import { encodeRecoveryCodes, userMfaEntity, userMfaTable } from "../schema/user-mfa.js";
-import { verifyMfaFactor } from "../verify-factor.js";
+import { findUserMfaRow } from "../db/queries.ts";
+import { invalidTotpCode, mfaNotEnabled } from "../errors.ts";
+import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes.ts";
+import { encodeRecoveryCodes, userMfaEntity, userMfaTable } from "../schema/user-mfa.ts";
+import { verifyMfaFactor } from "../verify-factor.ts";
 
 export type RegenerateRecoveryOptions = {
   readonly revokeAllOtherSessions?: (

package/packages/bundled-features/src/auth-mfa/handlers/status.query.ts

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { userMfaTable } from "../schema/user-mfa.js";
+import { userMfaTable } from "../schema/user-mfa.ts";
 
 // "Is MFA enabled for me" — the one thing a settings screen needs before it
 // can decide whether to show the enrollment flow or the disable/regenerate

package/packages/bundled-features/src/auth-mfa/handlers/verify.write.ts

@@ -8,19 +8,19 @@ import {
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
-import { burnToken, sessionLocaleField, sessionTimezoneField } from "../../shared/index.js";
-import { USER_STATUS, UserQueries } from "../../user/index.js";
-import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../constants.js";
-import { findUserMfaRow } from "../db/queries.js";
-import { invalidChallengeToken, invalidTotpCode, tooManyAttempts } from "../errors.js";
-import { verifyMfaChallengeToken } from "../mfa-challenge-token.js";
+import { burnToken, sessionLocaleField, sessionTimezoneField } from "../../shared/index.ts";
+import { USER_STATUS, UserQueries } from "../../user/index.ts";
+import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../constants.ts";
+import { findUserMfaRow } from "../db/queries.ts";
+import { invalidChallengeToken, invalidTotpCode, tooManyAttempts } from "../errors.ts";
+import { verifyMfaChallengeToken } from "../mfa-challenge-token.ts";
 import {
   clearMfaVerifyAttempts,
   getMfaVerifyLockoutState,
   recordFailedMfaVerifyAttempt,
-} from "../mfa-verify-attempts.js";
-import { encodeRecoveryCodes, userMfaEntity, userMfaTable } from "../schema/user-mfa.js";
-import { verifyMfaFactor } from "../verify-factor.js";
+} from "../mfa-verify-attempts.ts";
+import { encodeRecoveryCodes, userMfaEntity, userMfaTable } from "../schema/user-mfa.ts";
+import { verifyMfaFactor } from "../verify-factor.ts";
 
 export type MfaVerifyOptions = {
   // Must match the secret the login handler signs mfa-challenge tokens

package/packages/bundled-features/src/auth-mfa/index.ts

@@ -1,5 +1,5 @@
-export { base32Decode } from "./base32.js";
-export { type MfaRequiredPolicy, mfaRequiredConfigHandle } from "./config.js";
+export { base32Decode } from "./base32.ts";
+export { type MfaRequiredPolicy, mfaRequiredConfigHandle } from "./config.ts";
 export {
   AUTH_MFA_FEATURE,
   AuthMfaHandlers,
@@ -7,24 +7,29 @@ export {
   MFA_DISABLE_SCREEN_ID,
   MFA_ENABLE_SCREEN_ID,
   MFA_REGENERATE_RECOVERY_SCREEN_ID,
-} from "./constants.js";
+} from "./constants.ts";
+export { authMfaEnvSchema, mfaTokenSecretsEnvSchema } from "./env.ts";
+export type { AuthMfaFeatureOptions } from "./feature.ts";
+export { createAuthMfaFeature } from "./feature.ts";
 export type {
-  AuthMfaFeatureOptions,
   BindMfaRevokeAllOtherSessions,
+  BindMfaTokenSecrets,
   BindRevokeAllPatTokens,
-} from "./feature.js";
+} from "./feature-exports.ts";
 export {
   bindMfaRevokeAllOtherSessionsFromFeature,
+  bindMfaTokenSecretsFromFeature,
   bindRevokeAllPatTokensFromFeature,
-  createAuthMfaFeature,
   mfaStatusCheckerFromFeature,
   mfaVerifierFromFeature,
-} from "./feature.js";
-export type { MfaCodeVerifier, MfaCodeVerifyResult } from "./mfa-code-verifier.js";
-export type { MfaStatusChecker, MfaStatusCheckResult } from "./mfa-status-checker.js";
-export { userMfaEntity, userMfaTable } from "./schema/user-mfa.js";
+} from "./feature-exports.ts";
+export type { MfaCodeVerifier, MfaCodeVerifyResult } from "./mfa-code-verifier.ts";
+export type { MfaStatusChecker, MfaStatusCheckResult } from "./mfa-status-checker.ts";
+export { userMfaEntity, userMfaTable } from "./schema/user-mfa.ts";
 export {
   type MfaTokenSecretOverrides,
+  type MfaTokenSecretsEnv,
   type ResolvedMfaTokenSecrets,
   resolveMfaTokenSecrets,
-} from "./token-secrets.js";
+  resolveMfaTokenSecretsFromEnv,
+} from "./token-secrets.ts";

package/packages/bundled-features/src/auth-mfa/mfa-challenge-token.ts

@@ -1,7 +1,7 @@
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
-import { createHmacTokenCodec, type HmacTokenVerifyResult } from "./hmac-token-codec.js";
+import { createHmacTokenCodec, type HmacTokenVerifyResult } from "./hmac-token-codec.ts";
 
 export type MfaChallengePayload = {
   readonly userId: string;

package/packages/bundled-features/src/auth-mfa/mfa-code-verifier.ts

@@ -4,8 +4,8 @@ import {
   type HandlerContext,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { findUserMfaRow } from "./db/queries.js";
-import { verifyMfaFactor } from "./verify-factor.js";
+import { findUserMfaRow } from "./db/queries.ts";
+import { verifyMfaFactor } from "./verify-factor.ts";
 
 export type MfaCodeVerifyResult = { readonly enrolled: boolean; readonly ok: boolean };
 

package/packages/bundled-features/src/auth-mfa/mfa-preauth-setup-token.ts

@@ -1,7 +1,7 @@
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
-import { createHmacTokenCodec, type HmacTokenVerifyResult } from "./hmac-token-codec.js";
+import { createHmacTokenCodec, type HmacTokenVerifyResult } from "./hmac-token-codec.ts";
 
 export type MfaPreauthSetupPayload = {
   readonly userId: string;

package/packages/bundled-features/src/auth-mfa/mfa-status-checker.ts

@@ -6,14 +6,14 @@ import {
   type SessionUser,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { type MfaRequiredPolicy, mfaRequiredConfigHandle, mfaRequiredConfigKey } from "./config.js";
+import { type MfaRequiredPolicy, mfaRequiredConfigHandle, mfaRequiredConfigKey } from "./config.ts";
 import {
   MFA_CHALLENGE_TOKEN_TTL_MINUTES,
   MFA_PREAUTH_SETUP_TOKEN_TTL_MINUTES,
-} from "./constants.js";
-import { findUserMfaRow } from "./db/queries.js";
-import { signMfaChallengeToken } from "./mfa-challenge-token.js";
-import { signMfaPreauthSetupToken } from "./mfa-preauth-setup-token.js";
+} from "./constants.ts";
+import { findUserMfaRow } from "./db/queries.ts";
+import { signMfaChallengeToken } from "./mfa-challenge-token.ts";
+import { signMfaPreauthSetupToken } from "./mfa-preauth-setup-token.ts";
 
 export type MfaStatusCheckResult =
   | { readonly required: false }

package/packages/bundled-features/src/auth-mfa/mfa-verify-attempts.ts

@@ -18,7 +18,7 @@
 // semantics) live in shared/lockout-counter.ts — this file only wires the
 // mfa-verify key prefixes onto it.
 
-import { createLockoutCounter, type LockoutCounterState } from "../shared/index.js";
+import { createLockoutCounter, type LockoutCounterState } from "../shared/index.ts";
 
 export type MfaVerifyLockoutState = LockoutCounterState;
 

package/packages/bundled-features/src/auth-mfa/otpauth-uri.ts

@@ -1,4 +1,4 @@
-import { base32Encode } from "./base32.js";
+import { base32Encode } from "./base32.ts";
 
 // otpauth:// URI per Google Authenticator's key-uri-format (the de facto
 // standard every authenticator app implements). The client renders this as

package/packages/bundled-features/src/auth-mfa/recovery-codes.ts

@@ -1,5 +1,5 @@
 import { randomInt } from "node:crypto";
-import { hashPassword, verifyPassword } from "../shared/index.js";
+import { hashPassword, verifyPassword } from "../shared/index.ts";
 
 const RECOVERY_CODE_COUNT = 8;
 // No ambiguous chars (0/O, 1/I) — these get read aloud or copy-typed from a

package/packages/bundled-features/src/auth-mfa/screens.ts

@@ -8,7 +8,7 @@ import {
   MFA_DISABLE_SCREEN_ID,
   MFA_ENABLE_SCREEN_ID,
   MFA_REGENERATE_RECOVERY_SCREEN_ID,
-} from "./constants.js";
+} from "./constants.ts";
 
 // Declarative TOTP-enrollment screen: mint (no input) -> reveal QR/secret/
 // recovery-codes -> confirm with a 6-digit code. `setupToken` is carried

package/packages/bundled-features/src/auth-mfa/testing.ts

@@ -2,4 +2,4 @@
 // derives a code from the raw secret; the authenticator app does that).
 // Kept out of the main "./auth-mfa" barrel so consumers don't see a
 // server-side "valid code now" generator in autocomplete.
-export { currentTotpCode } from "./totp.js";
+export { currentTotpCode } from "./totp.ts";

package/packages/bundled-features/src/auth-mfa/token-secrets.ts

@@ -39,3 +39,29 @@ export function resolveMfaTokenSecrets(
     ),
   };
 }
+
+export type MfaTokenSecretsEnv = {
+  readonly MFA_SETUP_TOKEN_SECRET?: string | undefined;
+  readonly MFA_CHALLENGE_TOKEN_SECRET?: string | undefined;
+};
+
+function nonBlank(value: string | undefined): string | undefined {
+  return value !== undefined && value.trim() !== "" ? value : undefined;
+}
+
+/** Precedence per secret: explicit option, then `MFA_*_TOKEN_SECRET` from
+ *  env, then derivation from `masterSecret`. Blank values count as absent. */
+export function resolveMfaTokenSecretsFromEnv(
+  masterSecret: string,
+  env: MfaTokenSecretsEnv,
+  explicit: MfaTokenSecretOverrides = {},
+): ResolvedMfaTokenSecrets {
+  const setupTokenSecret =
+    nonBlank(explicit.setupTokenSecret) ?? nonBlank(env.MFA_SETUP_TOKEN_SECRET);
+  const challengeTokenSecret =
+    nonBlank(explicit.challengeTokenSecret) ?? nonBlank(env.MFA_CHALLENGE_TOKEN_SECRET);
+  return resolveMfaTokenSecrets(masterSecret, {
+    ...(setupTokenSecret !== undefined && { setupTokenSecret }),
+    ...(challengeTokenSecret !== undefined && { challengeTokenSecret }),
+  });
+}

package/packages/bundled-features/src/auth-mfa/verify-factor.ts

@@ -1,9 +1,9 @@
 import type { Redis } from "ioredis";
-import { burnToken } from "../shared/index.js";
-import { base32Decode } from "./base32.js";
-import type { UserMfaRow } from "./db/queries.js";
-import { findMatchingRecoveryCodeIndex } from "./recovery-codes.js";
-import { STEP_SECONDS, verifyTotp } from "./totp.js";
+import { burnToken } from "../shared/index.ts";
+import { base32Decode } from "./base32.ts";
+import type { UserMfaRow } from "./db/queries.ts";
+import { findMatchingRecoveryCodeIndex } from "./recovery-codes.ts";
+import { STEP_SECONDS, verifyTotp } from "./totp.ts";
 
 export type MfaFactorVerifyResult =
   | { readonly ok: true; readonly method: "totp" }

package/packages/bundled-features/src/auth-mfa/web/client-plugin.ts

@@ -10,7 +10,7 @@
 
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ComponentType, ReactNode } from "react";
-import { defaultTranslations, mergeTranslations } from "./i18n.js";
+import { defaultTranslations, mergeTranslations } from "./i18n.ts";
 
 export type AuthMfaClientOptions = {
   /** Key-Overrides pro Locale, gemerged mit den Default-Bundles (de/en). */

package/packages/bundled-features/src/auth-mfa/web/index.ts

@@ -4,22 +4,22 @@
 // (defineFeature) bleibt frei von React-/DOM-Deps, siehe auth-email-
 // password/web/index.ts für die selbe Trennung.
 
-export type { AuthMfaClientFeature, AuthMfaClientOptions } from "./client-plugin.js";
-export { authMfaClient } from "./client-plugin.js";
-export { defaultTranslations, mergeTranslations } from "./i18n.js";
+export type { AuthMfaClientFeature, AuthMfaClientOptions } from "./client-plugin.ts";
+export { authMfaClient } from "./client-plugin.ts";
+export { defaultTranslations, mergeTranslations } from "./i18n.ts";
 export type {
   MfaSetupPreauthStart,
   MfaSetupPreauthStartResult,
   MfaVerifyResult,
-} from "./mfa-client.js";
-export { confirmMfaSetupPreauth, startMfaSetupPreauth, verifyMfaChallenge } from "./mfa-client.js";
-export type { MfaDisableDialogProps } from "./mfa-disable-dialog.js";
-export { MfaDisableDialog } from "./mfa-disable-dialog.js";
-export type { MfaRecoveryCodesRevealProps } from "./mfa-recovery-codes-reveal.js";
-export { MfaRecoveryCodesReveal } from "./mfa-recovery-codes-reveal.js";
-export type { MfaRegenerateRecoveryDialogProps } from "./mfa-regenerate-recovery-dialog.js";
-export { MfaRegenerateRecoveryDialog } from "./mfa-regenerate-recovery-dialog.js";
-export type { MfaSetupPreauthScreenProps } from "./mfa-setup-preauth-screen.js";
-export { MfaSetupPreauthScreen } from "./mfa-setup-preauth-screen.js";
-export type { MfaVerifyScreenProps } from "./mfa-verify-screen.js";
-export { MfaVerifyScreen } from "./mfa-verify-screen.js";
+} from "./mfa-client.ts";
+export { confirmMfaSetupPreauth, startMfaSetupPreauth, verifyMfaChallenge } from "./mfa-client.ts";
+export type { MfaDisableDialogProps } from "./mfa-disable-dialog.tsx";
+export { MfaDisableDialog } from "./mfa-disable-dialog.tsx";
+export type { MfaRecoveryCodesRevealProps } from "./mfa-recovery-codes-reveal.tsx";
+export { MfaRecoveryCodesReveal } from "./mfa-recovery-codes-reveal.tsx";
+export type { MfaRegenerateRecoveryDialogProps } from "./mfa-regenerate-recovery-dialog.tsx";
+export { MfaRegenerateRecoveryDialog } from "./mfa-regenerate-recovery-dialog.tsx";
+export type { MfaSetupPreauthScreenProps } from "./mfa-setup-preauth-screen.tsx";
+export { MfaSetupPreauthScreen } from "./mfa-setup-preauth-screen.tsx";
+export type { MfaVerifyScreenProps } from "./mfa-verify-screen.tsx";
+export { MfaVerifyScreen } from "./mfa-verify-screen.tsx";

package/packages/bundled-features/src/auth-mfa/web/mfa-client.ts

@@ -12,7 +12,7 @@ import {
   type LoginFailure,
   type LoginResponse,
   toLoginResponse,
-} from "../../auth-email-password/web/index.js";
+} from "../../auth-email-password/web/index.ts";
 
 export type MfaVerifyResult =
   | { readonly kind: "success"; readonly data: LoginResponse }

package/packages/bundled-features/src/auth-mfa/web/mfa-disable-dialog.tsx

@@ -12,7 +12,7 @@
 
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
-import { AuthMfaHandlers } from "../constants.js";
+import { AuthMfaHandlers } from "../constants.ts";
 
 export type MfaDisableDialogProps = {
   readonly open: boolean;

package/packages/bundled-features/src/auth-mfa/web/mfa-regenerate-recovery-dialog.tsx

@@ -9,7 +9,7 @@
 
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
-import { AuthMfaHandlers } from "../constants.js";
+import { AuthMfaHandlers } from "../constants.ts";
 
 export type MfaRegenerateRecoveryDialogProps = {
   readonly open: boolean;

package/packages/bundled-features/src/auth-mfa/web/mfa-setup-preauth-screen.tsx

@@ -22,8 +22,8 @@ import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import QRCode from "qrcode/lib/browser.js";
 import { type FormEvent, type ReactNode, useState } from "react";
 // kumiko-lint-ignore cross-feature-import client-only component, the feature's server barrel has no web/ re-export
-import { AuthCard } from "../../auth-email-password/web/index.js";
-import { confirmMfaSetupPreauth, startMfaSetupPreauth } from "./mfa-client.js";
+import { AuthCard } from "../../auth-email-password/web/index.ts";
+import { confirmMfaSetupPreauth, startMfaSetupPreauth } from "./mfa-client.ts";
 
 type SetupState = {
   readonly setupToken: string;

package/packages/bundled-features/src/auth-mfa/web/mfa-verify-screen.tsx

@@ -9,8 +9,8 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 // kumiko-lint-ignore cross-feature-import client-only barrel, the feature's server barrel has no web/ re-export
-import { AuthCard, useSession } from "../../auth-email-password/web/index.js";
-import { verifyMfaChallenge } from "./mfa-client.js";
+import { AuthCard, useSession } from "../../auth-email-password/web/index.ts";
+import { verifyMfaChallenge } from "./mfa-client.ts";
 
 export type MfaVerifyScreenProps = {
   readonly challengeToken: string;

package/packages/bundled-features/src/auth-mfa-user-data/changes.json

@@ -1 +1,10 @@
-[]
+[
+  {
+    "version": "0.370.0",
+    "type": "breaking",
+    "title": "The deprecated authMfaUserDataFeature constant is removed",
+    "detail": "authMfaUserDataFeature was kept next to createAuthMfaUserDataFeature() for one release. Mount the feature by calling createAuthMfaUserDataFeature().",
+    "migration": "Run bun kumiko-upgrade --apply. It replaces authMfaUserDataFeature with createAuthMfaUserDataFeature().",
+    "codemod": "scripts/codemod/feature-factory.ts"
+  }
+]

package/packages/bundled-features/src/auth-mfa-user-data/hooks.ts

@@ -13,8 +13,8 @@ import {
   type UserDataDeleteHook,
   type UserDataExportHook,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { userMfaEntity, userMfaTable } from "../auth-mfa/index.js";
-import { collectErasureFailure, throwIfErasureFailed } from "../shared/index.js";
+import { userMfaEntity, userMfaTable } from "../auth-mfa/index.ts";
+import { collectErasureFailure, throwIfErasureFailed } from "../shared/index.ts";
 
 const executor = createEventStoreExecutor(userMfaTable, userMfaEntity, {
   entityName: "user-mfa",

package/packages/bundled-features/src/auth-mfa-user-data/index.ts

@@ -6,7 +6,7 @@
 // Mirrors folders-user-data.
 
 import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
-import { userMfaDeleteHook, userMfaExportHook } from "./hooks.js";
+import { userMfaDeleteHook, userMfaExportHook } from "./hooks.ts";
 
 export function createAuthMfaUserDataFeature() {
   return defineFeature(
@@ -25,6 +25,3 @@ export function createAuthMfaUserDataFeature() {
     { dedupeOptions: {} },
   );
 }
-
-/** @deprecated Use createAuthMfaUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const authMfaUserDataFeature = createAuthMfaUserDataFeature();

package/packages/bundled-features/src/billing-foundation/billing-info-query.ts

@@ -18,9 +18,9 @@ import type { HandlerContext, TenantId } from "@cosmicdrift/kumiko-framework/eng
 import { QnTypes, qn, SYSTEM_TENANT_ID, toKebab } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import SUBSCRIPTION_STRIPE_FEATURE is a plain string const in constants.ts (no imports); the barrel import (../subscription-stripe) would create a module cycle with billing-foundation via feature.ts → verify-webhook.ts, because billing-foundation/index.ts now re-exports billing-info-query.ts.
-import { SUBSCRIPTION_STRIPE_FEATURE } from "../subscription-stripe/constants.js";
-import { subscriptionAggregateId } from "./aggregate-id.js";
-import { subscriptionsProjectionTable } from "./projection.js";
+import { SUBSCRIPTION_STRIPE_FEATURE } from "../subscription-stripe/constants.ts";
+import { subscriptionAggregateId } from "./aggregate-id.ts";
+import { subscriptionsProjectionTable } from "./projection.ts";
 
 // subscription-stripe addresses its credentials + the live flag as config
 // keys (api-key via backing:"secrets" in the secrets store, billingLive

package/packages/bundled-features/src/billing-foundation/changes.json

@@ -1,4 +1,18 @@
 [
+  {
+    "version": "0.371.0",
+    "type": "improvement",
+    "title": "Billing webhook sync exposes afterSync",
+    "detail": "The billing webhook sync calls afterSync({ tenantId, tier, changed, event }) after every webhook, with changed false when the tier stayed the same."
+  },
+  {
+    "version": "0.370.0",
+    "type": "breaking",
+    "title": "The deprecated billingFoundationFeature constant is removed",
+    "detail": "billingFoundationFeature was kept next to createBillingFoundationFeature() for one release. Mount the feature by calling createBillingFoundationFeature().",
+    "migration": "Run bun kumiko-upgrade --apply. It replaces billingFoundationFeature with createBillingFoundationFeature().",
+    "codemod": "scripts/codemod/feature-factory.ts"
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/packages/bundled-features/src/billing-foundation/checkout-core.ts

@@ -15,9 +15,9 @@ import {
   BILLING_FOUNDATION_FEATURE,
   isSubscriptionBlockingCheckout,
   SUBSCRIPTION_PROVIDER_EXTENSION,
-} from "./constants.js";
-import { getSubscriptionForTenant } from "./get-subscription-for-tenant.js";
-import type { BillingPlanCatalog, SubscriptionProviderPlugin } from "./types.js";
+} from "./constants.ts";
+import { getSubscriptionForTenant } from "./get-subscription-for-tenant.ts";
+import type { BillingPlanCatalog, SubscriptionProviderPlugin } from "./types.ts";
 
 /** Narrows a `readonly string[]` to the non-empty tuple shape `z.enum`
  *  needs. Callers only reach this with a catalog's `plans` — the feature

package/packages/bundled-features/src/billing-foundation/consumer-protection/confirmation-mail.ts

@@ -4,9 +4,9 @@ import { Marked } from "marked";
 import {
   isAllowedDocumentLinkHref,
   isDocumentPlaceholderHref,
-} from "../../template-resolver/index.js";
-import type { CheckoutConsentRecordedPayload } from "../events.js";
-import { type ConsentLocale, resolveConsentLocale } from "./consent-text.js";
+} from "../../template-resolver/index.ts";
+import type { CheckoutConsentRecordedPayload } from "../events.ts";
+import { type ConsentLocale, resolveConsentLocale } from "./consent-text.ts";
 
 // Inline de/en like the consent texts: the confirmation repeats the legal
 // wording the buyer agreed to, so it cannot follow the en-only i18n convention.

package/packages/bundled-features/src/billing-foundation/consumer-protection/consent-gate.ts

@@ -10,17 +10,17 @@ import {
   requireTemplateResolver,
   TEXT_BLOCK_KIND,
   TemplateNotFoundError,
-} from "../../template-resolver/index.js";
-import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.js";
+} from "../../template-resolver/index.ts";
+import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.ts";
 import {
   CHECKOUT_CONSENT_RECORDED_EVENT_QN,
   type CheckoutConsentRecordedPayload,
   checkoutConsentRecordedPayloadSchema,
   PAYMENT_AGGREGATE_TYPE,
   SUBSCRIPTION_AGGREGATE_TYPE,
-} from "../events.js";
-import type { ConsumerProtectionOptions, ProviderPrice } from "../types.js";
-import { consentTextVersion, resolveConsentLocale, submitMessageFor } from "./consent-text.js";
+} from "../events.ts";
+import type { ConsumerProtectionOptions, ProviderPrice } from "../types.ts";
+import { consentTextVersion, resolveConsentLocale, submitMessageFor } from "./consent-text.ts";
 
 export type CheckoutMode = "subscription" | "payment";
 

package/packages/bundled-features/src/billing-foundation/consumer-protection/consent-text.ts

@@ -1,12 +1,12 @@
 import { createHash } from "node:crypto";
-import type { ConsentLocale } from "./consent-locale.js";
+import type { ConsentLocale } from "./consent-locale.ts";
 
 export {
   CONSENT_LOCALES,
   type ConsentLocale,
   FALLBACK_CONSENT_LOCALE,
   resolveConsentLocale,
-} from "./consent-locale.js";
+} from "./consent-locale.ts";
 
 // Legal texts, deliberately inline de/en: the wording is part of the recorded
 // consent, so it cannot follow the en-only i18n convention.

package/packages/bundled-features/src/billing-foundation/consumer-protection/issue-confirmation.ts

@@ -12,10 +12,10 @@ import { InternalError, UnprocessableError } from "@cosmicdrift/kumiko-framework
 import { createI18n } from "@cosmicdrift/kumiko-framework/i18n";
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
-import { requireTemplateResolver, TEXT_BLOCK_KIND } from "../../template-resolver/index.js";
-import { UserQueries } from "../../user/index.js";
-import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.js";
-import { CONTRACT_CONFIRMATION_NOTIFICATION_TYPE } from "../constants.js";
+import { requireTemplateResolver, TEXT_BLOCK_KIND } from "../../template-resolver/index.ts";
+import { UserQueries } from "../../user/index.ts";
+import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.ts";
+import { CONTRACT_CONFIRMATION_NOTIFICATION_TYPE } from "../constants.ts";
 import {
   CHECKOUT_CONSENT_RECORDED_EVENT_QN,
   type CheckoutConsentRecordedPayload,
@@ -25,10 +25,10 @@ import {
   contractConfirmationIssuedPayloadSchema,
   PAYMENT_AGGREGATE_TYPE,
   SUBSCRIPTION_AGGREGATE_TYPE,
-} from "../events.js";
-import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.js";
-import { contractConfirmationVariables } from "./confirmation-mail.js";
-import { resolveConsentLocale } from "./consent-text.js";
+} from "../events.ts";
+import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.ts";
+import { contractConfirmationVariables } from "./confirmation-mail.ts";
+import { resolveConsentLocale } from "./consent-text.ts";
 
 export const issueContractConfirmationSchema = z
   .object({

package/packages/bundled-features/src/billing-foundation/consumer-protection/mail-notifications.ts

@@ -4,10 +4,10 @@ import {
   type TemplateVariables,
   templateVariable,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { mailHeading, mailParagraph, mailRepeatedRows } from "../../shared/index.js";
-import { CONFIRMATION_LABELS } from "./confirmation-mail.js";
-import { CONSENT_LOCALES, CONSENT_TEXTS, type ConsentLocale } from "./consent-text.js";
-import { TERMINATION_TEXTS } from "./termination-texts.js";
+import { mailHeading, mailParagraph, mailRepeatedRows } from "../../shared/index.ts";
+import { CONFIRMATION_LABELS } from "./confirmation-mail.ts";
+import { CONSENT_LOCALES, CONSENT_TEXTS, type ConsentLocale } from "./consent-text.ts";
+import { TERMINATION_TEXTS } from "./termination-texts.ts";
 
 // Slot syntax for the translated texts: `{name}` becomes a template variable.
 const OPERATOR_EMAIL_SLOT = "{operatorEmail}";

package/packages/bundled-features/src/billing-foundation/consumer-protection/register-consent.ts

@@ -1,6 +1,6 @@
 import type { FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
-import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.js";
-import { SubscriptionFoundationHandlers, SubscriptionStatuses } from "../constants.js";
+import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.ts";
+import { SubscriptionFoundationHandlers, SubscriptionStatuses } from "../constants.ts";
 import {
   CHECKOUT_CONSENT_RECORDED_EVENT_SHORT,
   CONTRACT_CONFIRMATION_ISSUED_EVENT_SHORT,
@@ -10,11 +10,11 @@ import {
   PAYMENT_RECEIVED_EVENT_QN,
   SUBSCRIPTION_CREATED_EVENT_QN,
   SUBSCRIPTION_UPDATED_EVENT_QN,
-} from "../events.js";
-import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.js";
-import { createIssueContractConfirmationHandler } from "./issue-confirmation.js";
-import { registerConsumerProtectionMails } from "./mail-notifications.js";
-import { registerContractTermination } from "./register-termination.js";
+} from "../events.ts";
+import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.ts";
+import { createIssueContractConfirmationHandler } from "./issue-confirmation.ts";
+import { registerConsumerProtectionMails } from "./mail-notifications.ts";
+import { registerContractTermination } from "./register-termination.ts";
 
 type ConfirmationTrigger = {
   readonly eventQn: string;