ddd-ts-kit 0.1.0 → 0.2.0

package/templates/pipeline/github/scripts/start-postgres.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+# Starts the PostgreSQL the specs run against and waits until it accepts connections.
+# A `services:` container is pulled once, before the job, and one refusal of a registry fails
+# the run (a public mirror answered "toomanyrequests" once): here the image is pulled with
+# retries, from the next registry when one refuses.
+set -eu
+
+IMAGE="${POSTGRES_IMAGE:-postgres:18}"
+REGISTRIES="${POSTGRES_REGISTRIES:-mirror.gcr.io/library public.ecr.aws/docker/library docker.io/library}"
+
+pulled=""
+
+for attempt in 1 2 3; do
+  for registry in $REGISTRIES; do
+    if docker pull --quiet "$registry/$IMAGE"; then
+      pulled="$registry/$IMAGE"
+      break 2
+    fi
+
+    echo "Pulling $registry/$IMAGE failed (attempt $attempt)."
+  done
+
+  sleep $((attempt * 5))
+done
+
+if [ -z "$pulled" ]; then
+  echo "No registry served $IMAGE." >&2
+  exit 1
+fi
+
+docker run --detach --name postgres --publish 5432:5432 \
+  --env POSTGRES_USER=app --env POSTGRES_PASSWORD=app --env POSTGRES_DB=app \
+  --health-cmd "pg_isready -U app -d app" --health-interval 2s --health-timeout 3s --health-retries 30 \
+  "$pulled" > /dev/null
+
+for second in $(seq 1 60); do
+  if [ "$(docker inspect --format '{{.State.Health.Status}}' postgres)" = "healthy" ]; then
+    echo "PostgreSQL is ready ($pulled, ${second}s)."
+    exit 0
+  fi
+
+  sleep 1
+done
+
+docker logs postgres >&2
+echo "PostgreSQL did not become healthy." >&2
+exit 1

package/templates/pipeline/github/workflows/ci.yml

@@ -4,29 +4,39 @@ on:
   push:
     branches: [main]
   pull_request:
+  schedule:
+    # Every night, everything: a pull request runs the specs of the contexts its change reaches.
+    - cron: '0 3 * * *'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  # A newer commit of a pull request supersedes the run in progress; the default branch finishes every run.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read
 
-env:
-  NODE_VERSION: 24
-
 jobs:
   install:
     name: Install
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    outputs:
+      scope: ${{ steps.affected.outputs.scope }}
+      contexts: ${{ steps.affected.outputs.contexts }}
+      args: ${{ steps.affected.outputs.args }}
+      lint: ${{ steps.affected.outputs.lint }}
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
         with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-      - run: npm ci
+          # A pull request is checked out as its merge commit, whose first parent is the base it is compared with.
+          fetch-depth: 2
+      - uses: ./.github/actions/setup
+      - name: What this run covers (everything on the default branch and at night, the affected contexts on a pull request)
+        id: affected
+        env:
+          BASE: ${{ github.event_name == 'pull_request' && 'HEAD^1' || '' }}
+        run: npx --no -- ddd-ts-kit affected --base "$BASE" --format github | tee -a "$GITHUB_OUTPUT"
 
   typecheck:
     name: Typecheck
@@ -35,11 +45,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-      - run: npm ci
+      - uses: ./.github/actions/setup
       - run: npm run ci:typecheck
 
   lint:
@@ -49,13 +55,12 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-      - run: npm ci
+      - uses: ./.github/actions/setup
       - run: npm run ci:format
-      - run: npm run ci:lint
+      - name: Lint (the contexts a pull request does not reach are left to the default branch)
+        env:
+          LINT: ${{ needs.install.outputs.lint }}
+        run: npm run ci:lint -- $LINT
 
   architecture:
     name: Architecture
@@ -64,11 +69,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-      - run: npm ci
+      - uses: ./.github/actions/setup
       - name: Architecture rules
         run: npm run ci:arch:check -- --format github
       - name: Dependency graph
@@ -81,26 +82,23 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-      - run: npm ci
+      - uses: ./.github/actions/setup
       - run: npm run ci:deadcode
 
   unit:
     name: Unit tests
-    needs: [typecheck, lint, architecture, deadcode]
+    needs: install
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-      - run: npm ci
-      - run: npm run ci:test:unit
+      - uses: ./.github/actions/setup
+      - name: Unit specs, each context held to its coverage thresholds
+        if: ${{ needs.install.outputs.scope != 'none' }}
+        env:
+          DDD_TS_KIT_AFFECTED: ${{ needs.install.outputs.contexts }}
+          PARTIAL: ${{ needs.install.outputs.args }}
+        run: npm run ci:test:unit -- $PARTIAL
       - uses: actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
@@ -111,79 +109,57 @@ jobs:
 
   integration:
     name: Integration tests
-    needs: unit
+    needs: install
     runs-on: ubuntu-latest
     timeout-minutes: 20
     env:
       DATABASE_URL: postgres://app:app@localhost:5432/app
-    services:
-      postgres:
-        image: public.ecr.aws/docker/library/postgres:18
-        env:
-          POSTGRES_USER: app
-          POSTGRES_PASSWORD: app
-          POSTGRES_DB: app
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U app -d app"
-          --health-interval 2s
-          --health-timeout 3s
-          --health-retries 30
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-      - run: npm ci
-      - run: npm run db:migrate
-      - run: npm run ci:test:integration
+      - uses: ./.github/actions/setup
+      - name: PostgreSQL
+        if: ${{ needs.install.outputs.scope != 'none' }}
+        run: sh .github/scripts/start-postgres.sh
+      - if: ${{ needs.install.outputs.scope != 'none' }}
+        run: npm run db:migrate
+      - name: Integration specs, each context held to its coverage thresholds
+        if: ${{ needs.install.outputs.scope != 'none' }}
+        env:
+          DDD_TS_KIT_AFFECTED: ${{ needs.install.outputs.contexts }}
+          PARTIAL: ${{ needs.install.outputs.args }}
+        run: npm run ci:test:integration -- $PARTIAL
 
   e2e:
     name: End-to-end tests
-    needs: integration
+    needs: install
     runs-on: ubuntu-latest
     timeout-minutes: 20
     env:
       DATABASE_URL: postgres://app:app@localhost:5432/app
-    services:
-      postgres:
-        image: public.ecr.aws/docker/library/postgres:18
-        env:
-          POSTGRES_USER: app
-          POSTGRES_PASSWORD: app
-          POSTGRES_DB: app
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U app -d app"
-          --health-interval 2s
-          --health-timeout 3s
-          --health-retries 30
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-      - run: npm ci
-      - run: npm run db:migrate
-      - run: npm run ci:test:e2e
+      - uses: ./.github/actions/setup
+      - name: PostgreSQL
+        if: ${{ needs.install.outputs.scope != 'none' }}
+        run: sh .github/scripts/start-postgres.sh
+      - if: ${{ needs.install.outputs.scope != 'none' }}
+        run: npm run db:migrate
+      - name: End-to-end specs (the whole application, whatever the contexts a change reaches)
+        if: ${{ needs.install.outputs.scope != 'none' }}
+        run: npm run ci:test:e2e
 
-  docs:
-    name: Docs and contract drift
-    needs: [typecheck, lint, architecture, deadcode]
+  build:
+    name: Build, docs and contract drift
+    needs: install
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-      - run: npm ci
-      - run: npm run ci:docs
+      - uses: ./.github/actions/setup
+      - name: The production build
+        run: npm run ci:build
+      - name: Generated documents and contracts, from that build
+        run: npm run ci:docs
 
   security:
     name: Security
@@ -194,11 +170,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-      - run: npm ci
+      - uses: ./.github/actions/setup
       - name: Production dependencies audit
         run: npm run ci:audit
       - name: Dependency review
@@ -210,23 +182,9 @@ jobs:
         if: ${{ !cancelled() }}
         run: docker run --rm --volume "$GITHUB_WORKSPACE:/repo" ghcr.io/gitleaks/gitleaks:v8.30.1 git /repo --redact --no-banner
 
-  build:
-    name: Build
-    needs: e2e
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-      - run: npm ci
-      - run: npm run ci:build
-
   image:
     name: Docker image
-    needs: build
+    needs: install
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
@@ -243,7 +201,7 @@ jobs:
   gate:
     name: gate
     if: ${{ always() }}
-    needs: [install, typecheck, lint, architecture, deadcode, unit, integration, e2e, docs, security, build, image]
+    needs: [install, typecheck, lint, architecture, deadcode, unit, integration, e2e, build, security, image]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:

package/templates/pipeline/github/workflows/pr-title.yml

@@ -18,11 +18,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 24
-          cache: npm
-      - run: npm ci
+      - uses: ./.github/actions/setup
       - name: The title is a conventional commit subject
         env:
           TITLE: ${{ github.event.pull_request.title }}

package/templates/pipeline/gitlab/{gitlab-ci.yml → gitlab-ci.yml.tpl}

@@ -4,6 +4,8 @@ workflow:
   rules:
     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    # A pipeline schedule (Build > Pipeline schedules, every night on the default branch) runs everything.
+    - if: $CI_PIPELINE_SOURCE == "schedule"
 
 include:
   - template: Jobs/SAST.gitlab-ci.yml
@@ -14,32 +16,47 @@ include:
 
 stages:
   - install
-  - static
   - test
-  - verify
   - security
-  - package
   - gate
 
 variables:
   AST_ENABLE_MR_PIPELINES: 'true'
   NODE_IMAGE: node:24-bookworm-slim
+  # Behind the dependency proxy of a group, a registry that rate-limits is never asked twice:
+  # POSTGRES_IMAGE: ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/postgres:18
   POSTGRES_IMAGE: postgres:18
 
 default:
+  # A newer commit of a merge request supersedes the pipeline in progress; the default branch finishes every pipeline.
   interruptible: true
-
+  # An image that could not be pulled (a registry that rate-limits once) or a runner that failed is tried again; a failing script is not.
+  retry:
+    max: 2
+    when: [runner_system_failure, stuck_or_timeout_failure, scheduler_failure]
+
+# One install per lockfile, shared by every job and every pipeline. The key holds the lockfile
+# and package.json: a hit is what a fresh install of that lockfile gives. A job that finds no
+# cache installs.
 .node:
   image: $NODE_IMAGE
   cache:
     key:
       files:
         - package-lock.json
+        - package.json
     paths:
-      - .npm/
+      - node_modules/
     policy: pull
   before_script:
-    - npm ci --cache .npm --prefer-offline
+{{#if pm.corepack}}
+    - corepack enable
+{{/if}}
+    - test -d node_modules || npm ci
+{{#if orm.prisma}}
+    # The Prisma client and the schema of the tests are build products of prisma/schema.prisma.
+    - npm run db:client
+{{/if}}
 
 .postgres:
   services:
@@ -61,19 +78,28 @@ default:
 install:
   extends: .node
   stage: install
+  # The image with git: what a merge request covers is read from the difference with its target.
+  image: node:24-bookworm
   cache:
     key:
       files:
         - package-lock.json
+        - package.json
     paths:
-      - .npm/
+      - node_modules/
     policy: pull-push
   script:
-    - node --version && npm --version
+    - node --version
+    - if [ -n "${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}" ]; then git fetch --quiet --depth=1 origin "$CI_MERGE_REQUEST_DIFF_BASE_SHA"; fi
+    # Everything on the default branch and on a schedule, the affected contexts on a merge request.
+    - npx --no -- ddd-ts-kit affected --base "${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}" --format env | tee affected.env
+  artifacts:
+    reports:
+      dotenv: affected.env
 
 merge-request-title:
   extends: .node
-  stage: static
+  stage: test
   needs: [install]
   rules:
     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
@@ -82,21 +108,22 @@ merge-request-title:
 
 typecheck:
   extends: .node
-  stage: static
+  stage: test
   needs: [install]
   script:
     - npm run ci:typecheck
 
 lint:
   extends: .node
-  stage: static
+  stage: test
   needs: [install]
   variables:
     ESLINT_CODE_QUALITY_REPORT: reports/gl-code-quality-eslint.json
   script:
     - mkdir -p reports
     - npm run ci:format
-    - npm run ci:lint -- --format gitlab
+    # The contexts a merge request does not reach are left to the default branch.
+    - npm run ci:lint -- --format gitlab $AFFECTED_LINT
   artifacts:
     when: always
     expire_in: 14 days
@@ -105,7 +132,7 @@ lint:
 
 architecture:
   extends: .node
-  stage: static
+  stage: test
   needs: [install]
   script:
     - mkdir -p reports
@@ -119,7 +146,7 @@ architecture:
 
 deadcode:
   extends: .node
-  stage: static
+  stage: test
   needs: [install]
   script:
     - npm run ci:deadcode
@@ -127,9 +154,11 @@ deadcode:
 unit:
   extends: [.node, .junit]
   stage: test
-  needs: [typecheck, lint, architecture, deadcode]
+  needs: [install]
   script:
-    - npm run ci:test:unit -- --reporter=default --reporter=junit --outputFile.junit=reports/junit.xml
+    - if [ "$AFFECTED_SCOPE" = "none" ]; then echo "Only documents changed, no spec to run."; exit 0; fi
+    - export DDD_TS_KIT_AFFECTED="$AFFECTED_CONTEXTS"
+    - npm run ci:test:unit -- --reporter=default --reporter=junit --outputFile.junit=reports/junit.xml $AFFECTED_ARGS
   coverage: '/All files[^|]*\|[^|]*\s+([\d\.]+)/'
   artifacts:
     when: always
@@ -143,24 +172,30 @@ unit:
 integration:
   extends: [.node, .postgres, .junit]
   stage: test
-  needs: [unit]
+  needs: [install]
   script:
+    - if [ "$AFFECTED_SCOPE" = "none" ]; then echo "Only documents changed, no spec to run."; exit 0; fi
+    - export DDD_TS_KIT_AFFECTED="$AFFECTED_CONTEXTS"
     - npm run db:migrate
-    - npm run ci:test:integration -- --reporter=default --reporter=junit --outputFile.junit=reports/junit.xml
+    - npm run ci:test:integration -- --reporter=default --reporter=junit --outputFile.junit=reports/junit.xml $AFFECTED_ARGS
 
 e2e:
   extends: [.node, .postgres, .junit]
   stage: test
-  needs: [integration]
+  needs: [install]
   script:
+    - if [ "$AFFECTED_SCOPE" = "none" ]; then echo "Only documents changed, no spec to run."; exit 0; fi
     - npm run db:migrate
+    # The whole application, whatever the contexts a change reaches.
     - npm run ci:test:e2e -- --reporter=default --reporter=junit --outputFile.junit=reports/junit.xml
 
-docs:
+build:
   extends: .node
-  stage: verify
-  needs: [typecheck, lint, architecture, deadcode]
+  stage: test
+  needs: [install]
   script:
+    - npm run ci:build
+    # The generated documents and contracts, from that build.
     - npm run ci:docs
 
 audit:
@@ -181,16 +216,9 @@ secrets:
   script:
     - gitleaks git . --redact --no-banner
 
-build:
-  extends: .node
-  stage: package
-  needs: [e2e]
-  script:
-    - npm run ci:build
-
 image:
-  stage: package
-  needs: [build]
+  stage: test
+  needs: []
   image:
     name: moby/buildkit:v0.34.0-rootless
     entrypoint: ['']

package/templates/pipeline/knip.json.tpl

@@ -1,26 +1,25 @@
 {
   "$schema": "https://unpkg.com/knip@6/schema.json",
   "entry": [
-{{#if style.explicit}}
-    "{{config.contextsDir}}/*/*.module.ts",
-{{/if}}
-{{#if assembly.discovery}}
-    "{{config.contextsDir}}/*/{application,infrastructure}/**/*.{{knip.discovered}}.ts",
-{{/if}}
-    "{{config.contextsDir}}/*/published-language/index.ts",
+{{#if tests.jest}}
     "{{config.contextsDir}}/*/test/fakes/*.ts",
+{{/if}}
 {{#if knip.apps}}
     "{{config.sourceRoot}}/apps/*/main.ts",
 {{/if}}
     "scripts/*.ts"{{knip.e2eEntry}}
   ],
   "project": ["{{config.sourceRoot}}/**/*.ts", "scripts/**/*.ts"{{knip.e2eProject}}],
-{{#if ci.gitlab}}
-  "ignoreDependencies": ["eslint-formatter-gitlab"],
+{{#if knip.ignores}}
+  "ignoreDependencies": {{knip.ignored}},
 {{/if}}
   "ignoreExportsUsedInFile": true,
   "vitest": {
     "config": ["vitest.config.ts"{{knip.e2eConfig}}],
-    "entry": ["{{config.sourceRoot}}/**/*.spec.ts", "test/architecture/**/*.spec.ts"{{knip.e2eSpecs}}]
+    "entry": [
+      "{{config.sourceRoot}}/**/*.spec.ts",
+      "{{config.contextsDir}}/*/test/fakes/*.ts",
+      "test/architecture/**/*.spec.ts"{{knip.e2eSpecs}}{{knip.testDatabase}}
+    ]
   }
 }

package/templates/pipeline/package-scripts.json

@@ -23,7 +23,7 @@
     "@biomejs/biome": "2.5.15",
     "@commitlint/cli": "^21.2.3",
     "@commitlint/config-conventional": "^21.2.3",
-    "@ddd-ts-kit/eslint-plugin": "^0.1.0",
+    "@ddd-ts-kit/eslint-plugin": "^0.2.0",
     "@eslint/js": "^10.0.1",
     "@typescript/native": "npm:typescript@~7.0.2",
     "@vitest/coverage-v8": "5.0.3",

package/templates/pipeline/vitest.config.ts.tpl

@@ -1,4 +1,4 @@
-import { governedCoverage } from '@ddd-ts-kit/testing/coverage';
+import { governedCoverage, unaffectedContexts } from '@ddd-ts-kit/testing/coverage';
 {{#if decorators.standard}}
 import { decorators } from '@ddd-ts-kit/testing/vitest';
 {{/if}}
@@ -9,6 +9,8 @@ import { defineConfig } from 'vitest/config';
 
 const INTEGRATION_SPECS = '{{config.contextsDir}}/*/test/integration/**/*.spec.ts';
 const INTEGRATION_MODE = 'integration';
+// A pull request names the contexts its change reaches (DDD_TS_KIT_AFFECTED, from `ddd-ts-kit affected`): the specs of the others are left to the default branch.
+const NOT_AFFECTED = unaffectedContexts().map((directory) => `${directory}**`);
 
 export default defineConfig(({ mode }) => ({
   {{#if decorators.standard}}
@@ -22,6 +24,8 @@ export default defineConfig(({ mode }) => ({
   // An import alias is resolved from the "paths" of tsconfig.json, which name the sources.
   resolve: { tsconfigPaths: true },
   test: {
+    // The integration project has no spec before the first repository or adapter of the project: its run passes until then.
+    passWithNoTests: mode === INTEGRATION_MODE,
     {{#if assembly.discovery}}
     // Discovery imports the role files of a context itself: inlined, the package loads them through the runner, which compiles them.
     server: { deps: { inline: ['@ddd-ts-kit/di'] } },
@@ -32,10 +36,10 @@ export default defineConfig(({ mode }) => ({
         test: {
           name: 'unit',
           include: ['{{config.sourceRoot}}/**/*.spec.ts', 'test/architecture/**/*.spec.ts'],
-          exclude: [INTEGRATION_SPECS],
+          exclude: [INTEGRATION_SPECS, ...NOT_AFFECTED],
         },
       },
-      { extends: true, test: { name: INTEGRATION_MODE, include: [INTEGRATION_SPECS] } },
+      { extends: true, test: { name: INTEGRATION_MODE, include: [INTEGRATION_SPECS], exclude: NOT_AFFECTED } },
     ],
     coverage: {
       provider: 'v8',

package/templates/policy/policy.declared.ts.tpl

@@ -1,6 +1,6 @@
 import { isAuthenticated, type Actor } from '@ddd-ts-kit/kernel';
 import { Policy } from '@ddd-ts-kit/kernel/declarations';
-import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions.js';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
 
 // TODO(domain): give `allows` the aggregate "{{name.words}}" reads as its second parameter, add `appliesTo(subject: unknown): boolean { return subject instanceof <Aggregate>; }`, and decide from the actor, the loaded element and `now`; the handler asks it through `Access.authorize(command.actor, permission, element)`.
 @Policy({{context.camel}}Permissions['{{access.permission}}'], { name: '{{context.kebab}}.{{name.kebab}}' })

package/templates/policy/policy.spec.declared.ts.tpl

@@ -2,7 +2,7 @@ import { describe, expect, it } from '{{tests.module}}';
 import { anActor } from '@ddd-ts-kit/auth/testing';
 import { anonymousActor } from '@ddd-ts-kit/kernel';
 import { declarationOf } from '@ddd-ts-kit/kernel/declarations';
-import { {{name.pascal}}Policy } from '{{alias.context}}/application/authorization/{{name.kebab}}.policy.js';
+import { {{name.pascal}}Policy } from '{{alias.context}}/application/authorization/{{name.kebab}}.policy{{alias.ext}}';
 
 describe('{{name.title}}', () => {
   it('bears on the permission {{access.permission}}, under a name of its own', () => {

package/templates/policy/policy.spec.ts.tpl

@@ -1,7 +1,7 @@
 import { describe, expect, it } from '{{tests.module}}';
 import { anActor } from '@ddd-ts-kit/auth/testing';
 import { anonymousActor } from '@ddd-ts-kit/kernel';
-import { {{name.camel}} } from '{{alias.context}}/application/authorization/{{name.kebab}}.policy.js';
+import { {{name.camel}} } from '{{alias.context}}/application/authorization/{{name.kebab}}.policy{{alias.ext}}';
 
 const now = new Date('2026-01-01T00:00:00.000Z');
 

package/templates/policy/policy.ts.tpl

@@ -1,6 +1,6 @@
 import { definePolicy } from '@ddd-ts-kit/auth';
 import { isAuthenticated } from '@ddd-ts-kit/kernel';
-import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions.js';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
 
 // TODO(domain): replace `unknown` by the aggregate "{{name.words}}" reads, add `appliesTo: (subject): subject is <Aggregate> => subject instanceof <Aggregate>`, and decide from the actor, the loaded element and `now`; the handler asks it through `Access.authorize(command.actor, permission, element)`.
 export const {{name.camel}} = definePolicy<unknown>({