@cosmicdrift/kumiko-bundled-features 0.365.1 → 0.366.0

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -14,7 +14,7 @@
 // app owner still wires the supervisor in bin/server.ts:
 //
 //   const supervisor = createInboundMailSupervisor({
-//     providerCtx: { registry: deps.registry, secrets },
+//     providerCtx: { registry: deps.registry, secrets, metricsFor: deps.metricsFor },
 //     db,
 //     dispatchWrite: ({ handlerQn, payload, tenantId }) =>
 //       deps.dispatchSystemWrite({ handlerQn, payload, tenantId: tenantId as TenantId }),
@@ -48,7 +48,7 @@ import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/ku
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers } from "./constants.js";
-import { MAIL_ACCOUNT_PII_FIELDS, syncCursorTable } from "./entities.js";
+import { MAIL_ACCOUNT_PII_FIELDS, seenMessageTable, syncCursorTable } from "./entities.js";
 import { createOAuthAccessTokenManager, usesFoundationManagedOAuth, } from "./oauth-access-token.js";
 import { mailAccountsProjectionTable } from "./projection.js";
 import { resolveInboundProviderForAccount } from "./provider-factory.js";
@@ -255,6 +255,19 @@ export function createInboundMailSupervisor(deps) {
     // ---------------------------------------------------------------
     // Poll (Reconciliation).
     // ---------------------------------------------------------------
+    function unknownMessageIdsFilterFor(account) {
+        return async (providerMessageIds) => {
+            if (providerMessageIds.length === 0)
+                return new Set();
+            const seen = await selectMany(deps.db, seenMessageTable, {
+                tenantId: account.tenantId,
+                accountId: account.id,
+                providerMessageId: { in: providerMessageIds },
+            }, { fields: ["providerMessageId"] });
+            const seenIds = new Set(seen.map((row) => row.providerMessageId));
+            return new Set(providerMessageIds.filter((id) => !seenIds.has(id)));
+        };
+    }
     async function pollAccount(account, plugin) {
         let cursor = await loadCursor(account.id);
         let budget = maxMessagesPerPoll;
@@ -265,6 +278,7 @@ export function createInboundMailSupervisor(deps) {
                 const result = await plugin.fetch(deps.providerCtx, account, cursor, {
                     backfillWindowDays,
                     maxMessages: budget,
+                    filterUnknownMessageIds: unknownMessageIdsFilterFor(account),
                     ...(accessToken !== undefined && { accessToken }),
                 });
                 await ingestBatch(account, result.messages, JSON.stringify(result.nextCursor));

package/dist/inbound-provider-imap/feature.js

@@ -224,8 +224,8 @@ export const inboundProviderImapFeature = defineFeature(FEATURE_NAME, (r) => {
         category: "notifications",
         recommended: false,
     });
-    r.requires("inbound-mail-foundation");
-    r.requires("secrets");
+    r.requires({ features: ["inbound-mail-foundation"] });
+    r.requires({ features: ["secrets"] });
     r.envSchema(mailAllowedPrivateHostsEnvSchema);
     r.useExtension(INBOUND_MAIL_PROVIDER_EXTENSION, IMAP_PROVIDER_KEY, imapInboundMailPlugin);
 });

package/dist/inbound-provider-inmemory/feature.js

@@ -110,6 +110,6 @@ export const inboundProviderInMemoryFeature = defineFeature(FEATURE_NAME, (r) =>
         category: "notifications",
         recommended: false,
     });
-    r.requires("inbound-mail-foundation");
+    r.requires({ features: ["inbound-mail-foundation"] });
     r.useExtension("inboundMailProvider", INMEMORY_PROVIDER_KEY, inMemoryInboundMailPlugin);
 });

package/dist/ledger/feature.js

@@ -28,9 +28,9 @@ function registerLedger(r, access, toggleable) {
     });
     if (toggleable !== undefined)
         r.toggleable(toggleable);
-    r.entity("account", accountEntity);
-    r.entity("transaction", transactionEntity);
-    r.entity("schedule", scheduleEntity);
+    r.entity({ name: "account", ...accountEntity });
+    r.entity({ name: "transaction", ...transactionEntity });
+    r.entity({ name: "schedule", ...scheduleEntity });
     // Chart of accounts — plain CRUD, no custom logic. No delete in v1: removing an
     // account that has postings would orphan them; a posting-aware guard lands with
     // the postings projection (Phase 1).
@@ -73,8 +73,8 @@ function registerLedger(r, access, toggleable) {
         access,
         description: "Changes a recurring booking template's description, accounts, amount, interval or date window; use it when a standing order's terms change, already confirmed periods stay booked as they were.",
     }));
-    r.hook("preSave", "schedule:create", requireScheduleSubjectPair);
-    r.hook("preSave", "schedule:update", requireScheduleSubjectPair);
+    r.hook({ type: "preSave", target: "schedule:create", handler: requireScheduleSubjectPair });
+    r.hook({ type: "preSave", target: "schedule:update", handler: requireScheduleSubjectPair });
     r.writeHandler(createConfirmSchedulePeriodHandler(access));
     r.queryHandler(defineEntityListHandler("schedule", scheduleEntity, {
         access,

package/dist/legal-pages/feature.js

@@ -35,7 +35,7 @@ export function createLegalPagesFeature(opts = {}) {
             category: "content",
             recommended: false,
         });
-        r.requires("template-resolver");
+        r.requires({ features: ["template-resolver"] });
         // Public HTML routes (default: 4 DACH routes, configurable via opts.routes)
         for (const route of routes) {
             r.httpRoute({

package/dist/mail-foundation/feature.js

@@ -52,7 +52,7 @@ export const mailFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
         category: "notifications",
         recommended: false,
     });
-    r.requires("config");
+    r.requires({ features: ["config"] });
     // Plugin extension-point. Provider-features register here. The
     // entityName at registration time becomes the value tenants pick in
     // `provider` config-key (e.g. "smtp", "brevo-api").

package/dist/mail-transport-inmemory/feature.js

@@ -62,11 +62,11 @@ export function clearInbox(tenantId) {
 // =============================================================================
 export const mailTransportInMemoryFeature = defineFeature(FEATURE_NAME, (r) => {
     r.describe('Registers an in-process `"inmemory"` provider for `mail-foundation` that buffers sent mails per tenant instead of contacting an SMTP server. Use `getInbox(tenantId)` and `clearInbox(tenantId)` in demo apps and tests; not for production (buffer is process-memory, lost on restart).');
-    // Kein r.requires("config") + kein r.requires("secrets") — der
+    // Kein requires auf "config" oder "secrets" — der
     // In-Memory-Transport hat keine Config (nichts zu konfigurieren) und
     // kein Secret. Der einzige hard-require ist mail-foundation, das den
     // extension-point "mailTransport" definiert.
-    r.requires("mail-foundation");
+    r.requires({ features: ["mail-foundation"] });
     const plugin = {
         build: async (_ctx, tenantId) => {
             // Returnt den per-tenant Buffer. Identitätsstabil zwischen calls

package/dist/mail-transport-smtp/feature.js

@@ -57,9 +57,9 @@ export const mailTransportSmtpFeature = defineFeature(FEATURE_NAME, (r) => {
         category: "notifications",
         recommended: false,
     });
-    r.requires("config");
-    r.requires("secrets");
-    r.requires("mail-foundation");
+    r.requires({ features: ["config"] });
+    r.requires({ features: ["secrets"] });
+    r.requires({ features: ["mail-foundation"] });
     r.envSchema(mailTransportSmtpEnvSchema);
     // Provider-secret. Sensitive: redact-helper for admin-UI display.
     const password = r.secret("smtp.password", {

package/dist/managed-pages/css-gate.js

@@ -15,7 +15,7 @@ import { MANAGED_PAGES_CSS_FEATURE } from "./branding.js";
 export function createManagedPagesCssFeature() {
     return defineFeature(MANAGED_PAGES_CSS_FEATURE, (r) => {
         r.describe('Per-tenant toggle gate for the managed-pages custom-CSS (raw tenant CSS-inject) capability. Handler-less: composing it makes `managed-pages-css` a toggleable feature defaulting OFF, so an operator/tier can grant raw CSS-inject per tenant. managed-pages reads `ctx.hasFeature("managed-pages-css")` in its branding query and emits tenant CSS only when this toggle is on AND the app passed `allowCustomCss: true`. The tenant CSS is allowlist-sanitized + scoped at render regardless; this gate is the commercial/operator control, not the safety boundary.');
-        r.requires("managed-pages");
+        r.requires({ features: ["managed-pages"] });
         r.toggleable({ default: false });
     });
 }

package/dist/managed-pages/feature.js

@@ -86,8 +86,8 @@ export function createManagedPagesFeature(opts) {
             category: "content",
             recommended: false,
         });
-        r.requires("config");
-        r.entity("page", pageEntity);
+        r.requires({ features: ["config"] });
+        r.entity({ name: "page", ...pageEntity });
         // Per-tenant branding config keys (scope: tenant). Write-validated via
         // keyDef.pattern (hex / https) — see branding.ts. read:all so the
         // anonymous render path may resolve them. The raw-CSS key is added only

package/dist/metrics/feature.js

@@ -103,7 +103,7 @@ export function createMetricsFeature(options) {
             recommended: false,
         });
         for (const feature of requiredFeatures(metrics))
-            r.requires(feature);
+            r.requires({ features: [feature] });
         for (const metric of metrics)
             r.queryHandler(createTenantMetricQuery(metric, now));
         r.translations({ keys: METRICS_I18N });
@@ -122,7 +122,7 @@ export function createSystemMetricsFeature(options) {
         });
         r.systemScope();
         for (const feature of requiredFeatures(metrics))
-            r.requires(feature);
+            r.requires({ features: [feature] });
         for (const metric of metrics)
             r.queryHandler(createSystemMetricQuery(metric, now));
         r.translations({ keys: METRICS_I18N });

package/dist/notes-history/feature.js

@@ -27,13 +27,13 @@ function registerNotesHistory(r, access, ownership, parents) {
         recommended: false,
     });
     const entity = createNoteEntryEntity(ownership, parents);
-    r.entity("note-entry", entity);
+    r.entity({ name: "note-entry", ...entity });
     // No write/query handler of its own — populated only as a side effect of
     // add-note (see handlers/add-note.write.ts), looked up by
     // notes-history-user-data's forget cascade. Registering the entity (not
     // just building it inline in the handler) is what makes it visible to the
     // registry-wide GDPR boot guards and to executor.ts's table/projection setup.
-    r.entity("note-mention", noteMentionEntity);
+    r.entity({ name: "note-mention", ...noteMentionEntity });
     r.writeHandler(createAddNoteHandler(access, createNoteEntryExecutor(ownership)));
     r.queryHandler(defineEntityListHandler("note-entry", entity, {
         access,

package/dist/notes-history-user-data/index.js

@@ -13,7 +13,7 @@ export const notesHistoryUserDataFeature = defineFeature("notes-history-user-dat
     // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires
     // would throw an "effectively disabled" boot warning even though the
     // note-entry entity exists and the hooks work fine.
-    r.requires("user-data-rights");
+    r.requires({ features: ["user-data-rights"] });
     r.optionalRequires("notes-history");
     r.useExtension(EXT_USER_DATA, "note-entry", {
         export: noteEntryExportHook,

package/dist/personal-access-tokens/feature.js

@@ -52,7 +52,7 @@ export function createPersonalAccessTokensFeature(options) {
         // roles — make both boot-time deps so a mis-wiring fails validateBoot.
         // auth-foundation owns EXT_TOKEN_VERIFIER, which the useExtension below
         // registers against.
-        r.requires("user", "tenant", "auth-foundation");
+        r.requires({ features: ["user", "tenant", "auth-foundation"] });
         // Self-registers as a bearer-auth provider instead of the app wiring a
         // dedicated patResolver callback — the middleware finds it generically
         // via resolveTokenVerifier(), shape-matched by the PAT token prefix.
@@ -83,18 +83,22 @@ export function createPersonalAccessTokensFeature(options) {
         // #497), so a postSave hook on "user" gets a poisoned ctx.db here. The
         // concrete revoker is bound once run{Prod,Dev}App has a real db handle.
         let autoRevokeOnPasswordChange = options.autoRevokeOnPasswordChange;
-        r.hook("postSave", { allOf: "user" }, async (result) => {
-            // skip: nothing bound — same late-bind pattern as sessions/feature.ts
-            if (!autoRevokeOnPasswordChange)
-                return;
-            // skip: brand-new user, no PATs can exist yet
-            if (result.isNew)
-                return;
-            // skip: handler didn't touch any revoke-triggering field
-            if (!PAT_REVOKE_TRIGGERING_FIELDS.some((field) => result.changes[field] !== undefined)) {
-                return;
-            }
-            await autoRevokeOnPasswordChange(String(result.id));
+        r.hook({
+            type: "postSave",
+            target: { allOf: "user" },
+            handler: async (result) => {
+                // skip: nothing bound — same late-bind pattern as sessions/feature.ts
+                if (!autoRevokeOnPasswordChange)
+                    return;
+                // skip: brand-new user, no PATs can exist yet
+                if (result.isNew)
+                    return;
+                // skip: handler didn't touch any revoke-triggering field
+                if (!PAT_REVOKE_TRIGGERING_FIELDS.some((field) => result.changes[field] !== undefined)) {
+                    return;
+                }
+                await autoRevokeOnPasswordChange(String(result.id));
+            },
         });
         const bindAutoRevokeOnPasswordChange = (revoker) => {
             // explicit constructor option wins over the runtime binding

package/dist/readiness/feature.js

@@ -16,8 +16,8 @@ export const readinessFeature = defineFeature("readiness", (r) => {
         category: "operations",
         recommended: false,
     });
-    r.requires("config");
-    r.requires("secrets");
+    r.requires({ features: ["config"] });
+    r.requires({ features: ["secrets"] });
     const queries = {
         status: r.queryHandler(statusQuery),
     };

package/dist/renderer-foundation/feature.js

@@ -17,7 +17,7 @@ export function createRendererFoundationFeature() {
             category: "notifications",
             recommended: false,
         });
-        r.requires("template-resolver");
+        r.requires({ features: ["template-resolver"] });
         r.extendsRegistrar(RENDERER_EXTENSION, {
             onRegister: () => {
                 // Plugin-Konformitäts-Check könnte hier: shape-validation der

package/dist/renderer-pdf/feature.js

@@ -29,7 +29,7 @@ export function createRendererPdfFeature() {
             category: "notifications",
             recommended: false,
         });
-        r.requires("renderer-foundation");
+        r.requires({ features: ["renderer-foundation"] });
         r.useExtension(RENDERER_EXTENSION, "pdf", {
             kinds: ["document-pdf"],
             render: (req) => renderTablePdfRequest(req),

package/dist/secrets/feature.js

@@ -116,7 +116,7 @@ export function createSecretsFeature(opts = {}) {
         // uniqueIndex are not expressible via the field-DSL (jsonb-without-default,
         // now()-default), so the physical table is the DDL truth. Without this the
         // generated migration omitted those columns → prod-500 (publicstatus#116).
-        r.entity("tenant-secret", tenantSecretEntity, { table: tenantSecretsTable });
+        r.entity({ name: "tenant-secret", ...tenantSecretEntity, backingTable: tenantSecretsTable });
         // Read-audit domain-event. Registered here so ops tools + MSPs can
         // discover the type; secrets-context.get parses payloads against
         // `secretReadSchema` at write time because the low-level append() path

package/dist/seo/feature.js

@@ -108,7 +108,7 @@ export function createSeoFeature(opts) {
         // config keys need the config feature's write/read machinery to actually
         // function (same hard dependency managed-pages has) — only legal-pages/
         // managed-pages are genuinely optional (merged only when opted in).
-        r.requires("config");
+        r.requires({ features: ["config"] });
         r.optionalRequires("legal-pages", "managed-pages");
         r.config({ keys: SEO_CONFIG_KEYS });
         r.queryHandler(seoConfigQuery);

package/dist/sessions/feature.js

@@ -59,7 +59,7 @@ export function createSessionsFeature(options) {
         // sessions-without-user wiring fails validateBoot instead of 500ing live.
         // auth-foundation owns EXT_SESSION_STORE, which the useExtension below
         // registers against.
-        r.requires("user", "auth-foundation");
+        r.requires({ features: ["user", "auth-foundation"] });
         // store_user_sessions is a hot-path direct-write store: sessionCreator
         // inserts and the revoke handlers update rows WITHOUT emitting lifecycle
         // events (the row columns ARE the audit trail). Registering it as
@@ -144,21 +144,25 @@ export function createSessionsFeature(options) {
         // regardless.
         const REVOKE_TRIGGERING_FIELDS = ["passwordHash"];
         let autoRevoke = options?.autoRevokeOnPasswordChange;
-        r.hook("postSave", { allOf: "user" }, async (ctx) => {
-            // skip: nothing bound — stateless-JWT deployments without a runtime
-            // that calls bindAutoRevokeOnPasswordChange keep the old behavior.
-            if (!autoRevoke)
-                return;
-            // skip: brand-new user, no sessions can possibly exist yet. The
-            // initial passwordHash on a user:create would trip the second guard
-            // otherwise — every registration would do a mass-revoke roundtrip
-            // for a user who literally has no rows in user_sessions.
-            if (ctx.isNew)
-                return;
-            // skip: handler didn't touch any revoke-triggering field
-            if (!REVOKE_TRIGGERING_FIELDS.some((field) => ctx.changes[field] !== undefined))
-                return;
-            await autoRevoke(String(ctx.id));
+        r.hook({
+            type: "postSave",
+            target: { allOf: "user" },
+            handler: async (ctx) => {
+                // skip: nothing bound — stateless-JWT deployments without a runtime
+                // that calls bindAutoRevokeOnPasswordChange keep the old behavior.
+                if (!autoRevoke)
+                    return;
+                // skip: brand-new user, no sessions can possibly exist yet. The
+                // initial passwordHash on a user:create would trip the second guard
+                // otherwise — every registration would do a mass-revoke roundtrip
+                // for a user who literally has no rows in user_sessions.
+                if (ctx.isNew)
+                    return;
+                // skip: handler didn't touch any revoke-triggering field
+                if (!REVOKE_TRIGGERING_FIELDS.some((field) => ctx.changes[field] !== undefined))
+                    return;
+                await autoRevoke(String(ctx.id));
+            },
         });
         const bindAutoRevokeOnPasswordChange = (revoker) => {
             // explicit constructor option wins over the runtime binding

package/dist/step-dispatcher/feature.js

@@ -34,7 +34,7 @@ export function createStepDispatcherFeature() {
             recommended: false,
         });
         r.envSchema(stepDispatcherEnvSchema);
-        r.requires("secrets");
+        r.requires({ features: ["secrets"] });
         // Literal name: the few-shot corpus parser only reads string-literal job names.
         // StepDispatcherJobNames.deliver mirrors it; feature.boot.test.ts pins the two together.
         r.job("deliver", {

package/dist/subscription-mollie/feature.js

@@ -102,7 +102,7 @@ export function createSubscriptionMollieFeature(options) {
             category: "billing",
             recommended: false,
         });
-        r.requires("billing-foundation");
+        r.requires({ features: ["billing-foundation"] });
         r.envSchema(subscriptionMollieEnvSchema);
         const plugin = {
             verifyAndParseWebhook: verifyAndParse,

package/dist/subscription-stripe/feature.js

@@ -93,9 +93,9 @@ export function createSubscriptionStripeFeature(options = {}) {
         // Hard-deps: billing-foundation (plugin-host) + config (billing-live +
         // backing:"secrets" credentials) + secrets (the store the backing:secrets
         // dispatch reads/writes + its tenant_secrets table).
-        r.requires("billing-foundation");
-        r.requires("config");
-        r.requires("secrets");
+        r.requires({ features: ["billing-foundation"] });
+        r.requires({ features: ["config"] });
+        r.requires({ features: ["secrets"] });
         r.envSchema(subscriptionStripeEnvSchema);
         // Runtime config. api-key + webhook-secret declare backing:"secrets" —
         // the value lives envelope-encrypted in the secrets store under

package/dist/tags/feature.js

@@ -41,8 +41,8 @@ function registerTags(r, access, toggleable, ownership, parents) {
     if (toggleable !== undefined)
         r.toggleable(toggleable);
     const tagAssignmentEntity = createTagAssignmentEntity(ownership, parents);
-    r.entity("tag", tagEntity);
-    r.entity("tag-assignment", tagAssignmentEntity);
+    r.entity({ name: "tag", ...tagEntity });
+    r.entity({ name: "tag-assignment", ...tagAssignmentEntity });
     r.writeHandler(createCreateTagHandler(access));
     r.writeHandler(createUpdateTagHandler(access));
     r.writeHandler(createDeleteTagHandler(access));

package/dist/template-resolver/feature.js

@@ -63,13 +63,13 @@ export function createTemplateResolverFeature(opts = {}) {
                 resourceMaxBytes: createSystemConfig("number", { default: 2_097_152, bounds: { min: 1 } }),
             },
         });
-        r.entity("template-resource", templateResourceEntity);
+        r.entity({ name: "template-resource", ...templateResourceEntity });
         // Only when the app actually mounts a user-owned collection: the entity's
         // `content` is `userOwned`, which makes it subject data — the boot guard
         // then requires an EXT_USER_DATA hook (mount `template-resolver-user-data`).
         // Registering it unconditionally would impose that on every app.
         if (hasUserOwned)
-            r.entity("user-content-entry", userContentEntryEntity);
+            r.entity({ name: "user-content-entry", ...userContentEntryEntity });
         const handlers = {
             upsertSystem: r.writeHandler(upsertSystemWrite),
             upsertTenant: r.writeHandler(upsertTenantWrite),

package/dist/template-resolver-user-data/index.js

@@ -12,7 +12,7 @@ export const templateResolverUserDataFeature = defineFeature("template-resolver-
     // template-resolver is optional for the same reason as in
     // notes-history-user-data: a toggleable mount would otherwise trip the
     // "effectively disabled" boot warning even though the entity is there.
-    r.requires("user-data-rights");
+    r.requires({ features: ["user-data-rights"] });
     r.optionalRequires("template-resolver");
     r.useExtension(EXT_USER_DATA, "user-content-entry", {
         export: userContentExportHook,

package/dist/tenant/feature.js

@@ -38,7 +38,7 @@ export function createTenantFeature(options) {
             recommended: true,
         });
         r.systemScope();
-        r.requires("config");
+        r.requires({ features: ["config"] });
         r.extendsRegistrar(EXT_ASSIGNABLE_ROLE, {});
         // The elevation guards read the registry, the screens only these options: a role the
         // server accepts but the screen omits is silently stripped on the next member-roles save.
@@ -49,9 +49,9 @@ export function createTenantFeature(options) {
                 throw new Error(`[tenant] assignable app role "${role}" (assignableFrom "${assignableFrom}") is declared but missing from the tenant screens' options; pass assignableAppRoles: collectAssignableAppRoles(appFeatures) to createTenantFeature.`);
             }
         });
-        r.entity("tenant", tenantEntity);
-        r.entity("tenant-membership", tenantMembershipEntity);
-        r.entity("tenant-invitation", tenantInvitationEntity);
+        r.entity({ name: "tenant", ...tenantEntity });
+        r.entity({ name: "tenant-membership", ...tenantMembershipEntity });
+        r.entity({ name: "tenant-invitation", ...tenantInvitationEntity });
         r.config({
             keys: {
                 // Stammdaten-Settings — Tenant-Admin darf ändern, alle dürfen lesen.

package/dist/tenant/seeding.js

@@ -185,7 +185,7 @@ export async function seedTenant(db, options, hooks) {
     }
     // "tenant:seed" matches no handler-scoped hook, only entity-scoped ones
     // (keyed by result.entityName === "tenant") — that's exactly what
-    // tier-engine's `r.hook("postSave", { allOf: "tenant" }, ...)` needs.
+    // tier-engine's `r.hook({ type: "postSave", target: { allOf: "tenant" }, ... })` needs.
     await fireEntityPostSave(hooks, "tenant:seed", result.data, { tenantId: options.id, db });
     return { id: options.id };
 }

package/dist/tenant-lifecycle/feature.js

@@ -19,7 +19,7 @@ export function createTenantLifecycleFeature() {
             category: "compliance",
             recommended: false,
         });
-        r.requires("tenant", "compliance-profiles");
+        r.requires({ features: ["tenant", "compliance-profiles"] });
         r.optionalRequires("sessions");
         r.usesApi("compliance.forTenant");
         r.extendsRegistrar(EXT_TENANT_DATA, {});
@@ -74,8 +74,7 @@ export function createTenantLifecycleFeature() {
                 if (!ctx.registry) {
                     throw new Error("run-tenant-destruction: ctx.registry required (JobContext incomplete)");
                 }
-                const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
-                const now = T.Now.instant();
+                const now = ctx.tz.now();
                 // Without crossTenantReads (undeclared hatch) fall through to the sweep.
                 if (ctx.crossTenantReads && !(await hasTenantDestructionWork(ctx.crossTenantReads, now))) {
                     // skip: no tenant is due, so the sweep would not touch anything

package/dist/tenant-settings/feature.js

@@ -16,7 +16,7 @@ import { buildTenantSettingsKeys } from "./config.js";
 import { TENANT_SETTINGS_FEATURE_NAME } from "./constants.js";
 export function createTenantSettingsFeature(opts = {}) {
     return defineFeature(TENANT_SETTINGS_FEATURE_NAME, (r) => {
-        r.requires("config");
+        r.requires({ features: ["config"] });
         r.describe("Per-tenant Currency + Locale defaults, exposed as two config keys (tenant-settings:config:currency, tenant-settings:config:locale) that surface in the self-populating Settings-Hub via `mask`. Pair with defineCreateWithTenantDefaults to auto-fill a money field's currency or a locale field on create instead of hard-coding a literal per entity.");
         r.config({ keys: buildTenantSettingsKeys(opts) });
         r.translations({