@cosmicdrift/kumiko-samples 0.365.1 → 0.366.0

package/packages/bundled-features/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "improvement",
+    "title": "Inbound mail fetch can skip already-seen message ids",
+    "detail": "InboundMailProviderPlugin.fetch receives an optional filterUnknownMessageIds(providerMessageIds) hook. The watch supervisor implements it with a tenant- and account-scoped lookup of already-seen provider message ids and returns the ids not seen yet, so a plugin can avoid downloading messages it has already processed."
+  },
+  {
+    "version": "0.366.0",
+    "type": "breaking",
+    "title": "InboundMailContext exposes metricsFor to provider plugins",
+    "detail": "InboundMailContext gains an optional metricsFor(featureName) returning a MetricsHandle. runProdApp, the worker app and the dev server wire it from the observability meter, so provider plugins can emit their own metrics through the same pipeline.",
+    "migration": "Code that builds SystemWireDeps itself adds metricsFor (createMetricsForFactory(meter))."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/inbound-mail-foundation/connect-routes.ts

@@ -30,6 +30,7 @@ import {
 } from "./oauth-access-token.js";
 import { type OAuthStatePayload, signOAuthState, verifyOAuthState } from "./oauth-state.js";
 import { resolveInboundProviderForKey } from "./provider-factory.js";
+import type { InboundMailContext } from "./types.js";
 
 const DEFAULT_STATE_TTL_MINUTES = 15;
 const DEFAULT_CONNECT_PATH = "/api/inbound-mail/connect";
@@ -56,6 +57,8 @@ export type InboundMailConnectRoutesOptions = {
    *  lock and primes the access-token cache from the code exchange. Omitted
    *  → plain secret write, no cache priming. */
   readonly oauthTokens?: OAuthAccessTokenManager;
+  /** Handed to the provider plugin's context (`InboundMailContext.metricsFor`). */
+  readonly metricsFor?: InboundMailContext["metricsFor"];
 };
 
 function errorJson(c: Context, status: 400 | 401 | 404 | 500 | 502, code: string, message: string) {
@@ -172,7 +175,12 @@ export function createInboundMailConnectRoutes(
           `${INBOUND_MAIL_FOUNDATION_FEATURE}: no secrets context wired for the oauth callback route — the refresh token cannot be persisted`,
         );
       }
-      const providerCtx = { registry: deps.registry, secrets: deps.secrets, config: undefined };
+      const providerCtx: InboundMailContext = {
+        registry: deps.registry,
+        secrets: deps.secrets,
+        config: undefined,
+        ...(options.metricsFor && { metricsFor: options.metricsFor }),
+      };
 
       let plugin: ReturnType<typeof resolveInboundProviderForKey>;
       try {

package/packages/bundled-features/src/inbound-mail-foundation/feature.ts

@@ -107,7 +107,7 @@ export const inboundMailFoundationFeature = defineFeature(INBOUND_MAIL_FOUNDATIO
     recommended: false,
   });
   // EXT_TENANT_DATA-Hook braucht den tenant-lifecycle-Host.
-  r.requires("tenant-lifecycle");
+  r.requires({ features: ["tenant-lifecycle"] });
 
   // 5 fine-grained domain-events (Payload-Schemas: events.ts).
   // piiFields: "none" — address/subject/snippet are already ciphertext under the tenant subject key before append (see events.ts).

package/packages/bundled-features/src/inbound-mail-foundation/types.ts

@@ -11,23 +11,28 @@
 // (sichtbarer breaking change) statt ctx-cast.
 
 import type { ConfigAccessor, Registry } from "@cosmicdrift/kumiko-framework/engine";
+import type { MetricsHandle } from "@cosmicdrift/kumiko-framework/observability";
 import { INBOUND_MAIL_PROVIDER_EXTENSION, type InboundMailAccountStatus } from "./constants.js";
 
 /**
- * Slim-Context für Provider-Plugins.
+ * Slim context for provider plugins.
  *
- * **Felder:**
- *   config   — tenant-config-reads (host/port/... der Plugins)
- *   registry — extension-Lookup in der Factory (nicht plugin-intern)
- *   secrets  — tenant-secret-reads (IMAP-Passwort, OAuth-Refresh-Token)
- *   _userId  — Audit-Identity für secret-reads. Handler-Pfad: dispatcher
- *              setzt Caller-User-ID; Worker-Pfad: System-Identity.
+ * **Fields:**
+ *   config   — tenant config reads (host/port/... of the plugins)
+ *   registry — extension lookup in the factory (not plugin-internal)
+ *   secrets  — tenant secret reads (IMAP password, OAuth refresh token)
+ *   _userId  — audit identity for secret reads. Handler path: the dispatcher
+ *              sets the caller user ID; worker path: system identity.
+ *   metricsFor — metrics handle of a feature by name, same behavior as
+ *              HandlerContext.metricsFor: unregistered metrics are a silent
+ *              no-op instead of a throw.
  */
 export type InboundMailContext = {
   readonly config?: ConfigAccessor;
   readonly registry?: Registry;
   readonly secrets?: import("@cosmicdrift/kumiko-framework/secrets").SecretsContext;
   readonly _userId?: string | undefined;
+  readonly metricsFor?: (featureName: string) => MetricsHandle;
 };
 
 /**
@@ -167,6 +172,13 @@ export type InboundMailProviderPlugin = {
        *  whose provider declares `oauth` (authMethod oauth/xoauth2). Absent
        *  for password accounts and providers without an oauth flow. */
       readonly accessToken?: string;
+      /** Batch lookup of the provider message ids not yet ingested for this
+       *  account (committed seen anchors, one query per call). Call it after
+       *  the listing/delta page and download MIME only for the returned ids.
+       *  Ingest dedup stays the correctness anchor; this only saves downloads. */
+      readonly filterUnknownMessageIds?: (
+        providerMessageIds: readonly string[],
+      ) => Promise<ReadonlySet<string>>;
     },
   ) => Promise<InboundFetchResult>;
   /** Nur OAuth-Provider. */

package/packages/bundled-features/src/inbound-mail-foundation/watch-supervisor.ts

@@ -14,7 +14,7 @@
 // app owner still wires the supervisor in bin/server.ts:
 //
 //   const supervisor = createInboundMailSupervisor({
-//     providerCtx: { registry: deps.registry, secrets },
+//     providerCtx: { registry: deps.registry, secrets, metricsFor: deps.metricsFor },
 //     db,
 //     dispatchWrite: ({ handlerQn, payload, tenantId }) =>
 //       deps.dispatchSystemWrite({ handlerQn, payload, tenantId: tenantId as TenantId }),
@@ -54,7 +54,7 @@ import type { DistributedLock } from "@cosmicdrift/kumiko-framework/pipeline";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers } from "./constants.js";
-import { MAIL_ACCOUNT_PII_FIELDS, syncCursorTable } from "./entities.js";
+import { MAIL_ACCOUNT_PII_FIELDS, seenMessageTable, syncCursorTable } from "./entities.js";
 import {
   createOAuthAccessTokenManager,
   type OAuthAccessTokenManager,
@@ -398,6 +398,24 @@ export function createInboundMailSupervisor(
   // ---------------------------------------------------------------
   // Poll (Reconciliation).
   // ---------------------------------------------------------------
+  function unknownMessageIdsFilterFor(account: MailAccountRecord) {
+    return async (providerMessageIds: readonly string[]): Promise<ReadonlySet<string>> => {
+      if (providerMessageIds.length === 0) return new Set();
+      const seen = await selectMany<{ providerMessageId: string }>(
+        deps.db,
+        seenMessageTable,
+        {
+          tenantId: account.tenantId,
+          accountId: account.id,
+          providerMessageId: { in: providerMessageIds },
+        },
+        { fields: ["providerMessageId"] },
+      );
+      const seenIds = new Set(seen.map((row) => row.providerMessageId));
+      return new Set(providerMessageIds.filter((id) => !seenIds.has(id)));
+    };
+  }
+
   async function pollAccount(
     account: MailAccountRecord,
     plugin: InboundMailProviderPlugin,
@@ -411,6 +429,7 @@ export function createInboundMailSupervisor(
         const result = await plugin.fetch(deps.providerCtx, account, cursor, {
           backfillWindowDays,
           maxMessages: budget,
+          filterUnknownMessageIds: unknownMessageIdsFilterFor(account),
           ...(accessToken !== undefined && { accessToken }),
         });
         await ingestBatch(account, result.messages, JSON.stringify(result.nextCursor));

package/packages/bundled-features/src/inbound-provider-imap/feature.ts

@@ -281,8 +281,8 @@ export const inboundProviderImapFeature = defineFeature(FEATURE_NAME, (r) => {
     category: "notifications",
     recommended: false,
   });
-  r.requires("inbound-mail-foundation");
-  r.requires("secrets");
+  r.requires({ features: ["inbound-mail-foundation"] });
+  r.requires({ features: ["secrets"] });
   r.envSchema(mailAllowedPrivateHostsEnvSchema);
   r.useExtension(INBOUND_MAIL_PROVIDER_EXTENSION, IMAP_PROVIDER_KEY, imapInboundMailPlugin);
 });

package/packages/bundled-features/src/inbound-provider-inmemory/feature.ts

@@ -149,6 +149,6 @@ export const inboundProviderInMemoryFeature = defineFeature(FEATURE_NAME, (r) =>
     category: "notifications",
     recommended: false,
   });
-  r.requires("inbound-mail-foundation");
+  r.requires({ features: ["inbound-mail-foundation"] });
   r.useExtension("inboundMailProvider", INMEMORY_PROVIDER_KEY, inMemoryInboundMailPlugin);
 });

package/packages/bundled-features/src/ledger/feature.ts

@@ -54,9 +54,9 @@ function registerLedger(
 
   if (toggleable !== undefined) r.toggleable(toggleable);
 
-  r.entity("account", accountEntity);
-  r.entity("transaction", transactionEntity);
-  r.entity("schedule", scheduleEntity);
+  r.entity({ name: "account", ...accountEntity });
+  r.entity({ name: "transaction", ...transactionEntity });
+  r.entity({ name: "schedule", ...scheduleEntity });
 
   // Chart of accounts — plain CRUD, no custom logic. No delete in v1: removing an
   // account that has postings would orphan them; a posting-aware guard lands with
@@ -126,8 +126,8 @@ function registerLedger(
         "Changes a recurring booking template's description, accounts, amount, interval or date window; use it when a standing order's terms change, already confirmed periods stay booked as they were.",
     }),
   );
-  r.hook("preSave", "schedule:create", requireScheduleSubjectPair);
-  r.hook("preSave", "schedule:update", requireScheduleSubjectPair);
+  r.hook({ type: "preSave", target: "schedule:create", handler: requireScheduleSubjectPair });
+  r.hook({ type: "preSave", target: "schedule:update", handler: requireScheduleSubjectPair });
   r.writeHandler(createConfirmSchedulePeriodHandler(access));
   r.queryHandler(
     defineEntityListHandler("schedule", scheduleEntity, {

package/packages/bundled-features/src/legal-pages/feature.ts

@@ -110,7 +110,7 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
       category: "content",
       recommended: false,
     });
-    r.requires("template-resolver");
+    r.requires({ features: ["template-resolver"] });
 
     // Public HTML routes (default: 4 DACH routes, configurable via opts.routes)
     for (const route of routes) {

package/packages/bundled-features/src/mail-foundation/feature.ts

@@ -128,7 +128,7 @@ export const mailFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
     category: "notifications",
     recommended: false,
   });
-  r.requires("config");
+  r.requires({ features: ["config"] });
 
   // Plugin extension-point. Provider-features register here. The
   // entityName at registration time becomes the value tenants pick in

package/packages/bundled-features/src/mail-transport-inmemory/feature.ts

@@ -80,11 +80,11 @@ export const mailTransportInMemoryFeature = defineFeature(FEATURE_NAME, (r) => {
   r.describe(
     'Registers an in-process `"inmemory"` provider for `mail-foundation` that buffers sent mails per tenant instead of contacting an SMTP server. Use `getInbox(tenantId)` and `clearInbox(tenantId)` in demo apps and tests; not for production (buffer is process-memory, lost on restart).',
   );
-  // Kein r.requires("config") + kein r.requires("secrets") — der
+  // Kein requires auf "config" oder "secrets" — der
   // In-Memory-Transport hat keine Config (nichts zu konfigurieren) und
   // kein Secret. Der einzige hard-require ist mail-foundation, das den
   // extension-point "mailTransport" definiert.
-  r.requires("mail-foundation");
+  r.requires({ features: ["mail-foundation"] });
 
   const plugin: MailTransportPlugin = {
     build: async (_ctx: MailTransportContext, tenantId: string): Promise<EmailTransport> => {

package/packages/bundled-features/src/mail-transport-smtp/feature.ts

@@ -85,9 +85,9 @@ export const mailTransportSmtpFeature = defineFeature(FEATURE_NAME, (r) => {
     category: "notifications",
     recommended: false,
   });
-  r.requires("config");
-  r.requires("secrets");
-  r.requires("mail-foundation");
+  r.requires({ features: ["config"] });
+  r.requires({ features: ["secrets"] });
+  r.requires({ features: ["mail-foundation"] });
   r.envSchema(mailTransportSmtpEnvSchema);
 
   // Provider-secret. Sensitive: redact-helper for admin-UI display.

package/packages/bundled-features/src/managed-pages/css-gate.ts

@@ -18,7 +18,7 @@ export function createManagedPagesCssFeature(): FeatureDefinition {
     r.describe(
       'Per-tenant toggle gate for the managed-pages custom-CSS (raw tenant CSS-inject) capability. Handler-less: composing it makes `managed-pages-css` a toggleable feature defaulting OFF, so an operator/tier can grant raw CSS-inject per tenant. managed-pages reads `ctx.hasFeature("managed-pages-css")` in its branding query and emits tenant CSS only when this toggle is on AND the app passed `allowCustomCss: true`. The tenant CSS is allowlist-sanitized + scoped at render regardless; this gate is the commercial/operator control, not the safety boundary.',
     );
-    r.requires("managed-pages");
+    r.requires({ features: ["managed-pages"] });
     r.toggleable({ default: false });
   });
 }

package/packages/bundled-features/src/managed-pages/feature.ts

@@ -162,8 +162,8 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
       category: "content",
       recommended: false,
     });
-    r.requires("config");
-    r.entity("page", pageEntity);
+    r.requires({ features: ["config"] });
+    r.entity({ name: "page", ...pageEntity });
 
     // Per-tenant branding config keys (scope: tenant). Write-validated via
     // keyDef.pattern (hex / https) — see branding.ts. read:all so the

package/packages/bundled-features/src/metrics/feature.ts

@@ -146,7 +146,7 @@ export function createMetricsFeature(options: MetricsFeatureOptions): FeatureDef
       category: "operations",
       recommended: false,
     });
-    for (const feature of requiredFeatures(metrics)) r.requires(feature);
+    for (const feature of requiredFeatures(metrics)) r.requires({ features: [feature] });
     for (const metric of metrics) r.queryHandler(createTenantMetricQuery(metric, now));
     r.translations({ keys: METRICS_I18N });
   });
@@ -167,7 +167,7 @@ export function createSystemMetricsFeature(options: MetricsFeatureOptions): Feat
       recommended: false,
     });
     r.systemScope();
-    for (const feature of requiredFeatures(metrics)) r.requires(feature);
+    for (const feature of requiredFeatures(metrics)) r.requires({ features: [feature] });
     for (const metric of metrics) r.queryHandler(createSystemMetricQuery(metric, now));
     r.translations({ keys: METRICS_I18N });
   });

package/packages/bundled-features/src/notes-history/feature.ts

@@ -43,13 +43,13 @@ function registerNotesHistory(
   });
 
   const entity = createNoteEntryEntity(ownership, parents);
-  r.entity("note-entry", entity);
+  r.entity({ name: "note-entry", ...entity });
   // No write/query handler of its own — populated only as a side effect of
   // add-note (see handlers/add-note.write.ts), looked up by
   // notes-history-user-data's forget cascade. Registering the entity (not
   // just building it inline in the handler) is what makes it visible to the
   // registry-wide GDPR boot guards and to executor.ts's table/projection setup.
-  r.entity("note-mention", noteMentionEntity);
+  r.entity({ name: "note-mention", ...noteMentionEntity });
 
   r.writeHandler(createAddNoteHandler(access, createNoteEntryExecutor(ownership)));
   r.queryHandler(

package/packages/bundled-features/src/notes-history-user-data/index.ts

@@ -23,7 +23,7 @@ export const notesHistoryUserDataFeature = defineFeature("notes-history-user-dat
   // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires
   // would throw an "effectively disabled" boot warning even though the
   // note-entry entity exists and the hooks work fine.
-  r.requires("user-data-rights");
+  r.requires({ features: ["user-data-rights"] });
   r.optionalRequires("notes-history");
   r.useExtension(EXT_USER_DATA, "note-entry", {
     export: noteEntryExportHook,

package/packages/bundled-features/src/personal-access-tokens/feature.ts

@@ -106,7 +106,7 @@ export function createPersonalAccessTokensFeature(
     // roles — make both boot-time deps so a mis-wiring fails validateBoot.
     // auth-foundation owns EXT_TOKEN_VERIFIER, which the useExtension below
     // registers against.
-    r.requires("user", "tenant", "auth-foundation");
+    r.requires({ features: ["user", "tenant", "auth-foundation"] });
     // Self-registers as a bearer-auth provider instead of the app wiring a
     // dedicated patResolver callback — the middleware finds it generically
     // via resolveTokenVerifier(), shape-matched by the PAT token prefix.
@@ -142,16 +142,20 @@ export function createPersonalAccessTokensFeature(
     // #497), so a postSave hook on "user" gets a poisoned ctx.db here. The
     // concrete revoker is bound once run{Prod,Dev}App has a real db handle.
     let autoRevokeOnPasswordChange = options.autoRevokeOnPasswordChange;
-    r.hook("postSave", { allOf: "user" }, async (result) => {
-      // skip: nothing bound — same late-bind pattern as sessions/feature.ts
-      if (!autoRevokeOnPasswordChange) return;
-      // skip: brand-new user, no PATs can exist yet
-      if (result.isNew) return;
-      // skip: handler didn't touch any revoke-triggering field
-      if (!PAT_REVOKE_TRIGGERING_FIELDS.some((field) => result.changes[field] !== undefined)) {
-        return;
-      }
-      await autoRevokeOnPasswordChange(String(result.id));
+    r.hook({
+      type: "postSave",
+      target: { allOf: "user" },
+      handler: async (result) => {
+        // skip: nothing bound — same late-bind pattern as sessions/feature.ts
+        if (!autoRevokeOnPasswordChange) return;
+        // skip: brand-new user, no PATs can exist yet
+        if (result.isNew) return;
+        // skip: handler didn't touch any revoke-triggering field
+        if (!PAT_REVOKE_TRIGGERING_FIELDS.some((field) => result.changes[field] !== undefined)) {
+          return;
+        }
+        await autoRevokeOnPasswordChange(String(result.id));
+      },
     });
     const bindAutoRevokeOnPasswordChange: BindPatAutoRevokeOnPasswordChange = (revoker) => {
       // explicit constructor option wins over the runtime binding

package/packages/bundled-features/src/readiness/feature.ts

@@ -20,8 +20,8 @@ export const readinessFeature = defineFeature("readiness", (r) => {
     category: "operations",
     recommended: false,
   });
-  r.requires("config");
-  r.requires("secrets");
+  r.requires({ features: ["config"] });
+  r.requires({ features: ["secrets"] });
 
   const queries = {
     status: r.queryHandler(statusQuery),

package/packages/bundled-features/src/renderer-foundation/README.md

@@ -66,7 +66,7 @@ Mails einer `r.notification` rendert die Delivery selbst: `template` + `meta` an
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 
 export const myRendererFeature = defineFeature("renderer-myown", (r) => {
-  r.requires("renderer-foundation");
+  r.requires({ features: ["renderer-foundation"] });
   r.useExtension("renderer", "myown", {
     kinds: ["document-pdf"],
     // ctx ist optional — nur nehmen wenn Service-Access nötig

package/packages/bundled-features/src/renderer-foundation/feature.ts

@@ -20,7 +20,7 @@ export function createRendererFoundationFeature() {
       category: "notifications",
       recommended: false,
     });
-    r.requires("template-resolver");
+    r.requires({ features: ["template-resolver"] });
 
     r.extendsRegistrar(RENDERER_EXTENSION, {
       onRegister: () => {

package/packages/bundled-features/src/renderer-pdf/feature.ts

@@ -44,7 +44,7 @@ export function createRendererPdfFeature(): FeatureDefinition {
       category: "notifications",
       recommended: false,
     });
-    r.requires("renderer-foundation");
+    r.requires({ features: ["renderer-foundation"] });
 
     r.useExtension(RENDERER_EXTENSION, "pdf", {
       kinds: ["document-pdf"] as const,

package/packages/bundled-features/src/secrets/feature.ts

@@ -159,7 +159,7 @@ export function createSecretsFeature(opts: SecretsFeatureOptions = {}): FeatureD
     // uniqueIndex are not expressible via the field-DSL (jsonb-without-default,
     // now()-default), so the physical table is the DDL truth. Without this the
     // generated migration omitted those columns → prod-500 (publicstatus#116).
-    r.entity("tenant-secret", tenantSecretEntity, { table: tenantSecretsTable });
+    r.entity({ name: "tenant-secret", ...tenantSecretEntity, backingTable: tenantSecretsTable });
 
     // Read-audit domain-event. Registered here so ops tools + MSPs can
     // discover the type; secrets-context.get parses payloads against

package/packages/bundled-features/src/seo/feature.ts

@@ -179,7 +179,7 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
     // config keys need the config feature's write/read machinery to actually
     // function (same hard dependency managed-pages has) — only legal-pages/
     // managed-pages are genuinely optional (merged only when opted in).
-    r.requires("config");
+    r.requires({ features: ["config"] });
     r.optionalRequires("legal-pages", "managed-pages");
 
     r.config({ keys: SEO_CONFIG_KEYS });

package/packages/bundled-features/src/sessions/feature.ts

@@ -113,7 +113,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       // sessions-without-user wiring fails validateBoot instead of 500ing live.
       // auth-foundation owns EXT_SESSION_STORE, which the useExtension below
       // registers against.
-      r.requires("user", "auth-foundation");
+      r.requires({ features: ["user", "auth-foundation"] });
       // store_user_sessions is a hot-path direct-write store: sessionCreator
       // inserts and the revoke handlers update rows WITHOUT emitting lifecycle
       // events (the row columns ARE the audit trail). Registering it as
@@ -212,18 +212,22 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       // regardless.
       const REVOKE_TRIGGERING_FIELDS = ["passwordHash"] as const;
       let autoRevoke = options?.autoRevokeOnPasswordChange;
-      r.hook("postSave", { allOf: "user" }, async (ctx) => {
-        // skip: nothing bound — stateless-JWT deployments without a runtime
-        // that calls bindAutoRevokeOnPasswordChange keep the old behavior.
-        if (!autoRevoke) return;
-        // skip: brand-new user, no sessions can possibly exist yet. The
-        // initial passwordHash on a user:create would trip the second guard
-        // otherwise — every registration would do a mass-revoke roundtrip
-        // for a user who literally has no rows in user_sessions.
-        if (ctx.isNew) return;
-        // skip: handler didn't touch any revoke-triggering field
-        if (!REVOKE_TRIGGERING_FIELDS.some((field) => ctx.changes[field] !== undefined)) return;
-        await autoRevoke(String(ctx.id));
+      r.hook({
+        type: "postSave",
+        target: { allOf: "user" },
+        handler: async (ctx) => {
+          // skip: nothing bound — stateless-JWT deployments without a runtime
+          // that calls bindAutoRevokeOnPasswordChange keep the old behavior.
+          if (!autoRevoke) return;
+          // skip: brand-new user, no sessions can possibly exist yet. The
+          // initial passwordHash on a user:create would trip the second guard
+          // otherwise — every registration would do a mass-revoke roundtrip
+          // for a user who literally has no rows in user_sessions.
+          if (ctx.isNew) return;
+          // skip: handler didn't touch any revoke-triggering field
+          if (!REVOKE_TRIGGERING_FIELDS.some((field) => ctx.changes[field] !== undefined)) return;
+          await autoRevoke(String(ctx.id));
+        },
       });
 
       const bindAutoRevokeOnPasswordChange: BindAutoRevokeOnPasswordChange = (revoker) => {

package/packages/bundled-features/src/step-dispatcher/feature.ts

@@ -64,7 +64,7 @@ export function createStepDispatcherFeature(): FeatureDefinition {
       recommended: false,
     });
     r.envSchema(stepDispatcherEnvSchema);
-    r.requires("secrets");
+    r.requires({ features: ["secrets"] });
 
     // Literal name: the few-shot corpus parser only reads string-literal job names.
     // StepDispatcherJobNames.deliver mirrors it; feature.boot.test.ts pins the two together.

package/packages/bundled-features/src/subscription-mollie/feature.ts

@@ -154,7 +154,7 @@ export function createSubscriptionMollieFeature(
       category: "billing",
       recommended: false,
     });
-    r.requires("billing-foundation");
+    r.requires({ features: ["billing-foundation"] });
     r.envSchema(subscriptionMollieEnvSchema);
 
     const plugin: SubscriptionProviderPlugin = {

package/packages/bundled-features/src/subscription-stripe/feature.ts

@@ -155,9 +155,9 @@ export function createSubscriptionStripeFeature(
     // Hard-deps: billing-foundation (plugin-host) + config (billing-live +
     // backing:"secrets" credentials) + secrets (the store the backing:secrets
     // dispatch reads/writes + its tenant_secrets table).
-    r.requires("billing-foundation");
-    r.requires("config");
-    r.requires("secrets");
+    r.requires({ features: ["billing-foundation"] });
+    r.requires({ features: ["config"] });
+    r.requires({ features: ["secrets"] });
     r.envSchema(subscriptionStripeEnvSchema);
 
     // Runtime config. api-key + webhook-secret declare backing:"secrets" —

package/packages/bundled-features/src/tags/feature.ts

@@ -68,8 +68,8 @@ function registerTags(
   if (toggleable !== undefined) r.toggleable(toggleable);
 
   const tagAssignmentEntity = createTagAssignmentEntity(ownership, parents);
-  r.entity("tag", tagEntity);
-  r.entity("tag-assignment", tagAssignmentEntity);
+  r.entity({ name: "tag", ...tagEntity });
+  r.entity({ name: "tag-assignment", ...tagAssignmentEntity });
 
   r.writeHandler(createCreateTagHandler(access));
   r.writeHandler(createUpdateTagHandler(access));

package/packages/bundled-features/src/template-resolver/feature.ts

@@ -99,12 +99,12 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
         resourceMaxBytes: createSystemConfig("number", { default: 2_097_152, bounds: { min: 1 } }),
       },
     });
-    r.entity("template-resource", templateResourceEntity);
+    r.entity({ name: "template-resource", ...templateResourceEntity });
     // Only when the app actually mounts a user-owned collection: the entity's
     // `content` is `userOwned`, which makes it subject data — the boot guard
     // then requires an EXT_USER_DATA hook (mount `template-resolver-user-data`).
     // Registering it unconditionally would impose that on every app.
-    if (hasUserOwned) r.entity("user-content-entry", userContentEntryEntity);
+    if (hasUserOwned) r.entity({ name: "user-content-entry", ...userContentEntryEntity });
 
     const handlers = {
       upsertSystem: r.writeHandler(upsertSystemWrite),

package/packages/bundled-features/src/template-resolver-user-data/index.ts

@@ -16,7 +16,7 @@ export const templateResolverUserDataFeature = defineFeature("template-resolver-
   // template-resolver is optional for the same reason as in
   // notes-history-user-data: a toggleable mount would otherwise trip the
   // "effectively disabled" boot warning even though the entity is there.
-  r.requires("user-data-rights");
+  r.requires({ features: ["user-data-rights"] });
   r.optionalRequires("template-resolver");
   r.useExtension(EXT_USER_DATA, "user-content-entry", {
     export: userContentExportHook,

package/packages/bundled-features/src/tenant/feature.ts

@@ -80,7 +80,7 @@ export function createTenantFeature(options?: TenantFeatureOptions): FeatureDefi
       recommended: true,
     });
     r.systemScope();
-    r.requires("config");
+    r.requires({ features: ["config"] });
     r.extendsRegistrar(EXT_ASSIGNABLE_ROLE, {});
     // The elevation guards read the registry, the screens only these options: a role the
     // server accepts but the screen omits is silently stripped on the next member-roles save.
@@ -92,9 +92,9 @@ export function createTenantFeature(options?: TenantFeatureOptions): FeatureDefi
         );
       }
     });
-    r.entity("tenant", tenantEntity);
-    r.entity("tenant-membership", tenantMembershipEntity);
-    r.entity("tenant-invitation", tenantInvitationEntity);
+    r.entity({ name: "tenant", ...tenantEntity });
+    r.entity({ name: "tenant-membership", ...tenantMembershipEntity });
+    r.entity({ name: "tenant-invitation", ...tenantInvitationEntity });
 
     r.config({
       keys: {

package/packages/bundled-features/src/tenant/seeding.ts

@@ -292,7 +292,7 @@ export async function seedTenant(
 
   // "tenant:seed" matches no handler-scoped hook, only entity-scoped ones
   // (keyed by result.entityName === "tenant") — that's exactly what
-  // tier-engine's `r.hook("postSave", { allOf: "tenant" }, ...)` needs.
+  // tier-engine's `r.hook({ type: "postSave", target: { allOf: "tenant" }, ... })` needs.
   await fireEntityPostSave(hooks, "tenant:seed", result.data, { tenantId: options.id, db });
 
   return { id: options.id };

package/packages/bundled-features/src/tenant-lifecycle/feature.ts

@@ -63,7 +63,7 @@ export function createTenantLifecycleFeature(): FeatureDefinition {
       category: "compliance",
       recommended: false,
     });
-    r.requires("tenant", "compliance-profiles");
+    r.requires({ features: ["tenant", "compliance-profiles"] });
     r.optionalRequires("sessions");
     r.usesApi("compliance.forTenant");
 
@@ -140,8 +140,7 @@ export function createTenantLifecycleFeature(): FeatureDefinition {
         if (!ctx.registry) {
           throw new Error("run-tenant-destruction: ctx.registry required (JobContext incomplete)");
         }
-        const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
-        const now = T.Now.instant();
+        const now = ctx.tz.now();
         // Without crossTenantReads (undeclared hatch) fall through to the sweep.
         if (ctx.crossTenantReads && !(await hasTenantDestructionWork(ctx.crossTenantReads, now))) {
           // skip: no tenant is due, so the sweep would not touch anything

package/packages/bundled-features/src/tenant-settings/feature.ts

@@ -22,7 +22,7 @@ export function createTenantSettingsFeature(
   opts: TenantSettingsFeatureOptions = {},
 ): FeatureDefinition {
   return defineFeature(TENANT_SETTINGS_FEATURE_NAME, (r) => {
-    r.requires("config");
+    r.requires({ features: ["config"] });
     r.describe(
       "Per-tenant Currency + Locale defaults, exposed as two config keys (tenant-settings:config:currency, tenant-settings:config:locale) that surface in the self-populating Settings-Hub via `mask`. Pair with defineCreateWithTenantDefaults to auto-fill a money field's currency or a locale field on create instead of hard-coding a literal per entity.",
     );