@@ -0,0 +1,20 @@
+---
+'@objectstack/runtime': patch
+'@objectstack/cli': patch
+'@objectstack/spec': patch
+---
+
+feat(runtime): a sandboxed body can do time-zone date maths, through `Intl.DateTimeFormat`
+
+Clause-②: no
+Metadata-protocol: none
+
+The body sandbox (QuickJS) had no `Intl`, so a job `body` could not tell which calendar day or period an instant falls in for a named IANA zone. A job that needs that kept the deprecated `handler`. The sandbox now has `globalThis.Intl` with one member, `DateTimeFormat`, and it is the whole constructor: `new Intl.DateTimeFormat(locales, { timeZone, ... })` (or without `new`), `supportedLocalesOf`, and `format` (a bound getter), `formatToParts`, `formatRange`, `formatRangeToParts` and `resolvedOptions`. Every answer comes from the server's own `Intl`, so the output matches the server's for the same input, IANA zones and DST edges included. An invalid `timeZone` throws the server's `RangeError` text as a `RangeError` inside the body. Nothing else of `Intl` exists (`Intl.NumberFormat` is `undefined`), so test for it with `typeof Intl.DateTimeFormat === 'function'`.
+
+**Hooks and actions too.** Hook, action and job bodies run through one sandbox runner, so all three get the same `Intl.DateTimeFormat`.
+
+**Isolation is unchanged.** Only plain values cross the boundary: a snapshot of the locales and the options `DateTimeFormat` reads, and epoch-millisecond numbers in, one JSON string out, parsed inside the sandbox. No host object reaches a body, the bridge is not a global, and "now" for `format()` comes from the sandbox's own `Date.now()`. There is no new I/O.
+
+**`os build` lowering (cli).** A hook or action `handler` function that uses `Intl.DateTimeFormat` now lowers to a metadata `body` instead of being bundled, and `os lint` stops reporting it under `hook-body/not-lowerable`. The rest of `Intl` is judged per member: a handler using `Intl.NumberFormat`, or the bare `Intl` name in a way the build cannot follow (`const I = Intl`, `Intl[k]`), is still refused and bundled, and the refusal names the member, for example `Intl.NumberFormat`, where it used to name `Intl`. The refusal sentence now says the sandbox provides `Intl.DateTimeFormat` only of `Intl`, and says the body "would throw" where it said "would throw ReferenceError".
+
+**Migration text (spec).** The job `handler` description, which marks `handler` deprecated, now says time-zone date maths moves to `body` too, through `Intl.DateTimeFormat`. The accepted metadata is unchanged.
@@ -191,6 +191,14 @@ What running in the sandbox means for the code in `source`:
   `ctx.api.object(…)`, and only with the tokens it declares: `api.read`,
   `api.write`, `api.transaction`. Logging is `ctx.log`, under `log`. An undeclared
   call throws at run time. Outbound HTTP is not available; use a Connector.
+- **Time-zone date maths works.** `Intl.DateTimeFormat` is in the sandbox, whole
+  (`format`, `formatToParts`, `formatRange`, `formatRangeToParts`,
+  `resolvedOptions`), and answers exactly as the server's own does, so a body can
+  find the calendar date or period of an instant in a named IANA zone:
+  `new Intl.DateTimeFormat('en-CA', { timeZone: 'Asia/Shanghai', year: 'numeric', month: '2-digit', day: '2-digit' }).format(Date.now())`.
+  Nothing else of `Intl` is there (`Intl.NumberFormat` is `undefined`); test for
+  it with `typeof Intl.DateTimeFormat === 'function'`. Hook and action bodies run
+  in the same sandbox and get the same `Intl.DateTimeFormat`.
 - **Not the handler's context.** The `JobHandlerContext` a `handler` receives —
   `ql`, `logger`, `bundle` — does not exist inside the sandbox. A handler is not
   turned into a body by copying its source: rewrite its `ql.find(…)` reads as
 
@@ -57,7 +57,7 @@ const result = CronScheduleSchema.parse(data);
 | **label** | `string` | optional | Human-readable label |
 | **description** | `string` | optional | Job description / purpose |
 | **schedule** | `{ type: 'cron'; expression: string \| object; timezone?: string } \| { type: 'interval'; intervalMs: integer } \| { type: 'once'; at: string }` | ✅ | Job schedule configuration |
-| **handler** | `string` | optional | Handler function name (must match a key in `defineStack({ functions })`) — DEPRECATED, prefer `body`. When both are present `body` wins; refused beside `pull`. A job must declare one of `body`, `handler` or `pull`. |
+| **handler** | `string` | optional | Handler function name (must match a key in `defineStack({ functions })`) — DEPRECATED, prefer `body`. When both are present `body` wins; refused beside `pull`. A job must declare one of `body`, `handler` or `pull`. Time-zone date maths moves to `body` too: `Intl.DateTimeFormat` with a `timeZone` option is available in the sandbox (nothing else of `Intl` is). |
 | **body** | `{ language: 'js'; source: string; capabilities?: Enum<'api.read' \| 'api.write' \| 'api.transaction' \| 'crypto.uuid' \| 'log'>[]; timeoutMs?: integer; … }` | optional | Job body — a sandboxed JS (L2) body, the same shape hooks and actions use; an expression (L1) body is refused, because a job runs for its effects and an expression has none. Preferred over `handler`: when both are present `body` wins. It runs in the QuickJS sandbox with no module scope (no imports, no helpers or constants from the surrounding file): it reaches data only through `ctx.api` under its declared `capabilities` (`api.read` / `api.write` / `api.transaction`) and logs through `ctx.log` (`log`); the in-process handler context (`ql`, `logger`, `bundle`) does not exist there. Its time limit is the job's `timeoutMs` (see there): long-running work declares a `timeoutMs` that covers it, or splits into bounded runs that each finish within it. Every door that brings an artifact in schedules a job's `body` — the boot, and `os package install` on install and on every restart — while a `handler` is code that travels only in the artifact's runtime module and runs only on a boot that loads it (a config, or `os start --artifact`); `os package install` therefore refuses an enabled job with no `body`. A `pull` is data too, so an enabled `pull` job is judged by its `pull` instead: it installs when the `pull` binds (it names a mapping the package declares, with a `connectorSource`) and is refused when it does not, as is a job whose `body` the declaration refuses. Refused beside `pull`. |
 | **pull** | `{ mapping: string }` | optional | Pull run form: on each run the platform pulls the named mapping's `connectorSource` (one action call, one response) and writes the rows through the import runner — no code. A refused pull records the run `failed` (retried per `retryPolicy`); a pull whose rows the import runner refused records it `degraded`. Data like `body`, so every door schedules it. Refused beside `body` or `handler`. |
 | **organization** | `string` | optional | Organization id (sys_organization.id) this job runs as — its `body`'s `ctx.api`, the execution context its `handler` is handed, and its `pull`'s reads and writes alike, as a system run carrying that organization. A scheduled run has no session to inherit one from. Judged at bind by the posture rule scheduled flows use: required under the isolated tenancy posture (a job that declares none is not scheduled); optional under group (undeclared, the run carries no organization and a tenant-scoped write it makes is refused); not required under single (the install's one organization is resolved beneath each write). Where declared, it is the organization the run acts as on every posture. |
 
@@ -47,13 +47,26 @@ const forbiddenTokenHook = {
 // [#14301] A global the NODE HOST provides and the sandbox does not. Reads as
 // self-contained — `Intl` is standard in every browser and in Node — which is
 // precisely why it is the ACCIDENTAL class and not the structural one.
+// [#28898] Pinned on `Intl.NumberFormat`: the sandbox provides
+// `Intl.DateTimeFormat` now, and nothing else of `Intl`.
 const nodeOnlyGlobalHook = {
   name: 'stamp_due_label',
   object: 'task',
   events: ['beforeInsert'],
   handler: (ctx: any) => {
-    const f = new Intl.DateTimeFormat('en-US', { timeZone: 'UTC' });
-    ctx.input.due_label = f.format(new Date(ctx.input.due_at));
+    const f = new Intl.NumberFormat('en-US', { style: 'currency', currency: 'USD' });
+    ctx.input.due_label = f.format(ctx.input.amount);
+  },
+};
+
+// [#28898] The same handler shape on the member the sandbox DOES provide.
+const sandboxDateFormatHook = {
+  name: 'stamp_due_day',
+  object: 'task',
+  events: ['beforeInsert'],
+  handler: (ctx: any) => {
+    const f = new Intl.DateTimeFormat('en-US', { timeZone: 'Asia/Shanghai' });
+    ctx.input.due_day = f.format(new Date(ctx.input.due_at));
   },
 };
 
@@ -119,6 +132,10 @@ describe('checkHookBodyLowering', () => {
       expect(issues[0].message).toContain('deployment shape');
     });
 
+    it('reports nothing for Intl.DateTimeFormat, which the sandbox provides (#28898)', () => {
+      expect(checkHookBodyLowering({ hooks: [sandboxDateFormatHook] })).toEqual([]);
+    });
+
     it('prints the remedy that is POSSIBLE, not the inline one', () => {
       // The wrong-remedy failure is worse than none: there is nothing to inline
       // `Intl` from, so an author (or a code-writing model) told to inline it
 
@@ -198,25 +198,54 @@ describe('detectFreeIdentifiers (#1876 — body self-containment)', () => {
   // membership of the two sets is not asserted here from knowledge — it is
   // measured inside the real sandbox by `sandbox-globals-probe.test.ts`.
   describe('reports host globals the sandbox does not provide', () => {
-    it('the card reproduction — Intl.DateTimeFormat', () => {
+    // The #14301 reproduction called `Intl.DateTimeFormat`, which the sandbox
+    // has provided since #28898 (below). The class it pinned is unchanged and
+    // is pinned on a member the sandbox still lacks.
+    it('the card reproduction — an Intl member the sandbox lacks', () => {
       const r = detectFreeIdentifiers(
-        "(ctx) => { const f = new Intl.DateTimeFormat('en-US'); ctx.input.label = f.format(new Date(ctx.input.at)); }",
+        "(ctx) => { const f = new Intl.NumberFormat('en-US'); ctx.input.label = f.format(ctx.input.amount); }",
       );
       expect(r.unparsed).toBe(false);
-      expect(r.free).toEqual(['Intl']);
-      expect(r.nodeOnly).toEqual(['Intl']);
+      expect(r.free).toEqual(['Intl.NumberFormat']);
+      expect(r.nodeOnly).toEqual(['Intl.NumberFormat']);
     });
 
     it('`nodeOnly` is a labelled SUBSET of `free`, not a second list', () => {
       // Both halves at once. The caller needs them apart because the remedies
       // are opposite — inline the helper, but a host global cannot be inlined
       // — and needs them together because the refusal names every name.
       const r = detectFreeIdentifiers('(ctx) => { ctx.x = slugify(ctx.name) + Intl.NumberFormat; }');
-      expect(r.free).toEqual(['Intl', 'slugify']);
-      expect(r.nodeOnly).toEqual(['Intl']);
+      expect(r.free).toEqual(['Intl.NumberFormat', 'slugify']);
+      expect(r.nodeOnly).toEqual(['Intl.NumberFormat']);
       expect(r.nodeOnly.every((n) => r.free.includes(n))).toBe(true);
     });
 
+    // ── #28898 — `Intl` is judged per member ────────────────────────────────
+    it('Intl.DateTimeFormat is sandbox-provided, so a handler using only it has no free name', () => {
+      const r = detectFreeIdentifiers(
+        "(ctx) => { const f = new Intl.DateTimeFormat('en-US', { timeZone: 'Asia/Shanghai' }); ctx.input.label = f.formatToParts(new Date(ctx.input.at)).map((p) => p.value).join(''); }",
+      );
+      expect(r.free).toEqual([]);
+      expect(r.nodeOnly).toEqual([]);
+    });
+
+    it('a use of the bare namespace cannot be judged, so it is reported — the safe direction', () => {
+      for (const source of [
+        '(ctx) => { const I = Intl; ctx.x = new I.DateTimeFormat().format(0); }',
+        "(ctx) => { ctx.x = new Intl['DateTimeFormat']().format(0); }",
+      ]) {
+        const r = detectFreeIdentifiers(source);
+        expect(r.free, source).toEqual(['Intl']);
+        expect(r.nodeOnly, source).toEqual(['Intl']);
+      }
+    });
+
+    it('a member neither set lists is reported as host-only, not waived', () => {
+      const r = detectFreeIdentifiers('(ctx) => { ctx.x = Intl.SomeFutureFormat; }');
+      expect(r.free).toEqual(['Intl.SomeFutureFormat']);
+      expect(r.nodeOnly).toEqual(['Intl.SomeFutureFormat']);
+    });
+
     it('a sandbox-provided global is still waived — the positive control', () => {
       const r = detectFreeIdentifiers('(ctx) => { ctx.x = JSON.stringify(Math.round(ctx.n)); }');
       expect(r.free).toEqual([]);
 
@@ -72,6 +72,11 @@ export const SANDBOX_GLOBALS: ReadonlySet<string> = new Set([
   'encodeURIComponent', 'decodeURIComponent', 'encodeURI', 'decodeURI',
   // Literal-ish globals
   'undefined', 'NaN', 'Infinity', 'globalThis',
+  // A MEMBER of a {@link MEMBER_JUDGED_GLOBALS} namespace. The sandbox installs
+  // `Intl` with this one constructor, whole (every prototype method), and
+  // backs it with the host's (#28898) — so a handler formatting a date in an
+  // IANA zone lowers and runs the same in both places.
+  'Intl.DateTimeFormat',
 ]);
 
 /**
@@ -92,9 +97,12 @@ export const SANDBOX_GLOBALS: ReadonlySet<string> = new Set([
  * measured by the probe, never an edit here.
  */
 export const NODE_ONLY_GLOBALS: ReadonlySet<string> = new Set([
-  // ECMA-402. Standard in every browser and in Node; absent from this QuickJS
-  // build. The name the defect was reported under.
-  'Intl',
+  // ECMA-402. Standard in every browser and in Node; the sandbox's `Intl`
+  // carries `DateTimeFormat` only (#28898), so every other member is absent.
+  // `Intl` was the name the #14301 defect was reported under.
+  'Intl.Collator', 'Intl.DisplayNames', 'Intl.ListFormat', 'Intl.Locale',
+  'Intl.NumberFormat', 'Intl.PluralRules', 'Intl.RelativeTimeFormat', 'Intl.Segmenter',
+  'Intl.getCanonicalLocales', 'Intl.supportedValuesOf',
   // Host/Web platform additions, not ECMAScript. QuickJS is the language, not
   // the platform — nothing installs these into the VM.
   'structuredClone', 'queueMicrotask', 'atob', 'btoa',
@@ -113,6 +121,22 @@ export const NODE_ONLY_GLOBALS: ReadonlySet<string> = new Set([
   'arguments',
 ]);
 
+/**
+ * Namespaces the sandbox provides IN PART, so a reference to one is judged per
+ * member rather than per name (#28898). `Intl.DateTimeFormat` resolves in the
+ * sandbox and `Intl.NumberFormat` does not, so "is `Intl` in scope?" has no
+ * single answer: {@link collectReferences} records a non-computed member read
+ * as `Intl.NAME` and judges that against {@link SANDBOX_GLOBALS} /
+ * {@link NODE_ONLY_GLOBALS}. Any other use of the bare name — `const I = Intl`,
+ * `Intl[k]`, passing it along — cannot be judged statically, so it is reported
+ * as `Intl` and the handler stays bundled: the safe direction.
+ *
+ * Measured like the other two sets: `sandbox-globals-probe.test.ts` requires
+ * each member here to be PRESENT in the sandbox, and a member it reaches
+ * through to be present or absent as the two sets say.
+ */
+export const MEMBER_JUDGED_GLOBALS: ReadonlySet<string> = new Set(['Intl']);
+
 export interface FreeIdentifierResult {
   /**
    * Sorted, de-duplicated names the handler references and NOTHING in the
@@ -268,6 +292,16 @@ function collectReferences(fn: ts.FunctionLikeDeclarationBase): Set<string> {
     if (ts.isTypeNode(node)) return;
 
     if (ts.isPropertyAccessExpression(node)) {
+      // [#28898] `Intl.DateTimeFormat` — a member of a namespace the sandbox
+      // provides in part is the reference, judged as `Intl.NAME`.
+      if (
+        ts.isIdentifier(node.expression) &&
+        MEMBER_JUDGED_GLOBALS.has(node.expression.text) &&
+        ts.isIdentifier(node.name)
+      ) {
+        refs.add(`${node.expression.text}.${node.name.text}`);
+        return;
+      }
       // `a.b` — visit `a` (could be a ref) but NOT `b` (member name).
       walk(node.expression);
       return;
@@ -346,13 +380,18 @@ export function detectFreeIdentifiers(rawFunctionSource: string): FreeIdentifier
   const free: string[] = [];
   const nodeOnly: string[] = [];
   for (const name of refs) {
-    if (bound.has(name)) continue;
+    // A member reference (`Intl.NAME`) is bound when its namespace name is: a
+    // local or parameter called `Intl` is the author's, not the host's.
+    const root = name.split('.', 1)[0];
+    if (bound.has(root)) continue;
     // Only the SANDBOX set waives a name. A `NODE_ONLY_GLOBALS` member falls
     // through to `free` on purpose — that is the whole fix — and is ALSO
-    // recorded in `nodeOnly` so the refusal can name the right remedy.
+    // recorded in `nodeOnly` so the refusal can name the right remedy. So is
+    // any other use of a member-judged namespace (the bare name, or a member
+    // neither set lists): the host has it, the sandbox is not known to.
     if (SANDBOX_GLOBALS.has(name)) continue;
     free.push(name);
-    if (NODE_ONLY_GLOBALS.has(name)) nodeOnly.push(name);
+    if (NODE_ONLY_GLOBALS.has(name) || MEMBER_JUDGED_GLOBALS.has(root)) nodeOnly.push(name);
   }
   free.sort();
   nodeOnly.sort();
 
@@ -711,11 +711,16 @@ function freeIdentifierRefusal(
         `inline them into the handler or move the logic behind \`ctx\` (e.g. \`ctx.api\`).`
       : '';
   const hint = nodeOnly.map((n) => SANDBOX_REPLACEMENTS[n]).filter(Boolean).join(' ');
+  // [#28898] The sandbox's `Intl` is partial, so a refused `Intl` name says
+  // which part exists: "does not provide Intl" alone is false of the namespace.
+  const intlNote = nodeOnly.some((n) => n === 'Intl' || n.startsWith('Intl.'))
+    ? ' (of `Intl` it provides `Intl.DateTimeFormat` only)'
+    : '';
 
   return (
     head +
     `${names} ${isAre} not available in the hook sandbox — the QuickJS build the runtime evaluates a ` +
-    `lowered body in does not provide ${itThem}, so the body would throw ReferenceError in production ` +
+    `lowered body in does not provide ${itThem}${intlNote}, so the body would throw in production ` +
     `while validate, typecheck, test and build all stay green (they run the raw function in Node, ` +
     `where ${itThem} exist${nodeOnly.length === 1 ? 's' : ''}). This handler will be BUNDLED instead ` +
     `(no behavior change). To keep it as metadata, keep the check in a string handler ref — put the ` +