@cosmicdrift/kumiko-bundled-features 0.209.1 → 0.211.0

package/src/template-resolver/__tests__/collection-ownership.integration.test.ts

@@ -321,7 +321,7 @@ describe("GDPR :: the owner column is what makes erasure possible", () => {
 
   test("the tenant-wide table keeps its business-data declaration", () => {
     const content = templateResourceEntity.fields["content"];
-    expect((content as { allowPlaintext?: string }).allowPlaintext).toBe("is-business-data");
+    expect((content as { allowPlaintext?: string }).allowPlaintext).toBe("is_business_data");
     expect((content as { userOwned?: unknown }).userOwned).toBeUndefined();
   });
 

package/src/template-resolver/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.195.0",
+    "type": "breaking",
+    "title": "ContentEditorProps gains a required id (fw#2001).",
+    "detail": "TextBlockEditor's Field wrapping a registered \"rich\"/\"plain\" editor pointed its htmlFor at the fixed CONTENT_EDITOR_ELEMENT_ID, which only the never-mounted textarea fallback actually used — the label was disconnected from the real input as soon as a collection declared contentFormat: \"rich\" or \"plain\". TextBlockEditor now generates a per-instance id via useId() and passes it to both the Field and the ContentEditor, so the label stays correctly associated and two editors mounted on the same page no longer collide on a shared DOM id.",
+    "migration": "A custom-registered content editor component now needs to accept and use this id prop, rendering it onto its own focusable root element. Consumers that don't touch the DOM id directly are unaffected. CONTENT_EDITOR_ELEMENT_ID stays exported as a default value for callers that don't need their own generated id."
+  }
+]

package/src/template-resolver/table.ts

@@ -30,7 +30,10 @@ export const templateResourceEntity = createEntity({
     folder: createTextField({}),
     // Template-body is authored by TenantAdmin/Operator (email-templates etc.),
     // business data — kein end-user UGC.
-    content: createLongTextField({ allowPlaintext: "is-business-data" }),
+    content: createLongTextField({
+      personal: false,
+      reason: "is_business_data",
+    }),
     contentFormat: createSelectField({ required: true, options: [...CONTENT_FORMATS] }),
     variableSchema: createLongTextField({}),
     linkedResources: createLongTextField({}),

package/src/template-resolver/user-content-table.ts

@@ -24,13 +24,16 @@ import { CONTENT_FORMATS, TEMPLATE_KINDS } from "./constants";
 export const userContentEntryEntity = createEntity({
   table: "read_user_content_entries",
   fields: {
-    ownerId: createTextField({ required: true, subjectRef: true }),
+    ownerId: createTextField({ required: true, personal: "ref" }),
     slug: createTextField({ required: true }),
     kind: createSelectField({ required: true, options: [...TEMPLATE_KINDS] }),
     locale: createTextField({ required: true }),
     title: createTextField({}),
     folder: createTextField({}),
-    content: createLongTextField({ userOwned: { ownerField: "ownerId" } }),
+    content: createLongTextField({
+      personal: { of: "ownerId" },
+      find: "none",
+    }),
     contentFormat: createSelectField({ required: true, options: [...CONTENT_FORMATS] }),
   },
   indexes: [

package/src/template-resolver-user-data/hooks.ts

@@ -29,11 +29,12 @@ export const userContentExportHook: UserDataExportHook = async (ctx) => {
   };
 };
 
-// Deliberate no-op: `content` is annotated `userOwned`, so erasure runs via
-// crypto-shredding — destroying the owner's subject key makes every event AND
-// the projected row unreadable at once. A physical DELETE would not be
-// rebuild-safe here: user-content-entry is event-sourced, so a replay would
-// bring the row back (with unreadable content, but back).
+// Deliberate no-op: `content` is annotated `personal: { of: "ownerId" }`, so
+// erasure runs via crypto-shredding — destroying the owner's subject key
+// makes every event AND the projected row unreadable at once. A physical
+// DELETE would not be rebuild-safe here: user-content-entry is
+// event-sourced, so a replay would bring the row back (with unreadable
+// content, but back).
 // Precondition: this only erases anything if the app mounts a KMS adapter —
 // without one, userOwned fields fall back to plaintext framework-wide and
 // forget is a true no-op for `content`. Same property as notes-history.

package/src/tenant/__tests__/members-screens.boot.test.ts

@@ -3,30 +3,105 @@ import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createConfigFeature } from "../../config/feature";
-import { MEMBERS_SCREEN_ID, TenantHandlers, TenantQueries } from "../constants";
+import {
+  INVITE_CREATE_SCREEN_ID,
+  MEMBERS_SCREEN_ID,
+  TenantHandlers,
+  TenantQueries,
+} from "../constants";
 import { createTenantFeature } from "../feature";
 
 describe("tenant members screen + handler access alignment", () => {
   const features = [createConfigFeature(), createTenantFeature()];
 
-  test("boot-validates with members screen registered", () => {
+  test("boot-validates with members screen registered (inviteScreen off by default)", () => {
     expect(() => validateBoot(features)).not.toThrow();
   });
 
-  test("members screen is custom, access.admin-gated", () => {
+  // fw-2223 regression: an actionForm screen bound to an OPTIONAL
+  // cross-feature handler (auth-email-password's invite-create, only
+  // registered when its `invite` option is configured) must not be
+  // unconditionally wired into `tenant` — apps that mount tenant with
+  // auth-email-password but without `invite` would otherwise fail boot.
+  // `inviteScreen` defaults to false so the test above keeps booting clean
+  // with no auth-email-password mounted at all.
+  test("without inviteScreen, the invite toolbar action and actionForm screen are absent", () => {
     const tenant = createTenantFeature();
     const screen = tenant.screens[MEMBERS_SCREEN_ID];
-    expect(screen?.type).toBe("custom");
+    if (screen?.type !== "projectionList")
+      throw new Error("expected members screen to be projectionList");
+    expect(screen.toolbarActions ?? []).toHaveLength(0);
+    expect(tenant.screens[INVITE_CREATE_SCREEN_ID]).toBeUndefined();
+  });
+
+  // The opt-in path (inviteScreen: true + a real auth-email-password with
+  // `invite` configured) boots and works end to end — proven in
+  // tenant-security.integration.test.ts's setupTestStack, which composes the
+  // full realistic stack (delivery, channel-email, template-resolver, etc.)
+  // that a minimal validateBoot() here would otherwise have to duplicate.
+
+  test("members screen is a projectionList backed by team:list, access.admin-gated", () => {
+    const tenant = createTenantFeature();
+    const screen = tenant.screens[MEMBERS_SCREEN_ID];
+    expect(screen?.type).toBe("projectionList");
+    if (screen?.type === "projectionList") {
+      expect(screen.query).toBe(TenantQueries.teamList);
+    }
     if (screen && "access" in screen && screen.access && "roles" in screen.access) {
       expect(screen.access.roles).toEqual(access.admin);
     }
   });
 
+  test("cancel-invitation row action is only visible on pending rows and cancels via TenantHandlers.cancelInvitation", () => {
+    const tenant = createTenantFeature();
+    const screen = tenant.screens[MEMBERS_SCREEN_ID];
+    if (screen?.type !== "projectionList")
+      throw new Error("expected members screen to be projectionList");
+    const rowAction = screen.rowActions?.find((a) => a.id === "cancel-invitation");
+    if (rowAction?.kind !== "writeHandler") throw new Error("expected a writeHandler row action");
+    expect(rowAction.handler).toBe(TenantHandlers.cancelInvitation);
+    expect(rowAction.payload).toEqual({ map: { invitationId: "id" } });
+    expect(rowAction.visible).toEqual({ field: "status", eq: "pending" });
+  });
+
+  // The generic drawer-open/submit/close/refetch mechanics for kind:"drawer"
+  // toolbar actions are already covered end-to-end with a synthetic screen in
+  // renderer-web's projection-list-actions.test.tsx — this only proves OUR
+  // wiring (which screen, which handler, which fields) is correct. The
+  // "submit creates the invitation, list shows it afterward" behavior is
+  // proven at the backend layer in tenant-security.integration.test.ts.
+  test("invite toolbar action opens the same-feature invite-create actionForm, bound to AuthHandlers.inviteCreate", () => {
+    const tenant = createTenantFeature({ inviteScreen: true });
+    const membersScreenDef = tenant.screens[MEMBERS_SCREEN_ID];
+    if (membersScreenDef?.type !== "projectionList") {
+      throw new Error("expected members screen to be projectionList");
+    }
+    const toolbarAction = membersScreenDef.toolbarActions?.find((a) => a.id === "invite");
+    if (toolbarAction?.kind !== "drawer") throw new Error("expected a drawer toolbar action");
+    expect(toolbarAction.screen).toBe(INVITE_CREATE_SCREEN_ID);
+
+    const inviteScreen = tenant.screens[INVITE_CREATE_SCREEN_ID];
+    expect(inviteScreen?.type).toBe("actionForm");
+    if (inviteScreen?.type === "actionForm") {
+      expect(inviteScreen.handler).toBe(AuthHandlers.inviteCreate);
+      expect(Object.keys(inviteScreen.fields)).toEqual(["email", "role"]);
+    }
+    if (
+      inviteScreen &&
+      "access" in inviteScreen &&
+      inviteScreen.access &&
+      "roles" in inviteScreen.access
+    ) {
+      expect(inviteScreen.access.roles).toEqual(access.admin);
+    }
+  });
+
   test("members UI handlers share access.admin (screen ⊆ handler)", () => {
     const tenant = createTenantFeature();
     const adminRoles = [...access.admin];
     expect(rolesOf(tenant.queryHandlers["members"]?.access)).toEqual(adminRoles);
     expect(rolesOf(tenant.queryHandlers["invitations"]?.access)).toEqual(adminRoles);
+    expect(rolesOf(tenant.queryHandlers["team:list"]?.access)).toEqual(adminRoles);
     expect(rolesOf(tenant.writeHandlers["cancel-invitation"]?.access)).toEqual(adminRoles);
     // invite-create lives on auth feature — checked in tenant-security.integration.test.ts
     void AuthHandlers;

package/src/tenant/__tests__/tenant-security.integration.test.ts

@@ -11,7 +11,8 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { expectErrorIncludes, rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { expectErrorIncludes, rolesOf, seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { Temporal } from "temporal-polyfill";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
@@ -22,6 +23,7 @@ import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery
 import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createUserFeature } from "../../user/feature";
@@ -61,7 +63,9 @@ beforeAll(async () => {
     features: [
       createConfigFeature(),
       createUserFeature(),
-      createTenantFeature(),
+      // inviteScreen: this suite dispatches AuthHandlers.inviteCreate and
+      // needs /members' invite-create actionForm screen registered too.
+      createTenantFeature({ inviteScreen: true }),
       createTemplateResolverFeature(),
       createRendererFoundationFeature(),
       createDeliveryFeature(),
@@ -93,6 +97,7 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
   await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await unsafePushTables(stack.db, {
     configValuesTable,
     tenantMembershipsTable,
@@ -108,6 +113,7 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantInvitationsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userSessionTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
   emailTransport.sent.length = 0;
   const keys = await stack.redis.redis.keys("invite:*");
@@ -229,10 +235,11 @@ describe("TenantAdmin can use members-admin HTTP surface", () => {
 });
 
 describe("regular User is denied members-admin surface", () => {
-  test("403 on members, invitations, invite-create, cancel-invitation", async () => {
+  test("403 on members, invitations, team:list, invite-create, cancel-invitation", async () => {
     for (const [label, fn] of [
       ["members", () => stack.http.query(TenantQueries.members, {}, regularUserB())],
       ["invitations", () => stack.http.query(TenantQueries.invitations, {}, regularUserB())],
+      ["team:list", () => stack.http.query(TenantQueries.teamList, {}, regularUserB())],
       [
         "invite-create",
         () =>
@@ -247,6 +254,11 @@ describe("regular User is denied members-admin surface", () => {
       expect(res.status, label).toBe(403);
     }
   });
+
+  // The /members screen gates on the SAME access.admin roles as its query
+  // (see members-screens.boot.test.ts) — there is no separate HTTP surface
+  // for "screen access" beyond the query/handlers it dispatches, so denying
+  // the query above + the screen.access assertion together cover point 8.
 });
 
 describe("privilege escalation via invite role", () => {
@@ -298,6 +310,251 @@ describe("tenant isolation on cancel-invitation", () => {
   });
 });
 
+type TeamListRow = {
+  readonly id: string;
+  readonly email: string | null;
+  readonly roles: readonly string[];
+  readonly status: "active" | "pending";
+  readonly createdAt: string;
+  readonly lastSeenAt: string | null;
+};
+
+async function queryTeamList(
+  payload: Record<string, unknown>,
+  user: SessionUser,
+): Promise<readonly TeamListRow[]> {
+  const result = await stack.http.queryOk<{
+    rows: readonly TeamListRow[];
+    nextCursor: string | null;
+  }>(TenantQueries.teamList, payload, user);
+  return result.rows;
+}
+
+describe("tenant:query:team:list — combined members + pending invitations (§2.6a)", () => {
+  test("returns both memberships and pending invitations with correct per-row status", async () => {
+    const { id: memberUserId } = await seedUser(stack.db, {
+      email: "member-x@example.com",
+      displayName: "Member X",
+      passwordHash: await hashPassword("pw-x-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "invitee-x@example.com", role: "Editor" },
+      tenantAdminA(),
+    );
+
+    const rows = await queryTeamList({}, tenantAdminA());
+    const admin = rows.find((r) => r.email === "admin-a@example.com");
+    const member = rows.find((r) => r.email === "member-x@example.com");
+    const invitee = rows.find((r) => r.email === "invitee-x@example.com");
+    expect(admin?.status).toBe("active");
+    expect(admin?.roles).toEqual(["TenantAdmin"]);
+    expect(member?.status).toBe("active");
+    expect(member?.roles).toEqual(["User"]);
+    expect(invitee?.status).toBe("pending");
+    expect(invitee?.roles).toEqual(["Editor"]);
+  });
+
+  test("status facet genuinely narrows to matching rows, not just the count", async () => {
+    const { id: memberUserId } = await seedUser(stack.db, {
+      email: "member-y@example.com",
+      displayName: "Member Y",
+      passwordHash: await hashPassword("pw-y-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "invitee-y1@example.com", role: "User" },
+      tenantAdminA(),
+    );
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "invitee-y2@example.com", role: "User" },
+      tenantAdminA(),
+    );
+
+    const pendingOnly = await queryTeamList(
+      { filters: [{ field: "status", op: "in", value: ["pending"] }] },
+      tenantAdminA(),
+    );
+    expect(pendingOnly.map((r) => r.email).sort()).toEqual([
+      "invitee-y1@example.com",
+      "invitee-y2@example.com",
+    ]);
+
+    const activeOnly = await queryTeamList(
+      { filters: [{ field: "status", op: "in", value: ["active"] }] },
+      tenantAdminA(),
+    );
+    expect(activeOnly.map((r) => r.email).sort()).toEqual([
+      "admin-a@example.com",
+      "member-y@example.com",
+    ]);
+
+    const unfiltered = await queryTeamList({}, tenantAdminA());
+    expect(unfiltered).toHaveLength(pendingOnly.length + activeOnly.length);
+  });
+
+  test("sort direction genuinely reverses row order across ≥3 differing rows", async () => {
+    for (const email of [
+      "aaa-member@example.com",
+      "mmm-member@example.com",
+      "zzz-member@example.com",
+    ]) {
+      const { id: userId } = await seedUser(stack.db, {
+        email,
+        displayName: email,
+        passwordHash: await hashPassword("pw-sort-1234"),
+        emailVerified: true,
+      });
+      await seedTenantMembership(stack.db, { userId, tenantId: TENANT_A_ID, roles: ["User"] });
+    }
+
+    const asc = await queryTeamList({ sort: "email", sortDirection: "asc" }, tenantAdminA());
+    const desc = await queryTeamList({ sort: "email", sortDirection: "desc" }, tenantAdminA());
+    expect(asc.map((r) => r.email)).toEqual([
+      "aaa-member@example.com",
+      "admin-a@example.com",
+      "mmm-member@example.com",
+      "zzz-member@example.com",
+    ]);
+    expect(desc.map((r) => r.email)).toEqual([
+      "zzz-member@example.com",
+      "mmm-member@example.com",
+      "admin-a@example.com",
+      "aaa-member@example.com",
+    ]);
+  });
+
+  test("pagination crosses both sources: memberships-only page, then a page including invitations", async () => {
+    for (const email of ["page-member-1@example.com", "page-member-2@example.com"]) {
+      const { id: userId } = await seedUser(stack.db, {
+        email,
+        displayName: email,
+        passwordHash: await hashPassword("pw-page-1234"),
+        emailVerified: true,
+      });
+      await seedTenantMembership(stack.db, { userId, tenantId: TENANT_A_ID, roles: ["User"] });
+    }
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "page-invitee-1@example.com", role: "User" },
+      tenantAdminA(),
+    );
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "page-invitee-2@example.com", role: "User" },
+      tenantAdminA(),
+    );
+    // 3 members (adminA + 2 seeded, created first) + 2 invitations (created
+    // after) = 5 rows. Sorted oldest-first, a page size of 3 lands exactly
+    // on the members/invitations boundary.
+    const page1 = await queryTeamList(
+      { sort: "createdAt", sortDirection: "asc", limit: 3, offset: 0 },
+      tenantAdminA(),
+    );
+    const page2 = await queryTeamList(
+      { sort: "createdAt", sortDirection: "asc", limit: 3, offset: 3 },
+      tenantAdminA(),
+    );
+    expect(page1).toHaveLength(3);
+    expect(page1.every((r) => r.status === "active")).toBe(true);
+    expect(page2).toHaveLength(2);
+    expect(page2.every((r) => r.status === "pending")).toBe(true);
+
+    const allIds = [...page1, ...page2].map((r) => r.id);
+    expect(new Set(allIds).size).toBe(5);
+  });
+
+  test("lastSeenAt is set for a member with a session, null for one without, and null for an invitation", async () => {
+    const { id: withSessionId } = await seedUser(stack.db, {
+      email: "with-session@example.com",
+      displayName: "With Session",
+      passwordHash: await hashPassword("pw-sess-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: withSessionId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+    const seededLastSeen = Temporal.Now.instant().subtract({ minutes: 5 });
+    await seedRow(stack.db, userSessionTable, {
+      id: crypto.randomUUID(),
+      userId: withSessionId,
+      tenantId: TENANT_A_ID,
+      createdAt: Temporal.Now.instant().subtract({ hours: 1 }),
+      expiresAt: Temporal.Now.instant().add({ hours: 1 }),
+      lastSeenAt: seededLastSeen,
+    });
+
+    const { id: withoutSessionId } = await seedUser(stack.db, {
+      email: "without-session@example.com",
+      displayName: "Without Session",
+      passwordHash: await hashPassword("pw-nosess-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: withoutSessionId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "invitee-lastseen@example.com", role: "User" },
+      tenantAdminA(),
+    );
+
+    const rows = await queryTeamList({}, tenantAdminA());
+    const withSession = rows.find((r) => r.email === "with-session@example.com");
+    const withoutSession = rows.find((r) => r.email === "without-session@example.com");
+    const invitee = rows.find((r) => r.email === "invitee-lastseen@example.com");
+
+    expect(withSession?.lastSeenAt).not.toBeNull();
+    const driftMs = Math.abs(
+      Temporal.Instant.from(withSession?.lastSeenAt as string).epochMilliseconds -
+        seededLastSeen.epochMilliseconds,
+    );
+    expect(driftMs).toBeLessThan(1_000);
+    expect(withoutSession?.lastSeenAt).toBeNull();
+    expect(invitee?.lastSeenAt).toBeNull();
+  });
+});
+
+describe("cancel-invitation on the /members surface genuinely cancels", () => {
+  test("a pending invitation created via invite-create disappears from team:list after cancel-invitation", async () => {
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "cancel-me@example.com", role: "User" },
+      tenantAdminA(),
+    );
+    const before = await queryTeamList({}, tenantAdminA());
+    const pending = before.find((r) => r.email === "cancel-me@example.com");
+    expect(pending?.status).toBe("pending");
+    if (pending === undefined) throw new Error("expected the seeded invitation to be listed");
+
+    await stack.http.writeOk(
+      TenantHandlers.cancelInvitation,
+      { invitationId: pending.id },
+      tenantAdminA(),
+    );
+
+    const after = await queryTeamList({}, tenantAdminA());
+    expect(after.some((r) => r.email === "cancel-me@example.com")).toBe(false);
+  });
+});
+
 describe("updateMemberRoles not reachable by TenantAdmin", () => {
   test("TenantAdmin gets access_denied on updateMemberRoles", async () => {
     const err = await stack.http.writeErr(

package/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.209.0",
+    "type": "improvement",
+    "title": "tenant: single /members screen replaces the members-card/pending-card split (#2223)",
+    "detail": "New `tenant:query:team:list` handler merges active memberships and pending invitations into one projectionList screen (`membersScreen`), with a `status` facet, sortable/searchable columns, and a danger-styled `cancel-invitation` row action visible only on pending rows. `createTenantFeature({ inviteScreen: true })` additionally wires a drawer-hosted invite actionForm onto the toolbar (bound to auth-email-password's `invite-create` handler) — off by default, and only safe to enable once the app also configures `createAuthEmailPasswordFeature({ invite: {...} })`, since the boot validator rejects the actionForm's cross-feature handler QN otherwise. The old `members`/`invitations` query handlers and their custom `MembersScreen` component are unaffected and stay registered for existing callers; `updateMemberRoles` stays SystemAdmin-only and off this screen."
+  },
   {
     "version": "0.165.0",
     "type": "fix",

package/src/tenant/constants.ts

@@ -1,14 +1,25 @@
 // @runtime client
-// Pure string-Konstanten — `@runtime client` damit auch Browser-Code
-// (Members-Screen) sie importieren kann (siehe auth-email-password/
-// constants.ts für die Begründung). Runtime importiert client → server
-// kann sie weiter nutzen.
+// Pure string constants — `@runtime client` so browser code (e.g. the
+// MemberStatusCell column renderer) can import them too (see
+// auth-email-password/constants.ts for the rationale). Runtime imports
+// client → server can keep using them as well.
 
 // Feature name
 export const TENANT_FEATURE = "tenant" as const;
 
 export const MEMBERS_SCREEN_ID = "members" as const;
 
+export const INVITE_CREATE_SCREEN_ID = "invite-create" as const;
+
+/** Client column-renderer for the /members screen's status column — see
+ *  `screen.columns[].renderer.react.__component` in screens.ts and
+ *  `tenantClient()`'s `columnRenderers` map. */
+export const MEMBER_STATUS_CELL_COMPONENT = "MemberStatusCell" as const;
+
+/** Client column-renderer for the /members screen's roles column (joins the
+ *  `roles: readonly string[]` field into one cell) — same wiring as above. */
+export const MEMBER_ROLES_CELL_COMPONENT = "MemberRolesCell" as const;
+
 /** Closed allowlist for invite-role picker — never free text (escalation guard). */
 export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Admin", "Editor"] as const;
 
@@ -34,6 +45,8 @@ export const TenantQueries = {
   resolveUserIds: "tenant:query:resolve-user-ids",
   // Pending Invitations für den aktuellen Tenant (Admin-UI-Liste).
   invitations: "tenant:query:invitations",
+  // Combined active-members + pending-invitations list backing /members.
+  teamList: "tenant:query:team:list",
 } as const;
 
 // Error codes

package/src/tenant/feature.ts

@@ -8,7 +8,6 @@ import {
   defineFeature,
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { MEMBERS_SCREEN_ID } from "./constants";
 import { activeTenantIdsQuery } from "./handlers/active-tenant-ids.query";
 import { addMemberWrite } from "./handlers/add-member.write";
 import { cancelInvitationWrite } from "./handlers/cancel-invitation.write";
@@ -20,6 +19,7 @@ import { membersQuery } from "./handlers/members.query";
 import { membershipsQuery } from "./handlers/memberships.query";
 import { removeMemberWrite } from "./handlers/remove-member.write";
 import { resolveUserIdsQuery } from "./handlers/resolve-user-ids.query";
+import { teamListQuery } from "./handlers/team-list.query";
 import { disableWrite, enableWrite } from "./handlers/toggle-enabled.write";
 import { updateWrite } from "./handlers/update.write";
 import { updateMemberRolesWrite } from "./handlers/update-member-roles.write";
@@ -27,13 +27,29 @@ import { TENANT_I18N } from "./i18n";
 import { tenantInvitationEntity } from "./invitation-table";
 import { tenantMembershipEntity } from "./membership-table";
 import { tenantEntity } from "./schema/tenant";
-import { tenantEditScreen, tenantListScreen } from "./screens";
+import {
+  createMembersScreen,
+  inviteCreateScreen,
+  tenantEditScreen,
+  tenantListScreen,
+} from "./screens";
 
 export { tenantEntity, tenantTable } from "./schema/tenant";
 
+export type TenantFeatureOptions = {
+  /** Adds the /members "invite" drawer button + its `invite-create`
+   *  actionForm, bound to auth-email-password's `invite-create` write-
+   *  handler. That handler only exists when the app also mounts
+   *  `createAuthEmailPasswordFeature({ invite: {...} })` — the boot
+   *  validator rejects the actionForm's handler QN otherwise (cross-feature
+   *  handler lookup fails). Off by default: `tenant` cannot see whether an
+   *  app configured that optional auth-email-password flow. */
+  readonly inviteScreen?: boolean;
+};
+
 // --- Feature ---
 
-export function createTenantFeature(): FeatureDefinition {
+export function createTenantFeature(options?: TenantFeatureOptions): FeatureDefinition {
   return defineFeature("tenant", (r) => {
     r.describe(
       "Registers the three core multi-tenancy entities \u2014 `tenant`, `tenant-membership`, and `tenant-invitation` (DB tables `read_tenants`, `read_tenant_memberships`, and `read_tenant_invitations`) \u2014 along with write handlers for create/update/disable/enable/addMember/removeMember/updateMemberRoles and the matching queries. It also declares a set of per-tenant config keys (companyName, timezone, locale, SMTP credentials) and system-only keys (priceModel, maxUsers) via `r.config({ keys: { ... } })`. Use this feature in every multi-tenant app; membership resolution and invitation flows depend on it, and `auth-email-password` requires it.",
@@ -117,6 +133,7 @@ export function createTenantFeature(): FeatureDefinition {
       activeTenantIds: r.queryHandler(activeTenantIdsQuery),
       resolveUserIds: r.queryHandler(resolveUserIdsQuery),
       invitations: r.queryHandler(invitationsQuery),
+      teamList: r.queryHandler(teamListQuery),
     };
 
     // Entity-convention handlers for the SystemAdmin entityList/entityEdit
@@ -136,14 +153,14 @@ export function createTenantFeature(): FeatureDefinition {
     );
     r.screen(tenantListScreen);
     r.screen(tenantEditScreen);
-    // Tenant-admin team UI: members list + invite/cancel (no role-edit — updateMemberRoles
-    // stays SystemAdmin-only). Screen access matches handler access.admin.
-    r.screen({
-      id: MEMBERS_SCREEN_ID,
-      type: "custom",
-      renderer: { react: { __component: "MembersScreen" } },
-      access: { roles: access.admin },
-    });
+    // Tenant-admin team UI: one list (active members + pending invitations,
+    // §2.6), invite via a drawer-hosted actionForm. No role-edit —
+    // updateMemberRoles stays SystemAdmin-only. Screen access matches
+    // handler access.admin.
+    r.screen(createMembersScreen(options));
+    if (options?.inviteScreen) {
+      r.screen(inviteCreateScreen);
+    }
     r.nav({
       id: "members",
       label: "tenant.nav.members",