@cosmicdrift/kumiko-bundled-features 0.210.0 → 0.211.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.210.0",
+  "version": "0.211.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.210.0",
-    "@cosmicdrift/kumiko-framework": "0.210.0",
-    "@cosmicdrift/kumiko-headless": "0.210.0",
-    "@cosmicdrift/kumiko-renderer": "0.210.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.210.0",
-    "@cosmicdrift/kumiko-types": "0.210.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.211.0",
+    "@cosmicdrift/kumiko-framework": "0.211.0",
+    "@cosmicdrift/kumiko-headless": "0.211.0",
+    "@cosmicdrift/kumiko-renderer": "0.211.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.211.0",
+    "@cosmicdrift/kumiko-types": "0.211.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,6 +160,6 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.210.0"
+    "@cosmicdrift/kumiko-locale-de": "0.211.0"
   }
 }

package/src/file-derivatives/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.194.0",
+    "type": "breaking",
+    "title": "PRESET_VARIANT_NAMES removed from public exports; publicVariantQuery accepts any name.",
+    "detail": "The public GET /media/:fileRefId/:variant route now resolves the variant spec from the FileRef's field declaration (createImageField({ variants: {...} })) instead of a fixed spec table, so an app can declare and publicly serve its own variant names, and a field overriding a built-in preset name (thumb/card/hero/full) is served with its own spec instead of the frozen preset size. publicVariantQuery's schema now accepts any variant name (z.string().min(1).max(64)) instead of z.enum(PRESET_VARIANT_NAMES); resolution requires an exact match against the field's declared variants keys, and an unresolvable name answers 404, same as an unknown FileRef. The route's pre-DB path-param gate is now purely syntactic ([a-zA-Z0-9_-]{1,64}) instead of a name allow-list; a known-valid preset name plus a random fileRefId reached the same DB read as any other name, so the list only blocked the cheaper of two equally-costly attacks, and the actual defense is the existing per-IP rate limit and the UUID guard, both unchanged.",
+    "migration": "PRESET_VARIANT_NAMES only ever named the allow-list this release deletes, so there is nothing to migrate to. thumb/card/hero/full remain as ready-made specs to spread into a field's own variants."
+  }
+]

package/src/personal-access-tokens/changes.json

@@ -4,5 +4,12 @@
     "type": "improvement",
     "title": "personal-access-tokens: add `toggleable` option so the whole feature can be tier-gated vi…",
     "detail": "personal-access-tokens: add `toggleable` option so the whole feature can be tier-gated via the tier-engine (mirrors ledger/tags). Pass `{ toggleable: { default: false } }` for fail-closed gating — PAT is then off until a tier lists `\"personal-access-tokens\"` in its features. Omitting the option keeps PAT always-on (no behaviour change for existing consumers)."
+  },
+  {
+    "version": "0.202.0",
+    "type": "breaking",
+    "title": "personal-access-tokens: `write:create` now requires `currentPassword` (+ `mfaCode` if MFA enrolled) (e91d4cb).",
+    "detail": "`personal-access-tokens:write:create` now requires `currentPassword` (verified against the caller's password hash) before minting a token, and rejects when the caller has MFA enrolled and `mfaCode` is missing or wrong — a session cookie alone is no longer enough to stand up a durable API credential. `expiresInDays` now defaults to 90 days instead of never-expiring when omitted (the existing 3650-day cap is unchanged, so a genuinely long-lived token is still possible if requested explicitly). Changing a user's password, or enabling/disabling MFA, now revokes all of that user's live PAT tokens — mirrors the existing session auto-revoke-on-password-change behavior. `run-prod-app`/`run-dev-app` wire the new MFA↔PAT revoke callback automatically when both `auth-mfa` and `personal-access-tokens` are mounted; no app-level change needed for that part.",
+    "migration": "Apps that already mint PATs (their own client code, scripts, or tests) need to add `currentPassword` to the `create` request payload — this is a breaking change to the `create` request shape despite the minor bump (bundled-features doesn't follow strict semver across its handler schemas yet). If the caller has MFA enrolled, also include a valid `mfaCode`."
   }
 ]

package/src/template-resolver/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.195.0",
+    "type": "breaking",
+    "title": "ContentEditorProps gains a required id (fw#2001).",
+    "detail": "TextBlockEditor's Field wrapping a registered \"rich\"/\"plain\" editor pointed its htmlFor at the fixed CONTENT_EDITOR_ELEMENT_ID, which only the never-mounted textarea fallback actually used — the label was disconnected from the real input as soon as a collection declared contentFormat: \"rich\" or \"plain\". TextBlockEditor now generates a per-instance id via useId() and passes it to both the Field and the ContentEditor, so the label stays correctly associated and two editors mounted on the same page no longer collide on a shared DOM id.",
+    "migration": "A custom-registered content editor component now needs to accept and use this id prop, rendering it onto its own focusable root element. Consumers that don't touch the DOM id directly are unaffected. CONTENT_EDITOR_ELEMENT_ID stays exported as a default value for callers that don't need their own generated id."
+  }
+]

package/src/tenant/__tests__/members-screens.boot.test.ts

@@ -3,30 +3,105 @@ import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createConfigFeature } from "../../config/feature";
-import { MEMBERS_SCREEN_ID, TenantHandlers, TenantQueries } from "../constants";
+import {
+  INVITE_CREATE_SCREEN_ID,
+  MEMBERS_SCREEN_ID,
+  TenantHandlers,
+  TenantQueries,
+} from "../constants";
 import { createTenantFeature } from "../feature";
 
 describe("tenant members screen + handler access alignment", () => {
   const features = [createConfigFeature(), createTenantFeature()];
 
-  test("boot-validates with members screen registered", () => {
+  test("boot-validates with members screen registered (inviteScreen off by default)", () => {
     expect(() => validateBoot(features)).not.toThrow();
   });
 
-  test("members screen is custom, access.admin-gated", () => {
+  // fw-2223 regression: an actionForm screen bound to an OPTIONAL
+  // cross-feature handler (auth-email-password's invite-create, only
+  // registered when its `invite` option is configured) must not be
+  // unconditionally wired into `tenant` — apps that mount tenant with
+  // auth-email-password but without `invite` would otherwise fail boot.
+  // `inviteScreen` defaults to false so the test above keeps booting clean
+  // with no auth-email-password mounted at all.
+  test("without inviteScreen, the invite toolbar action and actionForm screen are absent", () => {
     const tenant = createTenantFeature();
     const screen = tenant.screens[MEMBERS_SCREEN_ID];
-    expect(screen?.type).toBe("custom");
+    if (screen?.type !== "projectionList")
+      throw new Error("expected members screen to be projectionList");
+    expect(screen.toolbarActions ?? []).toHaveLength(0);
+    expect(tenant.screens[INVITE_CREATE_SCREEN_ID]).toBeUndefined();
+  });
+
+  // The opt-in path (inviteScreen: true + a real auth-email-password with
+  // `invite` configured) boots and works end to end — proven in
+  // tenant-security.integration.test.ts's setupTestStack, which composes the
+  // full realistic stack (delivery, channel-email, template-resolver, etc.)
+  // that a minimal validateBoot() here would otherwise have to duplicate.
+
+  test("members screen is a projectionList backed by team:list, access.admin-gated", () => {
+    const tenant = createTenantFeature();
+    const screen = tenant.screens[MEMBERS_SCREEN_ID];
+    expect(screen?.type).toBe("projectionList");
+    if (screen?.type === "projectionList") {
+      expect(screen.query).toBe(TenantQueries.teamList);
+    }
     if (screen && "access" in screen && screen.access && "roles" in screen.access) {
       expect(screen.access.roles).toEqual(access.admin);
     }
   });
 
+  test("cancel-invitation row action is only visible on pending rows and cancels via TenantHandlers.cancelInvitation", () => {
+    const tenant = createTenantFeature();
+    const screen = tenant.screens[MEMBERS_SCREEN_ID];
+    if (screen?.type !== "projectionList")
+      throw new Error("expected members screen to be projectionList");
+    const rowAction = screen.rowActions?.find((a) => a.id === "cancel-invitation");
+    if (rowAction?.kind !== "writeHandler") throw new Error("expected a writeHandler row action");
+    expect(rowAction.handler).toBe(TenantHandlers.cancelInvitation);
+    expect(rowAction.payload).toEqual({ map: { invitationId: "id" } });
+    expect(rowAction.visible).toEqual({ field: "status", eq: "pending" });
+  });
+
+  // The generic drawer-open/submit/close/refetch mechanics for kind:"drawer"
+  // toolbar actions are already covered end-to-end with a synthetic screen in
+  // renderer-web's projection-list-actions.test.tsx — this only proves OUR
+  // wiring (which screen, which handler, which fields) is correct. The
+  // "submit creates the invitation, list shows it afterward" behavior is
+  // proven at the backend layer in tenant-security.integration.test.ts.
+  test("invite toolbar action opens the same-feature invite-create actionForm, bound to AuthHandlers.inviteCreate", () => {
+    const tenant = createTenantFeature({ inviteScreen: true });
+    const membersScreenDef = tenant.screens[MEMBERS_SCREEN_ID];
+    if (membersScreenDef?.type !== "projectionList") {
+      throw new Error("expected members screen to be projectionList");
+    }
+    const toolbarAction = membersScreenDef.toolbarActions?.find((a) => a.id === "invite");
+    if (toolbarAction?.kind !== "drawer") throw new Error("expected a drawer toolbar action");
+    expect(toolbarAction.screen).toBe(INVITE_CREATE_SCREEN_ID);
+
+    const inviteScreen = tenant.screens[INVITE_CREATE_SCREEN_ID];
+    expect(inviteScreen?.type).toBe("actionForm");
+    if (inviteScreen?.type === "actionForm") {
+      expect(inviteScreen.handler).toBe(AuthHandlers.inviteCreate);
+      expect(Object.keys(inviteScreen.fields)).toEqual(["email", "role"]);
+    }
+    if (
+      inviteScreen &&
+      "access" in inviteScreen &&
+      inviteScreen.access &&
+      "roles" in inviteScreen.access
+    ) {
+      expect(inviteScreen.access.roles).toEqual(access.admin);
+    }
+  });
+
   test("members UI handlers share access.admin (screen ⊆ handler)", () => {
     const tenant = createTenantFeature();
     const adminRoles = [...access.admin];
     expect(rolesOf(tenant.queryHandlers["members"]?.access)).toEqual(adminRoles);
     expect(rolesOf(tenant.queryHandlers["invitations"]?.access)).toEqual(adminRoles);
+    expect(rolesOf(tenant.queryHandlers["team:list"]?.access)).toEqual(adminRoles);
     expect(rolesOf(tenant.writeHandlers["cancel-invitation"]?.access)).toEqual(adminRoles);
     // invite-create lives on auth feature — checked in tenant-security.integration.test.ts
     void AuthHandlers;

package/src/tenant/__tests__/tenant-security.integration.test.ts

@@ -11,7 +11,8 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { expectErrorIncludes, rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { expectErrorIncludes, rolesOf, seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { Temporal } from "temporal-polyfill";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
@@ -22,6 +23,7 @@ import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery
 import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createUserFeature } from "../../user/feature";
@@ -61,7 +63,9 @@ beforeAll(async () => {
     features: [
       createConfigFeature(),
       createUserFeature(),
-      createTenantFeature(),
+      // inviteScreen: this suite dispatches AuthHandlers.inviteCreate and
+      // needs /members' invite-create actionForm screen registered too.
+      createTenantFeature({ inviteScreen: true }),
       createTemplateResolverFeature(),
       createRendererFoundationFeature(),
       createDeliveryFeature(),
@@ -93,6 +97,7 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
   await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await unsafePushTables(stack.db, {
     configValuesTable,
     tenantMembershipsTable,
@@ -108,6 +113,7 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantInvitationsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userSessionTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
   emailTransport.sent.length = 0;
   const keys = await stack.redis.redis.keys("invite:*");
@@ -229,10 +235,11 @@ describe("TenantAdmin can use members-admin HTTP surface", () => {
 });
 
 describe("regular User is denied members-admin surface", () => {
-  test("403 on members, invitations, invite-create, cancel-invitation", async () => {
+  test("403 on members, invitations, team:list, invite-create, cancel-invitation", async () => {
     for (const [label, fn] of [
       ["members", () => stack.http.query(TenantQueries.members, {}, regularUserB())],
       ["invitations", () => stack.http.query(TenantQueries.invitations, {}, regularUserB())],
+      ["team:list", () => stack.http.query(TenantQueries.teamList, {}, regularUserB())],
       [
         "invite-create",
         () =>
@@ -247,6 +254,11 @@ describe("regular User is denied members-admin surface", () => {
       expect(res.status, label).toBe(403);
     }
   });
+
+  // The /members screen gates on the SAME access.admin roles as its query
+  // (see members-screens.boot.test.ts) — there is no separate HTTP surface
+  // for "screen access" beyond the query/handlers it dispatches, so denying
+  // the query above + the screen.access assertion together cover point 8.
 });
 
 describe("privilege escalation via invite role", () => {
@@ -298,6 +310,251 @@ describe("tenant isolation on cancel-invitation", () => {
   });
 });
 
+type TeamListRow = {
+  readonly id: string;
+  readonly email: string | null;
+  readonly roles: readonly string[];
+  readonly status: "active" | "pending";
+  readonly createdAt: string;
+  readonly lastSeenAt: string | null;
+};
+
+async function queryTeamList(
+  payload: Record<string, unknown>,
+  user: SessionUser,
+): Promise<readonly TeamListRow[]> {
+  const result = await stack.http.queryOk<{
+    rows: readonly TeamListRow[];
+    nextCursor: string | null;
+  }>(TenantQueries.teamList, payload, user);
+  return result.rows;
+}
+
+describe("tenant:query:team:list — combined members + pending invitations (§2.6a)", () => {
+  test("returns both memberships and pending invitations with correct per-row status", async () => {
+    const { id: memberUserId } = await seedUser(stack.db, {
+      email: "member-x@example.com",
+      displayName: "Member X",
+      passwordHash: await hashPassword("pw-x-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "invitee-x@example.com", role: "Editor" },
+      tenantAdminA(),
+    );
+
+    const rows = await queryTeamList({}, tenantAdminA());
+    const admin = rows.find((r) => r.email === "admin-a@example.com");
+    const member = rows.find((r) => r.email === "member-x@example.com");
+    const invitee = rows.find((r) => r.email === "invitee-x@example.com");
+    expect(admin?.status).toBe("active");
+    expect(admin?.roles).toEqual(["TenantAdmin"]);
+    expect(member?.status).toBe("active");
+    expect(member?.roles).toEqual(["User"]);
+    expect(invitee?.status).toBe("pending");
+    expect(invitee?.roles).toEqual(["Editor"]);
+  });
+
+  test("status facet genuinely narrows to matching rows, not just the count", async () => {
+    const { id: memberUserId } = await seedUser(stack.db, {
+      email: "member-y@example.com",
+      displayName: "Member Y",
+      passwordHash: await hashPassword("pw-y-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "invitee-y1@example.com", role: "User" },
+      tenantAdminA(),
+    );
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "invitee-y2@example.com", role: "User" },
+      tenantAdminA(),
+    );
+
+    const pendingOnly = await queryTeamList(
+      { filters: [{ field: "status", op: "in", value: ["pending"] }] },
+      tenantAdminA(),
+    );
+    expect(pendingOnly.map((r) => r.email).sort()).toEqual([
+      "invitee-y1@example.com",
+      "invitee-y2@example.com",
+    ]);
+
+    const activeOnly = await queryTeamList(
+      { filters: [{ field: "status", op: "in", value: ["active"] }] },
+      tenantAdminA(),
+    );
+    expect(activeOnly.map((r) => r.email).sort()).toEqual([
+      "admin-a@example.com",
+      "member-y@example.com",
+    ]);
+
+    const unfiltered = await queryTeamList({}, tenantAdminA());
+    expect(unfiltered).toHaveLength(pendingOnly.length + activeOnly.length);
+  });
+
+  test("sort direction genuinely reverses row order across ≥3 differing rows", async () => {
+    for (const email of [
+      "aaa-member@example.com",
+      "mmm-member@example.com",
+      "zzz-member@example.com",
+    ]) {
+      const { id: userId } = await seedUser(stack.db, {
+        email,
+        displayName: email,
+        passwordHash: await hashPassword("pw-sort-1234"),
+        emailVerified: true,
+      });
+      await seedTenantMembership(stack.db, { userId, tenantId: TENANT_A_ID, roles: ["User"] });
+    }
+
+    const asc = await queryTeamList({ sort: "email", sortDirection: "asc" }, tenantAdminA());
+    const desc = await queryTeamList({ sort: "email", sortDirection: "desc" }, tenantAdminA());
+    expect(asc.map((r) => r.email)).toEqual([
+      "aaa-member@example.com",
+      "admin-a@example.com",
+      "mmm-member@example.com",
+      "zzz-member@example.com",
+    ]);
+    expect(desc.map((r) => r.email)).toEqual([
+      "zzz-member@example.com",
+      "mmm-member@example.com",
+      "admin-a@example.com",
+      "aaa-member@example.com",
+    ]);
+  });
+
+  test("pagination crosses both sources: memberships-only page, then a page including invitations", async () => {
+    for (const email of ["page-member-1@example.com", "page-member-2@example.com"]) {
+      const { id: userId } = await seedUser(stack.db, {
+        email,
+        displayName: email,
+        passwordHash: await hashPassword("pw-page-1234"),
+        emailVerified: true,
+      });
+      await seedTenantMembership(stack.db, { userId, tenantId: TENANT_A_ID, roles: ["User"] });
+    }
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "page-invitee-1@example.com", role: "User" },
+      tenantAdminA(),
+    );
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "page-invitee-2@example.com", role: "User" },
+      tenantAdminA(),
+    );
+    // 3 members (adminA + 2 seeded, created first) + 2 invitations (created
+    // after) = 5 rows. Sorted oldest-first, a page size of 3 lands exactly
+    // on the members/invitations boundary.
+    const page1 = await queryTeamList(
+      { sort: "createdAt", sortDirection: "asc", limit: 3, offset: 0 },
+      tenantAdminA(),
+    );
+    const page2 = await queryTeamList(
+      { sort: "createdAt", sortDirection: "asc", limit: 3, offset: 3 },
+      tenantAdminA(),
+    );
+    expect(page1).toHaveLength(3);
+    expect(page1.every((r) => r.status === "active")).toBe(true);
+    expect(page2).toHaveLength(2);
+    expect(page2.every((r) => r.status === "pending")).toBe(true);
+
+    const allIds = [...page1, ...page2].map((r) => r.id);
+    expect(new Set(allIds).size).toBe(5);
+  });
+
+  test("lastSeenAt is set for a member with a session, null for one without, and null for an invitation", async () => {
+    const { id: withSessionId } = await seedUser(stack.db, {
+      email: "with-session@example.com",
+      displayName: "With Session",
+      passwordHash: await hashPassword("pw-sess-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: withSessionId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+    const seededLastSeen = Temporal.Now.instant().subtract({ minutes: 5 });
+    await seedRow(stack.db, userSessionTable, {
+      id: crypto.randomUUID(),
+      userId: withSessionId,
+      tenantId: TENANT_A_ID,
+      createdAt: Temporal.Now.instant().subtract({ hours: 1 }),
+      expiresAt: Temporal.Now.instant().add({ hours: 1 }),
+      lastSeenAt: seededLastSeen,
+    });
+
+    const { id: withoutSessionId } = await seedUser(stack.db, {
+      email: "without-session@example.com",
+      displayName: "Without Session",
+      passwordHash: await hashPassword("pw-nosess-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: withoutSessionId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "invitee-lastseen@example.com", role: "User" },
+      tenantAdminA(),
+    );
+
+    const rows = await queryTeamList({}, tenantAdminA());
+    const withSession = rows.find((r) => r.email === "with-session@example.com");
+    const withoutSession = rows.find((r) => r.email === "without-session@example.com");
+    const invitee = rows.find((r) => r.email === "invitee-lastseen@example.com");
+
+    expect(withSession?.lastSeenAt).not.toBeNull();
+    const driftMs = Math.abs(
+      Temporal.Instant.from(withSession?.lastSeenAt as string).epochMilliseconds -
+        seededLastSeen.epochMilliseconds,
+    );
+    expect(driftMs).toBeLessThan(1_000);
+    expect(withoutSession?.lastSeenAt).toBeNull();
+    expect(invitee?.lastSeenAt).toBeNull();
+  });
+});
+
+describe("cancel-invitation on the /members surface genuinely cancels", () => {
+  test("a pending invitation created via invite-create disappears from team:list after cancel-invitation", async () => {
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "cancel-me@example.com", role: "User" },
+      tenantAdminA(),
+    );
+    const before = await queryTeamList({}, tenantAdminA());
+    const pending = before.find((r) => r.email === "cancel-me@example.com");
+    expect(pending?.status).toBe("pending");
+    if (pending === undefined) throw new Error("expected the seeded invitation to be listed");
+
+    await stack.http.writeOk(
+      TenantHandlers.cancelInvitation,
+      { invitationId: pending.id },
+      tenantAdminA(),
+    );
+
+    const after = await queryTeamList({}, tenantAdminA());
+    expect(after.some((r) => r.email === "cancel-me@example.com")).toBe(false);
+  });
+});
+
 describe("updateMemberRoles not reachable by TenantAdmin", () => {
   test("TenantAdmin gets access_denied on updateMemberRoles", async () => {
     const err = await stack.http.writeErr(

package/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.209.0",
+    "type": "improvement",
+    "title": "tenant: single /members screen replaces the members-card/pending-card split (#2223)",
+    "detail": "New `tenant:query:team:list` handler merges active memberships and pending invitations into one projectionList screen (`membersScreen`), with a `status` facet, sortable/searchable columns, and a danger-styled `cancel-invitation` row action visible only on pending rows. `createTenantFeature({ inviteScreen: true })` additionally wires a drawer-hosted invite actionForm onto the toolbar (bound to auth-email-password's `invite-create` handler) — off by default, and only safe to enable once the app also configures `createAuthEmailPasswordFeature({ invite: {...} })`, since the boot validator rejects the actionForm's cross-feature handler QN otherwise. The old `members`/`invitations` query handlers and their custom `MembersScreen` component are unaffected and stay registered for existing callers; `updateMemberRoles` stays SystemAdmin-only and off this screen."
+  },
   {
     "version": "0.165.0",
     "type": "fix",

package/src/tenant/constants.ts

@@ -1,14 +1,25 @@
 // @runtime client
-// Pure string-Konstanten — `@runtime client` damit auch Browser-Code
-// (Members-Screen) sie importieren kann (siehe auth-email-password/
-// constants.ts für die Begründung). Runtime importiert client → server
-// kann sie weiter nutzen.
+// Pure string constants — `@runtime client` so browser code (e.g. the
+// MemberStatusCell column renderer) can import them too (see
+// auth-email-password/constants.ts for the rationale). Runtime imports
+// client → server can keep using them as well.
 
 // Feature name
 export const TENANT_FEATURE = "tenant" as const;
 
 export const MEMBERS_SCREEN_ID = "members" as const;
 
+export const INVITE_CREATE_SCREEN_ID = "invite-create" as const;
+
+/** Client column-renderer for the /members screen's status column — see
+ *  `screen.columns[].renderer.react.__component` in screens.ts and
+ *  `tenantClient()`'s `columnRenderers` map. */
+export const MEMBER_STATUS_CELL_COMPONENT = "MemberStatusCell" as const;
+
+/** Client column-renderer for the /members screen's roles column (joins the
+ *  `roles: readonly string[]` field into one cell) — same wiring as above. */
+export const MEMBER_ROLES_CELL_COMPONENT = "MemberRolesCell" as const;
+
 /** Closed allowlist for invite-role picker — never free text (escalation guard). */
 export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Admin", "Editor"] as const;
 
@@ -34,6 +45,8 @@ export const TenantQueries = {
   resolveUserIds: "tenant:query:resolve-user-ids",
   // Pending Invitations für den aktuellen Tenant (Admin-UI-Liste).
   invitations: "tenant:query:invitations",
+  // Combined active-members + pending-invitations list backing /members.
+  teamList: "tenant:query:team:list",
 } as const;
 
 // Error codes

package/src/tenant/feature.ts

@@ -8,7 +8,6 @@ import {
   defineFeature,
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { MEMBERS_SCREEN_ID } from "./constants";
 import { activeTenantIdsQuery } from "./handlers/active-tenant-ids.query";
 import { addMemberWrite } from "./handlers/add-member.write";
 import { cancelInvitationWrite } from "./handlers/cancel-invitation.write";
@@ -20,6 +19,7 @@ import { membersQuery } from "./handlers/members.query";
 import { membershipsQuery } from "./handlers/memberships.query";
 import { removeMemberWrite } from "./handlers/remove-member.write";
 import { resolveUserIdsQuery } from "./handlers/resolve-user-ids.query";
+import { teamListQuery } from "./handlers/team-list.query";
 import { disableWrite, enableWrite } from "./handlers/toggle-enabled.write";
 import { updateWrite } from "./handlers/update.write";
 import { updateMemberRolesWrite } from "./handlers/update-member-roles.write";
@@ -27,13 +27,29 @@ import { TENANT_I18N } from "./i18n";
 import { tenantInvitationEntity } from "./invitation-table";
 import { tenantMembershipEntity } from "./membership-table";
 import { tenantEntity } from "./schema/tenant";
-import { tenantEditScreen, tenantListScreen } from "./screens";
+import {
+  createMembersScreen,
+  inviteCreateScreen,
+  tenantEditScreen,
+  tenantListScreen,
+} from "./screens";
 
 export { tenantEntity, tenantTable } from "./schema/tenant";
 
+export type TenantFeatureOptions = {
+  /** Adds the /members "invite" drawer button + its `invite-create`
+   *  actionForm, bound to auth-email-password's `invite-create` write-
+   *  handler. That handler only exists when the app also mounts
+   *  `createAuthEmailPasswordFeature({ invite: {...} })` — the boot
+   *  validator rejects the actionForm's handler QN otherwise (cross-feature
+   *  handler lookup fails). Off by default: `tenant` cannot see whether an
+   *  app configured that optional auth-email-password flow. */
+  readonly inviteScreen?: boolean;
+};
+
 // --- Feature ---
 
-export function createTenantFeature(): FeatureDefinition {
+export function createTenantFeature(options?: TenantFeatureOptions): FeatureDefinition {
   return defineFeature("tenant", (r) => {
     r.describe(
       "Registers the three core multi-tenancy entities \u2014 `tenant`, `tenant-membership`, and `tenant-invitation` (DB tables `read_tenants`, `read_tenant_memberships`, and `read_tenant_invitations`) \u2014 along with write handlers for create/update/disable/enable/addMember/removeMember/updateMemberRoles and the matching queries. It also declares a set of per-tenant config keys (companyName, timezone, locale, SMTP credentials) and system-only keys (priceModel, maxUsers) via `r.config({ keys: { ... } })`. Use this feature in every multi-tenant app; membership resolution and invitation flows depend on it, and `auth-email-password` requires it.",
@@ -117,6 +133,7 @@ export function createTenantFeature(): FeatureDefinition {
       activeTenantIds: r.queryHandler(activeTenantIdsQuery),
       resolveUserIds: r.queryHandler(resolveUserIdsQuery),
       invitations: r.queryHandler(invitationsQuery),
+      teamList: r.queryHandler(teamListQuery),
     };
 
     // Entity-convention handlers for the SystemAdmin entityList/entityEdit
@@ -136,14 +153,14 @@ export function createTenantFeature(): FeatureDefinition {
     );
     r.screen(tenantListScreen);
     r.screen(tenantEditScreen);
-    // Tenant-admin team UI: members list + invite/cancel (no role-edit — updateMemberRoles
-    // stays SystemAdmin-only). Screen access matches handler access.admin.
-    r.screen({
-      id: MEMBERS_SCREEN_ID,
-      type: "custom",
-      renderer: { react: { __component: "MembersScreen" } },
-      access: { roles: access.admin },
-    });
+    // Tenant-admin team UI: one list (active members + pending invitations,
+    // §2.6), invite via a drawer-hosted actionForm. No role-edit —
+    // updateMemberRoles stays SystemAdmin-only. Screen access matches
+    // handler access.admin.
+    r.screen(createMembersScreen(options));
+    if (options?.inviteScreen) {
+      r.screen(inviteCreateScreen);
+    }
     r.nav({
       id: "members",
       label: "tenant.nav.members",