@cosmicdrift/kumiko-bundled-features 0.241.0 → 0.243.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.241.0",
+  "version": "0.243.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -130,12 +130,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.241.0",
-    "@cosmicdrift/kumiko-framework": "0.241.0",
-    "@cosmicdrift/kumiko-headless": "0.241.0",
-    "@cosmicdrift/kumiko-renderer": "0.241.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.241.0",
-    "@cosmicdrift/kumiko-types": "0.241.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.243.0",
+    "@cosmicdrift/kumiko-framework": "0.243.0",
+    "@cosmicdrift/kumiko-headless": "0.243.0",
+    "@cosmicdrift/kumiko-renderer": "0.243.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.243.0",
+    "@cosmicdrift/kumiko-types": "0.243.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -164,7 +164,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.241.0",
-    "@cosmicdrift/kumiko-locale-es": "0.241.0"
+    "@cosmicdrift/kumiko-locale-de": "0.243.0",
+    "@cosmicdrift/kumiko-locale-es": "0.243.0"
   }
 }

package/src/agent-tools/__tests__/agent-doc-lint.test.ts

@@ -128,6 +128,46 @@ describe("findAgentDocGaps", () => {
     expect(findAgentDocGaps([feature])).toHaveLength(0);
   });
 
+  test("R2: custom screen with agent.expose:false opt-out -> no gap", () => {
+    const feature = defineFeature("doc-gap-demo", (r) => {
+      r.screen({
+        id: "sysadmin-secrets",
+        type: "custom",
+        renderer: { react: "stub" },
+        agent: { expose: false },
+      });
+    });
+
+    expect(findAgentDocGaps([feature])).toHaveLength(0);
+  });
+
+  test("R2: custom screen with agent.expose:true but no description -> still a gap", () => {
+    const feature = defineFeature("doc-gap-demo", (r) => {
+      r.screen({
+        id: "widget-editor",
+        type: "custom",
+        renderer: { react: "stub" },
+        agent: { expose: true },
+      });
+    });
+
+    const gaps = findAgentDocGaps([feature]);
+    expect(gaps).toHaveLength(1);
+    expect(gaps[0]?.qn).toBe("doc-gap-demo:screen:widget-editor");
+    expect(gaps[0]?.kind).toBe(AgentDocGapKinds.customScreenWithoutDescription);
+  });
+
+  test("R2: the custom-screen gap message names both ways out", () => {
+    const feature = defineFeature("doc-gap-demo", (r) => {
+      r.screen({ id: "widget-editor", type: "custom", renderer: { react: "stub" } });
+    });
+
+    const gaps = findAgentDocGaps([feature]);
+    expect(gaps).toHaveLength(1);
+    expect(formatAgentDocGap(gaps[0]!)).toContain("agent: { expose: false }");
+    expect(formatAgentDocGap(gaps[0]!)).toContain("`description`");
+  });
+
   test("R2: non-custom screen without description -> no gap (only custom screens are linted)", () => {
     const feature = defineFeature("doc-gap-demo", (r) => {
       r.entity("widget", { fields: {}, description: "A widget." });

package/src/agent-tools/__tests__/agent-manifest.test.ts

@@ -183,4 +183,40 @@ describe("buildAgentManifest", () => {
     const entityNames = manifestA.entities.map((e) => e.name);
     expect(entityNames).toEqual([...entityNames].sort());
   });
+
+  test("a nav pointing at an opted-out screen is dropped too, so the screen id never leaks via navs", () => {
+    const feature = defineFeature("nav-leak-test", (r) => {
+      r.screen({
+        id: "sysadmin-secrets",
+        type: "custom",
+        renderer: { react: "stub" },
+        description: "Webhook secrets.",
+        agent: { expose: false },
+      });
+      r.screen({
+        id: "public-board",
+        type: "custom",
+        renderer: { react: "stub" },
+        description: "Public board.",
+      });
+      r.nav({
+        id: "sysadmin-secrets",
+        label: "nav-leak-test:nav:sysadmin-secrets",
+        screen: "nav-leak-test:screen:sysadmin-secrets",
+      });
+      r.nav({
+        id: "public-board",
+        label: "nav-leak-test:nav:public-board",
+        screen: "nav-leak-test:screen:public-board",
+      });
+    });
+
+    const manifest = buildAgentManifest(createRegistry([feature]), {
+      locale: "en",
+      roles: ["admin"],
+    });
+
+    expect(manifest.navs.map((n) => n.screen)).toEqual(["nav-leak-test:screen:public-board"]);
+    expect(manifest.screens.map((s) => s.id)).toEqual(["nav-leak-test:screen:public-board"]);
+  });
 });

package/src/agent-tools/__tests__/tool-catalog.test.ts

@@ -303,6 +303,57 @@ describe("buildToolCatalog — client tools", () => {
     expect(descriptor.screenIds.has("catalog-test:screen:widget-approve-form")).toBe(true);
   });
 
+  test("a screen with agent.expose:false is absent from the navigate enum and from the manifest", () => {
+    const feature = defineFeature("exposure-test", (r) => {
+      r.screen({
+        id: "sysadmin-secrets",
+        type: "custom",
+        renderer: { react: "stub" },
+        description: "Webhook secrets.",
+        agent: { expose: false },
+      });
+      r.screen({
+        id: "public-board",
+        type: "custom",
+        renderer: { react: "stub" },
+        description: "Public board.",
+      });
+    });
+    const registry = createRegistry([feature]);
+    const manifest = buildAgentManifest(registry, { locale: "en", roles: ["Admin"] });
+    const catalog = buildToolCatalog(registry, manifest, { mode: "edit" });
+
+    expect(manifest.screens.map((s) => s.id)).toContain("exposure-test:screen:public-board");
+    expect(manifest.screens.map((s) => s.id)).not.toContain(
+      "exposure-test:screen:sysadmin-secrets",
+    );
+
+    const descriptor = catalog.dispatchTable.get("navigate");
+    if (descriptor?.kind !== "client" || descriptor.op !== "navigate")
+      throw new Error("wrong kind");
+    expect(descriptor.screenIds.has("exposure-test:screen:sysadmin-secrets")).toBe(false);
+    expect(descriptor.screenIds.has("exposure-test:screen:public-board")).toBe(true);
+
+    const navTool = catalog.tools.find((t) => t.name === "navigate");
+    const schema = navTool?.inputSchema ?? {};
+    const properties = isRecord(schema["properties"]) ? schema["properties"] : {};
+    const screenIdSchema = isRecord(properties["screenId"]) ? properties["screenId"] : {};
+    const enumValues = Array.isArray(screenIdSchema["enum"]) ? screenIdSchema["enum"] : [];
+    expect(enumValues).toContain("exposure-test:screen:public-board");
+    expect(enumValues).not.toContain("exposure-test:screen:sysadmin-secrets");
+  });
+
+  test("a screen without an agent slot stays in the navigate enum", () => {
+    const catalog = buildCatalog(ADMIN);
+    const descriptor = catalog.dispatchTable.get("navigate");
+    if (descriptor?.kind !== "client" || descriptor.op !== "navigate")
+      throw new Error("wrong kind");
+    // None of catalog-test's screens carry a description either — this is the
+    // regression guard against a screen without an `agent` slot silently
+    // fail-closing (the way a handler without a description would).
+    expect(descriptor.screenIds.has("catalog-test:screen:widget-detail")).toBe(true);
+  });
+
   test("open_form maps the actionForm handler and the entityEdit create/update handlers", () => {
     const catalog = buildCatalog(ADMIN);
     const descriptor = catalog.dispatchTable.get("open_form");

package/src/agent-tools/agent-doc-lint.ts

@@ -3,7 +3,13 @@ import type {
   QueryHandlerDef,
   WriteHandlerDef,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { QnTypes, qn, resolveAgentExposure, toKebab } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  isAgentVisibleScreen,
+  QnTypes,
+  qn,
+  resolveAgentExposure,
+  toKebab,
+} from "@cosmicdrift/kumiko-framework/engine";
 
 export const AgentDocGapKinds = {
   handlerWithoutDescription: "handler-without-description",
@@ -56,13 +62,18 @@ function handlerDocGaps(
 function screenDocGaps(feature: FeatureDefinition): readonly AgentDocGap[] {
   const gaps: AgentDocGap[] = [];
   for (const [shortId, screen] of Object.entries(feature.screens ?? {})) {
-    if (screen.type !== CUSTOM_SCREEN_TYPE || screen.description !== undefined) continue;
+    if (
+      screen.type !== CUSTOM_SCREEN_TYPE ||
+      screen.description !== undefined ||
+      !isAgentVisibleScreen(screen)
+    )
+      continue;
     gaps.push({
       qn: qn(toKebab(feature.name), QnTypes.screen, toKebab(shortId)),
       feature: feature.name,
       kind: AgentDocGapKinds.customScreenWithoutDescription,
       message:
-        "This custom screen has no description, so the AI agent can't tell what it's for — set `description` to explain it.",
+        "This custom screen has no description, so the AI agent can't tell what it's for — set `description` to explain it, or `agent: { expose: false }` to hide it from the agent deliberately.",
     });
   }
   return gaps;

package/src/agent-tools/agent-manifest.ts

@@ -10,7 +10,11 @@ import type {
   WorkspaceDefinition,
   WriteHandlerDef,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { hasAccess, resolveAgentExposure } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  hasAccess,
+  isAgentVisibleScreen,
+  resolveAgentExposure,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 import type {
   AgentManifest,
@@ -204,10 +208,15 @@ function buildNavs(
   workspaces: ReadonlyMap<string, WorkspaceDefinition>,
   translations: TranslationKeys,
   roles: readonly string[],
+  screens: ReadonlyMap<string, ScreenDefinition>,
 ): readonly AgentManifestNav[] {
   const result: AgentManifestNav[] = [];
   for (const [, nav] of navs) {
     if (!uiVisible(nav.access, roles)) continue;
+    // A nav pointing at an opted-out screen would leak its id and label back
+    // into the manifest the screen was just removed from.
+    const target = nav.screen !== undefined ? screens.get(nav.screen) : undefined;
+    if (target !== undefined && !isAgentVisibleScreen(target)) continue;
     const visibleWorkspaces = visibleWorkspaceIds(nav.workspaces, workspaces, roles);
     const hasWorkspaces = nav.workspaces !== undefined && nav.workspaces.length > 0;
     if (hasWorkspaces && visibleWorkspaces.length === 0) continue;
@@ -239,6 +248,9 @@ function buildScreens(
   const result: AgentManifestScreen[] = [];
 
   for (const [, screen] of screens) {
+    // An opted-out screen must not reach the manifest at all — the tool catalog
+    // builds `navigate`'s screen-id enum straight from `manifest.screens`.
+    if (!isAgentVisibleScreen(screen)) continue;
     const matchingNavs = allNavs.filter((nav) => nav.screen === screen.id);
     const accessibleNavs = matchingNavs.filter((nav) => uiVisible(nav.access, roles));
 
@@ -312,8 +324,9 @@ export function buildAgentManifest(
     roles,
     (qn) => registry.getHandlerEntity(qn),
   );
-  const navs = buildNavs(navMap, workspaceMap, translations, roles);
-  const screens = buildScreens(registry.getAllScreens(), navMap, workspaceMap, translations, roles);
+  const screenMap = registry.getAllScreens();
+  const navs = buildNavs(navMap, workspaceMap, translations, roles, screenMap);
+  const screens = buildScreens(screenMap, navMap, workspaceMap, translations, roles);
   const workspaces = buildWorkspaces(workspaceMap, translations, roles);
 
   return {

package/src/agent-tools/feature.ts

@@ -6,7 +6,7 @@ export const AGENT_TOOLS_FEATURE_NAME = "agent-tools";
 export function createAgentToolsFeature(): FeatureDefinition {
   return defineFeature(AGENT_TOOLS_FEATURE_NAME, (r) => {
     r.describe(
-      "Builds a tool catalog and an agent manifest from the mounted registry so an LLM agent can call handlers and understand the app's shape. A handler, custom screen, or entity without a `description` stays invisible to the agent by construction (see `resolveAgentExposure`) — this feature surfaces those gaps at boot and via `kumiko agent lint` so an app author notices before an agent silently can't see a feature.",
+      "Builds a tool catalog and an agent manifest from the mounted registry so an LLM agent can call handlers and understand the app's shape. A handler or entity without a `description` stays invisible to the agent by construction (see `resolveAgentExposure`), while a screen stays visible unless it opts out with `agent: { expose: false }` (see `isAgentVisibleScreen`) — this feature surfaces the resulting gaps at boot and via `kumiko agent lint` so an app author notices before an agent silently can't see a feature.",
     );
     r.uiHints({
       displayLabel: "AI Agent Tools",

package/src/auth-email-password/changes.json

@@ -5,6 +5,13 @@
     "title": "Self-signup provisions TenantAdmin on the new tenant",
     "detail": "INITIAL_SIGNUP_ROLES is TenantAdmin (was Admin) so the first user on a new tenant can invite peers and manage memberships without elevation dead-ends."
   },
+  {
+    "version": "0.167.1",
+    "type": "improvement",
+    "title": "accountLockout is reachable through runProdApp/runDevApp (fw#1627).",
+    "detail": "accountLockout was an option on createAuthEmailPasswordFeature, but both wrappers mount auth-email-password themselves and their auth options only knew accountUnlock — an app on either entrypoint had no way to turn brute-force protection on. RunProdAppAuthOptions and RunDevAppAuthOptions now carry accountLockout and composeFeatures passes it through.",
+    "migration": "Opt-in, nothing breaks without it. Two things to know before relying on it: without ctx.redis the lockout is silently skipped in login.write.ts — no error, no warning, no protection — so treat Redis as a deploy invariant, and prove the lockout with a behavioural test instead of assuming the mount is enough."
+  },
   {
     "version": "0.165.1",
     "type": "breaking",
@@ -12,13 +19,6 @@
     "detail": "The four positional args (LoginComponent, loginProps, MfaVerifyComponent, MfaSetupComponent) did not scale past two optional MFA params. Shipped in the stranded 2.0.0 major and carried into the 0.165.1 line.",
     "migration": "Rewrite call sites as makeAuthGate({ loginScreen, loginScreenProps, mfaVerifyScreen, mfaSetupScreen }). Type-check catches every occurrence."
   },
-  {
-    "version": "0.167.1",
-    "type": "improvement",
-    "title": "accountLockout is reachable through runProdApp/runDevApp (fw#1627).",
-    "detail": "accountLockout was an option on createAuthEmailPasswordFeature, but both wrappers mount auth-email-password themselves and their auth options only knew accountUnlock \u2014 an app on either entrypoint had no way to turn brute-force protection on. RunProdAppAuthOptions and RunDevAppAuthOptions now carry accountLockout and composeFeatures passes it through.",
-    "migration": "Opt-in, nothing breaks without it. Two things to know before relying on it: without ctx.redis the lockout is silently skipped in login.write.ts \u2014 no error, no warning, no protection \u2014 so treat Redis as a deploy invariant, and prove the lockout with a behavioural test instead of assuming the mount is enough."
-  },
   {
     "version": "0.162.0",
     "type": "improvement",
@@ -28,19 +28,19 @@
   {
     "version": "0.154.1",
     "type": "fix",
-    "title": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled\u2026",
-    "detail": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled-features/auth-email-password/web`. Every other auth screen (ForgotPasswordScreen, SignupScreen, ResetPasswordScreen, \u2026) was already exported from the barrel with its props type; `LoginScreen` was missed. `makeAuthGate`'s second parameter is typed `LoginScreenProps`, so consumers passing a typed `loginScreenProps` override (e.g. `@cosmicdriftgamestudio/kumiko-designer`) couldn't import the type at all. - @cosmicdrift/kumiko-framework@0.154.1 - @cosmicdrift/kumiko-dispatcher-live@0.154.1 - @cosmicdrift/kumiko-headless@0.154.1 - @cosmicdrift/kumiko-renderer@0.154.1 - @cosmicdrift/kumiko-renderer-web@0.154.1"
+    "title": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled…",
+    "detail": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled-features/auth-email-password/web`. Every other auth screen (ForgotPasswordScreen, SignupScreen, ResetPasswordScreen, …) was already exported from the barrel with its props type; `LoginScreen` was missed. `makeAuthGate`'s second parameter is typed `LoginScreenProps`, so consumers passing a typed `loginScreenProps` override (e.g. `@cosmicdriftgamestudio/kumiko-designer`) couldn't import the type at all. - @cosmicdrift/kumiko-framework@0.154.1 - @cosmicdrift/kumiko-dispatcher-live@0.154.1 - @cosmicdrift/kumiko-headless@0.154.1 - @cosmicdrift/kumiko-renderer@0.154.1 - @cosmicdrift/kumiko-renderer-web@0.154.1"
   },
   {
     "version": "0.151.0",
     "type": "improvement",
-    "title": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly \u2014 u\u2026",
-    "detail": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly \u2014 use the new `createLoginRoute({ loginScreenProps, mfaVerifyScreen, unaffected (they already build on the same logic internally now). Why: a raw `<LoginScreen />` render has no MFA-challenge handling unless the caller remembers to hand-wire `onMfaChallenge` + swap in a verify screen itself \u2014 exactly how kumiko-framework#266's login-time MFA step went missing in a real app's standalone apex/marketing login route (it renders outside `emailPasswordClient`'s own gate, which already handled this correctly). `createLoginRoute` is the one place this logic lives now, for both the gated and standalone cases \u2014 there's no lower-level piece left to misuse. The `apex-surface-auth` recipe is updated to match."
+    "title": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly — u…",
+    "detail": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly — use the new `createLoginRoute({ loginScreenProps, mfaVerifyScreen, unaffected (they already build on the same logic internally now). Why: a raw `<LoginScreen />` render has no MFA-challenge handling unless the caller remembers to hand-wire `onMfaChallenge` + swap in a verify screen itself — exactly how kumiko-framework#266's login-time MFA step went missing in a real app's standalone apex/marketing login route (it renders outside `emailPasswordClient`'s own gate, which already handled this correctly). `createLoginRoute` is the one place this logic lives now, for both the gated and standalone cases — there's no lower-level piece left to misuse. The `apex-surface-auth` recipe is updated to match."
   },
   {
     "version": "0.131.0",
     "type": "improvement",
-    "title": "App-Mounting 2.0 S\u00e4ule A: Mid-Level-Widget-Kit in renderer-web (StatCard, MiniStat, Secti\u2026",
-    "detail": "App-Mounting 2.0 S\u00e4ule A: Mid-Level-Widget-Kit in renderer-web (StatCard, MiniStat, SectionCard, StatusBadge, ProgressBar, CollapsibleSection, DetailList, ModeSwitch, StatusBarChart, TimeseriesChart, EmptyState/LoadingState/ErrorState, QueryTable) + Status-Farb-Tokens (--color-status-\\*). Neue Hooks useMutation + useDisclosure. Neues Core-Primitive Link (default/button/muted), Button-Variant \"link\", Text-Variant \"muted\"; auth-email-password nutzt sie (authButtonClass/authMutedLinkClass entfernt)."
+    "title": "App-Mounting 2.0 Säule A: Mid-Level-Widget-Kit in renderer-web (StatCard, MiniStat, Secti…",
+    "detail": "App-Mounting 2.0 Säule A: Mid-Level-Widget-Kit in renderer-web (StatCard, MiniStat, SectionCard, StatusBadge, ProgressBar, CollapsibleSection, DetailList, ModeSwitch, StatusBarChart, TimeseriesChart, EmptyState/LoadingState/ErrorState, QueryTable) + Status-Farb-Tokens (--color-status-\\*). Neue Hooks useMutation + useDisclosure. Neues Core-Primitive Link (default/button/muted), Button-Variant \"link\", Text-Variant \"muted\"; auth-email-password nutzt sie (authButtonClass/authMutedLinkClass entfernt)."
   }
 ]

package/src/auth-foundation/changes.json

@@ -5,16 +5,16 @@
     "title": "validateSessionStoreMultiplicity accepts zero sessionStore providers (fw#1547).",
     "detail": "A machine-API-only deployment (PAT-bearer auth, no browser sessions) can mount auth-foundation without also mounting sessions."
   },
-  {
-    "version": "0.161.0",
-    "type": "improvement",
-    "title": "tenantResolver/tenantExistence extension points, sessionStore without auth.sessions (fw#1372-1375).",
-    "detail": "Auth-foundation migration: tenant resolution and tenant-existence become extension points, sessionStore is wired without going through auth.sessions, AnonymousAccessConfig is slimmed down. See the auth-foundation-providers recipe."
-  },
   {
     "version": "0.165.0",
     "type": "fix",
     "title": "Allow zero tokenVerifier when sessionStore present",
     "detail": "Auth foundation now accepts zero tokenVerifier when a sessionStore is configured — prevents crash in session-store-only setups."
+  },
+  {
+    "version": "0.161.0",
+    "type": "improvement",
+    "title": "tenantResolver/tenantExistence extension points, sessionStore without auth.sessions (fw#1372-1375).",
+    "detail": "Auth-foundation migration: tenant resolution and tenant-existence become extension points, sessionStore is wired without going through auth.sessions, AnonymousAccessConfig is slimmed down. See the auth-foundation-providers recipe."
   }
 ]

package/src/cap-overview/changes.json

@@ -1,14 +1,14 @@
 [
-  {
-    "version": "0.224.0",
-    "type": "improvement",
-    "title": "Add cap-overview feature: tier + cap usage visibility per tenant.",
-    "detail": "New read-only bundled feature. SystemAdmin gets a paged, searchable tenant list with tier/billing columns and per-cap usage bars, plus a per-tenant dashboard reachable from the list. TenantAdmin gets a 'My usage' dashboard showing their own tenant's cap usage as cards. Reads tier-engine, billing-foundation and tenant projections plus caller-supplied CapSpec usage callbacks; every handler enforces explicit tenant scoping (no ambient tenant filter, cross-tenant reads require SystemAdmin + acknowledgeCrossTenant)."
-  },
   {
     "version": "0.233.0",
     "type": "improvement",
     "title": "CapSpec.limit can now return null for an unlimited usage meter.",
     "detail": "A CapSpec's `limit(tier)` may now return `null` to mean unlimited: the cap is still counted (used shows the raw count) but never capped, has no percent, and renders no progress bar or badge. This is a distinct meaning from `limit <= 0`, which unchanged still means 'not part of this tier' and renders as 0/0%."
+  },
+  {
+    "version": "0.224.0",
+    "type": "improvement",
+    "title": "Add cap-overview feature: tier + cap usage visibility per tenant.",
+    "detail": "New read-only bundled feature. SystemAdmin gets a paged, searchable tenant list with tier/billing columns and per-cap usage bars, plus a per-tenant dashboard reachable from the list. TenantAdmin gets a 'My usage' dashboard showing their own tenant's cap usage as cards. Reads tier-engine, billing-foundation and tenant projections plus caller-supplied CapSpec usage callbacks; every handler enforces explicit tenant scoping (no ambient tenant filter, cross-tenant reads require SystemAdmin + acknowledgeCrossTenant)."
   }
 ]

package/src/crypto-shredding/changes.json

@@ -1,4 +1,12 @@
 [
+  {
+    "version": "0.167.0",
+    "type": "breaking",
+    "title": "Test-only reset helpers moved from /crypto to /testing (fw#1631).",
+    "detail": "resetPiiSubjectKmsForTests and resetBlindIndexKeyForTests are no longer exported by the production barrels. The functions did not change — only the export path. Why it matters beyond tidiness: resetPiiSubjectKmsForTests clears the injected KMS, after which encryptForStorage sees no adapter and writes subject-annotated fields in plaintext, with no error and no log. Reachable from a production barrel, that is one stray import away from silent plaintext PII.",
+    "migration": "Change the import in your test files: `import { resetPiiSubjectKmsForTests } from \"@cosmicdrift/kumiko-framework/testing\"` instead of `.../crypto`. Type-check catches every occurrence; nothing else changes. Apps mounting crypto-shredding typically hit this in every test that configures an InMemoryKmsAdapter.",
+    "codemod": "scripts/codemod/crypto-shredding-testing-move.ts"
+  },
   {
     "version": "0.166.0",
     "type": "improvement",
@@ -11,14 +19,6 @@
     "title": "KmsWiringEnv accepts process.env directly (fw#1618).",
     "detail": "All members being optional made TypeScript's weak-type detection reject ProcessEnv for having no properties in common, which forced every consumer into a cast or a six-key mapping — the boilerplate fw#1617 set out to remove."
   },
-  {
-    "version": "0.167.0",
-    "type": "breaking",
-    "title": "Test-only reset helpers moved from /crypto to /testing (fw#1631).",
-    "detail": "resetPiiSubjectKmsForTests and resetBlindIndexKeyForTests are no longer exported by the production barrels. The functions did not change — only the export path. Why it matters beyond tidiness: resetPiiSubjectKmsForTests clears the injected KMS, after which encryptForStorage sees no adapter and writes subject-annotated fields in plaintext, with no error and no log. Reachable from a production barrel, that is one stray import away from silent plaintext PII.",
-    "migration": "Change the import in your test files: `import { resetPiiSubjectKmsForTests } from \"@cosmicdrift/kumiko-framework/testing\"` instead of `.../crypto`. Type-check catches every occurrence; nothing else changes. Apps mounting crypto-shredding typically hit this in every test that configures an InMemoryKmsAdapter.",
-    "codemod": "scripts/codemod/crypto-shredding-testing-move.ts"
-  },
   {
     "version": "0.165.3",
     "type": "improvement",

package/src/personal-access-tokens/changes.json

@@ -1,15 +1,15 @@
 [
-  {
-    "version": "0.117.0",
-    "type": "improvement",
-    "title": "personal-access-tokens: add `toggleable` option so the whole feature can be tier-gated vi…",
-    "detail": "personal-access-tokens: add `toggleable` option so the whole feature can be tier-gated via the tier-engine (mirrors ledger/tags). Pass `{ toggleable: { default: false } }` for fail-closed gating — PAT is then off until a tier lists `\"personal-access-tokens\"` in its features. Omitting the option keeps PAT always-on (no behaviour change for existing consumers)."
-  },
   {
     "version": "0.202.0",
     "type": "breaking",
     "title": "personal-access-tokens: `write:create` now requires `currentPassword` (+ `mfaCode` if MFA enrolled) (e91d4cb).",
     "detail": "`personal-access-tokens:write:create` now requires `currentPassword` (verified against the caller's password hash) before minting a token, and rejects when the caller has MFA enrolled and `mfaCode` is missing or wrong — a session cookie alone is no longer enough to stand up a durable API credential. `expiresInDays` now defaults to 90 days instead of never-expiring when omitted (the existing 3650-day cap is unchanged, so a genuinely long-lived token is still possible if requested explicitly). Changing a user's password, or enabling/disabling MFA, now revokes all of that user's live PAT tokens — mirrors the existing session auto-revoke-on-password-change behavior. `run-prod-app`/`run-dev-app` wire the new MFA↔PAT revoke callback automatically when both `auth-mfa` and `personal-access-tokens` are mounted; no app-level change needed for that part.",
     "migration": "Apps that already mint PATs (their own client code, scripts, or tests) need to add `currentPassword` to the `create` request payload — this is a breaking change to the `create` request shape despite the minor bump (bundled-features doesn't follow strict semver across its handler schemas yet). If the caller has MFA enrolled, also include a valid `mfaCode`."
+  },
+  {
+    "version": "0.117.0",
+    "type": "improvement",
+    "title": "personal-access-tokens: add `toggleable` option so the whole feature can be tier-gated vi…",
+    "detail": "personal-access-tokens: add `toggleable` option so the whole feature can be tier-gated via the tier-engine (mirrors ledger/tags). Pass `{ toggleable: { default: false } }` for fail-closed gating — PAT is then off until a tier lists `\"personal-access-tokens\"` in its features. Omitting the option keeps PAT always-on (no behaviour change for existing consumers)."
   }
 ]

package/src/user-data-rights/changes.json

@@ -6,18 +6,18 @@
     "detail": "`privacy-center` is now a declarative `projectionDetail` screen instead of a custom React component: the Restriction and Deletion sections render through the generic renderer (`EditFieldsSection` + `actions: RowAction[]`), preserving the original confirmation dialogs (`RowActionWriteHandler.confirm`) and visibility rules (`visible: {field, eq/ne}`) 1:1. The Export section (Art. 20) stays a custom `EditExtensionSection` — it needs polling + a signed-URL download — registered via the new `ClientFeatureDefinition.extensionSectionComponents` under `EXPORT_SECTION_EXTENSION_NAME`. `PrivacyCenterScreen` is a dead export (the renderer selects the screen by `screen.type`, not the client component registry). The single `status` field now renders through the `enumOption` format instead of the raw enum string; `gracePeriodEnd` is hidden when no deletion is pending instead of showing an empty date. Known UI regression, accepted for this pass: the confirm-dialog title is now always the action's `label` (the renderer hardcodes this) — the original's distinct `dialogTitle` copy and its dynamic composed banner sentence (e.g. \"Your account will be deleted on {date}\") are gone, replaced by the translated `status` label plus a separately labeled `gracePeriodEnd` date.",
     "migration": "A declarative screen is registered once and can no longer be toggled per-app on the client: `userDataRightsClient(options)`'s `privacyCenter: { showDeletion }` option is removed. Move the flag server-side instead — replace `createUserDataRightsFeature({})` with `createUserDataRightsFeature({ privacyCenterShowDeletion: false })` (default `true`) — it conditionally omits the Deletion section and its `request-deletion`/`cancel-deletion` actions from the screen definition. Then drop the now-unused `privacyCenter` option from the matching `userDataRightsClient({ privacyCenter: { showDeletion: false } })` call. Known affected consumer: `money-horse` (`src/app/client-features.tsx:74`)."
   },
-  {
-    "version": "0.165.1",
-    "type": "fix",
-    "title": "restrict-account runs the same cross-tenant membership check as lift-restriction (fw#1543).",
-    "detail": "Any Admin/TenantAdmin — not just SystemAdmin — could restrict a user's account and force-revoke their sessions regardless of tenant, as long as they held an admin role in some tenant. Also: the GET /user-export/by-token fallback now forwards x-forwarded-for to the internal query call, so the per-IP 30/min limit stops collapsing into one global bucket."
-  },
   {
     "version": "0.165.3",
     "type": "improvement",
     "title": "Forget cleanup purges derived Meili docs for searchable subject-PII (fw#1610).",
     "detail": "run-forget-cleanup (and the forget cron path) call purgeSearchDocumentsForSubject after crypto-shred so searchable userOwned fields do not linger in Meili as plaintext after Art. 17."
   },
+  {
+    "version": "0.165.1",
+    "type": "fix",
+    "title": "restrict-account runs the same cross-tenant membership check as lift-restriction (fw#1543).",
+    "detail": "Any Admin/TenantAdmin — not just SystemAdmin — could restrict a user's account and force-revoke their sessions regardless of tenant, as long as they held an admin role in some tenant. Also: the GET /user-export/by-token fallback now forwards x-forwarded-for to the internal query call, so the per-IP 30/min limit stops collapsing into one global bucket."
+  },
   {
     "version": "0.165.0",
     "type": "breaking",