@terreno/mcp 57.6.1 → 57.7.0

package/src/docs/versioned/next/implementationPlans/support-agent.md

@@ -1,6 +1,7 @@
 # Implementation Plan: Support answering agent (`@terreno/support`)
 
 **Status:** Draft — awaiting approval (Grow ran unattended; every Decisions row marked `assumed` is a recommended default the reviewer can change before Approve)  
+**Roadmap:** Area=`ai`, Target=`Future`, Impact=`Feature`  
 **Branch:** `cursor/support-agent-grow-fd63`  
 **Owner:** unassigned  
 **Created:** 2026-09-15  

package/src/docs/versioned/next/implementationPlans/syncdb-codegen.md

@@ -1,7 +1,7 @@
 # Implementation Plan: @terreno/syncdb-codegen
 
 **Status:** Complete — shipped as `syncdb/src/codegen` + `terreno-syncdb-codegen`
-**Roadmap issue:** https://github.com/TerrenoLabs/terreno/issues/1087
+**Roadmap issue:** https://github.com/TerrenoLabs/terreno/issues/1110
 **Branch:** cursor/syncdb-codegen-in-package-746d
 **Owner:**
 **Created:** 2026-07-08

package/src/docs/versioned/next/implementationPlans/terreno-langfuse-integration.md

@@ -1,7 +1,7 @@
 # @terreno/langfuse
 
 **Roadmap issue:** https://github.com/TerrenoLabs/terreno/issues/1093  
-**Status:** Approved
+**Status:** Complete
 
 > **See also:** Native in-app observability (prompts, traces, evals, experiments, review queue) is specified in [ai-observability.md](./ai-observability.md). This IP remains the **Langfuse Cloud/self-host vendor plugin**. Both plugins may be registered; traces/scores fan out (see that IP).
 

package/src/docs/versioned/next/implementationPlans/upgrade-guides-and-skill.md

@@ -1,6 +1,6 @@
 # Implementation Plan: Upgrade Guides and the `upgrading-terreno` Skill
 
-**Status:** Approved
+**Status:** Complete
 **Roadmap issue:** https://github.com/TerrenoLabs/terreno/issues/1013
 **Priority:** High
 **Effort:** Big batch

package/src/docs/versioned/next/reference/lifecycle-plugin.md

@@ -14,7 +14,7 @@ loops that invoke those stages; they are not stages and must not appear as `stag
 | `terreno-2-pick` | approved task + branch/state | one implemented slice, then Roast, then the next task | Roast, or Brew when the list is done |
 | `terreno-3-roast` | Pick result + current diff | independent requirement/evidence verdict for the current task | emit Pick if tasks remain, else Brew; never invoke Pick; pass a task-scoped briefing; do not spawn two unconstrained reviewers |
 | `terreno-4-brew` | Roast PASS for every in-scope task + branch/evidence | pushed head + PR + product-CI trigger check + review-bot wait + attached evidence | Taste |
-| `terreno-5-taste` | PR + current state | one current-head reaction; before push: pull latest `master`, re-verify last-run failed tests locally, run root `prepush` when present (otherwise affected-package checks) in a no-context subagent, then watch CI | null or fresh Taste |
+| `terreno-5-taste` | PR + current state | one current-head reaction; before push: fetch latest `master` (merge only when needed), re-verify last-run failed tests locally, run root `prepush` when present (otherwise affected-package checks) in a no-context subagent, then watch CI; invoked directly, repeats bounded reactions until terminal | null or fresh Taste |
 
 Outer loops (not stages):
 
@@ -51,7 +51,7 @@ until async review bots (Bugbot, CodeQL, and similar) on the current head have r
 preferring provider CLI watch hooks or harness event subscriptions over sleep polling.
 Taste then waits in a loop for product CI using GitHub CLI (`gh pr checks --watch`,
 `gh run watch`) or CircleCI CLI (`circleci run watch`) until jobs are terminal or the
-wait times out. Before any push, Taste always pulls latest `master`, records last-run
+wait times out. Before any push, Taste fetches latest `master` (merging it only when needed), records last-run
 failed tests and re-verifies them locally, then spawns a
 fresh subagent with no parent conversation. If the repository root defines a `prepush`
 package script, Taste runs it as the authoritative local gate; otherwise it falls back

package/src/docs/versioned/next/reference/test.md

@@ -148,7 +148,7 @@ the demo compiles. Add a story plus `demoConfig.tsx` registration for new
 components, or an allowlist entry with a specific reason — not "hard to demo".
 The allowlist is limited to shell/providers, React context objects, thin RN
 list wrappers, subcomponents already exercised by a parent story
-(Filter, Table, DateTimeField, HeightField, ConsentFormScreen), and
+(DropdownPanel, Table, DateTimeField, HeightField, ConsentFormScreen), and
 product surfaces that belong in `example-frontend` rather than the isolated
 UI demo (announcements and in-app notifications).
 Standalone picker sheets (`NumberPickerActionSheet`, `DecimalRangeActionSheet`)

package/src/docs/versioned/next/reference/ui.md

@@ -226,6 +226,69 @@ overrides it:
 | Helper | `{testID}.helper` |
 | Show/hide toggle | `{testID}.visibility-toggle` |
 
+### DropdownPanel
+
+`DropdownPanel` is the compositional dropdown behind the DataTable filter popovers. A
+trigger opens an anchored panel of arbitrary composed content with an optional
+Apply / Clear / Cancel footer, so it also fits non-filter panels (bulk actions, column
+pickers, sort menus).
+
+``````typescript
+<DropdownPanel
+  label="Filters"
+  onApply={applyDraft}
+  onCancel={resetDraft}
+  onClear={clearDraft}
+  onOpenChange={(isOpen) => isOpen && seedDraft()}
+  width={340}
+>
+  <FilterSelectMenu title="Due date" options={DUE_DATE_OPTIONS} value={dueDate} onChange={setDueDate} />
+  <FilterBoolean title="Urgent tasks only" value={urgentOnly} onChange={setUrgentOnly} />
+</DropdownPanel>
+``````
+
+> `Filter` is the former name and stays exported as a deprecated alias (with `FilterProps`)
+> until Terreno 58. The `FilterSelectMenu` / `FilterBoolean` / `FilterAccordion` /
+> `FilterChangesBadge` controls keep their names.
+
+#### Positioning
+
+The panel never renders inside its parent's clipping or stacking context: on web it is
+portaled to `document.body` with fixed positioning, and on native it is teleported to the
+`TerrenoProvider` portal host (falling back to an inline absolute overlay when no host is
+mounted). `computeDropdownPanelLayout` then anchors it to the measured trigger:
+
+| Situation | Behavior |
+| --- | --- |
+| Panel fits beside the trigger | Left edges line up (`align="start"`) |
+| Left-aligned panel would cross the right viewport edge | Right edges line up instead (`align="auto"`, the default) |
+| Panel is wider than the viewport | Narrowed to the viewport minus the 8px screen margins |
+| Less than 160px below the trigger, and more above | Flipped above the trigger |
+| Content taller than the space on screen | Panel body scrolls; the footer stays pinned |
+
+Pass `align="start"` or `align="end"` to pin the side explicitly, and `maxPanelHeight` to
+cap the height below what the viewport allows.
+
+#### Trigger
+
+The default trigger is a `Button` (or a compact icon trigger with `iconOnly`). Style it
+with `triggerVariant` (any `Button` variant), `triggerSize`, and `fullWidth`, or replace
+it entirely with `renderTrigger` when the design needs chrome the button variants do not
+cover:
+
+``````typescript
+<DropdownPanel
+  fullWidth
+  renderTrigger={({isOpen, toggle}) => <MyPill active={isOpen} onPress={toggle} />}
+  width={300}
+>
+  {fields}
+</DropdownPanel>
+``````
+
+`variant` still sets both the trigger and the Apply button; `triggerVariant` and
+`applyButtonVariant` override each independently.
+
 ### GPTChat
 
 Streaming chat surface for `@terreno/ai`. Histories, messages, submit, and optional MCP/tools stay under consumer control.
@@ -811,10 +874,10 @@ columns; web shows one **More filters** popover and native includes them in the
 
 | Platform | Chrome |
 | --- | --- |
-| Web | Toolbar search + per-column `Filter` popovers (`column.filter`) |
+| Web | Toolbar search + per-column `DropdownPanel` popovers (`column.filter`) |
 | Native | Toolbar search + one **Filters** sheet (`Modal`) with the same fields |
 
-Column headers use `Filter` with `iconOnly`, which renders a compact icon trigger
+Column headers use `DropdownPanel` with `iconOnly`, which renders a compact icon trigger
 (24px at the default `triggerSize="sm"`, 32px with `triggerSize="default"`) instead
 of a labeled button. Give it an accessible name with `triggerAccessibilityLabel`.
 

package/src/docs/versioned/next/tasks/can-as-permission-seam.md

@@ -4,7 +4,7 @@ IP: [can-as-permission-seam.md](../implementationPlans/can-as-permission-seam.md
 
 ## Phase 1 — `assertAllowed`
 
-- [ ] **Task 1.1**: Helper + unit tests
+- [x] **Task 1.1**: Helper + unit tests
   - Delivers: `assertAllowed` implements legacy `checkPermissions` and `accessControl.can()`; double-gate test (access allow + permissions deny → allow)
   - Files: `api/src/rbac/assertAllowed.ts`, `api/src/rbac/assertAllowed.test.ts`
   - Blocked by: none (can land before MCP adapters; executors wiring waits on unified writes if MCP still duplicates checks)
@@ -12,7 +12,7 @@ IP: [can-as-permission-seam.md](../implementationPlans/can-as-permission-seam.md
 
 ## Phase 2 — Hot path
 
-- [ ] **Task 2.1**: Middleware + executors
+- [x] **Task 2.1**: Middleware + executors
   - Delivers: `permissionMiddleware` and `executeCreate/Update/Delete` call `assertAllowed`; `buildAccessPermissions` not used on requests
   - Files: `api/src/permissions.ts`, `api/src/sync/executors.ts`, `api/src/api.ts`, `api/src/rbac/modelRouterAccess.ts`, tests
   - Blocked by: 1.1; unified-mutation-executors Phase 2 so MCP is included automatically
@@ -20,12 +20,12 @@ IP: [can-as-permission-seam.md](../implementationPlans/can-as-permission-seam.md
 
 ## Phase 3 — Consumers and docs
 
-- [ ] **Task 3.1**: example-backend dual config
+- [x] **Task 3.1**: example-backend dual config
   - Delivers: routers with `access` drop redundant AND `permissions` where RBAC is the intent
   - Files: `example-backend/src/**` model routers
   - Blocked by: 2.1
   - Acceptance: example-backend tests pass
-- [ ] **Task 3.2**: Docs + breaking changelog
+- [x] **Task 3.2**: Docs + breaking changelog
   - Files: `docs/reference/api.md`, `docs/how-to/create-a-model.md`, `docs/implementationPlans/rbac-permissions.md` pointer, changelog
   - Blocked by: 2.1
   - Skills: `update-docs`

package/src/docs/versioned/next/tasks/collection-registry.md

@@ -4,12 +4,12 @@ IP: [collection-registry.md](../implementationPlans/collection-registry.md)
 
 ## Phase 1 — Dual-write catalog
 
-- [ ] **Task 1.1**: `CollectionRegistry` module
+- [x] **Task 1.1**: `CollectionRegistry` module
   - Delivers: `registerCollection`, `replaceCollectionOptions`, `getCollection`, `listCollections`, `clearCollectionRegistry` with unit tests (unknown path no-op, options replace)
   - Files: `api/src/collectionRegistry.ts`, `api/src/collectionRegistry.test.ts`
   - Blocked by: none
   - Acceptance: bun tests for the module pass without wiring modelRouter
-- [ ] **Task 1.2**: Dual-write from `modelRouter`
+- [x] **Task 1.2**: Dual-write from `modelRouter`
   - Delivers: `modelRouter` / `_buildModelRouter` write the catalog in addition to existing `register*` / `update*`
   - Files: `api/src/api.ts`
   - Blocked by: 1.1
@@ -17,12 +17,12 @@ IP: [collection-registry.md](../implementationPlans/collection-registry.md)
 
 ## Phase 2 — Surfaces read the catalog
 
-- [ ] **Task 2.1**: MCP and realtime views
+- [x] **Task 2.1**: MCP and realtime views
   - Delivers: `getMCPRegistry` / realtime finders read `CollectionRegistry`; arrays in those files removed
   - Files: `api/src/mcp/registry.ts`, `api/src/realtime/registry.ts`, related tests
   - Blocked by: 1.2
   - Acceptance: MCP and realtime tests pass; `updateMCPRegistryOptions` updates the shared record
-- [ ] **Task 2.2**: Sync view + keep validation
+- [x] **Task 2.2**: Sync view + keep validation
   - Delivers: sync lookup uses catalog; `registerSync` validation + index promises still run
   - Files: `api/src/sync/registry.ts`, `api/src/sync/*.test.ts`
   - Blocked by: 1.2
@@ -30,12 +30,12 @@ IP: [collection-registry.md](../implementationPlans/collection-registry.md)
 
 ## Phase 3 — Contract
 
-- [ ] **Task 3.1**: Single writer + clear-all
+- [x] **Task 3.1**: Single writer + clear-all
   - Delivers: `modelRouter` only writes `CollectionRegistry`; wrapper register/update/clear functions; tests that used independent clears updated
   - Files: `api/src/api.ts`, registry wrappers, tests
   - Blocked by: 2.1, 2.2
   - Acceptance: one `replaceCollectionOptions` is enough for MCP+sync options identity
-- [ ] **Task 3.2**: Docs + changelog
+- [x] **Task 3.2**: Docs + changelog
   - Files: `docs/explanation/modular-api-design.md`, `docs/reference/api.md`, changelog
   - Blocked by: 3.1
   - Skills: `update-docs`

package/src/docs/versioned/next/tasks/describe-model-schema.md

@@ -4,12 +4,12 @@ IP: [describe-model-schema.md](../implementationPlans/describe-model-schema.md)
 
 ## Phase 1 — Descriptor + MCP
 
-- [ ] **Task 1.1**: `describeModel` / `describeModelForRouter`
+- [x] **Task 1.1**: `describeModel` / `describeModelForRouter`
   - Delivers: field graph + snapshot tests on a fixture schema
   - Files: `api/src/schemaMetadata.ts`, `api/src/schemaMetadata.test.ts`
   - Blocked by: none
   - Acceptance: snapshots for enum, ref, array, subdocument, system fields
-- [ ] **Task 1.2**: MCP Zod from descriptor
+- [x] **Task 1.2**: MCP Zod from descriptor
   - Delivers: `schemaGenerator.ts` maps `FieldDescription`; no SchemaType switch for kinds already in the descriptor
   - Files: `api/src/mcp/schemaGenerator.ts`, `api/src/mcp/schemaGenerator.test.ts`
   - Blocked by: 1.1
@@ -17,7 +17,7 @@ IP: [describe-model-schema.md](../implementationPlans/describe-model-schema.md)
 
 ## Phase 2 — Admin
 
-- [ ] **Task 2.1**: `extractFieldMeta` from descriptor
+- [x] **Task 2.1**: `extractFieldMeta` from descriptor
   - Delivers: admin config fields built from `describeModel`, not OpenAPI property walk
   - Files: `admin-backend/src/adminApp.ts`, admin-backend tests
   - Blocked by: 1.1
@@ -25,12 +25,12 @@ IP: [describe-model-schema.md](../implementationPlans/describe-model-schema.md)
 
 ## Phase 3 — OpenAPI + docs
 
-- [ ] **Task 3.1**: `getOpenApiSpecForModel` from descriptor
+- [x] **Task 3.1**: `getOpenApiSpecForModel` from descriptor
   - Delivers: OpenAPI properties derived from `ModelDescription`; populate still applied
   - Files: `api/src/populate.ts`, `api/src/openApi.test.ts` / example-backend openapi snapshot if required
   - Blocked by: 1.1
   - Acceptance: OpenAPI tests pass; any snapshot diff is reviewed in the PR
-- [ ] **Task 3.2**: Docs + export
+- [x] **Task 3.2**: Docs + export
   - Files: `docs/explanation/schema-metadata.md`, `docs/reference/api.md`, `docs/how-to/create-a-model.md`, admin reference, `api/src/index.ts`, changelog
   - Blocked by: 1.2, 2.1, 3.1
   - Skills: `update-docs`

package/src/docs/versioned/next/tasks/migrate-cicd-to-circleci.md

@@ -103,19 +103,21 @@ Research: [`docs/implementationPlans/migrate-cicd-to-circleci-research.md`](../i
   - Files: `.circleci/continue-config.yml`
   - Depends on: Task 0.2, Task 1.3
   - Acceptance: preview deploy URL posted or visible; prod deploy on master path filter.
-  - Note: Path filters and preview jobs exist. Live Netlify still runs on GHA until `terreno-netlify` is filled; CircleCI skips. Cleanup on PR close is GHA `preview-cleanup.yml`.
+  - Note: CircleCI is the only Netlify deployer; jobs fail when `terreno-netlify` is empty. PR close triggers CircleCI `preview-cleanup` through `preview-cleanup.yml`.
 
 - [ ] **Task 4.2**: Preview cleanup port
   - Description: On PR close, clean Netlify/GCP preview resources from CircleCI (webhook or GitHub App → pipeline). Prefer OIDC over `GCP_SA_KEY`.
   - Files: `.circleci/continue-config.yml`
   - Depends on: Task 4.1
   - Acceptance: closing a PR removes preview resources; no orphaned Cloud Run `pr-N` services in a test PR.
+  - Note: Cutover code landed on branch `move-cd-to-circleci` (GHA deploy workflows disabled; CircleCI deploy jobs fail on empty contexts). Check off after contexts are filled and the acceptance is observed.
 
 - [ ] **Task 4.3**: Dual-run cutover for Netlify
   - Description: Delete GHA deploy workflows after CircleCI trusted.
   - Files: `.github/workflows/demo-deploy.yml`, `frontend-example-deploy.yml`, `docs-deploy.yml`, `preview-cleanup.yml`
   - Depends on: Task 4.1, Task 4.2
   - Acceptance: GHA deploy twins deleted.
+  - Note: Cutover code landed on branch `move-cd-to-circleci` (GHA deploy workflows disabled; CircleCI deploy jobs fail on empty contexts). Check off after contexts are filled and the acceptance is observed.
 
 ## Phase 5: EAS + fingerprint
 
@@ -150,13 +152,14 @@ Research: [`docs/implementationPlans/migrate-cicd-to-circleci-research.md`](../i
   - Files: `.circleci/continue-config.yml`
   - Depends on: Task 6.1
   - Acceptance: terraform preview on PR; apply+deploy on master for a safe test path; GitHub Deployment records optional but documented.
-  - Note: Path filters exist. Live GCP still runs on GHA until `terreno-gcp` is filled; CircleCI skips apply.
+  - Note: CircleCI is the only GCP deployer; jobs fail when `terreno-gcp` is empty. `gcp-cd-prod` runs MCP `test:ci` before the MCP deploy.
 
 - [ ] **Task 6.3**: Dual-run cutover for CD
   - Description: Single deployer: disable GHA `cd.yml` when CircleCI CD is required; remove GitHub OIDC provider only after GHA CD is gone (or keep read-only if other repos need it — document).
   - Files: `.github/workflows/cd.yml`, terraform OIDC
   - Depends on: Task 6.2
   - Acceptance: only CircleCI performs terreno CD; no double apply.
+  - Note: Cutover code landed on branch `move-cd-to-circleci` (GHA deploy workflows disabled; CircleCI deploy jobs fail on empty contexts). Check off after contexts are filled and the acceptance is observed.
 
 ## Phase 7: npm publish
 
@@ -200,7 +203,7 @@ Research: [`docs/implementationPlans/migrate-cicd-to-circleci-research.md`](../i
   - Depends on: Task 0.2
   - Acceptance: Security tab still receives results **or** explicit maintainer sign-off on alternative.
 
-- [ ] **Task 9.2**: Replace Dependabot auto-merge + triage + roadmap-generate + docs-audit
+- [ ] **Task 9.2**: Replace Dependabot auto-merge + triage + docs-audit (roadmap workflows stay on GitHub Actions, decided 2026-09-26)
   - Description: Implement CircleCI (or Renovate) equivalents; wire issue/schedule triggers without leaving required logic on GHA.
   - Files: `.circleci/continue-config.yml`, corresponding GHA deletions
   - Depends on: Task 0.2