thinkwork-cli 0.13.2 → 1.0.0

package/dist/drizzle/0285_tenant_mcp_twin_keys_trusted_subsystem.sql

@@ -0,0 +1,30 @@
+-- Trusted-subsystem marker on tenant_mcp_twin_keys (THINK-626) — the write
+-- side of the `trustedSubsystem` field in key manifest v2
+-- (twin-mcp-keys/v2; reader is company-brain brain-mcp/src/auth.ts).
+--
+-- true lets the key assert `on_behalf_of` per tools/call — running the call
+-- under the named signed-in human's user-claims entry instead of under the
+-- key's own grants. It is NOT a grant and it can never widen anyone: the
+-- asserted user's grants come from the user-claims manifest, and a tenant
+-- that publishes none refuses the assertion. It belongs only on keys the
+-- platform itself holds (the Pi runtime's provisioned "default" connector
+-- key), never on one handed to a customer's client — hence default false
+-- and no backfill for user-minted rows.
+--
+-- Hand-rolled (mirrors the 0274/0281/0282 convention; not registered in
+-- meta/_journal.json).
+-- Apply via: psql "$DATABASE_URL" -f drizzle/0285_tenant_mcp_twin_keys_trusted_subsystem.sql
+-- creates-column: public.tenant_mcp_twin_keys.trusted_subsystem
+
+ALTER TABLE public.tenant_mcp_twin_keys
+  ADD COLUMN IF NOT EXISTS trusted_subsystem boolean NOT NULL DEFAULT false;
+
+-- The platform-provisioned connector key ("default") is the ThinkWork Pi
+-- runtime's own key — the one and only principal that may speak for a
+-- signed-in human. Grandfather every active one; re-provisioning would set
+-- the same flag anyway. User-minted keys stay false.
+UPDATE public.tenant_mcp_twin_keys
+   SET trusted_subsystem = true
+ WHERE name = 'default'
+   AND revoked_at IS NULL
+   AND trusted_subsystem = false;

package/dist/drizzle/0286_brain_analytics_key.sql

@@ -0,0 +1,26 @@
+-- Analytics-channel visibility flag on Brain principals (THINK-656 D4) —
+-- the write side of the `analyticsKey` field in both published manifests:
+-- user-claims/v1 (per-user entries) and twin-mcp-keys/v2 (key entries).
+-- Reader is company-brain brain-mcp/src/auth.ts, which parses literal true
+-- only: `analyticsKey: true` lets the principal's brain_ask loop consult
+-- the mart_analytics briefing tools. Tool VISIBILITY only, never a data
+-- grant — the marts hold the tenant's own data and every query still runs
+-- under the account's env gates (ANALYTICS_ENABLED et al.).
+--
+-- Default TRUE by decision (Eric, 2026-08-08): every user and key gets the
+-- analytics channel unless an operator turns it off per row. There is no
+-- console UI for the flag yet; the column is the future toggle. The NOT
+-- NULL DEFAULT true also backfills every existing row, which matches the
+-- 2026-08-07 go-live hand-edits this migration makes durable.
+--
+-- Hand-rolled (mirrors the 0274/0281/0282/0284/0285 convention; not
+-- registered in meta/_journal.json).
+-- Apply via: psql "$DATABASE_URL" -f drizzle/0286_brain_analytics_key.sql
+-- creates-column: public.tenant_mcp_twin_keys.analytics_key
+-- creates-column: public.user_brain_claims.analytics_key
+
+ALTER TABLE public.tenant_mcp_twin_keys
+  ADD COLUMN IF NOT EXISTS analytics_key boolean NOT NULL DEFAULT true;
+
+ALTER TABLE public.user_brain_claims
+  ADD COLUMN IF NOT EXISTS analytics_key boolean NOT NULL DEFAULT true;

package/dist/drizzle/0287_brain_subject.sql

@@ -0,0 +1,25 @@
+-- Brain-pool subject on Brain principals (THINK-625 backfill gap) — the
+-- write side of the `subject` field in user-claims/v1.
+--
+-- The manifest published `users.cognito_sub` as `subject`, but that column
+-- is the user's sub in THIS product's Cognito pool. The Brain MCP has its
+-- OWN end-user pool, and a federated (Google/Microsoft) sign-in there mints
+-- a DIFFERENT sub — so the published subject never matched the Brain access
+-- token, claims resolution fell closed to emptyGrants(), and an HR user's
+-- payroll ask was refused (TEI, 2026-08-12). Access tokens carry no email
+-- claim, so the reader's email fallback cannot save the mismatch.
+--
+-- This column holds the sub the user's Brain tokens actually carry. It is
+-- captured at the ONE place the product ever sees a Brain token: the
+-- mcp-oauth callback (skills.ts), which decodes the access token it just
+-- exchanged and republishes the manifest. The manifest publisher prefers
+-- brain_subject over users.cognito_sub; NULL (never captured) keeps
+-- today's fallback byte-identical.
+--
+-- Hand-rolled (mirrors the 0274/0281/0282/0284/0285/0286 convention; not
+-- registered in meta/_journal.json).
+-- Apply via: psql "$DATABASE_URL" -f drizzle/0287_brain_subject.sql
+-- creates-column: public.user_brain_claims.brain_subject
+
+ALTER TABLE public.user_brain_claims
+  ADD COLUMN IF NOT EXISTS brain_subject text;

package/dist/drizzle/0288_multi_lane_identities.sql

@@ -0,0 +1,25 @@
+-- Multi-lane identity enrollment (Eric 2026-08-15: "I need all three" —
+-- email, Google AND Microsoft sign-in for one person).
+--
+-- uq_user_auth_identities_cognito_sub allowed ONE enrollment per Cognito
+-- subject, total. But a Cognito user with linked providers carries one sub
+-- across lanes (password + Microsoft on the same sub), so whichever lane
+-- enrolled first consumed the slot and every other lane admitted to
+-- "No tenant assigned". Admission already matches per-connection
+-- (auth-admission.ts: identity.authProviderResourceId === route.connectionId);
+-- the index was the only thing forcing one lane per person.
+--
+-- One row per (subject, connection) from now on. The invariant that one
+-- Cognito subject maps to ONE product user is no longer carried by this
+-- index — the writers enforce it (cross-user guard in auto-link, enrollment
+-- consume, and invite).
+--
+-- Hand-rolled (mirrors the 0274..0287 convention; not registered in
+-- meta/_journal.json).
+-- Apply via: psql "$DATABASE_URL" -f drizzle/0288_multi_lane_identities.sql
+-- drops: public.uq_user_auth_identities_cognito_sub
+-- creates: public.uq_user_auth_identities_sub_connection
+
+DROP INDEX IF EXISTS public.uq_user_auth_identities_cognito_sub;
+CREATE UNIQUE INDEX IF NOT EXISTS uq_user_auth_identities_sub_connection
+  ON public.user_auth_identities (cognito_issuer, cognito_sub, auth_provider_resource_id);

package/dist/{loadSso-DJVB7BXE.js → loadSso-ETCXTR4I.js}

@@ -7,7 +7,7 @@ import {
   AwsSdkSigV4Signer,
   NODE_AUTH_SCHEME_PREFERENCE_OPTIONS,
   resolveAwsSdkSigV4Config
-} from "./chunk-DVPBI5HM.js";
+} from "./chunk-OLUQ4U2Z.js";
 import "./chunk-EI5ZX7CN.js";
 import {
   NodeHttpHandler
@@ -48,7 +48,7 @@ import {
   resolveHostHeaderConfig,
   resolveRetryConfig,
   resolveUserAgentConfig
-} from "./chunk-QOERT44A.js";
+} from "./chunk-YQCYD6NE.js";
 import {
   NODE_REGION_CONFIG_FILE_OPTIONS,
   NODE_REGION_CONFIG_OPTIONS,

package/dist/{loadSso-JAMNA3WY.js → loadSso-UBD7KUHE.js}

@@ -7,7 +7,7 @@ import {
   AwsSdkSigV4Signer,
   NODE_AUTH_SCHEME_PREFERENCE_OPTIONS,
   resolveAwsSdkSigV4Config
-} from "./chunk-DVPBI5HM.js";
+} from "./chunk-OLUQ4U2Z.js";
 import "./chunk-EI5ZX7CN.js";
 import {
   Sha256Node
@@ -51,7 +51,7 @@ import {
   resolveHostHeaderConfig,
   resolveRetryConfig,
   resolveUserAgentConfig
-} from "./chunk-QOERT44A.js";
+} from "./chunk-YQCYD6NE.js";
 import {
   NODE_REGION_CONFIG_FILE_OPTIONS,
   NODE_REGION_CONFIG_OPTIONS,

package/dist/plugins/README.md

@@ -152,8 +152,8 @@ When a plugin version bump should become visible without a full app deploy:
 6. Install or upgrade through ThinkWork. Do not substitute a direct Terraform
    apply, vendor cloud login, local Docker Compose run, or manual catalog edit.
 7. Run the package-owned smoke for the plugin after install/upgrade. For
-   LastMile, that means proving `lastmile--crm`, `lastmile--tasks`, and
-   `lastmile--routing` through ThinkWork's MCP proxy.
+   Twenty, that means proving the `twenty--crm` MCP server through
+   ThinkWork's MCP proxy.
 
 Before closing a migration slice, run the source-boundary check:
 

package/dist/plugins/catalog/package.json

@@ -21,10 +21,7 @@
     "build:catalog": "tsx scripts/generate-plugin-registry.ts --check && tsx scripts/build-catalog.ts"
   },
   "dependencies": {
-    "@thinkwork/plugin-company-data": "workspace:*",
-    "@thinkwork/plugin-company-etl": "workspace:*",
     "@thinkwork/plugin-email-channel": "workspace:*",
-    "@thinkwork/plugin-lastmile": "workspace:*",
     "@thinkwork/plugin-n8n": "workspace:*",
     "@thinkwork/plugin-sendgrid": "workspace:*",
     "@thinkwork/plugin-twenty": "workspace:*"

package/dist/plugins/catalog/src/__tests__/build-catalog.test.ts

@@ -33,15 +33,18 @@ describe("buildSignedCatalogJson", () => {
       trustedPublicKeyPem: keys.publicKeyPem,
     });
     expect(verified.plugins.map((plugin) => plugin.pluginKey)).toEqual([
-      "lastmile",
       "n8n",
       "email-channel",
       "sendgrid",
-      "company-data",
-      "company-etl",
       "twenty",
     ]);
     expect(verified.generatedAt).toBe("2026-06-12T00:00:00.000Z");
+    // AE5 (THINK-334 U6): the built catalog must not carry the superseded data plugins.
+    for (const removedKey of ["lastmile", "company-data", "company-etl"]) {
+      expect(verified.plugins.map((plugin) => plugin.pluginKey)).not.toContain(
+        removedKey,
+      );
+    }
   });
 
   it("includes source provenance when provided by the publisher", () => {

package/dist/plugins/catalog/src/__tests__/catalog.test.ts

@@ -14,7 +14,7 @@ import {
   type SignedPluginCatalogDocument,
 } from "../catalog";
 import type { PluginManifest } from "../contracts";
-import { lastmileManifest, n8nManifest } from "../registry";
+import { n8nManifest, twentyManifest } from "../registry";
 
 function keyPair() {
   const pair = generateKeyPairSync("ed25519");
@@ -36,7 +36,7 @@ function clone<T>(value: T): T {
 
 function signedDocument(privateKeyPem: string): SignedPluginCatalogDocument {
   const catalog = buildPluginCatalog({
-    manifests: [lastmileManifest],
+    manifests: [twentyManifest],
     generatedAt: "2026-06-12T00:00:00.000Z",
     source: {
       repository: "thinkwork-ai/thinkwork",
@@ -53,19 +53,19 @@ function signedDocument(privateKeyPem: string): SignedPluginCatalogDocument {
 
 describe("buildPluginCatalog", () => {
   it("builds an entry per manifest with per-version payload digests", () => {
-    const catalog = buildPluginCatalog({ manifests: [lastmileManifest] });
+    const catalog = buildPluginCatalog({ manifests: [twentyManifest] });
     expect(catalog.schemaVersion).toBe(PLUGIN_CATALOG_SCHEMA_VERSION);
     expect(catalog.plugins).toHaveLength(1);
     const entry = catalog.plugins[0];
-    expect(entry.pluginKey).toBe("lastmile");
+    expect(entry.pluginKey).toBe("twenty");
     expect(entry.versions[0].version).toBe("0.1.0");
     expect(entry.versions[0].payloadSha256).toMatch(/^[a-f0-9]{64}$/);
-    expect(entry.versions[0].payload).toEqual(lastmileManifest.versions[0]);
+    expect(entry.versions[0].payload).toEqual(twentyManifest.versions[0]);
   });
 
   it("optionally signs GitHub source provenance", () => {
     const catalog = buildPluginCatalog({
-      manifests: [lastmileManifest],
+      manifests: [twentyManifest],
       generatedAt: "2026-06-12T00:00:00.000Z",
       source: {
         repository: "thinkwork-ai/thinkwork",
@@ -82,7 +82,7 @@ describe("buildPluginCatalog", () => {
 
   it("keeps source provenance optional for bundled fallback catalogs", () => {
     const catalog = buildPluginCatalog({
-      manifests: [lastmileManifest],
+      manifests: [twentyManifest],
       generatedAt: "2026-06-12T00:00:00.000Z",
     });
     expect(catalog.source).toBeUndefined();
@@ -90,41 +90,41 @@ describe("buildPluginCatalog", () => {
 
   it("rejects duplicate plugin keys in a catalog", () => {
     expect(() =>
-      buildPluginCatalog({ manifests: [lastmileManifest, lastmileManifest] }),
-    ).toThrow(/Duplicate plugin key in catalog: lastmile/);
+      buildPluginCatalog({ manifests: [twentyManifest, twentyManifest] }),
+    ).toThrow(/Duplicate plugin key in catalog: twenty/);
   });
 
   it("sorts catalog plugins alphabetically by display name", () => {
     const catalog = buildPluginCatalog({
-      manifests: [n8nManifest, lastmileManifest],
+      manifests: [twentyManifest, n8nManifest],
     });
 
     expect(catalog.plugins.map((plugin) => plugin.displayName)).toEqual([
-      "LastMile",
       "n8n",
+      "Twenty CRM",
     ]);
   });
 
   it("preserves premium metadata on catalog entries", () => {
     const premiumManifest: PluginManifest = {
-      ...lastmileManifest,
+      ...twentyManifest,
       premium: {
-        entitlementProductKey: "lastmile-premium",
+        entitlementProductKey: "twenty-premium",
         installKeyRequired: true,
         installKeyPrompt: "Enter the install key.",
       },
     };
     const catalog = buildPluginCatalog({ manifests: [premiumManifest] });
-    expect(catalog.plugins[0].pluginKey).toBe("lastmile");
+    expect(catalog.plugins[0].pluginKey).toBe("twenty");
     expect(catalog.plugins[0].premium).toEqual({
-      entitlementProductKey: "lastmile-premium",
+      entitlementProductKey: "twenty-premium",
       installKeyRequired: true,
       installKeyPrompt: "Enter the install key.",
     });
   });
 
   it("rejects invalid manifests", () => {
-    const bad = clone(lastmileManifest);
+    const bad = clone(twentyManifest);
     bad.versions[0].version = "not-semver";
     expect(() => buildPluginCatalog({ manifests: [bad] })).toThrow(
       /not valid semver/,
@@ -134,7 +134,7 @@ describe("buildPluginCatalog", () => {
   it("rejects invalid source provenance shape", () => {
     expect(() =>
       buildPluginCatalog({
-        manifests: [lastmileManifest],
+        manifests: [twentyManifest],
         source: {
           repository: "not-owner-name",
           ref: "main",
@@ -144,7 +144,7 @@ describe("buildPluginCatalog", () => {
     ).toThrow(/owner\/name/);
     expect(() =>
       buildPluginCatalog({
-        manifests: [lastmileManifest],
+        manifests: [twentyManifest],
         source: {
           repository: "thinkwork-ai/thinkwork",
           ref: "main",
@@ -163,7 +163,7 @@ describe("sign → verify round-trip", () => {
       document,
       trustedPublicKeyPem: keys.publicKeyPem,
     });
-    expect(verified.plugins[0].pluginKey).toBe("lastmile");
+    expect(verified.plugins[0].pluginKey).toBe("twenty");
     expect(verified.source).toEqual({
       repository: "thinkwork-ai/thinkwork",
       ref: "main",
@@ -194,8 +194,8 @@ describe("verification fails closed", () => {
     const document = signedDocument(keys.privateKeyPem);
     const tampered = clone(document);
     const component = tampered.catalog.plugins[0].versions[0].payload
-      .components[0] as { endpointUrl?: string };
-    component.endpointUrl = "https://evil.example.invalid/mcp";
+      .components[0] as { displayName?: string };
+    component.displayName = "Tampered CRM";
     expect(() =>
       verifyPluginCatalog({
         document: tampered,

package/dist/plugins/catalog/src/__tests__/contracts.test.ts

@@ -6,14 +6,91 @@ import {
   type PluginManifest,
   type PluginVersion,
 } from "../contracts";
-import { lastmileManifest } from "../registry";
+
+/**
+ * Local fixture manifest exercising the richest contract surface: three
+ * OAuth MCP servers plus a bundled skill. (Shape preserved from the
+ * retired LastMile catalog entry, THINK-334 U6.)
+ */
+const FIXTURE_AUTH_DOMAIN = "https://fixture-auth.example.invalid";
+const FIXTURE_MCP_BASE = "https://fixture-mcp.example.invalid";
+
+const fixtureManifest = {
+  pluginKey: "fixture-crm",
+  displayName: "Fixture CRM",
+  description:
+    "Contract-test fixture plugin with CRM, task, and routing MCP servers.",
+  versions: [
+    {
+      version: "0.1.0",
+      requiredOauthScopes: ["openid", "email", "profile", "offline_access"],
+      components: [
+        {
+          type: "mcp-server",
+          key: "crm",
+          displayName: "Fixture CRM",
+          description: "Customer accounts and sales opportunities.",
+          endpointUrl: `${FIXTURE_MCP_BASE}/crm`,
+          auth: {
+            mode: "oauth",
+            authDomain: FIXTURE_AUTH_DOMAIN,
+            resourceIndicator: `${FIXTURE_MCP_BASE}/crm`,
+          },
+        },
+        {
+          type: "mcp-server",
+          key: "tasks",
+          displayName: "Fixture Tasks",
+          description: "Work orders and task assignments.",
+          endpointUrl: `${FIXTURE_MCP_BASE}/tasks`,
+          auth: {
+            mode: "oauth",
+            authDomain: FIXTURE_AUTH_DOMAIN,
+            resourceIndicator: `${FIXTURE_MCP_BASE}/tasks`,
+          },
+        },
+        {
+          type: "mcp-server",
+          key: "routing",
+          displayName: "Fixture Routing",
+          description: "Route planning and technician dispatch.",
+          endpointUrl: `${FIXTURE_MCP_BASE}/routing`,
+          auth: {
+            mode: "oauth",
+            authDomain: FIXTURE_AUTH_DOMAIN,
+            resourceIndicator: `${FIXTURE_MCP_BASE}/routing`,
+          },
+        },
+        {
+          type: "skills",
+          key: "skills",
+          skills: [
+            {
+              slug: "fixture-crm--crm-basics",
+              skillMd: [
+                "---",
+                "name: fixture-crm--crm-basics",
+                "description: Fixture skill for contract validation tests.",
+                "---",
+                "",
+                "# Fixture CRM basics",
+                "",
+                "Work CRM requests through the fixture MCP tools.",
+              ].join("\n"),
+            },
+          ],
+        },
+      ],
+    },
+  ],
+} as unknown as PluginManifest;
 
 function clone<T>(value: T): T {
   return JSON.parse(JSON.stringify(value)) as T;
 }
 
 function manifest(mutate?: (manifest: PluginManifest) => void): PluginManifest {
-  const copy = clone(lastmileManifest);
+  const copy = clone(fixtureManifest);
   mutate?.(copy);
   return copy;
 }
@@ -23,9 +100,9 @@ function version(m: PluginManifest): PluginVersion {
 }
 
 describe("validatePluginManifest", () => {
-  it("validates the LastMile manifest (three OAuth MCP servers + skills)", () => {
-    const validated = validatePluginManifest(lastmileManifest);
-    expect(validated.pluginKey).toBe("lastmile");
+  it("validates the fixture manifest (three OAuth MCP servers + skills)", () => {
+    const validated = validatePluginManifest(fixtureManifest);
+    expect(validated.pluginKey).toBe("fixture-crm");
     const components = validated.versions[0].components;
     expect(
       components.filter((component) => component.type === "mcp-server"),
@@ -38,7 +115,7 @@ describe("validatePluginManifest", () => {
 
   it("rejects non-object input", () => {
     expect(() => validatePluginManifest(null)).toThrow(PluginManifestError);
-    expect(() => validatePluginManifest("lastmile")).toThrow(
+    expect(() => validatePluginManifest("fixture-crm")).toThrow(
       PluginManifestError,
     );
   });
@@ -52,13 +129,13 @@ describe("validatePluginManifest", () => {
   it("validates premium metadata for key-gated plugins", () => {
     const ok = manifest((m) => {
       m.premium = {
-        entitlementProductKey: "lastmile",
+        entitlementProductKey: "fixture-crm",
         installKeyRequired: true,
         installKeyPrompt: "Enter the install key provided by ThinkWork.",
       };
     });
     expect(validatePluginManifest(ok).premium).toEqual({
-      entitlementProductKey: "lastmile",
+      entitlementProductKey: "fixture-crm",
       installKeyRequired: true,
       installKeyPrompt: "Enter the install key provided by ThinkWork.",
     });
@@ -67,7 +144,7 @@ describe("validatePluginManifest", () => {
   it("rejects premium metadata without a true install-key requirement", () => {
     const bad = manifest((m) => {
       m.premium = {
-        entitlementProductKey: "lastmile",
+        entitlementProductKey: "fixture-crm",
         installKeyRequired: true,
         installKeyPrompt: "Enter the install key provided by ThinkWork.",
       };
@@ -82,7 +159,7 @@ describe("validatePluginManifest", () => {
   it("rejects premium metadata without an entitlement product key", () => {
     const bad = manifest((m) => {
       m.premium = {
-        entitlementProductKey: "lastmile",
+        entitlementProductKey: "fixture-crm",
         installKeyRequired: true,
         installKeyPrompt: "Enter the install key provided by ThinkWork.",
       };
@@ -116,7 +193,7 @@ describe("validatePluginManifest", () => {
       (component) => component.type === "skills",
     );
     if (skills?.type !== "skills") throw new Error("missing skills component");
-    skills.skills[0].slug = "lastmile/crm-basics";
+    skills.skills[0].slug = "fixture-crm/crm-basics";
     expect(() => validatePluginManifest(bad)).toThrow(/skill slug/);
   });
 
@@ -648,18 +725,18 @@ describe("validatePluginManifest", () => {
         {
           type: "ui-surface",
           key: "dashboard",
-          displayName: "LastMile dashboard",
+          displayName: "Fixture CRM dashboard",
           intendedMount: "settings.plugins.detail.tab",
           launch: {
             schemaVersion: 1,
             type: "app",
-            appKey: "lastmile-dashboard",
+            appKey: "fixture-crm-dashboard",
             routeSegment: "dashboard",
             mount: "main-shell",
             runtime: "trusted-bundled-react",
             description: "Account engagement dashboard.",
             icon: "layout-dashboard",
-            entitlementProductKey: "lastmile",
+            entitlementProductKey: "fixture-crm",
           },
         },
       );
@@ -672,7 +749,7 @@ describe("validatePluginManifest", () => {
       m.versions[0].components.push({
         type: "ui-surface",
         key: "settings",
-        displayName: "LastMile settings",
+        displayName: "Fixture CRM settings",
         intendedMount: "settings.plugins.detail.tab",
       });
     });
@@ -683,7 +760,7 @@ describe("validatePluginManifest", () => {
     expect(surface).toMatchObject({
       type: "ui-surface",
       key: "settings",
-      displayName: "LastMile settings",
+      displayName: "Fixture CRM settings",
       intendedMount: "settings.plugins.detail.tab",
     });
     expect(surface?.type === "ui-surface" ? surface.launch : undefined).toBe(
@@ -765,7 +842,7 @@ describe("validatePluginManifest", () => {
       m.versions[0].components.push({
         type: "ui-surface",
         key: "dashboard",
-        displayName: "LastMile dashboard",
+        displayName: "Fixture CRM dashboard",
         intendedMount: "",
       });
     });
@@ -778,7 +855,7 @@ describe("validatePluginManifest", () => {
       {
         schemaVersion: 2,
         type: "app",
-        appKey: "lastmile-dashboard",
+        appKey: "fixture-crm-dashboard",
         routeSegment: "dashboard",
         mount: "main-shell",
         runtime: "trusted-bundled-react",
@@ -786,7 +863,7 @@ describe("validatePluginManifest", () => {
       {
         schemaVersion: 1,
         type: "widget",
-        appKey: "lastmile-dashboard",
+        appKey: "fixture-crm-dashboard",
         routeSegment: "dashboard",
         mount: "main-shell",
         runtime: "trusted-bundled-react",
@@ -794,7 +871,7 @@ describe("validatePluginManifest", () => {
       {
         schemaVersion: 1,
         type: "app",
-        appKey: "LastMile",
+        appKey: "Fixture_CRM",
         routeSegment: "dashboard",
         mount: "main-shell",
         runtime: "trusted-bundled-react",
@@ -802,7 +879,7 @@ describe("validatePluginManifest", () => {
       {
         schemaVersion: 1,
         type: "app",
-        appKey: "lastmile-dashboard",
+        appKey: "fixture-crm-dashboard",
         routeSegment: "/dashboard",
         mount: "main-shell",
         runtime: "trusted-bundled-react",
@@ -810,7 +887,7 @@ describe("validatePluginManifest", () => {
       {
         schemaVersion: 1,
         type: "app",
-        appKey: "lastmile-dashboard",
+        appKey: "fixture-crm-dashboard",
         routeSegment: "dashboard",
         mount: "settings",
         runtime: "trusted-bundled-react",
@@ -818,7 +895,7 @@ describe("validatePluginManifest", () => {
       {
         schemaVersion: 1,
         type: "app",
-        appKey: "lastmile-dashboard",
+        appKey: "fixture-crm-dashboard",
         routeSegment: "dashboard",
         mount: "main-shell",
         runtime: "remote-url",
@@ -826,7 +903,7 @@ describe("validatePluginManifest", () => {
       {
         schemaVersion: 1,
         type: "app",
-        appKey: "lastmile-dashboard",
+        appKey: "fixture-crm-dashboard",
         routeSegment: "dashboard",
         mount: "main-shell",
         runtime: "trusted-bundled-react",
@@ -837,7 +914,7 @@ describe("validatePluginManifest", () => {
         m.versions[0].components.push({
           type: "ui-surface",
           key: "dashboard",
-          displayName: "LastMile dashboard",
+          displayName: "Fixture CRM dashboard",
           intendedMount: "settings.plugins.detail.tab",
           launch,
         } as never);

package/dist/plugins/catalog/src/__tests__/plugin-package.test.ts

@@ -13,10 +13,7 @@ import {
 describe("first-party plugin packages", () => {
   it("registers n8n from its root plugin package boundary", () => {
     expect(firstPartyPluginPackages.map((entry) => entry.packageKey)).toEqual([
-      "company-data",
-      "company-etl",
       "email-channel",
-      "lastmile",
       "n8n",
       "sendgrid",
       "twenty",
@@ -45,16 +42,20 @@ describe("first-party plugin packages", () => {
 
   it("publishes every first-party plugin manifest through the catalog aggregate", () => {
     expect(allPluginManifests.map((manifest) => manifest.pluginKey)).toEqual([
-      "lastmile",
       "n8n",
       "email-channel",
       "sendgrid",
-      "company-data",
-      "company-etl",
       "twenty",
     ]);
   });
 
+  it("no longer publishes the superseded data plugins (THINK-334 U6)", () => {
+    const keys = allPluginManifests.map((manifest) => manifest.pluginKey);
+    expect(keys).not.toContain("lastmile");
+    expect(keys).not.toContain("company-data");
+    expect(keys).not.toContain("company-etl");
+  });
+
   it("rejects package descriptors whose source root does not match the key", () => {
     expect(() =>
       defineFirstPartyPluginPackage({

package/dist/plugins/catalog/src/__tests__/plugin-registry.test.ts

@@ -18,26 +18,11 @@ describe("generated first-party plugin registry", () => {
         exportName: entry.exportName,
       })),
     ).toEqual([
-      {
-        packageKey: "company-data",
-        packageName: "@thinkwork/plugin-company-data",
-        exportName: "companyDataPluginPackage",
-      },
-      {
-        packageKey: "company-etl",
-        packageName: "@thinkwork/plugin-company-etl",
-        exportName: "companyEtlPluginPackage",
-      },
       {
         packageKey: "email-channel",
         packageName: "@thinkwork/plugin-email-channel",
         exportName: "emailChannelPluginPackage",
       },
-      {
-        packageKey: "lastmile",
-        packageName: "@thinkwork/plugin-lastmile",
-        exportName: "lastmilePluginPackage",
-      },
       {
         packageKey: "n8n",
         packageName: "@thinkwork/plugin-n8n",