v0.30.1

One BFF in front of a resource server per tenant. api.target may be a function of the organization the request addresses — the answer organization gives — so one kanzoAuth serves every organization with one Keycloak client, one session store and one back-channel logout URL, which is Keycloak's Organizations model, while each tenant's data stays behind its own server.

api: { mount: "/api", target: (organization) => `http://${organization}-api:8080` }

A string target behaves as before.

@kanzo-tech/auth

Peer ranges stop at the major we test. react and react-dom are ^19.0.0, lucide-react ^1.0.0, every @codemirror/* ^6.0.0, @lezer/highlight ^1.0.0, @tanstack/react-table ^8.0.0, and next ^16.0.0 for @kanzo-tech/auth and ^15.3.0 || ^16.0.0 for @kanzo-tech/navigation. They were open-ended (>=19, >=1, >=6…), so a future major would have installed without a word. Nothing changes for a host on today's majors; a host that already runs a newer major gets a peer warning instead of silence.

@kanzo-tech/ui, @kanzo-tech/ai, @kanzo-tech/auth, @kanzo-tech/graph, @kanzo-tech/navigation

Services. services/auth's realm offers passkeys beside the password (Keycloak 26.4+, web_authn_passwordless_policy). Users add one from the account console; the username-then-password login is unchanged. See the Passkeys section of /docs/auth/keycloak. (#88)