diff --git a/.changeset/custom-functions-cli.md b/.changeset/custom-functions-cli.md
deleted file mode 100644
index 5bb06115..00000000
--- a/.changeset/custom-functions-cli.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-'@transcend-io/cli': minor
----
-
-Add `transcend custom-functions push` (manifest-driven create/update of custom function code revisions with change detection, draft + promote, and dry-run support) and `transcend custom-functions list`, designed to run from client CI. Code is signed against the Sombra customer ingress (pass `--sombraAuth` when self-hosting Sombra). Manifest entries can pin a custom function `id` (required when names are not unique), and `push --updateManifest` writes assigned IDs back into the manifest while preserving comments and `<<parameters.x>>` placeholders.
-
-Manifest entries can also define `test-payloads` — a list of JSON payload files, each with an optional `payload-type` so DSR functions cover both their default (`DATA_POINT`) and enricher (`REQUEST_ENRICHER`) exports on every push (`test-payload` remains as single-payload shorthand). The freshly signed code is test-run with every payload via the `runCustomFunction` mutation before pushing; all must pass or the function is rejected with each failing payload's reason and execution logs (exit code 1). A warning is printed when a DSR entry only covers one export. Use `--skipTests` to bypass testing.
-
-New DSR functions no longer require a `data-silo-id`: the DSR integration (a `customFunction`-catalog data silo) is created automatically before the test run, the function is created and linked on a passing test (the silo is rolled back on failure), and `--updateManifest` writes both the function `id` and the `data-silo-id` back into the manifest. DSR test payloads get `extras.dataSilo` injected from the resolved silo automatically.
-
-Metadata-only changes (description, or name for id-pinned entries) are updated in place without signing, testing, or pushing a new code revision, reported as "metadata-only" in the sync summary. The skip message now points at `--force` for env value-only rotations, which cannot be diffed.
diff --git a/.changeset/custom-functions-sdk.md b/.changeset/custom-functions-sdk.md
deleted file mode 100644
index 550a9dcf..00000000
--- a/.changeset/custom-functions-sdk.md
+++ /dev/null
@@ -1,20 +0,0 @@
----
-'@transcend-io/sdk': minor
-'@transcend-io/privacy-types': minor
----
-
-`@transcend-io/privacy-types` gains custom function enums (`CustomFunctionType`, `CustomFunctionLifecycleState`, `CustomFunctionVersionLifecycleState`, `CustomFunctionPayloadType`), mirroring the backend's canonical values.
-
-Add custom function sync support. The SDK gains a customer-ingress code signing helper (`signCustomFunctionCode`, calling Sombra's `/v1/custom/sign` route with bearer authentication) and typed custom function fetch/diff/sync helpers (`fetchAllCustomFunctions`, `syncCustomFunction`). The custom function type/lifecycle/payload-type unions come from the new `@transcend-io/privacy-types` enums, and JWT payload decoding uses `jsonwebtoken`. Existing custom functions are matched by `id` when provided, falling back to exact name, with an error on ambiguous names.
-
-`createSombraGotInstance` gains a `sombraId` option to connect to a specific (non-primary) Sombra gateway by ID, resolved from the organization's gateway list.
-
-Creating a GENERAL function without a pinned gateway resolves the organization's primary Sombra (the backend requires an explicit `sombraId` for GENERAL creates); DSR creates never send `sombraId` or `setActive` — the linked data silo dictates the gateway, and DSR functions are always created active (a warning is logged when `promote` is disabled for a DSR create).
-
-Also adds a test-before-promote flow: `runCustomFunctionTest` test-runs freshly signed code via the `runCustomFunction` mutation (pre-signed JWT pair, `isCustomFunctionTestRun: true`) and reports a `passed` boolean; `syncCustomFunction` accepts a `testPayloads` list (each payload optionally tagged with a `payloadType`, so DSR functions can cover both the default `DATA_POINT` export and the `REQUEST_ENRICHER` enricher export in one push). Every payload runs and all must pass — any failure rejects the push with a new `test-failed` outcome, with per-payload `testResults` (error and logs) attached.
-
-New DSR functions get their DSR integration created automatically: when a DSR config has no `dataSiloId` and no existing function matches, `syncCustomFunction` creates a `customFunction`-catalog data silo shell (`createCustomFunctionDataSilo`), tests the signed code against it (DSR test payloads always get `extras.dataSilo` injected from the resolved silo, with `title`/`description`/`link` defaulted to satisfy the backend's webhook payload codec), then creates and links the function on a passing test — rolling the silo back (`deleteDataSilo`) when the test or the create itself fails. Sync results now report `dataSiloId` / `createdDataSilo`.
-
-`makeGraphQLRequest` no longer retries backend payload validation failures (`Failed to decode codec`) — they are deterministic, and retrying repeated the full codec error output.
-
-Metadata-only changes (description, or name for id-pinned entries) are detected when code and context are unchanged, and update the function record in place — no signing, no test runs, and no new code revision — reported with a new `metadata-updated` outcome. Environment variable *values* remain undiffable (encrypted at sign time); use `force` for value-only rotations.
diff --git a/.changeset/design-tokens-chart-colors.md b/.changeset/design-tokens-chart-colors.md
deleted file mode 100644
index ba1d63b9..00000000
--- a/.changeset/design-tokens-chart-colors.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@transcend-io/design-tokens': patch
----
-
-Update chart yellow and lime semantic colors to darker palette steps (`yellow.600`, `lime.600`) from the latest Figma DTCG export.
diff --git a/dev/mcp-server-examples/CHANGELOG.md b/dev/mcp-server-examples/CHANGELOG.md
index ffebaeab..8133ff69 100644
--- a/dev/mcp-server-examples/CHANGELOG.md
+++ b/dev/mcp-server-examples/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @transcend-io/mcp-server-examples
 
+## 0.0.8
+
+### Patch Changes
+
+- @transcend-io/mcp-server-base@1.3.1
+
 ## 0.0.7
 
 ### Patch Changes
diff --git a/dev/mcp-server-examples/package.json b/dev/mcp-server-examples/package.json
index ca932b5a..6d92b5ba 100644
--- a/dev/mcp-server-examples/package.json
+++ b/dev/mcp-server-examples/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/mcp-server-examples",
-  "version": "0.0.7",
+  "version": "0.0.8",
   "private": true,
   "description": "Reference MCP App views and capability-aware tools. Development only, never published.",
   "license": "Apache-2.0",
diff --git a/packages/airgap.js-types/CHANGELOG.md b/packages/airgap.js-types/CHANGELOG.md
index f0e424d8..3c9afb2c 100644
--- a/packages/airgap.js-types/CHANGELOG.md
+++ b/packages/airgap.js-types/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @transcend-io/airgap.js-types
 
+## 14.2.35
+
+### Patch Changes
+
+- Updated dependencies [98eeb1d]
+  - @transcend-io/privacy-types@5.19.0
+
 ## 14.2.34
 
 ### Patch Changes
diff --git a/packages/airgap.js-types/package.json b/packages/airgap.js-types/package.json
index 370e1c10..6e8b2493 100644
--- a/packages/airgap.js-types/package.json
+++ b/packages/airgap.js-types/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/airgap.js-types",
-  "version": "14.2.34",
+  "version": "14.2.35",
   "description": "TypeScript types for airgap.js interoperability with custom consent UIs.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/airgap.js-types",
   "license": "Apache-2.0",
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
index 0ea7179e..120f7fb8 100644
--- a/packages/cli/CHANGELOG.md
+++ b/packages/cli/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @transcend-io/cli
 
+## 10.26.0
+
+### Minor Changes
+
+- 2f5271e: Add `transcend custom-functions push` (manifest-driven create/update of custom function code revisions with change detection, draft + promote, and dry-run support) and `transcend custom-functions list`, designed to run from client CI. Code is signed against the Sombra customer ingress (pass `--sombraAuth` when self-hosting Sombra). Manifest entries can pin a custom function `id` (required when names are not unique), and `push --updateManifest` writes assigned IDs back into the manifest while preserving comments and `<<parameters.x>>` placeholders.
+
+  Manifest entries can also define `test-payloads` — a list of JSON payload files, each with an optional `payload-type` so DSR functions cover both their default (`DATA_POINT`) and enricher (`REQUEST_ENRICHER`) exports on every push (`test-payload` remains as single-payload shorthand). The freshly signed code is test-run with every payload via the `runCustomFunction` mutation before pushing; all must pass or the function is rejected with each failing payload's reason and execution logs (exit code 1). A warning is printed when a DSR entry only covers one export. Use `--skipTests` to bypass testing.
+
+  New DSR functions no longer require a `data-silo-id`: the DSR integration (a `customFunction`-catalog data silo) is created automatically before the test run, the function is created and linked on a passing test (the silo is rolled back on failure), and `--updateManifest` writes both the function `id` and the `data-silo-id` back into the manifest. DSR test payloads get `extras.dataSilo` injected from the resolved silo automatically.
+
+  Metadata-only changes (description, or name for id-pinned entries) are updated in place without signing, testing, or pushing a new code revision, reported as "metadata-only" in the sync summary. The skip message now points at `--force` for env value-only rotations, which cannot be diffed.
+
+### Patch Changes
+
+- Updated dependencies [98eeb1d]
+  - @transcend-io/sdk@1.10.0
+  - @transcend-io/privacy-types@5.19.0
+  - @transcend-io/airgap.js-types@14.2.35
+
 ## 10.25.5
 
 ### Patch Changes
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 60b52cda..a22fda1f 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/cli",
-  "version": "10.25.5",
+  "version": "10.26.0",
   "description": "A command line interface for programmatic operations across Transcend.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/cli",
   "license": "Apache-2.0",
diff --git a/packages/design-tokens/CHANGELOG.md b/packages/design-tokens/CHANGELOG.md
index ded71b7f..2697b534 100644
--- a/packages/design-tokens/CHANGELOG.md
+++ b/packages/design-tokens/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @transcend-io/design-tokens
 
+## 1.2.1
+
+### Patch Changes
+
+- 99a0110: Update chart yellow and lime semantic colors to darker palette steps (`yellow.600`, `lime.600`) from the latest Figma DTCG export.
+
 ## 1.2.0
 
 ### Minor Changes
diff --git a/packages/design-tokens/package.json b/packages/design-tokens/package.json
index 121023e5..05f6ff1c 100644
--- a/packages/design-tokens/package.json
+++ b/packages/design-tokens/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/design-tokens",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Centralized design token primitives and semantics for Transcend frontends.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/design-tokens",
   "license": "Apache-2.0",
diff --git a/packages/mcp/mcp-server-admin/CHANGELOG.md b/packages/mcp/mcp-server-admin/CHANGELOG.md
index a45c0287..c5ce092b 100644
--- a/packages/mcp/mcp-server-admin/CHANGELOG.md
+++ b/packages/mcp/mcp-server-admin/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @transcend-io/mcp-server-admin
 
+## 0.5.17
+
+### Patch Changes
+
+- Updated dependencies [98eeb1d]
+  - @transcend-io/privacy-types@5.19.0
+  - @transcend-io/mcp-server-base@1.3.1
+
 ## 0.5.16
 
 ### Patch Changes
diff --git a/packages/mcp/mcp-server-admin/package.json b/packages/mcp/mcp-server-admin/package.json
index 64b8417b..5b8eb2be 100644
--- a/packages/mcp/mcp-server-admin/package.json
+++ b/packages/mcp/mcp-server-admin/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/mcp-server-admin",
-  "version": "0.5.16",
+  "version": "0.5.17",
   "description": "Transcend MCP Server — Admin tools.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/mcp/mcp-server-admin",
   "license": "Apache-2.0",
diff --git a/packages/mcp/mcp-server-assessment/CHANGELOG.md b/packages/mcp/mcp-server-assessment/CHANGELOG.md
index d22f65bb..6f39032c 100644
--- a/packages/mcp/mcp-server-assessment/CHANGELOG.md
+++ b/packages/mcp/mcp-server-assessment/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @transcend-io/mcp-server-assessment
 
+## 0.5.17
+
+### Patch Changes
+
+- Updated dependencies [98eeb1d]
+  - @transcend-io/privacy-types@5.19.0
+  - @transcend-io/mcp-server-base@1.3.1
+
 ## 0.5.16
 
 ### Patch Changes
diff --git a/packages/mcp/mcp-server-assessment/package.json b/packages/mcp/mcp-server-assessment/package.json
index 6d84a438..9df88ccb 100644
--- a/packages/mcp/mcp-server-assessment/package.json
+++ b/packages/mcp/mcp-server-assessment/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/mcp-server-assessment",
-  "version": "0.5.16",
+  "version": "0.5.17",
   "description": "Transcend MCP Server — Assessments tools.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/mcp/mcp-server-assessment",
   "license": "Apache-2.0",
diff --git a/packages/mcp/mcp-server-base/CHANGELOG.md b/packages/mcp/mcp-server-base/CHANGELOG.md
index 2a1d5312..5209df72 100644
--- a/packages/mcp/mcp-server-base/CHANGELOG.md
+++ b/packages/mcp/mcp-server-base/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @transcend-io/mcp-server-base
 
+## 1.3.1
+
+### Patch Changes
+
+- Updated dependencies [99a0110]
+  - @transcend-io/design-tokens@1.2.1
+
 ## 1.3.0
 
 ### Minor Changes
diff --git a/packages/mcp/mcp-server-base/package.json b/packages/mcp/mcp-server-base/package.json
index 7b5d7b50..b2671600 100644
--- a/packages/mcp/mcp-server-base/package.json
+++ b/packages/mcp/mcp-server-base/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/mcp-server-base",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Shared infrastructure for Transcend MCP Server packages.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/mcp/mcp-server-base",
   "license": "Apache-2.0",
diff --git a/packages/mcp/mcp-server-consent/CHANGELOG.md b/packages/mcp/mcp-server-consent/CHANGELOG.md
index 9a8d42f2..7478a664 100644
--- a/packages/mcp/mcp-server-consent/CHANGELOG.md
+++ b/packages/mcp/mcp-server-consent/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @transcend-io/mcp-server-consent
 
+## 0.6.17
+
+### Patch Changes
+
+- Updated dependencies [98eeb1d]
+  - @transcend-io/sdk@1.10.0
+  - @transcend-io/privacy-types@5.19.0
+  - @transcend-io/mcp-server-base@1.3.1
+
 ## 0.6.16
 
 ### Patch Changes
diff --git a/packages/mcp/mcp-server-consent/package.json b/packages/mcp/mcp-server-consent/package.json
index 13f4ec68..e1c8c737 100644
--- a/packages/mcp/mcp-server-consent/package.json
+++ b/packages/mcp/mcp-server-consent/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/mcp-server-consent",
-  "version": "0.6.16",
+  "version": "0.6.17",
   "description": "Transcend MCP Server — Consent Management tools.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/mcp/mcp-server-consent",
   "license": "Apache-2.0",
diff --git a/packages/mcp/mcp-server-discovery/CHANGELOG.md b/packages/mcp/mcp-server-discovery/CHANGELOG.md
index 08b57331..b64c7924 100644
--- a/packages/mcp/mcp-server-discovery/CHANGELOG.md
+++ b/packages/mcp/mcp-server-discovery/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @transcend-io/mcp-server-discovery
 
+## 0.5.17
+
+### Patch Changes
+
+- Updated dependencies [98eeb1d]
+  - @transcend-io/privacy-types@5.19.0
+  - @transcend-io/mcp-server-base@1.3.1
+
 ## 0.5.16
 
 ### Patch Changes
diff --git a/packages/mcp/mcp-server-discovery/package.json b/packages/mcp/mcp-server-discovery/package.json
index 6b819f12..6054258c 100644
--- a/packages/mcp/mcp-server-discovery/package.json
+++ b/packages/mcp/mcp-server-discovery/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/mcp-server-discovery",
-  "version": "0.5.16",
+  "version": "0.5.17",
   "description": "Transcend MCP Server — Data Discovery tools.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/mcp/mcp-server-discovery",
   "license": "Apache-2.0",
diff --git a/packages/mcp/mcp-server-docs/CHANGELOG.md b/packages/mcp/mcp-server-docs/CHANGELOG.md
index 77ff356a..86d9c9f9 100644
--- a/packages/mcp/mcp-server-docs/CHANGELOG.md
+++ b/packages/mcp/mcp-server-docs/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @transcend-io/mcp-server-docs
 
+## 0.3.17
+
+### Patch Changes
+
+- @transcend-io/mcp-server-base@1.3.1
+
 ## 0.3.16
 
 ### Patch Changes
diff --git a/packages/mcp/mcp-server-docs/package.json b/packages/mcp/mcp-server-docs/package.json
index 5a27756e..ecfe0e2e 100644
--- a/packages/mcp/mcp-server-docs/package.json
+++ b/packages/mcp/mcp-server-docs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/mcp-server-docs",
-  "version": "0.3.16",
+  "version": "0.3.17",
   "description": "Transcend MCP Server — Documentation lookup tools.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/mcp/mcp-server-docs",
   "license": "Apache-2.0",
diff --git a/packages/mcp/mcp-server-dsr/CHANGELOG.md b/packages/mcp/mcp-server-dsr/CHANGELOG.md
index b53943a1..75f3dc6b 100644
--- a/packages/mcp/mcp-server-dsr/CHANGELOG.md
+++ b/packages/mcp/mcp-server-dsr/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @transcend-io/mcp-server-dsr
 
+## 0.6.2
+
+### Patch Changes
+
+- Updated dependencies [98eeb1d]
+  - @transcend-io/privacy-types@5.19.0
+  - @transcend-io/mcp-server-base@1.3.1
+
 ## 0.6.1
 
 ### Patch Changes
diff --git a/packages/mcp/mcp-server-dsr/package.json b/packages/mcp/mcp-server-dsr/package.json
index db37aeac..a4c955e2 100644
--- a/packages/mcp/mcp-server-dsr/package.json
+++ b/packages/mcp/mcp-server-dsr/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/mcp-server-dsr",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Transcend MCP Server — DSR Automation tools.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/mcp/mcp-server-dsr",
   "license": "Apache-2.0",
diff --git a/packages/mcp/mcp-server-inventory/CHANGELOG.md b/packages/mcp/mcp-server-inventory/CHANGELOG.md
index adf0af27..747cd135 100644
--- a/packages/mcp/mcp-server-inventory/CHANGELOG.md
+++ b/packages/mcp/mcp-server-inventory/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @transcend-io/mcp-server-inventory
 
+## 0.6.6
+
+### Patch Changes
+
+- Updated dependencies [98eeb1d]
+  - @transcend-io/privacy-types@5.19.0
+  - @transcend-io/mcp-server-base@1.3.1
+
 ## 0.6.5
 
 ### Patch Changes
diff --git a/packages/mcp/mcp-server-inventory/package.json b/packages/mcp/mcp-server-inventory/package.json
index 00a442ec..bb15fb5b 100644
--- a/packages/mcp/mcp-server-inventory/package.json
+++ b/packages/mcp/mcp-server-inventory/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/mcp-server-inventory",
-  "version": "0.6.5",
+  "version": "0.6.6",
   "description": "Transcend MCP Server — Data Inventory tools.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/mcp/mcp-server-inventory",
   "license": "Apache-2.0",
diff --git a/packages/mcp/mcp-server-preferences/CHANGELOG.md b/packages/mcp/mcp-server-preferences/CHANGELOG.md
index 45ee7372..eb52d32e 100644
--- a/packages/mcp/mcp-server-preferences/CHANGELOG.md
+++ b/packages/mcp/mcp-server-preferences/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @transcend-io/mcp-server-preferences
 
+## 0.5.17
+
+### Patch Changes
+
+- Updated dependencies [98eeb1d]
+  - @transcend-io/privacy-types@5.19.0
+  - @transcend-io/mcp-server-base@1.3.1
+
 ## 0.5.16
 
 ### Patch Changes
diff --git a/packages/mcp/mcp-server-preferences/package.json b/packages/mcp/mcp-server-preferences/package.json
index c6f3f5a3..3ad77dec 100644
--- a/packages/mcp/mcp-server-preferences/package.json
+++ b/packages/mcp/mcp-server-preferences/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/mcp-server-preferences",
-  "version": "0.5.16",
+  "version": "0.5.17",
   "description": "Transcend MCP Server — Preference Management tools.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/mcp/mcp-server-preferences",
   "license": "Apache-2.0",
diff --git a/packages/mcp/mcp-server-workflows/CHANGELOG.md b/packages/mcp/mcp-server-workflows/CHANGELOG.md
index 8ddfa6c0..d1c82eda 100644
--- a/packages/mcp/mcp-server-workflows/CHANGELOG.md
+++ b/packages/mcp/mcp-server-workflows/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @transcend-io/mcp-server-workflows
 
+## 0.5.17
+
+### Patch Changes
+
+- Updated dependencies [98eeb1d]
+  - @transcend-io/privacy-types@5.19.0
+  - @transcend-io/mcp-server-base@1.3.1
+
 ## 0.5.16
 
 ### Patch Changes
diff --git a/packages/mcp/mcp-server-workflows/package.json b/packages/mcp/mcp-server-workflows/package.json
index 30d5a350..7765f3c2 100644
--- a/packages/mcp/mcp-server-workflows/package.json
+++ b/packages/mcp/mcp-server-workflows/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/mcp-server-workflows",
-  "version": "0.5.16",
+  "version": "0.5.17",
   "description": "Transcend MCP Server — Workflows tools.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/mcp/mcp-server-workflows",
   "license": "Apache-2.0",
diff --git a/packages/mcp/mcp/CHANGELOG.md b/packages/mcp/mcp/CHANGELOG.md
index 31c78951..80816f1f 100644
--- a/packages/mcp/mcp/CHANGELOG.md
+++ b/packages/mcp/mcp/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @transcend-io/mcp
 
+## 0.11.1
+
+### Patch Changes
+
+- @transcend-io/mcp-server-consent@0.6.17
+- @transcend-io/mcp-server-admin@0.5.17
+- @transcend-io/mcp-server-assessment@0.5.17
+- @transcend-io/mcp-server-discovery@0.5.17
+- @transcend-io/mcp-server-dsr@0.6.2
+- @transcend-io/mcp-server-inventory@0.6.6
+- @transcend-io/mcp-server-preferences@0.5.17
+- @transcend-io/mcp-server-workflows@0.5.17
+- @transcend-io/mcp-server-base@1.3.1
+- @transcend-io/mcp-server-docs@0.3.17
+
 ## 0.11.0
 
 ### Minor Changes
diff --git a/packages/mcp/mcp/package.json b/packages/mcp/mcp/package.json
index af8a7a10..3c925a25 100644
--- a/packages/mcp/mcp/package.json
+++ b/packages/mcp/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/mcp",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Transcend MCP Server — unified server with all domain tools.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/mcp/mcp",
   "license": "Apache-2.0",
diff --git a/packages/privacy-types/CHANGELOG.md b/packages/privacy-types/CHANGELOG.md
index d759e337..7ab9c3d2 100644
--- a/packages/privacy-types/CHANGELOG.md
+++ b/packages/privacy-types/CHANGELOG.md
@@ -1,5 +1,25 @@
 # @transcend-io/privacy-types
 
+## 5.19.0
+
+### Minor Changes
+
+- 98eeb1d: `@transcend-io/privacy-types` gains custom function enums (`CustomFunctionType`, `CustomFunctionLifecycleState`, `CustomFunctionVersionLifecycleState`, `CustomFunctionPayloadType`), mirroring the backend's canonical values.
+
+  Add custom function sync support. The SDK gains a customer-ingress code signing helper (`signCustomFunctionCode`, calling Sombra's `/v1/custom/sign` route with bearer authentication) and typed custom function fetch/diff/sync helpers (`fetchAllCustomFunctions`, `syncCustomFunction`). The custom function type/lifecycle/payload-type unions come from the new `@transcend-io/privacy-types` enums, and JWT payload decoding uses `jsonwebtoken`. Existing custom functions are matched by `id` when provided, falling back to exact name, with an error on ambiguous names.
+
+  `createSombraGotInstance` gains a `sombraId` option to connect to a specific (non-primary) Sombra gateway by ID, resolved from the organization's gateway list.
+
+  Creating a GENERAL function without a pinned gateway resolves the organization's primary Sombra (the backend requires an explicit `sombraId` for GENERAL creates); DSR creates never send `sombraId` or `setActive` — the linked data silo dictates the gateway, and DSR functions are always created active (a warning is logged when `promote` is disabled for a DSR create).
+
+  Also adds a test-before-promote flow: `runCustomFunctionTest` test-runs freshly signed code via the `runCustomFunction` mutation (pre-signed JWT pair, `isCustomFunctionTestRun: true`) and reports a `passed` boolean; `syncCustomFunction` accepts a `testPayloads` list (each payload optionally tagged with a `payloadType`, so DSR functions can cover both the default `DATA_POINT` export and the `REQUEST_ENRICHER` enricher export in one push). Every payload runs and all must pass — any failure rejects the push with a new `test-failed` outcome, with per-payload `testResults` (error and logs) attached.
+
+  New DSR functions get their DSR integration created automatically: when a DSR config has no `dataSiloId` and no existing function matches, `syncCustomFunction` creates a `customFunction`-catalog data silo shell (`createCustomFunctionDataSilo`), tests the signed code against it (DSR test payloads always get `extras.dataSilo` injected from the resolved silo, with `title`/`description`/`link` defaulted to satisfy the backend's webhook payload codec), then creates and links the function on a passing test — rolling the silo back (`deleteDataSilo`) when the test or the create itself fails. Sync results now report `dataSiloId` / `createdDataSilo`.
+
+  `makeGraphQLRequest` no longer retries backend payload validation failures (`Failed to decode codec`) — they are deterministic, and retrying repeated the full codec error output.
+
+  Metadata-only changes (description, or name for id-pinned entries) are detected when code and context are unchanged, and update the function record in place — no signing, no test runs, and no new code revision — reported with a new `metadata-updated` outcome. Environment variable _values_ remain undiffable (encrypted at sign time); use `force` for value-only rotations.
+
 ## 5.18.0
 
 ### Minor Changes
diff --git a/packages/privacy-types/package.json b/packages/privacy-types/package.json
index 839930b0..d4ac7eb3 100644
--- a/packages/privacy-types/package.json
+++ b/packages/privacy-types/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/privacy-types",
-  "version": "5.18.0",
+  "version": "5.19.0",
   "description": "Core enums and types for interacting with Transcend's public APIs.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/privacy-types",
   "license": "Apache-2.0",
diff --git a/packages/sdk/CHANGELOG.md b/packages/sdk/CHANGELOG.md
index 4fb64e27..339e7c2e 100644
--- a/packages/sdk/CHANGELOG.md
+++ b/packages/sdk/CHANGELOG.md
@@ -1,5 +1,31 @@
 # @transcend-io/sdk
 
+## 1.10.0
+
+### Minor Changes
+
+- 98eeb1d: `@transcend-io/privacy-types` gains custom function enums (`CustomFunctionType`, `CustomFunctionLifecycleState`, `CustomFunctionVersionLifecycleState`, `CustomFunctionPayloadType`), mirroring the backend's canonical values.
+
+  Add custom function sync support. The SDK gains a customer-ingress code signing helper (`signCustomFunctionCode`, calling Sombra's `/v1/custom/sign` route with bearer authentication) and typed custom function fetch/diff/sync helpers (`fetchAllCustomFunctions`, `syncCustomFunction`). The custom function type/lifecycle/payload-type unions come from the new `@transcend-io/privacy-types` enums, and JWT payload decoding uses `jsonwebtoken`. Existing custom functions are matched by `id` when provided, falling back to exact name, with an error on ambiguous names.
+
+  `createSombraGotInstance` gains a `sombraId` option to connect to a specific (non-primary) Sombra gateway by ID, resolved from the organization's gateway list.
+
+  Creating a GENERAL function without a pinned gateway resolves the organization's primary Sombra (the backend requires an explicit `sombraId` for GENERAL creates); DSR creates never send `sombraId` or `setActive` — the linked data silo dictates the gateway, and DSR functions are always created active (a warning is logged when `promote` is disabled for a DSR create).
+
+  Also adds a test-before-promote flow: `runCustomFunctionTest` test-runs freshly signed code via the `runCustomFunction` mutation (pre-signed JWT pair, `isCustomFunctionTestRun: true`) and reports a `passed` boolean; `syncCustomFunction` accepts a `testPayloads` list (each payload optionally tagged with a `payloadType`, so DSR functions can cover both the default `DATA_POINT` export and the `REQUEST_ENRICHER` enricher export in one push). Every payload runs and all must pass — any failure rejects the push with a new `test-failed` outcome, with per-payload `testResults` (error and logs) attached.
+
+  New DSR functions get their DSR integration created automatically: when a DSR config has no `dataSiloId` and no existing function matches, `syncCustomFunction` creates a `customFunction`-catalog data silo shell (`createCustomFunctionDataSilo`), tests the signed code against it (DSR test payloads always get `extras.dataSilo` injected from the resolved silo, with `title`/`description`/`link` defaulted to satisfy the backend's webhook payload codec), then creates and links the function on a passing test — rolling the silo back (`deleteDataSilo`) when the test or the create itself fails. Sync results now report `dataSiloId` / `createdDataSilo`.
+
+  `makeGraphQLRequest` no longer retries backend payload validation failures (`Failed to decode codec`) — they are deterministic, and retrying repeated the full codec error output.
+
+  Metadata-only changes (description, or name for id-pinned entries) are detected when code and context are unchanged, and update the function record in place — no signing, no test runs, and no new code revision — reported with a new `metadata-updated` outcome. Environment variable _values_ remain undiffable (encrypted at sign time); use `force` for value-only rotations.
+
+### Patch Changes
+
+- Updated dependencies [98eeb1d]
+  - @transcend-io/privacy-types@5.19.0
+  - @transcend-io/airgap.js-types@14.2.35
+
 ## 1.9.5
 
 ### Patch Changes
diff --git a/packages/sdk/package.json b/packages/sdk/package.json
index 55685571..7c4b8ad8 100644
--- a/packages/sdk/package.json
+++ b/packages/sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@transcend-io/sdk",
-  "version": "1.9.5",
+  "version": "1.10.0",
   "description": "Transcend SDK — shared GraphQL/REST API clients and preference management utilities.",
   "homepage": "https://github.com/transcend-io/tools/tree/main/packages/sdk",
   "license": "Apache-2.0",