@burdenoff/fe-libs 2026.825.1 → 2026.825.3

package/dist/shared/native/push-registration.d.ts

@@ -83,7 +83,12 @@ export interface RegisterPushDeviceOptions {
  * Register (or refresh) this device. Idempotent on the backend, and additionally
  * de-duplicated here so a remount storm cannot hammer the mutation.
  *
- * Resolves `true` when the backend accepted the registration.
+ * Resolves `true` only when the device is registered AND routable — i.e. the
+ * backend stamped a Firebase project on it. It resolves `false` both when the
+ * mutation failed and when the row had to be written through the legacy,
+ * project-less shape during a gateway schema-skew window: that row exists but
+ * nothing can be delivered to it, and reporting it as success is what turns a
+ * deliberate server-side rejection into a device that silently never receives.
  */
 export declare function registerPushDevice(options: RegisterPushDeviceOptions): Promise<boolean>;
 export interface UnregisterPushDeviceOptions {

package/dist/shared/native/push-registration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push-registration.d.ts","sourceRoot":"","sources":["../../../src/shared/native/push-registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;AAElE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,4ZAqB1C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,gWAmBjD,CAAC;AAEF,eAAO,MAAM,gCAAgC,oHAI5C,CAAC;AAEF,0DAA0D;AAC1D,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,wBAAwB,EAAE,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC3E;AAED,MAAM,MAAM,yBAAyB,GAAG,CACtC,OAAO,EAAE,uBAAuB,KAC7B,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAgCvC;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAuBhD;AAoBD,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,yBAAyB,CAAC;CACvC;AAcD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CA6C7F;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,yBAAyB,CAAC;CACvC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,OAAO,CAAC,CAalB;AAID,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,SAAS,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,KAAK,IAAI,CAAC;IACzC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAYD;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,6BAA6B,GAAG,MAAM,IAAI,CA+BhG;AAED,+EAA+E;AAC/E,wBAAgB,mCAAmC,IAAI,IAAI,CAI1D"}
+{"version":3,"file":"push-registration.d.ts","sourceRoot":"","sources":["../../../src/shared/native/push-registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;AAElE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,4ZAqB1C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,gWAmBjD,CAAC;AAEF,eAAO,MAAM,gCAAgC,oHAI5C,CAAC;AAEF,0DAA0D;AAC1D,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,wBAAwB,EAAE,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC3E;AAED,MAAM,MAAM,yBAAyB,GAAG,CACtC,OAAO,EAAE,uBAAuB,KAC7B,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAgCvC;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAuBhD;AA2CD,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,yBAAyB,CAAC;CACvC;AAcD;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAyD7F;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,yBAAyB,CAAC;CACvC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,OAAO,CAAC,CAalB;AAID,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,SAAS,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,KAAK,IAAI,CAAC;IACzC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAYD;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,6BAA6B,GAAG,MAAM,IAAI,CA+BhG;AAED,+EAA+E;AAC/E,wBAAgB,mCAAmC,IAAI,IAAI,CAI1D"}

package/dist/shared/native/push-registration.js

@@ -25,7 +25,10 @@ function l() {
 	return e;
 }
 function u(e) {
-	return (e.errors ?? []).some((e) => e.message.includes("productSlug") && !e.message.includes("metadata"));
+	return (e.errors ?? []).some((e) => {
+		let t = typeof e.extensions?.code == "string" ? e.extensions.code : "";
+		return t && t !== "GRAPHQL_VALIDATION_FAILED" ? !1 : /unknown\s+argument\s+"?productSlug"?/i.test(e.message);
+	});
 }
 var d = null;
 function f(e, t) {
@@ -62,16 +65,16 @@ async function p(e) {
 		variables: p,
 		...e.authToken ? { authToken: e.authToken } : {},
 		suppressGlobalErrorEvent: !0
-	}, h = await c(m);
+	}, h = await c(m), g = !0;
 	if (u(h)) {
 		let e = { ...p };
 		delete e.productSlug, h = await c({
 			...m,
 			query: r,
 			variables: e
-		});
+		}), g = !1;
 	}
-	return h.errors?.length ? !1 : (d = s, !0);
+	return h.errors?.length ? !1 : (g && (d = s), g);
 }
 async function m(e = {}) {
 	d = null;

package/dist/shell-native/web-push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-push.d.ts","sourceRoot":"","sources":["../../src/shell-native/web-push.ts"],"names":[],"mappings":"AA8CA,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAEtD,MAAM,WAAW,qBAAqB;IACpC,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,IAAI,OAAO,CAQ5C;AAqBD;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAOtF;AAED,sFAAsF;AACtF,wBAAsB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIrF;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAOhF;AAID;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,YAAY,EAAE,gBAAgB,GAAG,MAAM,CAEnF;AAWD,iEAAiE;AACjE,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAQ/E;AAED,MAAM,WAAW,uBAAuB;IACtC,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA+BlC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,OAAO,CAAC,CAclB;AAID,mEAAmE;AACnE,eAAO,MAAM,6BAA6B,iCAAiC,CAAC;AAC5E,gFAAgF;AAChF,eAAO,MAAM,mCAAmC,uCAAuC,CAAC;AAyBxF;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAKlD;AAED,gFAAgF;AAChF,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ3D;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C"}
+{"version":3,"file":"web-push.d.ts","sourceRoot":"","sources":["../../src/shell-native/web-push.ts"],"names":[],"mappings":"AA8CA,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAEtD,MAAM,WAAW,qBAAqB;IACpC,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,IAAI,OAAO,CAQ5C;AAqBD;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAOtF;AAED,sFAAsF;AACtF,wBAAsB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIrF;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAOhF;AAID;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,YAAY,EAAE,gBAAgB,GAAG,MAAM,CAEnF;AAuCD,iEAAiE;AACjE,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAQ/E;AAED,MAAM,WAAW,uBAAuB;IACtC,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8ClC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,OAAO,CAAC,CAclB;AAID,mEAAmE;AACnE,eAAO,MAAM,6BAA6B,iCAAiC,CAAC;AAC5E,gFAAgF;AAChF,eAAO,MAAM,mCAAmC,uCAAuC,CAAC;AAyBxF;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAclD;AAED,gFAAgF;AAChF,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ3D;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C"}

package/dist/shell-native/web-push.js

@@ -32,7 +32,21 @@ function l(e) {
 function u(e) {
 	return JSON.stringify(e.toJSON());
 }
-async function d() {
+function d(e, t) {
+	let n = e.options?.applicationServerKey;
+	if (!n) return !1;
+	let r;
+	try {
+		r = l(t);
+	} catch {
+		return !1;
+	}
+	let i = new Uint8Array(n);
+	if (i.length !== r.length) return !1;
+	for (let e = 0; e < i.length; e += 1) if (i[e] !== r[e]) return !1;
+	return !0;
+}
+async function f() {
 	if (!r()) return null;
 	try {
 		return await navigator.serviceWorker.ready;
@@ -40,8 +54,8 @@ async function d() {
 		return null;
 	}
 }
-async function f() {
-	let e = await d();
+async function p() {
+	let e = await f();
 	if (!e) return null;
 	try {
 		return await e.pushManager.getSubscription();
@@ -49,35 +63,40 @@ async function f() {
 		return null;
 	}
 }
-async function p(e = {}) {
+async function m(e = {}) {
 	if (!r() || Notification.permission !== "granted") return null;
-	let n = await d();
+	let n = await f();
 	if (!n) return null;
-	y();
+	b();
 	try {
-		let r = await n.pushManager.getSubscription();
-		if (r) return t(u(r), "web"), r;
-		let i = await c(e.vapidPublicKey);
-		if (!i) return null;
+		let r = await c(e.vapidPublicKey);
+		if (!r) return null;
+		let i = await n.pushManager.getSubscription();
+		if (i) {
+			if (d(i, r)) return t(u(i), "web"), i;
+			try {
+				await i.unsubscribe();
+			} catch {}
+		}
 		let a = await n.pushManager.subscribe({
 			userVisibleOnly: !0,
-			applicationServerKey: l(i)
+			applicationServerKey: l(r)
 		});
 		return t(u(a), "web"), a;
 	} catch {
 		return null;
 	}
 }
-async function m(e = {}) {
+async function h(e = {}) {
 	if (!r()) return !1;
 	try {
-		return Notification.permission === "denied" || Notification.permission !== "granted" && await Notification.requestPermission() !== "granted" ? !1 : await p(e) !== null;
+		return Notification.permission === "denied" || Notification.permission !== "granted" && await Notification.requestPermission() !== "granted" ? !1 : await m(e) !== null;
 	} catch {
 		return !1;
 	}
 }
-var h = "BURDENOFF_NOTIFICATION_CLICK", g = "BURDENOFF_PUSH_SUBSCRIPTION_CHANGE", _ = !1;
-function v(n) {
+var g = "BURDENOFF_NOTIFICATION_CLICK", _ = "BURDENOFF_PUSH_SUBSCRIPTION_CHANGE", v = !1;
+function y(n) {
 	let r = n.data;
 	if (!r || typeof r != "object") return;
 	let i = r;
@@ -87,11 +106,11 @@ function v(n) {
 	}
 	i.type === "BURDENOFF_PUSH_SUBSCRIPTION_CHANGE" && i.subscription && t(JSON.stringify(i.subscription), "web");
 }
-function y() {
-	_ || typeof navigator > "u" || !("serviceWorker" in navigator) || (navigator.serviceWorker.addEventListener("message", v), _ = !0);
+function b() {
+	v || typeof navigator > "u" || !("serviceWorker" in navigator) || (navigator.serviceWorker.addEventListener("message", y), typeof navigator.serviceWorker.startMessages == "function" && navigator.serviceWorker.startMessages(), v = !0);
 }
-async function b() {
-	let e = await f();
+async function x() {
+	let e = await p();
 	if (!e) return !1;
 	try {
 		return await e.unsubscribe();
@@ -99,8 +118,8 @@ async function b() {
 		return !1;
 	}
 }
-function x() {
-	i = null, _ = !1;
+function S() {
+	i = null, v = !1;
 }
 //#endregion
-export { h as SW_NOTIFICATION_CLICK_MESSAGE, g as SW_PUSH_SUBSCRIPTION_CHANGE_MESSAGE, n as WEB_PUSH_MANIFEST_KEY, s as getWebPushManifestConfig, f as getWebPushSubscription, y as installWebPushMessageBridge, r as isWebPushSupported, m as requestWebPushPermission, x as resetWebPushForTests, c as resolveVapidPublicKey, u as serializeWebPushSubscription, p as subscribeWebPush, b as unsubscribeWebPush, l as urlBase64ToUint8Array };
+export { g as SW_NOTIFICATION_CLICK_MESSAGE, _ as SW_PUSH_SUBSCRIPTION_CHANGE_MESSAGE, n as WEB_PUSH_MANIFEST_KEY, s as getWebPushManifestConfig, p as getWebPushSubscription, b as installWebPushMessageBridge, r as isWebPushSupported, h as requestWebPushPermission, S as resetWebPushForTests, c as resolveVapidPublicKey, u as serializeWebPushSubscription, m as subscribeWebPush, x as unsubscribeWebPush, l as urlBase64ToUint8Array };

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@burdenoff/fe-libs",
-  "version": "2026.825.1",
+  "version": "2026.825.3",
   "description": "Burdenoff frontend primitives and domain libraries",
   "type": "module",
   "bin": {
-    "graphql-schema-drift": "./scripts/graphql-schema-drift/cli.ts"
+    "graphql-schema-drift": "./scripts/graphql-schema-drift/cli.ts",
+    "a11y-audit": "./scripts/a11y-audit/cli.ts"
   },
   "imports": {
     "#lib/*": "./src/lib/*",
@@ -283,6 +284,8 @@
     "src/vite/**/*",
     "scripts/graphql-schema-drift/*.ts",
     "scripts/graphql-schema-drift/README.md",
+    "scripts/a11y-audit/*.ts",
+    "scripts/a11y-audit/README.md",
     "README.md",
     "LICENSE"
   ],
@@ -293,7 +296,7 @@
     "lint:sanity": "if [ \"${CI:-}\" = \"true\" ]; then bun run lint; else bun run lint -- --cache --cache-location .eslintcache; fi",
     "format": "prettier --config shared/config/prettier.config.mjs --write \"src/**/*.{ts,tsx}\" \"!src/config/*.config.ts\"",
     "type:check": "bash scripts/build-limits.sh tsc --noEmit",
-    "test": "bun test scripts/graphql-schema-drift/__tests__ src/credentials src/storage src/shared/assistant src/shared/providers/AppShellProvider.test.ts src/shared/events/sinks/RybbitSink.test.ts src/shell-native src/shared/native src/chrome/__tests__ src/ui/__tests__",
+    "test": "bun test scripts/graphql-schema-drift/__tests__ scripts/a11y-audit/__tests__ src/credentials src/storage src/shared/assistant src/shared/providers/AppShellProvider.test.ts src/shared/events/sinks/RybbitSink.test.ts src/shell-native src/shared/native src/chrome/__tests__ src/ui/__tests__",
     "sanity": "bash scripts/build-limits.sh --gate bash -c 'bun run lint:sanity && bun run format && bun run type:check && bun run test && bun run build'",
     "switch:status": "bun scripts/deps-mode.ts status",
     "switch:remote": "bun scripts/deps-mode.ts remote",

package/scripts/a11y-audit/README.md

@@ -0,0 +1,172 @@
+# a11y-audit — the fleet WCAG 2.1 AA gate
+
+A real axe-core run against a built app shell, microfrontend or website, wired to
+fail a build on `serious` **and** `critical` violations, with an explicit
+allowlist for the exceptions you have decided to live with.
+
+It exists because the thing it replaces did not work. Several repos had an
+`@axe-core/playwright` spec checked in, but:
+
+- no CI workflow ever executed it, and
+- where it did assert, it asserted `impact === 'critical'` only, through
+  `expect.soft(...)`, which records a failure and then lets the run pass.
+
+So the fleet's accessibility posture was "not assessed" while looking assessed.
+
+## What it does
+
+For every configured route × viewport:
+
+1. serves the built app (or points at a running one),
+2. navigates, waits for the DOM to stop changing, and refuses to audit a page
+   that never painted,
+3. runs axe-core with the WCAG 2.1 A + AA tag set,
+4. splits every failing DOM node into **blocking** / **allowlisted** /
+   **advisory**,
+5. writes a JSON report and a GitHub step summary,
+6. exits non-zero when anything blocking survives.
+
+Exit codes:
+
+| Code | Meaning |
+| --- | --- |
+| `0` | no blocking violations |
+| `1` | blocking violations (or stale allowlist entries with `failOnStaleAllowlist`) |
+| `2` | the audit could not run — invalid config, app never came up, a route failed to load or never rendered |
+
+Exit `2` matters as much as exit `1`. An audit that could not look at a page is
+reported as a failure to audit, never as a pass.
+
+## Install in a repo
+
+```bash
+bun add -d @playwright/test @axe-core/playwright
+bunx playwright install --with-deps chromium
+```
+
+`@burdenoff/fe-libs` ships the runner as a package `bin`, so either of these works
+from the repo root:
+
+```bash
+a11y-audit
+bun run node_modules/@burdenoff/fe-libs/scripts/a11y-audit/cli.ts
+```
+
+Add the script to `package.json`:
+
+```json
+"a11y": "bun run node_modules/@burdenoff/fe-libs/scripts/a11y-audit/cli.ts"
+```
+
+Playwright and axe are imported dynamically, so fe-libs itself does not drag a
+browser automation stack into every consumer of the component library.
+
+## Config
+
+`a11y-audit.config.json` at the repo root (or pass a path as the first argument).
+
+```jsonc
+{
+  "name": "vibecontrols-app",
+  "serve": { "staticDir": "dist", "spa": true },
+  "routes": [
+    { "path": "/", "name": "landing" },
+    { "path": "/auth/login", "name": "auth-login" }
+  ],
+  "viewports": [
+    { "name": "desktop", "width": 1280, "height": 800 },
+    { "name": "mobile", "width": 390, "height": 844 }
+  ],
+  "settleMs": 1000,
+  "domQuietMs": 2000,
+  "allowlist": []
+}
+```
+
+### `serve` — exactly one mode
+
+| Mode | Use for | Example |
+| --- | --- | --- |
+| `staticDir` | app shells and websites, which build to a servable `dist/` | `{ "staticDir": "dist", "spa": true }` |
+| `command` + `port` | microfrontends, which build to a library and need their Vite harness to render | `{ "command": "bun run dev --port 4180", "port": 4180 }` |
+| `baseUrl` | an already-running target (preview deploy, alpha, prod) | `{ "baseUrl": "https://alphaapp.vibecontrols.com" }` |
+
+`spa: true` (the default) serves `index.html` for extension-less paths so
+client-routed URLs resolve. Missing *assets* still 404 — a broken bundle must not
+be laundered into a page load.
+
+`--base-url=URL` on the command line overrides whatever the config says, which is
+how you point the same config at alpha or prod.
+
+### Determinism knobs
+
+| Key | Default | Why |
+| --- | --- | --- |
+| `blockExternalRequests` | `true` | Aborts every request leaving the app's own origin. Without it, axe races backend latency: the same route audits a splash screen on one run and a rendered page on the next. Set `false` when auditing a live deployment where the backend is part of the subject. |
+| `settleMs` | `1500` | Fixed delay after `load` before quiescence polling starts. |
+| `domQuietMs` | `1500` | The DOM must stop changing (text length and element count) for this long before axe runs. |
+| `minTextLength` | `100` | A route that renders less than this much text is reported as **not audited** (exit 2), never as a pass. |
+| `navigationTimeoutMs` | `45000` | Per-navigation and per-quiescence ceiling. |
+
+Per route you can also set `waitForSelector` and a route-specific `settleMs`.
+
+### `failOn`
+
+Defaults to `["critical", "serious"]`. It may be **widened** (adding `moderate`),
+never narrowed — a config that drops `critical` or `serious` is rejected. That is
+the fleet floor and the gate refuses to run below it.
+
+## The allowlist
+
+There is deliberately **no** way to disable a rule. The only suppression
+mechanism is an allowlist entry, and every entry must say why.
+
+```jsonc
+{
+  "rule": "color-contrast",
+  "reason": "Stripe's hosted card iframe; contrast is fixed upstream and we cannot restyle it.",
+  "routes": ["/billing/*"],
+  "selectors": ["#stripe-card-frame"],
+  "expires": "2026-12-31",
+  "ticket": "BOFF-1234"
+}
+```
+
+| Field | Required | Rules |
+| --- | --- | --- |
+| `rule` | yes | one axe rule id. Wildcards (`*`, `**`, `.*`) are rejected. |
+| `reason` | yes | ≥ 20 characters of actual prose. `TODO`, `TBD`, `known issue`, `legacy`, `n/a` and "placeholder + nothing substantive" (`TODO: fix later`) are rejected. |
+| `routes` | no | exact path or `/prefix/*` subtree. A scope naming a route that is not audited fails the run as a typo. |
+| `selectors` | no | matches the node's own axe target, or an ancestor prefix of it on a combinator boundary. `#billing` does **not** match `#billing-panel`. |
+| `expires` | no | ISO `YYYY-MM-DD`. Past its end-of-day the entry suppresses nothing and the violations under it start failing again. |
+| `ticket` | no | Linear id, surfaced in the report. |
+
+Omitting both `routes` and `selectors` is allowed but it is a fleet-wide
+exemption for that rule, and the report labels it as unscoped so it is visible in
+review.
+
+Entries that matched nothing in a run are reported as **stale**. Set
+`failOnStaleAllowlist: true` once a repo's list is clean to keep it that way.
+
+## Output
+
+- console report (route by route, rule by rule, with the failing selectors),
+- `a11y-report.json` (path configurable via `reportPath` or `--json=`), which is
+  what you attach to a CI artifact,
+- a markdown table appended to `$GITHUB_STEP_SUMMARY` when running in Actions.
+
+## CLI flags
+
+```
+a11y-audit [configPath]
+           [--base-url=URL]   audit a running deployment instead of serving dist
+           [--json=PATH]      where to write the JSON report
+           [--route=/path]    repeatable; audit only these routes
+           [--quiet]          suppress the console report, keep the verdict
+```
+
+## Wiring it into CI
+
+Copy `a11y-check.yml.tmpl` from
+`~/products/dev/platform/context/cicd/templates/` into `.github/workflows/`.
+Rollout guide: `~/products/dev/platform/context/ui-simplification/HOW_TO_ADD_A11Y_CI.md`.

package/scripts/a11y-audit/allowlist.ts

@@ -0,0 +1,178 @@
+/**
+ * Allowlist matching and violation partitioning.
+ *
+ * Pure functions only — this is the part of the gate that decides what is
+ * allowed to not fail a build, so it is unit-tested directly rather than
+ * inferred from a green CI run.
+ */
+
+import type { AllowedNode, AllowlistEntry, FlatNode, ImpactLevel, RouteSpec } from './types';
+
+/** axe targets nest one level for iframes; flatten to plain selector strings. */
+export function flattenTarget(target: unknown): string[] {
+  if (typeof target === 'string') return [target];
+  if (!Array.isArray(target)) return [];
+  return target.flatMap((t) => flattenTarget(t));
+}
+
+function normalizeSelector(selector: string): string {
+  return selector.trim().replace(/\s+/g, ' ');
+}
+
+/**
+ * A configured selector matches an axe target when it is the target itself or
+ * an ancestor prefix of it. `#billing-panel` therefore covers
+ * `#billing-panel > table > tr:nth-child(2) > td`, but `#billing` does not —
+ * the boundary must fall on a combinator, so prefixes never match by accident.
+ */
+export function selectorMatches(allowSelector: string, target: string): boolean {
+  const allow = normalizeSelector(allowSelector);
+  const actual = normalizeSelector(target);
+  if (allow.length === 0) return false;
+  if (allow === actual) return true;
+  if (!actual.startsWith(allow)) return false;
+  const boundary = actual.charAt(allow.length);
+  return boundary === ' ' || boundary === '>' || boundary === '+' || boundary === '~';
+}
+
+/**
+ * A configured route matches either exactly, or as a `/prefix/*` subtree.
+ * `/settings/*` covers `/settings/profile` and `/settings` itself.
+ */
+export function routeMatches(allowRoute: string, routePath: string): boolean {
+  const allow = allowRoute.trim();
+  const actual = routePath.trim();
+  if (allow === actual) return true;
+  if (!allow.endsWith('/*')) return false;
+  const prefix = allow.slice(0, -2);
+  if (prefix.length === 0) return false;
+  return actual === prefix || actual.startsWith(`${prefix}/`);
+}
+
+/** An entry with an `expires` date in the past suppresses nothing. */
+export function isExpired(entry: AllowlistEntry, now: Date): boolean {
+  if (!entry.expires) return false;
+  const expiryEnd = new Date(`${entry.expires}T23:59:59.999Z`).getTime();
+  return now.getTime() > expiryEnd;
+}
+
+/** Does this entry cover this specific failing node? */
+export function entryCovers(entry: AllowlistEntry, node: FlatNode, now: Date): boolean {
+  if (entry.rule !== node.rule) return false;
+  if (isExpired(entry, now)) return false;
+  if (entry.routes && !entry.routes.some((r) => routeMatches(r, node.route))) return false;
+  if (
+    entry.selectors &&
+    !entry.selectors.some((s) => node.target.some((t) => selectorMatches(s, t)))
+  ) {
+    return false;
+  }
+  return true;
+}
+
+/** Shape of the subset of an axe violation this module reads. */
+export interface AxeViolationLike {
+  id: string;
+  impact?: string | null;
+  help?: string;
+  helpUrl?: string;
+  tags?: string[];
+  nodes: Array<{
+    target: unknown;
+    html?: string;
+    impact?: string | null;
+    failureSummary?: string;
+  }>;
+}
+
+/** Flatten axe violations into one record per failing DOM node. */
+export function flattenViolations(
+  violations: AxeViolationLike[],
+  context: { route: string; routeName: string; viewport: string }
+): FlatNode[] {
+  const flat: FlatNode[] = [];
+  for (const violation of violations) {
+    for (const node of violation.nodes) {
+      flat.push({
+        rule: violation.id,
+        impact: (node.impact ?? violation.impact ?? 'minor') as ImpactLevel,
+        help: violation.help ?? '',
+        helpUrl: violation.helpUrl ?? '',
+        tags: violation.tags ?? [],
+        route: context.route,
+        routeName: context.routeName,
+        viewport: context.viewport,
+        target: flattenTarget(node.target),
+        html: (node.html ?? '').slice(0, 400),
+        failureSummary: node.failureSummary ?? '',
+      });
+    }
+  }
+  return flat;
+}
+
+export interface PartitionResult {
+  blocking: FlatNode[];
+  allowed: AllowedNode[];
+  advisory: FlatNode[];
+  /** Indexes into the allowlist that actually suppressed something. */
+  usedEntries: Set<number>;
+}
+
+/**
+ * Split flattened nodes into build-failing, explicitly-allowed and advisory
+ * (below the failure threshold, reported but not blocking).
+ *
+ * When several entries cover the same node the first one wins, so the report
+ * attributes it to a single, nameable reason.
+ */
+export function partitionNodes(
+  nodes: FlatNode[],
+  allowlist: AllowlistEntry[],
+  failOn: ImpactLevel[],
+  now: Date
+): PartitionResult {
+  const blocking: FlatNode[] = [];
+  const allowed: AllowedNode[] = [];
+  const advisory: FlatNode[] = [];
+  const usedEntries = new Set<number>();
+
+  for (const node of nodes) {
+    const index = allowlist.findIndex((entry) => entryCovers(entry, node, now));
+    if (index >= 0) {
+      usedEntries.add(index);
+      const entry = allowlist[index];
+      allowed.push({
+        ...node,
+        allowlistIndex: index,
+        allowlistReason: entry.reason,
+        allowlistTicket: entry.ticket,
+      });
+      continue;
+    }
+    if (failOn.includes(node.impact)) blocking.push(node);
+    else advisory.push(node);
+  }
+
+  return { blocking, allowed, advisory, usedEntries };
+}
+
+/**
+ * Entries whose `routes` name a path that is not in the audited route list.
+ * Almost always a typo, and a typo here silently widens or voids the scope.
+ */
+export function findUnreachableRouteScopes(
+  allowlist: AllowlistEntry[],
+  routes: RouteSpec[]
+): Array<{ index: number; route: string }> {
+  const unreachable: Array<{ index: number; route: string }> = [];
+  allowlist.forEach((entry, index) => {
+    if (!entry.routes) return;
+    for (const scope of entry.routes) {
+      if (!routes.some((route) => routeMatches(scope, route.path))) {
+        unreachable.push({ index, route: scope });
+      }
+    }
+  });
+  return unreachable;
+}