@efa-one/sdk 1.14.0 → 1.15.0

package/README.md

@@ -15,6 +15,7 @@ sub-paths — this keeps `express` out of the frontend and `react` out of the ba
 | `@efa-one/sdk/backend` | Node/Express | Auth + token exchange (`requireAuth`, `createExchangeRouter`, `requireInternalOrAuth` …), health router, service discovery + gateway client (`serviceClient`, `resolveService`), clients for audit/reporting/mail/notifications, permission resolution/registration (`getUserPermissions`, `registerPermissions`, `checkPermission`), capability registry (`registerApiMetadata`), backend i18n |
 | `@efa-one/sdk/frontend` | Browser/React | postMessage IPC (`registerAppInfo`, `sendAtStart`, `navigateToApp`, `notifyRouteChange` …), react-i18next factory (`initI18n`), `DevHeader` |
 | `@efa-one/sdk/frontend/ui` | Browser/React | The efa-one design-system kit: `Button`, `Input`, `Badge`, `Alert`, `Dialog`, `DropdownMenu`, `Tooltip`, `EmptyState`, `Skeleton`, `RecordDialog`, and the **`DataTable`** (sortable/filterable/groupable list with per-user persisted view; reflows to stacked cards below 640px). Also exports `useIsMobile` — the platform-wide 640px breakpoint hook. Ship its companion CSS once: `import '@efa-one/sdk/frontend/ui/styles.css'` |
+| `@efa-one/sdk/frontend/format` | Browser | Platform-wide date/time display — `formatDate` (`01.09.2026`), `formatDateTime` (`01.09.2026, 11:05`), `formatTime`, `formatFileStamp`, `localeForLanguage`. Always use these instead of `toLocaleDateString`/`toLocaleString`: without an options object those render `1.9.2026`, and without a locale argument they follow the browser language (`9/1/2026`) |
 | `@efa-one/sdk/frontend/viewPreferences` | Browser/React | Persistence seam for `DataTable` — `createViewPreferencesClient()` (standard `/api/view-preferences/:listId` adapter) + `useViewPreferences()` |
 
 Every individual module is also reachable directly, e.g.
@@ -112,6 +113,33 @@ The flat output layout (`backend/` + `frontend/` at the package root) is a
 deliberate choice so that consumers using `moduleResolution: node` (node10) can
 resolve the subpath imports physically — without having to change their tsconfig.
 
+## Quality gates (CI)
+
+Every push and pull request runs the full gate; the same gate also runs as a
+prerequisite job of the release workflow, so a `v*` tag can never publish a state
+that a PR would have rejected.
+
+| Workflow | Runs on | What it enforces |
+|---|---|---|
+| `build-check.yml` | push (`main`, `development`), PR, called by `publish.yml` | `tsc` typecheck (sources **and** `test/` + `scripts/`), Vitest **with coverage thresholds**, ESLint, full `npm run build` (incl. the ESM specifier gate), plus `npm ci` **and** `npm run build` in both `template/` scaffolds |
+| `security.yml` | push, PR, weekly (Mon 06:00 UTC) | `npm audit --audit-level=high` and a copyleft license gate (GPL/AGPL/LGPL) across all three npm directories, Trivy filesystem scan (HIGH/CRITICAL, **including devDependencies** — without that switch Trivy skips them and the scan would be structurally empty here), Trivy misconfig/secret scan (report-only) |
+| `publish.yml` | `v*` tag | tag ↔ `package.json` version match, then npm publish via OIDC trusted publishing |
+| `dependabot.yml` + `dependabot-automerge.yml` | weekly | grouped minor/patch dependency PRs for the SDK, both scaffolds, the scaffold's Docker base images and the GitHub Actions themselves. Auto-merge is present but dormant — see the header comment in the workflow for the three settings that arm it |
+
+Run the blocking gates locally before pushing:
+
+```bash
+./scripts/ci-local.sh    # mirrors build-check.yml + security.yml (Trivy via docker if not installed)
+```
+
+Coverage uses a two-level ratchet (global floor + per-file gates on the modules that
+are deliberately tested); see `vitest.config.ts`. When new tests raise coverage, raise
+the thresholds — never lower them.
+
+**TypeScript is pinned to exactly `6.0.3`.** That is the last JS-based line;
+`typescript-eslint` does not support the native 7.0 compiler and aborts the entire lint
+run under it. Dependabot is configured to never propose a TypeScript major.
+
 ## Versioning
 
 SemVer. Consuming apps pull new versions with `npm update @efa-one/sdk`.

package/frontend/format.d.ts

@@ -0,0 +1,14 @@
+export type DateInput = Date | string | number | null | undefined;
+export interface DateFormatOptions {
+    locale?: string;
+    timeZone?: string;
+    fallback?: string;
+    withSeconds?: boolean;
+}
+export declare const DEFAULT_DATE_LOCALE = "de-DE";
+export declare const DEFAULT_DATE_FALLBACK = "\u2014";
+export declare function localeForLanguage(language?: string | null): string;
+export declare function formatDate(value: DateInput, opts?: DateFormatOptions): string;
+export declare function formatTime(value: DateInput, opts?: DateFormatOptions): string;
+export declare function formatDateTime(value: DateInput, opts?: DateFormatOptions): string;
+export declare function formatFileStamp(value: DateInput, opts?: Pick<DateFormatOptions, 'timeZone'>): string;

package/frontend/format.js

@@ -0,0 +1,64 @@
+export const DEFAULT_DATE_LOCALE = 'de-DE';
+export const DEFAULT_DATE_FALLBACK = '—';
+export function localeForLanguage(language) {
+    const lang = (language ?? '').trim().toLowerCase();
+    if (!lang)
+        return DEFAULT_DATE_LOCALE;
+    if (lang === 'de' || lang.startsWith('de-'))
+        return DEFAULT_DATE_LOCALE;
+    if (lang === 'en' || lang.startsWith('en-'))
+        return 'en-US';
+    return language;
+}
+function toDate(value) {
+    if (value === null || value === undefined || value === '')
+        return null;
+    const d = value instanceof Date ? value : new Date(value);
+    return Number.isNaN(d.getTime()) ? null : d;
+}
+function base(opts) {
+    return opts?.timeZone ? { timeZone: opts.timeZone } : {};
+}
+function run(value, opts, fmt) {
+    const d = toDate(value);
+    if (!d)
+        return opts?.fallback ?? DEFAULT_DATE_FALLBACK;
+    return new Intl.DateTimeFormat(opts?.locale ?? DEFAULT_DATE_LOCALE, { ...base(opts), ...fmt }).format(d);
+}
+export function formatDate(value, opts) {
+    return run(value, opts, { day: '2-digit', month: '2-digit', year: 'numeric' });
+}
+export function formatTime(value, opts) {
+    return run(value, opts, {
+        hour: '2-digit',
+        minute: '2-digit',
+        ...(opts?.withSeconds ? { second: '2-digit' } : {}),
+        hourCycle: 'h23',
+    });
+}
+export function formatDateTime(value, opts) {
+    return run(value, opts, {
+        day: '2-digit',
+        month: '2-digit',
+        year: 'numeric',
+        hour: '2-digit',
+        minute: '2-digit',
+        ...(opts?.withSeconds ? { second: '2-digit' } : {}),
+        hourCycle: 'h23',
+    });
+}
+export function formatFileStamp(value, opts) {
+    const d = toDate(value) ?? new Date();
+    const parts = new Intl.DateTimeFormat('en-CA', {
+        ...(opts?.timeZone ? { timeZone: opts.timeZone } : {}),
+        year: 'numeric',
+        month: '2-digit',
+        day: '2-digit',
+        hour: '2-digit',
+        minute: '2-digit',
+        second: '2-digit',
+        hourCycle: 'h23',
+    }).formatToParts(d);
+    const p = (type) => parts.find((x) => x.type === type)?.value ?? '';
+    return `${p('year')}-${p('month')}-${p('day')}_${p('hour')}-${p('minute')}-${p('second')}`;
+}

package/frontend/index.d.ts

@@ -1,4 +1,5 @@
 export * from './ipc.js';
+export * from './format.js';
 export { useIsMobile, MOBILE_QUERY } from './useIsMobile.js';
 export * from './i18n.js';
 export { default as DevHeader } from './DevHeader.js';

package/frontend/index.js

@@ -1,4 +1,5 @@
 export * from './ipc.js';
+export * from './format.js';
 export { useIsMobile, MOBILE_QUERY } from './useIsMobile.js';
 export * from './i18n.js';
 export { default as DevHeader } from './DevHeader.js';

package/frontend/ui/DataTable.js

@@ -1,4 +1,4 @@
-import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useMemo, useState } from 'react';
 import * as DropdownMenu from './DropdownMenu.js';
 import { ChevronDown, ChevronUp, ChevronRight, Settings, EyeOff, Filter, RotateCcw, ArrowUp, ArrowDown, Layers, X } from 'lucide-react';

package/frontend/ui/RecordDialog.js

@@ -1,4 +1,4 @@
-import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useEffect, useState } from 'react';
 import { Pencil } from 'lucide-react';
 import { Dialog, DialogClose } from './Dialog.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@efa-one/sdk",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "description": "Offizielles SDK für efa-one-Apps: Auth/Session, Service-Discovery, Gateway-Client, Audit/Reporting/Mail/Notifications, Permission- und Capability-Registrierung sowie das Frontend-IPC-/i18n-Toolkit.",
   "license": "Apache-2.0",
   "type": "commonjs",
@@ -43,8 +43,10 @@
     "build:backend": "tsc -p tsconfig.backend.json",
     "build:frontend": "tsc -p tsconfig.frontend.json && node scripts/postbuild-frontend.mjs",
     "build": "npm run clean && npm run build:backend && npm run build:frontend",
-    "typecheck": "tsc -p tsconfig.backend.json --noEmit && tsc -p tsconfig.frontend.json --noEmit",
+    "typecheck": "tsc -p tsconfig.backend.json --noEmit && tsc -p tsconfig.frontend.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "lint": "eslint src test scripts",
     "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
     "prepublishOnly": "npm run build"
   },
   "publishConfig": {
@@ -103,28 +105,33 @@
     }
   },
   "devDependencies": {
+    "@eslint/js": "^9.39.5",
     "@radix-ui/react-dialog": "^1.1.4",
     "@radix-ui/react-dropdown-menu": "^2.1.4",
     "@radix-ui/react-tooltip": "^1.1.6",
     "@types/express": "^4.17.21",
     "@types/jsonwebtoken": "^9.0.6",
-    "cookie-parser": "^1.4.6",
-    "lucide-react": "^0.468.0",
     "@types/node": "^20.14.0",
     "@types/pg": "^8.11.0",
     "@types/react": "^18.2.46",
+    "@types/react-dom": "^18.2.0",
     "@types/supertest": "^7.2.0",
+    "@vitest/coverage-v8": "^4.1.11",
+    "cookie-parser": "^1.4.6",
+    "eslint": "^9.39.5",
+    "eslint-plugin-react-hooks": "^7.1.1",
     "express": "^4.19.2",
     "i18next": "^23.11.0",
     "i18next-http-backend": "^2.7.3",
     "jsonwebtoken": "^9.0.2",
+    "lucide-react": "^0.577.0",
     "pg": "^8.12.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
-    "@types/react-dom": "^18.2.0",
     "react-i18next": "^13.5.0",
     "supertest": "^7.2.2",
-    "typescript": "7.0.2",
+    "typescript": "6.0.3",
+    "typescript-eslint": "^8.67.0",
     "vitest": "^4.1.4"
   },
   "engines": {