@micha.bigler/ui-core-micha 2.41.0 → 2.41.2

package/.github/workflows/publish.yml

@@ -109,14 +109,14 @@ jobs:
         if: steps.version_check.outputs.should_publish == 'true'
         run: pnpm install --frozen-lockfile
 
-      - name: Run tests
-        if: steps.version_check.outputs.should_publish == 'true'
-        run: pnpm run test
-
       - name: Build
         if: steps.version_check.outputs.should_publish == 'true'
         run: pnpm run build
 
+      - name: Run tests
+        if: steps.version_check.outputs.should_publish == 'true'
+        run: pnpm run test
+
       - name: Ensure recent npm for trusted publishing
         if: steps.version_check.outputs.should_publish == 'true'
         run: npm install -g npm@latest

package/WORK_ORDERS.md

@@ -27,6 +27,11 @@ prefixed ID; never reuse a bare flat number across workstreams.
 
 | ID | Titel | Beschreibung | Datum | Status | Commit(s) | Notiz |
 |---|---|---|---|---|---|---|
+| DX-3 | `publish.yml` tests before it builds, so `2.41.2` cannot publish | `DX-2` landed on `main` (`31675d8`, `e75192f`) and **its publish failed** — run [32029216699](https://github.com/bigler-webapps/ui-core-micha/actions/runs/32029216699), `completed/failure`. `publish.yml` runs `Run tests` **before** `Build`; `DX-2`'s new `tests/packageTreeShaking.test.js` copies the package's own `dist/` to assemble a fake installed consumer, and **`dist/` is gitignored** (`.gitignore:2`), so in a clean checkout it does not exist yet: `ENOENT ... lstat '.../dist'`, 510/511 passing with the one new test as the sole failure. The test is neither flaky nor wrong — it inspects the built artifact, which is the point; it cannot pass in the order the workflow runs. It was green locally at 511/511 only because a `dist/` from an earlier build was lying around. Full order [`work-orders/DX-3.md`](work-orders/DX-3.md) | 2026-08-17 | blocked | 67fe140 | Tier 3 — CI surface, independent `reviewer` mandatory for two lines; no `ui_reviewer`. Fix: move `Build` above `Run tests`, **keeping `if: steps.version_check.outputs.should_publish == 'true'` on both** — dropping one is the only way a reorder can go wrong, so the reviewer is asked to confirm it explicitly. Codex implemented (available today per `.claude/codex-status.md`, no prior fallback needed) — one-file, 4-line diff, nothing else touched. **Independent `reviewer` (Sonnet) confirmed: only file changed, both `if:` conditions retained on Build and Run-tests, order now install→Build→Run-tests→npm-bump→Publish, `tsc` (Build) emits `dist/` before `vitest run` (tests) needs it — no findings, safe to commit.** **Status `blocked`, not `done`: the code fix is committed but the dispatch that actually re-publishes `2.41.2` needs an explicit operator go** (`publish.yml` is not on the dispatch safe-allowlist, and its `paths` filter excludes `.github/workflows/**` so this commit alone does not re-trigger it). Move to `done` only once `npm view @micha.bigler/ui-core-micha version` returns `2.41.2` — acceptance is the registry, not the green tile. **The dispatch is the part most likely to be missed:** `publish.yml`'s trigger `paths` cover `package.json`/`pnpm-lock.yaml`/`src/**`/`tsconfig.build.json` but **not `.github/workflows/**`**, so landing this fix does NOT re-trigger the publish — `2.41.2` sits unpublished until `publish.yml` is dispatched on `main`, which needs explicit operator confirmation (not on the safe-allowlist). No version bump: the artifact being published is DX-2's. **Acceptance is `npm view` returning `2.41.2`, not a green tile** — the publish status of this package has now been misreported in both directions in one session. Do NOT skip, delete or self-build the tree-shaking test; a skip would silently retire the only check that `sideEffects` actually tree-shakes. **Recorded, out of scope:** `publish.yml` is the ONLY workflow here that runs tests, and only when `should_publish` is true — so ucm's suite runs in CI *only on a version bump*, and a `src/**` change without one is never tested. Real gap for a twelve-consumer shared core, separate decision. |
+| DX-2 | Declare `sideEffects` so consumers can tree-shake the kit | `package.json` has **no `sideEffects` field** and no `exports` map, so a bundler must assume every module can have an import side effect and cannot drop unused exports — twelve consumers ship the whole kit whatever they import. Measured, not theorised: `hram/THEME-2` switched from three named bundles to the full aggregate and the built size changed by **−11 bytes**. Full order [`work-orders/DX-2.md`](work-orders/DX-2.md) | 2026-08-12 | done | 31675d8 | Tier 3. Codex implemented (available today, no prior fallback needed). **Array form used, not blanket `false`** — the per-module audit found exactly one real import-time side effect group: font CSS. `src/theme/createAppTheme.js` and `src/theme/index.js` both used to `import '@fontsource/dm-sans/*.css'` at module scope; isolated into a new `src/theme/fonts.js`, declared in the `sideEffects` array (both `src/`/`dist/` forms) alongside `index.js`, `theme/index.js`, `theme/createAppTheme.js`, and `notifications/serviceWorker/sw.js` (a genuine `addEventListener` side effect, conservatively listed even though it isn't reachable from `src/index.js` — consumers import it directly). `uiCoreTranslations`'s aggregate-object construction relocated verbatim from `src/index.js` into `src/i18n/uiCoreTranslations.js` (no shape/value change) so the entry module carries no non-trivial logic beyond its own font import. New test `tests/packageTreeShaking.test.js` builds two throwaway consumer bundles against the real `dist/` output via Vite and asserts translations actually tree-shake. **Independent `reviewer` (Sonnet) redid the module-by-module audit from scratch** (walked theme/, auth/apiClient, notifications/realtime, messaging/, onboarding/, i18n/ for CSS imports, `document`/`window`/`self` mutation, axios interceptors, WebSocket construction, i18next `.use()/.init()`) and independently ran `pnpm run build` + the new test — **verdict: classification correct and complete, no missed side effect, safe to commit.** One non-blocking finding, addressed: **`src/index.js`'s font import is unconditional, so `@fontsource/dm-sans` CSS ships in every consumer's bundle regardless of import — it does NOT tree-shake**, and the reviewer flagged that the reported byte delta could be misread as covering the whole entry when it is translations-only. Added a one-line comment at `src/index.js:3` documenting the font/`sideEffects`-array coupling so a future edit can't decouple them silently (the exact false-negative hazard this WO exists to prevent). **Re-measured delta** (built `dist/`, minified, real bundler, supersedes both `I18N-1`'s `+28,943 B`/`+7,327 B` source-reachability figure and `THEME-2`'s `−11 bytes` no-tree-shaking baseline): auth-only **62,294 B raw / 17,653 B gzip** vs. aggregate **90,395 B raw / 25,045 B gzip** → **+28,101 B raw / +7,392 B gzip, translations only — font CSS is a separate, always-shipped, non-tree-shakeable cost not included in this number.** Written into `I18N-2`'s note below. Scoped tests: `pnpm run build` green, new test green, **full existing suite 511/511 green** (WO called for the existing suite as the scoped run, not full-estate). No rendered gate (nothing renders). Version bumped to `2.41.2` (patch by scope, per the WO). **Correction (2026-08-17): the publish failed** — `publish.yml` runs tests before build, and this WO's own new tree-shaking test needs `dist/` (gitignored), so it cannot pass on a clean checkout; registry stayed at `2.41.1`. Fix + re-publish tracked in `DX-3`. |
+| I18N-3 | Backfill Swahili in `messagingTranslations` and restore the four-locale shape test | `messagingTranslations.ts` carries **116 keys with `de`/`fr`/`en` and zero `sw`**, while all six other bundles carry all four locales. `I18N-1` hit this writing its aggregate test, confirmed the gap as pre-existing, and the operator scoped the assertion down to `{de,fr,en}` with the backfill recorded as a follow-up — **which was never written**. Full order [`work-orders/I18N-3.md`](work-orders/I18N-3.md) | 2026-08-12 | planned | | Tier 3 — re-tightens a deliberately loosened test, so every future bundle must then supply `sw` or fail CI. **No app is broken today**: `sw` is configured only in hram and hram does not register messaging — this closes an inconsistency and re-arms a test, which is why there is no urgency justifying unreviewed strings. **The real risk is translation quality**: 116 user-facing strings nobody on the team can check are worse than an honest gap, so the note must **state the translation source**, flag uncertain keys instead of guessing, and reuse `notifications`/`onboarding` terminology rather than coining new terms. `reviewer` mandatory but **cannot validate Swahili** — say so, or a clean verdict implies the translations were checked. Close `I18N-1`'s follow-up note in the same commit. Patch by scope. **A push to `main` publishes.** |
+| THEME-12 | `ScatterChart` ignores the kit's own margin opinion | `THEME-11` gave the kit an opinion about chart margins instead of inheriting MUI's flat 20 px. **`src/components/charts/ScatterChart.jsx` does not reference `withMarginDefaults`** — verified in the source — even though `THEME-10` shipped it in the same `2.41.0`. So every `ScatterChart` consumer re-inherits exactly what `THEME-11` removed. Found 2026-08-12 while surveying the strand; `hram/FIX-15` already bridged it app-side with a local `CHART_MARGIN`, which moves the workaround into the app instead of fixing the kit — the pattern worth not repeating. | 2026-08-12 | planned | | Tier 3 (shared-core, changes rendered output for every scatter consumer). **Not yet authored** — needs a decision first: wire `ScatterChart` to `withMarginDefaults` and let hram drop `CHART_MARGIN`, or decide scatter legitimately needs different margins and document why. The second is plausible — a scatter with a rotated axis title and auto-sized y-tick width is not a bar chart — so this is a question, not a defect to patch blind. `hram/FIX-15` named the gap in its own notes; this row exists so the kit side is tracked where it belongs rather than only in a consumer's WO. |
+| AUTH-5 | `addPublicPath` muss dynamische Routen ausdruecken koennen | `apiClient` leitet bei 401/403 hart auf `/login` um, ausser der Pfad steht auf einer Allowlist — der Mechanismus ist richtig gebaut, kann aber keine **dynamischen** Routen beschreiben: `matchesPublicPath` vergleicht mit `startsWith` (ausser `/`, das Gleichheit verlangt). Eine App mit oeffentlichen Seiten unter einem variablen Segment (`/<slug>`, `/<slug>/team`) kann ihre oeffentliche Flaeche damit nicht ausdruecken: ein konkreter Slug laesst sich eintragen, der naechste faellt wieder heraus. Folge: ein anonymer Besucher landet beim ersten 401 auf `/login` — auf einer Seite, die oeffentlich sein soll, von aussen nicht von "Seite existiert nicht" zu unterscheiden. `addPublicPath` nimmt daher zusaetzlich ein `RegExp` entgegen, geprueft ausschliesslich gegen `pathname`; die eingefrorene Builtin-Liste bleibt string-basiert und unberuehrt. | 2026-08-17 | done | ca09d6e, 2c4a5d3 | Tier 3 (shared-core). reviewer: keine P1/P2-Blocker (ein P2 zu g/y-Flag-Statefulness bei RegExp.test() behoben — lastIndex-Reset + Regressionstest ergaenzt). sec_reviewer: keine Blocker (zwei P3-Hinweise, kein Handlungsbedarf). Kein ui_reviewer noetig (keine Oberflaeche). Veroeffentlicht als 2.41.1 (patch, da Erweiterung einer bestehenden Funktion). jg-ferien PUB-7 kann den Pin jetzt von 2.37.1 auf 2.41.1 ziehen. |
 | PRIM-1 | Promote `StatTile` and `SoftChip` into the shared kit | Both already exist **twice**, independently built, and each second build is an **inline component inside a page** rather than a file — `StatTile` in `fitness-monitor/frontend/src/pages/BodyHistoryPage.jsx:554-568` beside hram's `ResearchComponents/StatTile.jsx`, `SoftChip` in `cockpit/frontend/src/cockpit/BoardView.jsx:65-73` (the lane pill) beside hram's `SoftChip.jsx`. The promotion trigger is met on evidence, not waived. The two builds diverged in seven places; all seven decided by the operator 2026-08-12 and rendered in the prototype. Full order [`work-orders/PRIM-1.md`](work-orders/PRIM-1.md) | 2026-08-12 | done | b5fff23 | Tier 3 (shared-core). `reviewer` + `ui_reviewer` mandatory and concurrent; no `sec_reviewer`. **Prototype in scope** — [`work-orders/assets/PRIM-1-dashboard-primitives.html`](work-orders/assets/PRIM-1-dashboard-primitives.html), so the rendered 375/1280 side-by-side is a commit gate; screenshots have not been legibly obtainable here, so a substitution must be **declared**, not silent. Decisions: value `h5` 18/600 · `tabular-nums` always · `flex: 1` with a `minWidth` floor · `accent` kept (fitness-monitor cannot adopt without it) · responsive padding · `status` uses **`overline`** (cockpit independently chose uppercase + .4px tracking, so this satisfies `THEME-4` with **no** baseline change and only hram's chips shift to uppercase) · dot-or-icon and optional border via props. **Token delta list has one entry:** `caveat`'s 12/500 has no baseline variant (`caption` is 12/400) — operator resolved it as keep-the-value, so it must be **exempted in `THEME-4` with that reason stated**, not flattened to 400 and not fixed by extending the baseline here. Neither `StatTile` build has a test; the promoted tests are written from scratch. Minor bump `2.38.0` → `2.39.0` (new capability area). **The three app adoptions are separate follow-up WOs** and land no app change here. Programme strand `DS-5`. **Codex skipped, dated evidence**: `.claude/codex-status.md` records `unavailable` for 2026-08-12 (`cockpit/UI-10`, out of workspace credits, the day's one allowed probe already spent) — Orchestrator implemented directly, flipping authorship. **Independent `reviewer` (Haiku, mandatory regardless of tier per the WO): no findings.** **`ui_reviewer` (Haiku, mandatory, concurrent): two P1 findings, both fixed** — (1) `StatTile`'s padding had only `px` responsive (`{xs:1, sm:1.5}`) with `py` fixed at 1, against the decided "responsive `{xs:1, sm:1.5}`" (matching fitness-monitor's original `p` shorthand, not hram's split values) — changed to a single `p: {xs:1, sm:1.5}`; (2) the `status` variant's typography was under-tested (only `textTransform` checked) — added explicit `fontSize`/`fontWeight`/`letterSpacing` assertions against `theme.typography.overline`, and separately against the `caveat` variant's raw 12/500, both now green. Re-verified 51/51 scoped tests green after fixes, `tsc -p tsconfig.build.json --noEmit` clean. **Rendered gate: declared substitution**, per the WO's own text — the 375/1280 side-by-side screenshot capture is not legibly obtainable in this repo; computed-style/DOM inspection substituted instead, via the test suite itself (fill/border/text colour per tone verified against `alpha`/`darken` of `theme.palette[tone]`; `borderRadius` 999px status vs non-pill caveat; `fontVariantNumeric: tabular-nums`; accent border width 1px vs 2px; `overline` typography values now explicit). No visual click-through was performed. Commit `b5fff23`. |
 | THEME-3 | Add the missing "subtle surface" baseline token | Adds `palette.background.subtle` (`#F4F5F6`, fixed baseline constant alongside `default`/`paper`) to `createAppTheme` and registers it in `THEME_COMPLETENESS_SURFACES`. Found by `cockpit/UI-6`: the `UI-4` design-language sheet's canonical token table names this as a baseline-supplied "inset surface" replacing `cockpit.surface2` (16 of 195 token reads in that WO), but the value was never actually wired into the shipped package — confirmed by grep, not assumed. `cockpit/UI-6` is blocked on this landing + publishing first, per this estate's own "gap in the shared kit is a ucm WO, not a local workaround" rule. Full spec: [work-orders/THEME-3.md](work-orders/THEME-3.md). `2.33.2` (patch). | 2026-08-11 | done | 1b25117 | Tier 3 — shared-core, this repo publishes to npm on every `main` push touching `src/**`, no staging net. Codex implemented in one pass (stdin invocation), exit 0, `RESULT: DONE`, 17/17 of its own new tests green. **Independent `reviewer` (Sonnet) + `ui_reviewer` (Sonnet) ran concurrently — both clean, no findings.** Both independently re-derived the safety mechanism rather than trusting the WO's claim: `MUI_DEFAULT_THEME = createTheme()` never defines `background.subtle` (vanilla MUI only has `.default`/`.paper`), so `assertThemeComplete`'s `sameValue` check can never flag the new surface for any real adopter — the same unexempted treatment `background.default` already gets; `background.paper`'s exemption (needed because MUI's own default theme is also white) was correctly not copied. Both read `fitness-monitor`'s actual `theme.js`/`theme.test.js` directly (the one real production adopter, hard-asserting `assertThemeComplete(theme).findings` equals `[]`) and confirmed this diff cannot break it. `ui_reviewer` additionally grepped every sibling app repo under `webapps/` for `createAppTheme` — no other live consumer exists; cockpit's own adoption (`UI-6`) isn't wired yet. `reviewer` independently recomputed the contrast ratio in a throwaway script and got the same `5.3748:1` the diff claims (not the design sheet's `4.81:1`, which was computed on the sheet's own static canvas — a source discrepancy, not a functional risk; both clear AA). **Orchestrator's own verification:** built the package (`npm run build`) and attempted to run `fitness-monitor`'s real assertions against the fresh `dist/` via raw Node ESM import — hit a pre-existing (confirmed via `git show`, not introduced here) `tsc`-emitted extensionless-import quirk that only affects raw `node`, not the Vite/Vitest resolution every real consumer (incl. fitness-monitor's own suite) uses; fell back to the scoped vitest run instead. Tests: 17/17 green (`tests/createAppTheme.test.js` + `tests/themeCompleteness.test.js`), run by the Orchestrator. No visual/prototype gate — token-only change with no rendered specimen in this repo (per the Envelope); the rendered check happens downstream in `cockpit/UI-6`. Semver: patch, applied by the Orchestrator per the WO's own reasoning (additive, resolves automatically, no adopter code change needed) — confirmed rather than assumed by both reviews. Unblocks `cockpit/UI-6`, which was waiting on this landing + publish. |
 | CHART-7 | `ChartFrame` gains a `titleVariant` prop | Adds `titleVariant` (default `'h6'`, unchanged from today's hardcoded value) to `ChartFrame`, forwarded to the title `Typography` — lets a dense panel grid (e.g. fitness-monitor's seven body-composition panels beside one hero chart) render smaller titles that recede instead of competing with the one chart that matters. One prop, not a `slotProps.title` system — deliberately minimal per the WO. Precondition of fitness-monitor's `FM-12` (DS-10). `2.32.0` (minor, additive). Full spec: [work-orders/CHART-7.md](work-orders/CHART-7.md). | 2026-08-10 | done | 14020d0 | Envelope authored by Expertenchat, no design question (short-form WO). No preconditions. Orchestrator filled a minimal Implementation map (the whole change is two lines in `ChartFrame.jsx`), ran Codex (stdin invocation). Codex added `titleVariant = 'h6'` to the prop destructure, forwarded it to the title `Typography`, wrote all 3 required tests, and bumped `2.31.1` → `2.32.0` per the WO's own stated version target. **Independent `reviewer` + `ui_reviewer` (both Haiku, proportionate to a small low-risk diff) ran concurrently — both found NO findings**, including explicit confirmation that only the prop-destructure line and the one `Typography` line changed (padding, foot row, subtitle/toolbar/slots byte-for-byte unchanged) and that the default-regression test is non-vacuous. Re-verified: 13/13 scoped vitest tests green, `tsc -p tsconfig.build.json --noEmit` clean. **Two-width rendered side-by-side (DS-1 gate)**: no existing harness specimen used `titleVariant`, so the Orchestrator added one (two `ChartFrame`s side by side, default vs. `titleVariant="subtitle2"`) to `dev/entries.jsx` — confirmed live at 375px and 1280px that the override renders visibly smaller/lighter than the unchanged h6 default. |
@@ -76,7 +81,7 @@ Two chunks. **Chunk 1** (Part 1 + Part 2 of the Envelope): extended `SPACING_SHO
 **Orchestrator's own verification:** scoped tests (`themeCompleteness`, `createAppTheme`, `MobileBottomNav`, `ChartFrame`) 65/65 green, `tsc -p tsconfig.build.json --noEmit` clean. Independent `reviewer` (Sonnet) + `ui_reviewer` (Sonnet) spawned concurrently against the real, complete two-chunk diff — **this was the only independent review that actually ran; no prior pass exists despite what the uncommitted Notiz briefly claimed.** Both reviewers: **no blocking code findings.** `reviewer`: two P3 notes, not fixed — the print-document masking regex only matches the first `printWindow.document.write(...)` call in a file (currently safe, only one exists; latent fragility if a second is ever added); `exportChartPng`'s new `backgroundColour` parameter has no default (low risk, not exported from `src/index.js`, single caller always supplies it — a footgun only if the function gains a second caller or goes public). `ui_reviewer`: confirmed all nine role-based mappings resolve against real `tokens.js` values and are visually reasonable; flagged the Google-icon border change (`rgba(0,0,0,0.2)` → `divider`, roughly halving visible contrast) as the single largest visual delta of the nine and worth a live look given the operator's explicit no-rendered-gate decision for this WO — not blocking, no rendered gate was added, consistent with that decision. Version `2.34.0` → `2.35.0` (minor, new exported API). No rendered/prototype gate, per the operator's explicit decision — this note is the substitute, all nine changed values listed from-and-to above. DS-18 follow-ups. |
 | SHELL-5 | Promote the secondary-navigation shell | Promotes jg-ferien's `SectionSwitcher` (grouped sidebar + bottom drawer) into the kit as the level *below* the bottom bar, adds the trigger bar that supplies the missing affordance, and makes ucm's own `AccountPage` its first consumer by replacing its horizontal `Tabs` strip. Look and feel follow jg by operator decision. Full spec: [work-orders/SHELL-5.md](work-orders/SHELL-5.md). | 2026-08-11 | done | b283c33 | DS-11. Supersedes `SHELL-2` (now `dropped`); prototype `assets/SHELL-2-account-navigation.html` kept as the composition spec. Each jg-specific concept was made optional and `AccountPage` proves it optional: no `overviewItem` (no "Übersicht" concept), no `rememberedKey`, `APP_HEADER_HEIGHT` → `headerOffset` (default `24`), `zIndex.drawer + 3` kept as default (`SHELL-3`'s bar sits at `+2`, ordering is meaningful), and the 280px two-column grid moved from the consumer into the component. The trigger bar is the one net-new piece (jg has none) — new full-width 56px bar, first thing rendered on mobile, opens a bottom drawer. `AccountPage`'s flat permission-computed `tabs` list bucketed into four fixed groups per the prototype ("Mein Konto"/"Verwaltung"/"Hilfe"/trailing "Weitere" catch-all for ungrouped `extraTabs`), new `Account.GROUP_*` i18n keys; `?tab=` contract and all permission-gating logic byte-for-byte unchanged. New component-owned chrome i18n (`src/i18n/sectionNavTranslations.ts`, all 4 locales) resolves the trap jg's `t("SectionSwitcher.TITLE")` had — no fallback, would have rendered a raw key. **Codex left the diff uncommitted and did not touch this file, as instructed** (the third consecutive WO where the explicit warning about the prior invalid-review pattern held). **Concurrent-session note:** an unrelated `I18N-1` session was uncommitted in the same working tree at the same time (`README.md`, `tests/i18nAggregate.test.js`, an aggregate-translations addition to `src/index.js`) — separated by hunk-level staging (`git add -p`) before this commit; only `SectionNav`'s two export lines in `src/index.js` are in this commit, I18N-1's own hunks were left for its own session to land. **Orchestrator's own verification:** scoped tests green (52/52 after fixes, see below), `tsc` clean. Independent `reviewer` + `ui_reviewer` (Sonnet, both mandatory — new logic and a prototype in scope) ran concurrently. **`reviewer` found two real P2s, both fixed:** the drawer's `zIndex` was set via BOTH an exported/registered `sx` object and a separate inline `style` prop on the same element — `style` always wins, so the registered `sx` value was dead code, tested but never actually reaching the DOM; removed the redundant `SECTION_NAV_DRAWER_SX` entirely (and its now-pointless `kitSxRegistry.js` entry), kept only the working `style`-based zIndex. The "optional controlled" `open`/`onClose` API (an Orchestrator design resolution for reconciling jg's controlled drawer with the new internally-triggered one) was incomplete — no `onOpen` callback existed, so a controlled consumer's trigger click was silently a no-op; added `onOpen`, fixed, added a regression test (`AccountPage` itself is unaffected, it uses uncontrolled mode). **`ui_reviewer` found one real P2, fixed:** the mobile trigger's current-section text used `fontWeight={700}`, matching neither the theme's `subtitle1` (600) nor the prototype's `.trigger-value` (16.5px/600) — an undeclared deviation that made it visually indistinguishable from the bold group headers; removed the override. One P3 left as documented, not fixed: `headerOffset` defaults to `24` vs. the prototype's `16` — a defensible generalisation (the component no longer assumes a fixed app-header height the way jg's original did; no consumer today is sensitive to the exact value). **Rendered verification:** the Browser pane could not composite frames in this session (same recurring environment limitation as `SHELL-3`/`SHELL-4`) — DOM/computed-style substitution via the test suite's own assertions (grid columns, drawer dimensions, z-index, theme-token resolution under two themes) plus static composition comparison against the prototype by both independent reviewers, one of which (`ui_reviewer`) is exactly the review type this repo relies on for design fidelity when a real render isn't obtainable. **Follow-ups named, unchanged:** jg migrates onto this and deletes its own drawer (operator requirement, separate WO); the users table is `AUTH-4`, deliberately not here. |
 | I18N-1 | One export, so a consumer cannot half-register the kit's strings | ucm exports its UI strings as **six separate bundles** that each app must spread into its own i18n resources by hand. Adopting a component without also adding its bundle renders **a raw key as visible UI text** — no type error, no runtime error. Ship a `uiCoreTranslations` aggregate so that cannot happen, and so a future ucm feature is carried automatically instead of requiring twelve apps to notice. Full order [work-orders/I18N-1.md](work-orders/I18N-1.md). | 2026-08-11 | done | a6d322d | Tier 3 (shared-core + new public export). **Shipped as `2.37.0`, not the planned `2.36.0`** — the concurrent `SHELL-5` release claimed `2.36.0` first; sequenced behind it (see below), no other change to scope. **Landed with seven bundles, not six** — `SHELL-5` (same day, same repo) added a seventh `sectionNavTranslations`, already picked up by the directory-enumerated ratchet before this WO's own commit, so the aggregate never had a six-bundle gap in practice. Codex implemented (`uiCoreTranslations` export + directory-ratcheted `tests/i18nAggregate.test.js` + README line); left the diff uncommitted as instructed. **Concurrent-session collision, real one:** `SHELL-5` was landing in the same working tree at the same time and touched `src/index.js` too; held this WO uncommitted until `SHELL-5`'s commit (`b283c33`) reached `main`, then re-diffed — clean, only this WO's seven-import/aggregate hunk remained. **Test #3 blocked Codex for a real reason, resolved by the operator, not routed around:** the required "every value keeps its `{de,fr,en,sw}` shape" test failed because `messagingTranslations`'s 116 keys have **no `sw` value at all**, a pre-existing gap, not something the merge caused — confirmed directly (`grep -c "'sw':" src/i18n/messagingTranslations.ts` → 0). Operator chose to scope the test down to `{de,fr,en}` for now with `sw` backfill tracked as a follow-up (comment in `tests/i18nAggregate.test.js` records this); key/value fidelity and the collision check are unaffected by the scope-down. **Bundle-size delta measured** (feeds `I18N-2`): +28,943 B raw / +7,327 B gzip for an auth-only app switching from `authTranslations` alone to the (then six-bundle) aggregate. **Independent `reviewer` + `ui_reviewer` (Sonnet, both mandatory, concurrent): no findings from either.** `reviewer` additionally confirmed the seven bundles are namespace-disjoint by prefix so spread order can't shadow a value, and that the ratchet's `fs.readdirSync` + `import.meta.glob` targets stay in sync (mismatch throws explicitly). Scoped tests green: 23/23 (`i18nAggregate`, `authTranslations`, `messagingExports`, `notificationsExports`). No rendered verification — the diff renders nothing. **`fitness-monitor/FM-14` is the still-open acceptance condition**, executed in another repo: fitness-monitor keeps rendering raw `ChartFrame.*` keys until it lands. **Two apps hit by the same mechanism, evidence not hypothesis:** (1) cockpit's `UI-3` adopted `UserMenu` without `userMenuTranslations` and shipped a header button reading the literal `UserMenu.TITLE` — **both independent static reviews were clean**, it was caught only by the rendered click-through, and only by DOM inspection at that since screenshots were unavailable; (2) **fitness-monitor is defective right now** — it imports `ChartFrame` (`BodyHistoryPage.jsx:7`, used `:295`/`:445`) but registers only `authTranslations`, so `ChartFrame.jsx:74`'s `t('ChartFrame.LOADING')` and its empty/error siblings render raw keys. It survived because those are transient edge states. **Estate survey, 2026-08-11:** twelve apps register ucm bundles — jg-ferien all six, cockpit four, hram three, **fitness-monitor one (defective)**, and eight auth-only apps that are correct solely because they have not adopted a second component yet. That is a coincidence with an expiry date, not a safety property. **The merge is safe:** 504 keys across the six bundles with **zero collisions**, verified by enumeration; every key is namespace-prefixed. **The part that makes the fix permanent is the ratchet test** — the aggregate must be asserted against the bundle list **read from `src/i18n/`**, not a hand-written list, so a future bundle that is not folded in fails. Without it the aggregate is correct today and rots exactly as the six exports did. Per-feature exports stay (removing them would break twelve apps for no gain); double-spreading during migration is harmless, which is why the zero-collision property is a test and not a comment. **Rollout is constrained by the one-repo rule** — a WO implements in one repository, so the twelve consumers cannot be migrated from here: `fitness-monitor/FM-14` is written, mandatory and blocked on this release, and **fitness-monitor renders raw keys until it lands** (the operator chose to route the fix through this rollout rather than patch it separately, so it could not be lost between two WOs; the delay is the cost and is recorded rather than left implicit). The other eleven are correct today — prevention, not repair — and ride along when each is next touched. Self-registration via `addResourceBundle` is **deliberately out of scope**: feasible (ucm components use `useTranslation()` against the consumer's own instance and ucm owns no instance), but all twelve consumers flatten into the default namespace with dotted keys, and registering at render time risks a first-paint flash of the raw key — replacing an invisible defect with a visible one. It is `I18N-2`, framed as a bundle-size optimisation rather than a correctness fix, because this WO already closes the hole. |
-| I18N-2 | Self-registering component strings, if the bundle cost justifies it | Have ucm components register their own strings on the consumer's i18n instance (`addResourceBundle` on the instance from `useTranslation()`) instead of relying on the consumer spreading a bundle. Would remove the last of the consumer's i18n obligations and stop auth-only apps shipping strings they never render. | 2026-08-11 | blocked | | **Deferred by operator decision 2026-08-12** (recorded as `blocked` because the register's status vocabulary has no `deferred`; the blocker is named below). **Its premise did not survive measurement.** `hram/THEME-2` switched from three named bundles to the full aggregate and the built size changed by **−11 bytes**, not the expected increase — because **this package declares no `sideEffects` field** (and no `exports` map), so a bundler must assume every module has side effects and cannot drop unused exports. An auth-only app therefore already ships all seven bundles whatever it imports. That makes this WO's stated input **unmeasurable until tree-shaking works at all**, and it relocates the actual bundle-size lever to a `package.json` change rather than a Tier-3 rework of how twelve consumers resolve strings. Do not author this until `sideEffects` is settled and the delta re-measured against a package that can actually tree-shake. Original framing, kept for the record: Tier 3 (shared-core, changes how every consumer resolves strings); **deliberately NOT a correctness WO** — `I18N-1`'s aggregate closes the defect class. Source-side the non-auth strings are ~30 KB (the five non-auth bundles are 188 keys against auth's 316), but a source figure is not the answer and a guess here would make this decision unfalsifiable. **Two known hazards, both to be resolved before authoring:** (1) all twelve consumers flatten everything into i18next's DEFAULT namespace with flat dotted keys, so the registration shape has to match exactly or key resolution changes under twelve apps at once; (2) registering during render risks a first-paint flash of the raw key — which would trade an invisible defect for a visible one, the opposite of the point. Feasibility is established: ucm components use `useTranslation()` against the consumer's instance and ucm owns no i18next instance of its own, so there is a real instance to register against. |
+| I18N-2 | Self-registering component strings, if the bundle cost justifies it | Have ucm components register their own strings on the consumer's i18n instance (`addResourceBundle` on the instance from `useTranslation()`) instead of relying on the consumer spreading a bundle. Would remove the last of the consumer's i18n obligations and stop auth-only apps shipping strings they never render. | 2026-08-11 | blocked | | **Deferred by operator decision 2026-08-12** (recorded as `blocked` because the register's status vocabulary has no `deferred`; the blocker is named below). **Its premise did not survive measurement.** `hram/THEME-2` switched from three named bundles to the full aggregate and the built size changed by **−11 bytes**, not the expected increase — because **this package declares no `sideEffects` field** (and no `exports` map), so a bundler must assume every module has side effects and cannot drop unused exports. An auth-only app therefore already ships all seven bundles whatever it imports. That makes this WO's stated input **unmeasurable until tree-shaking works at all**, and it relocates the actual bundle-size lever to a `package.json` change rather than a Tier-3 rework of how twelve consumers resolve strings. Do not author this until `sideEffects` is settled and the delta re-measured against a package that can actually tree-shake. Original framing, kept for the record: Tier 3 (shared-core, changes how every consumer resolves strings); **deliberately NOT a correctness WO** — `I18N-1`'s aggregate closes the defect class. Source-side the non-auth strings are ~30 KB (the five non-auth bundles are 188 keys against auth's 316), but a source figure is not the answer and a guess here would make this decision unfalsifiable. **Two known hazards, both to be resolved before authoring:** (1) all twelve consumers flatten everything into i18next's DEFAULT namespace with flat dotted keys, so the registration shape has to match exactly or key resolution changes under twelve apps at once; (2) registering during render risks a first-paint flash of the raw key — which would trade an invisible defect for a visible one, the opposite of the point. Feasibility is established: ucm components use `useTranslation()` against the consumer's instance and ucm owns no i18next instance of its own, so there is a real instance to register against. **`DX-2` (2026-08-17) re-measured the input this WO is blocked on**, against a package that can now actually tree-shake: auth-only **62,294 B raw / 17,653 B gzip** vs. aggregate **90,395 B raw / 25,045 B gzip** → **+28,101 B raw / +7,392 B gzip**, translations only. This is now real, tree-shaking-aware evidence rather than the pre-`DX-2` source-reachability figure — **but the number is unchanged in kind (still a ~7.4 KB gzip cost for a fully auth-only app), so it does not by itself flip the blocked decision.** Still unresolved before this WO can be authored: the two named hazards (flat-namespace registration shape matching exactly across twelve consumers; first-paint raw-key flash risk during render-time registration) — the size delta alone was never the only gate. |
 | AUTH-4 | The account user list on a phone | Gives `UserListComponent` a card layout below `md` — one card per user, email as the title, the two boolean columns as labelled chips, role select and delete in a divided footer, plus a sort control that replaces the column headers the table loses. Above `md` the table is byte-identical. Prototype: [assets/AUTH-4-user-list-card.html](work-orders/assets/AUTH-4-user-list-card.html). Full spec: [work-orders/AUTH-4.md](work-orders/AUTH-4.md). | 2026-08-11 | planned | | Split out of DS-11 by operator decision; fix class chosen by operator (card list, over sticky-first-column and priority-hide). Envelope only (Approval Gate #1 pending). **Authored and parked by operator decision 2026-08-11 — not queued.** It is built on demand, not as SHELL-5's successor; a fresh session should not dispatch it without the operator saying so. When it does run, it runs **after** `SHELL-5` (same screen, different half). The point of this row is that the measurements above are already done, so nobody re-measures. Prototype in scope, so the two-width rendered gate applies. **Measured 2026-08-11 in cockpit** at `innerWidth` 411 (the mobile preset gives 411, not 375): table **1053px inside a 325px container**, container `overflow-x: auto` and **the document does not overflow** — so it is not a broken layout but a desktop table on a phone, with Role and Actions, the two things the screen exists for, entirely outside the view. **The cheap fix was tested and rejected:** 253px of the width is `New` (90) + `Successful Login` (163), both default-on props that `AccountPage` already forwards and cockpit simply left on — but the four remaining columns are 800px against 325px, so configuration cannot fix it. Column defaults deliberately NOT flipped: that would be a silent estate-wide change. SHELL-2's 1045px from 2026-08-08 still holds (+8px), so THEME-4/5 did not move the density. **Four prototype decisions are load-bearing:** email as title with a muted placeholder when the name is absent (verified: a 47-char address wraps to two lines in a 357px card without overflow); the icon-only flags become labelled chips **because a Tooltip is unreachable on a touch pointer**, so that data is effectively absent today; role and delete in a footer behind a divider with the full 44px target; and a **sort control**, because a card list has no column headers — without it the mobile view silently loses a desktop capability. `extraColumns` render as label/value rows with **no new required field**; `extraRowActions` beyond three must collapse into an overflow menu. Reached via `AccountPage`, which **at least ten apps mount**, and ucm has no staging net. |
 | SHELL-6 | A controlled `SectionNav` with no way to open must not render a trigger | In `mode="mobile"` the built-in trigger renders unconditionally (`SectionNav.jsx:246`), while `handleTriggerClick` calls `onOpen?.()` — so a consumer driving `open` itself without `onOpen` gets a button that is visible, focusable and does nothing. Render the trigger only when a click can open the drawer: uncontrolled, or controlled **and** `onOpen` supplied. Plus the component's **render matrix** written into its doc comment. Full spec: [work-orders/SHELL-6.md](work-orders/SHELL-6.md). | 2026-08-11 | done | f119b70 | **Unblocks `jg-ferien/NAV-37`** (`blocked`, `c627d7b`), same shape as `SHELL-3`→`SHELL-4`. **Operator chose the semantics fix over a `showTrigger` prop** — a prop would leave the dead button as the default for every controlled consumer who has not heard of it, turning a defect into a configuration option; a focusable control that performs no action is wrong on its own terms. Fix: `const canOpenTrigger = !isControlled || Boolean(onOpen)`, wrapping only the `<ButtonBase>` trigger — `children` and `<Drawer>` keep rendering unconditionally in every case. Render-matrix doc comment added above the component per the WO's own framing ("not optional documentation; it is the artefact whose absence caused the defect"). `AccountPage`, the only shipped consumer, is uncontrolled and renders identically. Version `2.37.0` → `2.37.1` (patch, defect fix, no API change). **Codex left the diff uncommitted and did not touch this file, as instructed** — fourth consecutive WO where the explicit warning held. **Required test 1's non-vacuity confirmed**: Codex's own landing note states the new regression test was run against the pre-fix code and failed (dead trigger still in the DOM), then passed after the one-line fix — the Orchestrator did not re-verify this specific claim by checking out the prior commit, but both independent reviewers separately read the old-vs-new JSX and found the claim plausible/consistent. **Orchestrator's own verification:** scoped tests 47/47 green, `tsc` clean. Independent `reviewer` + `ui_reviewer` (Sonnet, both mandatory) ran concurrently — **both came back clean, no findings, no fix required.** `reviewer` confirmed the condition is keyed correctly (not on `open`'s value, avoiding the trap the WO's own test 3 exists to catch), `children`/`Drawer` stay unconditional, desktop path untouched, and the render-matrix comment matches the Envelope's table exactly. `ui_reviewer` confirmed the trigger's removal is genuine (conditional JSX unmount, not a CSS-hidden trick left in the accessibility tree/tab order) and no restyle occurred as a side effect; noted two non-blocking residual observations, not fixed: a hypothetical layout-shift if a consumer dynamically toggled `onOpen` on/off at runtime (no current or planned consumer does this), and `resolvedEyebrow`/`resolvedTitle` computed unconditionally even when unused (harmless). No rendered gate needed per the WO's own reasoning — the change is a DOM absence fact, not an appearance, and the test suite is the correct instrument. |
 | THEME-6 | An app-side check for `sx` values the theme already gives | `THEME-4` made shadowing mechanical for the kit's own components; apps have no equivalent — cockpit alone carries **464 `sx` props across 37 files** (measured 2026-08-11). Adds an exported, source-level, **report-only** check an app calls from its own suite, plus the cockpit count. Full spec: [work-orders/THEME-6.md](work-orders/THEME-6.md). | 2026-08-11 | done | 637d262 | DS-18's app-side half. **Codex → Claude fallback**: Codex ran out of workspace credits mid-task (first-hand failure this session, stamped today) — the Orchestrator implemented directly. Author-flip rule applied: independent `reviewer` (Sonnet, mandatory regardless of tier) ran against the Orchestrator's own diff; `ui_reviewer` correctly not spawned, per the WO's own text, since nothing renders. New export `reportRedundantThemeValues(sources, { theme })` in `src/theme/themeCompleteness.js`, reusing existing primitives (`getPath`, `sameValue`, `jsxOpeningTag`, `topLevelSxValue`, `BASELINE_STYLED_MUI_COMPONENTS`, `expandShorthandProperty`) rather than rebuilding them. Attribution by JSX tag name only (root-slot styleOverrides only), literal string/number sx values only — no template literals, identifiers, spreads, or `component={...}` resolution, the bound written open per the WO's instruction. **A real, verified discrepancy in the Envelope's own grounding, corrected here rather than silently chased:** the cited cockpit examples (`borderColor: 'divider'` ×2, `bgcolor: 'background.paper'` ×3, `borderRadius: 1` ×3) all live on `<Box component="button">` in `cockpit/frontend/src/cockpit/ChatView.jsx:75,82,95` — confirmed by direct inspection — which the check's own stated tag-name attribution method cannot catch (`Box` isn't a themed tag, and `component={...}` resolution is explicitly out of scope). The check was NOT widened to chase these numbers. **Run against cockpit's real source** (`cockpit/frontend/src`, 50 `.jsx` files, `theme.js` excluded from the sources passed per the WO's app-side-exclusion instruction — `reportOffPaletteColours`'s own skip pattern left untouched): **27 findings, all `MuiButton.textTransform`, across 4 files** (`BoardView.jsx`, `KnowledgeView.jsx`, `SettingsView.jsx`, one more) — cockpit's buttons redundantly set `sx={{ textTransform: 'none' }}`, matching the baseline's own `MuiButton.styleOverrides.root.textTransform`. This is the honest, real result, reported as a correction to the Envelope's stale grounding, not a match to it. Independent `reviewer` found one real **P2, fixed**: numeric sx values for `borderRadius` and spacing-shorthand aliases were compared raw against the theme's already-resolved CSS value, but MUI actually multiplies a bare number by `theme.shape.borderRadius`/`theme.spacing()` before rendering (e.g. `borderRadius: 8` in sx renders as `8 × shape.borderRadius`, not `8`) — comparing the two raw numbers could produce a **false positive**, exactly the failure mode the WO's own Risks section names as the one to avoid. Fixed by skipping numeric-value comparison entirely for `borderRadius` and every spacing alias (`MUI_NUMERIC_SCALE_PROPERTIES`), erring toward a false negative (the accepted lower bound) rather than a false positive; two regression tests added (the specific false-positive case, plus a corrected version of the "component the theme doesn't style" test, which had used an off-list tag rather than exercising the intended undefined-styleOverride branch — also a reviewer note, fixed). Re-verified: cockpit's 27/27 findings unchanged by the fix (all string-valued `textTransform`, not numeric). Scoped tests 37/37 green, `tsc` clean. Version `2.37.1` → `2.38.0` (minor, new exported API). No rendered gate — static/logic change, no fix shipped anywhere (report-only, per the WO's explicit non-goal). |

package/dist/auth/apiClient.js

@@ -26,6 +26,18 @@ const CONSUMER_PUBLIC_PATHS = new Set();
  * Register an additional public path so a 401 on that route does not auto-redirect
  * to `/login`. Typical use: a public landing on `/` in an otherwise authenticated app.
  *
+ * Accepts a `string` (matched like the builtins: exact for "/", prefix otherwise) or
+ * a `RegExp` (AUTH-5) for consumers whose public area includes a dynamic segment —
+ * e.g. `/<slug>`, `/<slug>/team` — that no finite set of string prefixes can describe.
+ *
+ * A `RegExp` is tested via `.test()` against `window.location.pathname` ONLY — never
+ * against the query string or fragment. Anchor it (`^…$`): this library does not add
+ * anchors for you, and an unanchored pattern like `/team` also matches `/admin/team`,
+ * silently suppressing the redirect somewhere it's still needed. That failure is
+ * invisible until someone opens the over-matched page anonymously and lands on a
+ * blank error instead of `/login` — so test the non-matching direction too, not just
+ * the intended match.
+ *
  * MUST be called before the AuthProvider mounts (i.e. before `ReactDOM.render`).
  * Calling it later won't help the bootstrap probe which fires on AuthProvider mount.
  */
@@ -33,18 +45,36 @@ export function addPublicPath(path) {
     if (typeof path === "string" && path) {
         CONSUMER_PUBLIC_PATHS.add(path);
     }
+    else if (path instanceof RegExp) {
+        CONSUMER_PUBLIC_PATHS.add(path);
+    }
 }
-/** Remove a consumer-added public path. Library-internal paths are protected. */
+/**
+ * Remove a consumer-added public path. Library-internal paths are protected.
+ *
+ * For a `RegExp` entry, removal is by object identity (`Set.delete` uses SameValueZero
+ * equality) — pass the exact same `RegExp` instance `addPublicPath` was given, not a
+ * new literal that merely looks the same. Two `/^\/team$/` literals are not equal.
+ */
 export function removePublicPath(path) {
     CONSUMER_PUBLIC_PATHS.delete(path);
 }
 function isPublicSitePath(pathname) {
     return pathname === "/sites" || pathname.startsWith("/sites/");
 }
-// Match rule: an entry of exactly "/" requires strict equality (avoids matching
-// every path with startsWith). Other entries keep the looser prefix match so
-// dynamic routes like /invite/:uid/:token still work.
+// Match rule: a RegExp entry is tested against pathname only (AUTH-5). A string entry
+// of exactly "/" requires strict equality (avoids matching every path with
+// startsWith); other string entries keep the looser prefix match so dynamic routes
+// like /invite/:uid/:token still work.
 function matchesPublicPath(pathname, entry) {
+    if (entry instanceof RegExp) {
+        // `g`/`y` flags make `.test()` stateful (`lastIndex` advances on match), which would
+        // make the same pathname alternate matched/unmatched across calls to this
+        // long-lived, module-scoped RegExp — a redirect that only fires every other time.
+        // Reset before every test so a consumer's flags can't leak state across calls.
+        entry.lastIndex = 0;
+        return entry.test(pathname);
+    }
     if (entry === "/")
         return pathname === "/";
     return pathname.startsWith(entry);

package/dist/i18n/uiCoreTranslations.js

@@ -0,0 +1,8 @@
+import { authTranslations } from './authTranslations';
+import { chartsTranslations } from './chartsTranslations';
+import { messagingTranslations } from './messagingTranslations';
+import { notificationsTranslations } from './notificationsTranslations';
+import { onboardingTranslations } from './onboardingTranslations';
+import { sectionNavTranslations } from './sectionNavTranslations';
+import { userMenuTranslations } from './userMenuTranslations';
+export const uiCoreTranslations = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, authTranslations), chartsTranslations), messagingTranslations), notificationsTranslations), onboardingTranslations), sectionNavTranslations), userMenuTranslations);

package/dist/index.js

@@ -1,11 +1,9 @@
 // index.js (Entry Point deiner Library)
-import { authTranslations } from './i18n/authTranslations';
-import { chartsTranslations } from './i18n/chartsTranslations';
-import { messagingTranslations } from './i18n/messagingTranslations';
-import { notificationsTranslations } from './i18n/notificationsTranslations';
-import { onboardingTranslations } from './i18n/onboardingTranslations';
-import { sectionNavTranslations } from './i18n/sectionNavTranslations';
-import { userMenuTranslations } from './i18n/userMenuTranslations';
+// Deliberately unconditional: font CSS ships in every consumer bundle regardless of what they
+// import (not tree-shaken). If this import is ever removed, drop this file from the
+// `sideEffects` array in package.json in the same change — decoupling them silently reintroduces
+// the false-sideEffects-false hazard DX-2 exists to avoid.
+import './theme/fonts';
 // --- 0. Theme ---
 export { createAppTheme, assertThemeComplete, assertKitSxDisjoint, calculateContrastRatio, KIT_COMPONENT_SX_REGISTRY, reportOffPaletteColours, reportKitSxBypasses, reportRedundantThemeValues, reportThemeAdoption, THEME_COMPLETENESS_SURFACES, } from './theme';
 // --- 1. Auth Context (Essentiell für den Wrapper) ---
@@ -91,4 +89,4 @@ export { notificationsTranslations } from './i18n/notificationsTranslations';
 export { onboardingTranslations } from './i18n/onboardingTranslations';
 export { chartsTranslations } from './i18n/chartsTranslations';
 export { messagingTranslations } from './i18n/messagingTranslations';
-export const uiCoreTranslations = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, authTranslations), chartsTranslations), messagingTranslations), notificationsTranslations), onboardingTranslations), sectionNavTranslations), userMenuTranslations);
+export { uiCoreTranslations } from './i18n/uiCoreTranslations';

package/dist/theme/createAppTheme.js

@@ -1,6 +1,4 @@
-import '@fontsource/dm-sans/400.css';
-import '@fontsource/dm-sans/500.css';
-import '@fontsource/dm-sans/600.css';
+import './fonts';
 import { createTheme, darken, getContrastRatio } from '@mui/material/styles';
 import { BASELINE_INTENTIONAL_DEFAULT_EXEMPTIONS, BASELINE_PALETTE, BASELINE_STATIC, MOTION, } from './tokens';
 function findFunction(value, path) {

package/dist/theme/fonts.js

@@ -0,0 +1,3 @@
+import '@fontsource/dm-sans/400.css';
+import '@fontsource/dm-sans/500.css';
+import '@fontsource/dm-sans/600.css';

package/dist/theme/index.js

@@ -1,3 +1,4 @@
+import './fonts';
 export { createAppTheme } from './createAppTheme';
 export { assertThemeComplete, assertKitSxDisjoint, calculateContrastRatio, reportOffPaletteColours, reportKitSxBypasses, reportRedundantThemeValues, reportThemeAdoption, THEME_COMPLETENESS_SURFACES, } from './themeCompleteness';
 export { KIT_COMPONENT_SX_REGISTRY } from './kitSxRegistry';

package/package.json

@@ -1,8 +1,20 @@
 {
   "name": "@micha.bigler/ui-core-micha",
-  "version": "2.41.0",
+  "version": "2.41.2",
   "main": "dist/index.js",
   "module": "dist/index.js",
+  "sideEffects": [
+    "./src/index.js",
+    "./dist/index.js",
+    "./src/theme/index.js",
+    "./dist/theme/index.js",
+    "./src/theme/createAppTheme.js",
+    "./dist/theme/createAppTheme.js",
+    "./src/theme/fonts.js",
+    "./dist/theme/fonts.js",
+    "./src/notifications/serviceWorker/sw.js",
+    "./dist/notifications/serviceWorker/sw.js"
+  ],
   "repository": {
     "type": "git",
     "url": "https://github.com/bigler-webapps/ui-core-micha"

package/src/auth/apiClient.jsx

@@ -32,16 +32,36 @@ const CONSUMER_PUBLIC_PATHS = new Set();
  * Register an additional public path so a 401 on that route does not auto-redirect
  * to `/login`. Typical use: a public landing on `/` in an otherwise authenticated app.
  *
+ * Accepts a `string` (matched like the builtins: exact for "/", prefix otherwise) or
+ * a `RegExp` (AUTH-5) for consumers whose public area includes a dynamic segment —
+ * e.g. `/<slug>`, `/<slug>/team` — that no finite set of string prefixes can describe.
+ *
+ * A `RegExp` is tested via `.test()` against `window.location.pathname` ONLY — never
+ * against the query string or fragment. Anchor it (`^…$`): this library does not add
+ * anchors for you, and an unanchored pattern like `/team` also matches `/admin/team`,
+ * silently suppressing the redirect somewhere it's still needed. That failure is
+ * invisible until someone opens the over-matched page anonymously and lands on a
+ * blank error instead of `/login` — so test the non-matching direction too, not just
+ * the intended match.
+ *
  * MUST be called before the AuthProvider mounts (i.e. before `ReactDOM.render`).
  * Calling it later won't help the bootstrap probe which fires on AuthProvider mount.
  */
 export function addPublicPath(path) {
   if (typeof path === "string" && path) {
     CONSUMER_PUBLIC_PATHS.add(path);
+  } else if (path instanceof RegExp) {
+    CONSUMER_PUBLIC_PATHS.add(path);
   }
 }
 
-/** Remove a consumer-added public path. Library-internal paths are protected. */
+/**
+ * Remove a consumer-added public path. Library-internal paths are protected.
+ *
+ * For a `RegExp` entry, removal is by object identity (`Set.delete` uses SameValueZero
+ * equality) — pass the exact same `RegExp` instance `addPublicPath` was given, not a
+ * new literal that merely looks the same. Two `/^\/team$/` literals are not equal.
+ */
 export function removePublicPath(path) {
   CONSUMER_PUBLIC_PATHS.delete(path);
 }
@@ -50,10 +70,19 @@ function isPublicSitePath(pathname) {
   return pathname === "/sites" || pathname.startsWith("/sites/");
 }
 
-// Match rule: an entry of exactly "/" requires strict equality (avoids matching
-// every path with startsWith). Other entries keep the looser prefix match so
-// dynamic routes like /invite/:uid/:token still work.
+// Match rule: a RegExp entry is tested against pathname only (AUTH-5). A string entry
+// of exactly "/" requires strict equality (avoids matching every path with
+// startsWith); other string entries keep the looser prefix match so dynamic routes
+// like /invite/:uid/:token still work.
 function matchesPublicPath(pathname, entry) {
+  if (entry instanceof RegExp) {
+    // `g`/`y` flags make `.test()` stateful (`lastIndex` advances on match), which would
+    // make the same pathname alternate matched/unmatched across calls to this
+    // long-lived, module-scoped RegExp — a redirect that only fires every other time.
+    // Reset before every test so a consumer's flags can't leak state across calls.
+    entry.lastIndex = 0;
+    return entry.test(pathname);
+  }
   if (entry === "/") return pathname === "/";
   return pathname.startsWith(entry);
 }

package/src/i18n/uiCoreTranslations.js

@@ -0,0 +1,17 @@
+import { authTranslations } from './authTranslations';
+import { chartsTranslations } from './chartsTranslations';
+import { messagingTranslations } from './messagingTranslations';
+import { notificationsTranslations } from './notificationsTranslations';
+import { onboardingTranslations } from './onboardingTranslations';
+import { sectionNavTranslations } from './sectionNavTranslations';
+import { userMenuTranslations } from './userMenuTranslations';
+
+export const uiCoreTranslations = {
+  ...authTranslations,
+  ...chartsTranslations,
+  ...messagingTranslations,
+  ...notificationsTranslations,
+  ...onboardingTranslations,
+  ...sectionNavTranslations,
+  ...userMenuTranslations,
+};

package/src/index.js

@@ -1,12 +1,10 @@
 // index.js (Entry Point deiner Library)
 
-import { authTranslations } from './i18n/authTranslations';
-import { chartsTranslations } from './i18n/chartsTranslations';
-import { messagingTranslations } from './i18n/messagingTranslations';
-import { notificationsTranslations } from './i18n/notificationsTranslations';
-import { onboardingTranslations } from './i18n/onboardingTranslations';
-import { sectionNavTranslations } from './i18n/sectionNavTranslations';
-import { userMenuTranslations } from './i18n/userMenuTranslations';
+// Deliberately unconditional: font CSS ships in every consumer bundle regardless of what they
+// import (not tree-shaken). If this import is ever removed, drop this file from the
+// `sideEffects` array in package.json in the same change — decoupling them silently reintroduces
+// the false-sideEffects-false hazard DX-2 exists to avoid.
+import './theme/fonts';
 
 // --- 0. Theme ---
 export {
@@ -142,13 +140,4 @@ export { notificationsTranslations } from './i18n/notificationsTranslations';
 export { onboardingTranslations } from './i18n/onboardingTranslations';
 export { chartsTranslations } from './i18n/chartsTranslations';
 export { messagingTranslations } from './i18n/messagingTranslations';
-
-export const uiCoreTranslations = {
-  ...authTranslations,
-  ...chartsTranslations,
-  ...messagingTranslations,
-  ...notificationsTranslations,
-  ...onboardingTranslations,
-  ...sectionNavTranslations,
-  ...userMenuTranslations,
-};
+export { uiCoreTranslations } from './i18n/uiCoreTranslations';

package/src/theme/createAppTheme.js

@@ -1,6 +1,4 @@
-import '@fontsource/dm-sans/400.css';
-import '@fontsource/dm-sans/500.css';
-import '@fontsource/dm-sans/600.css';
+import './fonts';
 
 import { createTheme, darken, getContrastRatio } from '@mui/material/styles';
 

package/src/theme/fonts.js

@@ -0,0 +1,3 @@
+import '@fontsource/dm-sans/400.css';
+import '@fontsource/dm-sans/500.css';
+import '@fontsource/dm-sans/600.css';

package/src/theme/index.js

@@ -1,3 +1,5 @@
+import './fonts';
+
 export { createAppTheme } from './createAppTheme';
 export {
   assertThemeComplete,

package/tests/apiClientPublicPaths.test.js

@@ -0,0 +1,178 @@
+// @vitest-environment jsdom
+// AUTH-5: addPublicPath/matchesPublicPath/removePublicPath must accept a RegExp alongside a
+// string, evaluated exclusively against pathname. Driven through the real response interceptor
+// (not a reimplementation of matchesPublicPath) so these tests fail if the wiring, not just the
+// matcher, breaks.
+//
+// The module keeps a `redirectingToLogin` latch that only resets on a real navigation, which
+// never happens in jsdom — so each test re-imports a fresh module instance via
+// vi.resetModules()/dynamic import, rather than sharing one import across the file.
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+function notAuthenticatedError(status = 401) {
+  return {
+    response: {
+      status,
+      data: { code: 'not_authenticated' },
+    },
+    config: {},
+  };
+}
+
+async function rejectThroughInterceptor(client, error) {
+  const handler = client.interceptors.response.handlers.find(Boolean);
+  try {
+    await handler.rejected(error);
+  } catch {
+    // The interceptor always re-rejects after handling — expected, not the assertion.
+  }
+}
+
+// jsdom's real `window.location` ties `pathname` to `history.pushState` through internal
+// wiring that a deleted/replaced `location` object doesn't preserve, and `assign` is
+// non-configurable so `vi.spyOn` can't touch it directly either. Sidestep both by installing a
+// fully synthetic `location` this file controls end to end — the interceptor only ever reads
+// `.pathname` and calls `.assign()`, so nothing else needs to be real.
+function installLocationMock(initialPathname = '/') {
+  const assign = vi.fn();
+  delete window.location;
+  window.location = { pathname: initialPathname, search: '', hash: '', assign };
+  return assign;
+}
+
+function setPathname(pathname) {
+  window.location.pathname = pathname;
+}
+
+describe('apiClient public-path registry (AUTH-5)', () => {
+  let assignSpy;
+  let apiClient;
+  let addPublicPath;
+  let removePublicPath;
+
+  beforeEach(async () => {
+    vi.resetModules();
+    ({ default: apiClient, addPublicPath, removePublicPath } = await import('../src/auth/apiClient'));
+    assignSpy = installLocationMock();
+  });
+
+  it('string registration still matches by prefix (regression)', async () => {
+    setPathname('/custom-public');
+    addPublicPath('/custom-public');
+
+    await rejectThroughInterceptor(apiClient, notAuthenticatedError());
+
+    expect(assignSpy).not.toHaveBeenCalled();
+  });
+
+  it('a bare "/" registration does not match a deeper path via startsWith (regression)', async () => {
+    addPublicPath('/');
+    setPathname('/somewhere-else');
+
+    await rejectThroughInterceptor(apiClient, notAuthenticatedError());
+
+    expect(assignSpy).toHaveBeenCalledWith('/login');
+  });
+
+  it('a registered RegExp matches the intended dynamic path', async () => {
+    addPublicPath(/^\/[^/]+\/team$/);
+    setPathname('/jg-bern/team');
+
+    await rejectThroughInterceptor(apiClient, notAuthenticatedError());
+
+    expect(assignSpy).not.toHaveBeenCalled();
+  });
+
+  it('a non-matching path still redirects even with an unrelated RegExp registered', async () => {
+    addPublicPath(/^\/[^/]+\/team$/);
+    setPathname('/account');
+
+    await rejectThroughInterceptor(apiClient, notAuthenticatedError());
+
+    expect(assignSpy).toHaveBeenCalledWith('/login');
+  });
+
+  it('the RegExp is tested against pathname, not the query string', async () => {
+    // A pattern that would only match if the query string leaked into the tested value.
+    setPathname('/blocked-page');
+    window.location.search = '?next=/public';
+    addPublicPath(/public/);
+
+    await rejectThroughInterceptor(apiClient, notAuthenticatedError());
+
+    expect(assignSpy).toHaveBeenCalledWith('/login');
+  });
+
+  it('the RegExp is tested against pathname, not the fragment', async () => {
+    setPathname('/blocked-page');
+    window.location.hash = '#panel';
+    addPublicPath(/panel/);
+
+    await rejectThroughInterceptor(apiClient, notAuthenticatedError());
+
+    expect(assignSpy).toHaveBeenCalledWith('/login');
+  });
+
+  it('a pathname-anchored RegExp still matches when the URL also carries a query string', async () => {
+    setPathname('/public');
+    window.location.search = '?next=/admin';
+    addPublicPath(/^\/public$/);
+
+    await rejectThroughInterceptor(apiClient, notAuthenticatedError());
+
+    expect(assignSpy).not.toHaveBeenCalled();
+  });
+
+  it('removePublicPath removes a RegExp entry by identity', async () => {
+    const pattern = /^\/temp$/;
+    addPublicPath(pattern);
+    removePublicPath(pattern);
+    setPathname('/temp');
+
+    await rejectThroughInterceptor(apiClient, notAuthenticatedError());
+
+    expect(assignSpy).toHaveBeenCalledWith('/login');
+  });
+
+  it('removePublicPath does not remove a RegExp entry given only an equal-looking literal', async () => {
+    addPublicPath(/^\/temp$/);
+    removePublicPath(/^\/temp$/); // a different object, same source — must NOT remove the original
+    setPathname('/temp');
+
+    await rejectThroughInterceptor(apiClient, notAuthenticatedError());
+
+    expect(assignSpy).not.toHaveBeenCalled();
+  });
+
+  it('removePublicPath cannot remove a builtin path', async () => {
+    removePublicPath('/login');
+    setPathname('/login');
+
+    await rejectThroughInterceptor(apiClient, notAuthenticatedError());
+
+    expect(assignSpy).not.toHaveBeenCalled();
+  });
+
+  it('a stateful (global-flag) RegExp matches consistently across repeated calls', async () => {
+    // Without resetting lastIndex, a `g`-flagged RegExp would alternate
+    // matched/unmatched across calls since it is reused from the module-level Set.
+    addPublicPath(/^\/public$/g);
+    setPathname('/public');
+
+    await rejectThroughInterceptor(apiClient, notAuthenticatedError());
+    expect(assignSpy).not.toHaveBeenCalled();
+
+    await rejectThroughInterceptor(apiClient, notAuthenticatedError());
+    expect(assignSpy).not.toHaveBeenCalled();
+  });
+
+  it('a RegExp entry in the registry does not break evaluation of string entries', async () => {
+    addPublicPath(/^\/gallery\/\d+$/);
+    addPublicPath('/custom-string');
+    setPathname('/custom-string');
+
+    await rejectThroughInterceptor(apiClient, notAuthenticatedError());
+
+    expect(assignSpy).not.toHaveBeenCalled();
+  });
+});