@micha.bigler/ui-core-micha 3.12.0 → 3.13.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 3.13.0 - UCM-AUTH-12
+
+`AccountPage` accepts `showProfileStatements` (default `true`). Set it to `false` in consumers
+without privacy/cookie statement endpoints to suppress the statement panels and their requests.
+Both existing consent controls and their submitted values remain available.
+
 ## 3.12.0 - UCM-THEME-18
 
 The shared type scale now uses h1–h5 sizes of 36/32/28/24/20px, h4 steps to 23px below `sm`, and subtitle1 is 13px; every adopted app changes on its next bump, with hram, jg-ferien, kerzenziehen, spesix, and fitness-monitor moving screen titles from h5 to h4, while survey_app should remove its 800/700 weights and h4 `2.125rem`/400 override and decide its h3 page titles (24px to 28px), closing the held `SVA-THEME-1` typography revert. An app h4 `fontSize` override retains the baseline’s 23px mobile step (survey_app currently sets `2.125rem`); heading weights are fixed at 600, so apps should not override them per level. All other adopted apps need only bump; webshop-guenter, Kira, Cinevia, and Gustav are unaffected.

package/README.md

@@ -10,6 +10,12 @@ To add an entry, create a small component in `dev/entries.jsx` and append it to
 
 Spread `uiCoreTranslations` into the default i18n namespace as the supported aggregate; per-feature translation exports remain available to selective apps that accept responsibility for pairing every adopted feature with its bundle.
 
+## Account profile statements
+
+`AccountPage` defaults `showProfileStatements` to `true`. Pass `false` when the consumer does not
+offer privacy/cookie statement text endpoints; this hides their panels and prevents their requests.
+The privacy and cookie consent controls and their submitted values remain available.
+
 ## Consumer integration check
 
 ```js

package/WORK_ORDERS.md

@@ -28,6 +28,8 @@ prefixed ID; never reuse a bare flat number across workstreams.
 
 | ID | Titel | Beschreibung | Datum | Status | Commit(s) | Notiz |
 |---|---|---|---|---|---|---|
+| UCM-AUTH-12 | [Optional account profile statement text](work-orders/UCM-AUTH-12.md) | AccountPage showProfileStatements defaults true; false suppresses statement panels/requests while preserving both consent controls and their payload. Minor release 3.13.0, consumed by innoservice INNO-FIX-13. | 2026-10-13 | in-review | 97b7d83 | Tier 3 (shared-core account surface). Gate #1 explicitly approved in the innoservice Codex chat on 2026-10-13, including release and app pin bump. Separate configured Luna implementation and independent reviews; existing default and consent behavior are invariants.  review: codex/gpt-6-luna · lenses: envelope, regression, duplication, tests, ui, security · 0 raised · 0 accepted · worst accepted: none. Parent scoped tests: AccountPage.profileStatements.test.jsx + AccountPage.test.jsx, 6 passed, correct kit cwd, maxWorkers2. Native author attempt EPERM before collection; parent gate green. Reviewed additive API/default and package release metadata; main push triggers the existing release build/suite/publish. Publication and innoservice capture remain pending. |
+| UCM-SHELL-8 | SectionNav lists contain direct button children | innoservice INNO-FIX-11 retained three serious axe list violations in account-admin-populated at 1280 px: ul[aria-labelledby="_r_b_-0"], ul[aria-labelledby="_r_b_-1"], ul[aria-labelledby="_r_b_-2"]. Installed ui-core-micha 3.12.0 AccountPage uses src/layout/SectionNav.jsx:132-159, where ListItemButton divs sit directly under List/ul. | 2026-10-13 | planned | | Source-attributed from CI38387014900, candidate9937adb, artifact e2e-capture-38387014900-1; full node evidence in innoservice/work-orders/assets/INNO-FIX-11-axe-nodes.json. Registered as expressly required by INNO-FIX-11 Part A; no kit source/token fix or implementation approval implied. Registration itself: Tier 1, self-checked identifiers/source/evidence; tests none (metadata only). Future shared-core implementation is Tier 3 and needs its own approved scope. |
 | UCM-THEME-17 | Decide a less compressed baseline type scale | Design round (design-language process): inventory, instrument with 2-3 candidate scales next to today's baseline and MUI on real screens (hram, a survey site, jg-ferien, kerzenziehen), value rounds, frozen sheet. Measured 2026-10-04: page/card/section titles differ by 1-3 px, hierarchy rests on weight alone. Full order [`work-orders/UCM-THEME-17.md`](work-orders/UCM-THEME-17.md) | 2026-10-04 | done | `68dfc6a`, `998e36c`, `cb9dd89`, `c452224` | Tier 2 (document only) · operator decision 2026-10-04: baseline finding, not per-app overrides · implementation order follows the freeze · survey_app SVA-THEME-1 typography revert held until then · **frozen 2026-10-04** after two value rounds: candidate B, mobile h4 23, h1-h3 36/32/28; value source [`docs/TYPE-SCALE.md`](docs/TYPE-SCALE.md) · review: none, document order, the operator freeze is the gate · implementation UCM-THEME-18 |
 | UCM-THEME-18 | Ship the frozen baseline type scale | `tokens.js` typography per `docs/TYPE-SCALE.md`: h1-h3 36/32/28, h4 24 (23 below `sm`), h5 20, subtitle1 13; light fixture typography entries; minor release 3.12.0. Full order [`work-orders/UCM-THEME-18.md`](work-orders/UCM-THEME-18.md) | 2026-10-04 | 5be83d5 | | Tier 3 (shared-core) · reviewer + ui_reviewer · downstream per-app orders (h5 page titles -> h4, per-level weight overrides) written after the release - 2026-10-04: Codex implemented (gpt-6-luna; probe of stale 2026-10-03 record succeeded, available) - orchestrator fixed review findings - review: codex/gpt-6-luna - lenses: envelope,regression,duplication,tests + ui_review - 3 raised - 2 accepted - worst accepted: defect (h4 mobile key now follows an app-overridden sm, test added; completeness test strengthened; rejected: breakpointDownQuery vs theme.breakpoints.down, no theme exists at token time) - light fixture diff limited to typography entries - no rendered side-by-side (no prototype; values asserted from the resolved theme in light and dark) - release 3.12.0 |
 | UCM-I18N-5 | [User-list pagination range text is hard-coded English](work-orders/UCM-I18N-5.md) | `UserListComponent`'s `TablePagination` sets `labelRowsPerPage` but no `labelDisplayedRows`, so German shows "1–4 of 4". | 2026-10-01 | done | 6b9d557 | Found in jg-ferien's rendered check 2026-10-01. Follows `UCM-I18N-4`. Tier 3. Done = released AND jg-ferien pin bumped. Envelope written 2026-10-01; operator: hand to the jg Paket-4 session. Implementation map filled 2026-10-02 (`a732025`): the translation bundle carries FOUR locales (de/fr/en/sw), not three — confirmed by reading `authTranslations.ts` directly; proposed two keys (exact-count + "more than" form) with a best-effort, not native-verified, Swahili wording. Implemented by codex/gpt-5.6-luna exactly per the map: `labelDisplayedRows` resolves `UserList.DISPLAYED_ROWS`/`UserList.DISPLAYED_ROWS_MORE_THAN` through `t()`, both keys added in all four locales. review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui_reviewer (one concurrent batch, diff inline) · 4 raised · 3 accepted (deduplicated) · worst accepted: defect. Accepted: the rendered English test would still pass against a reverted implementation, since the EN wording was deliberately made identical to MUI's own hardcoded default — added a second test swapping in a distinctive marker string for just that key, proving the render genuinely resolves through i18next, not MUI's fallback; `authTranslations.test.js`'s new key-parity check only asserted non-empty strings, not that each locale actually carries the `{{from}}`/`{{to}}`/`{{count}}` placeholders the others do — strengthened with an explicit per-locale placeholder check; self-identified (corroborated by the `tests` lens's own closing remark) that the `count === -1` ("more than") branch can never be reached through a render of `UserListComponent` itself (its own `count` prop is always a real array length) — extracted the inline callback into an exported, directly unit-tested `formatDisplayedRowsLabel(t)` rather than leaving it permanently untested dead code. Rejected: `regression`'s claim that hard-coding `labelDisplayedRows` "overrides any consuming app's MUI theme customisation" — speculative, no actual consumer override exists (same explicit-prop design as `labelRowsPerPage` since `UCM-I18N-4`), and the reviewer's own repo search found zero consumer snapshots/assertions relying on the old English text. `envelope`'s "release + pin bump missing from the diff" was correct but not a code defect — addressed by the remaining steps below, not a fix to the reviewed diff. `duplication`: 0 findings. `ui_reviewer`: 0 blocking findings; confirmed placeholder consistency across all 8 strings; Swahili wording flagged as advisory-only ("structurally plausible to a non-native reviewer, native-speaker verification advisable" — not re-asked of a native speaker here, recorded as open). Tests: 37/37 green (`userScreenTranslations.test.jsx`, `authTranslations.test.js`, `UserListComponent.test.jsx`). Released as `3.11.1` (patch — continues `UCM-I18N-4`'s i18n-gap category, not a new capability area), commit `6b9d557`; npm Trusted Publishing confirmed via the Actions job log (not a registry re-query — provenance publishes can lag), tarball `@micha.bigler/ui-core-micha@3.11.1`. jg-ferien's pin bumped 3.7.0 -> 3.11.1 same day, closed as jg's own `JG-DEPS-3` (`2c1d6e3`) — see that repo's `WORK_ORDERS.md` for the empirical safety checks (status-colour palette diff, `UserListComponent`-unused confirmation, full-suite run) this multi-version jump required. |

package/dist/pages/AccountPage.js

@@ -26,7 +26,7 @@ import { QrSignupValidityManager } from '../components/QrSignupValidityManager';
 import { SupportRecoveryRequestsTab } from '../components/SupportRecoveryRequestsTab';
 import { BulkInviteCsvTab } from '../components/BulkInviteCsvTab';
 import { fetchAuthPolicy, updateUserProfile } from '../auth/authApi'; // Ggf. Pfad anpassen
-export function AccountPage({ userListExtraColumns = [], userListExtraRowActions = [], userListExtraContext = null, userListRefreshTrigger = 0, userListCanEditUser = null, userListShowNewColumn = true, userListShowSuccessfulLoginColumn = true, userListShowRoleColumn = true, userListOnChangeRole = null, userListShowDeleteAction = true, userListCanDeleteUser = null, userListOnDeleteUser = null, showBulkInviteCsvTab = false, bulkInviteCsvProps = {}, extraTabs = [], }) {
+export function AccountPage({ userListExtraColumns = [], userListExtraRowActions = [], userListExtraContext = null, userListRefreshTrigger = 0, userListCanEditUser = null, userListShowNewColumn = true, userListShowSuccessfulLoginColumn = true, userListShowRoleColumn = true, userListOnChangeRole = null, userListShowDeleteAction = true, userListCanDeleteUser = null, userListOnDeleteUser = null, showBulkInviteCsvTab = false, bulkInviteCsvProps = {}, extraTabs = [], showProfileStatements = true, }) {
     var _a;
     const { t, i18n } = useTranslation();
     const { user, login, loading } = useContext(AuthContext);
@@ -174,5 +174,5 @@ export function AccountPage({ userListExtraColumns = [], userListExtraRowActions
     const activeExtraTab = builtInTabValues.has(safeTab)
         ? null
         : extraTabs.find((tab) => tab.value === safeTab);
-    return (_jsxs(WidePage, { title: t('Account.TITLE', 'Account & Administration'), children: [_jsx(Helmet, { children: _jsxs("title", { children: [t('Account.PAGE_TITLE', 'Account'), " \u2013 ", user.email] }) }), _jsxs(SectionNav, { mode: isMobile ? 'mobile' : 'desktop', groups: groups, activeKey: safeTab, onSelect: (key) => handleTabChange(null, key), children: [safeTab === 'profile' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(ProfileComponent, { onSubmit: handleProfileSubmit, showName: true, showPrivacy: true, showCookies: true }) })), safeTab === 'security' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SecurityComponent, { fromRecovery: fromRecovery, fromWeakLogin: fromWeakLogin }) })), safeTab === 'users' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(UserListComponent, { roles: activeRoles, currentUser: user, extraColumns: userListExtraColumns, extraRowActions: userListExtraRowActions, extraContext: userListExtraContext, refreshTrigger: userListRefreshTrigger, canEditUser: userListCanEditUser, showNewColumn: userListShowNewColumn, showSuccessfulLoginColumn: userListShowSuccessfulLoginColumn, showRoleColumn: userListShowRoleColumn, onChangeRole: userListOnChangeRole, showDeleteAction: userListShowDeleteAction, canDeleteUser: userListCanDeleteUser, onDeleteUser: userListOnDeleteUser }) })), safeTab === 'invite' && (_jsx(Box, { sx: { mt: 2 }, children: _jsxs(Stack, { spacing: 2.5, children: [canViewAuthPolicy && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(AuthFactorRequirementCard, { canEdit: canWriteAuthPolicy, policy: authPolicy }) })), canViewAuthPolicy && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(RegistrationMethodsManager, { policy: authPolicy, error: authPolicyError, onPolicyChange: setAuthPolicy, canEdit: canWriteAuthPolicy }) })), canSendInvites && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_admin_invite) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(UserInviteComponent, {}) })), canManageAccessCodes && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_access_code) && (_jsxs(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.ACCESS_CODE_MANAGER_TITLE', 'Access Codes') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Account.ACCESS_CODES_HINT', 'Manage access codes for self-registration.') }), _jsx(AccessCodeManager, {})] })), canManageAccessCodes && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_access_code) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(AccessCodeSingleUseToggle, { canEdit: canWriteAuthPolicy, policy: authPolicy, onPolicyChange: setAuthPolicy }) })), canSendInvites && showBulkInviteCsvTab && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_admin_invite) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(BulkInviteCsvTab, Object.assign({}, bulkInviteCsvProps)) })), canViewAuthPolicy && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_email_domain) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(AllowedEmailDomainsManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_email_domain), domains: (authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allowed_email_domains) || [], onPolicyChange: setAuthPolicy, canEdit: canWriteAuthPolicy }) })), canViewAuthPolicy && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(QrSignupValidityManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr), expiryDays: authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.signup_qr_expiry_days, onPolicyChange: setAuthPolicy, canEdit: canWriteAuthPolicy }) })), canManageSignupQr && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(QrSignupManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr), expiryDays: authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.signup_qr_expiry_days }) }))] }) })), safeTab === 'support' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SupportRecoveryRequestsTab, {}) })), activeExtraTab && (_jsx(Box, { sx: { mt: 2 }, children: (_a = activeExtraTab.render) === null || _a === void 0 ? void 0 : _a.call(activeExtraTab, { user, perms, isSuperUser, t }) }))] })] }));
+    return (_jsxs(WidePage, { title: t('Account.TITLE', 'Account & Administration'), children: [_jsx(Helmet, { children: _jsxs("title", { children: [t('Account.PAGE_TITLE', 'Account'), " \u2013 ", user.email] }) }), _jsxs(SectionNav, { mode: isMobile ? 'mobile' : 'desktop', groups: groups, activeKey: safeTab, onSelect: (key) => handleTabChange(null, key), children: [safeTab === 'profile' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(ProfileComponent, { onSubmit: handleProfileSubmit, showName: true, showPrivacy: true, showCookies: true, showStatements: showProfileStatements }) })), safeTab === 'security' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SecurityComponent, { fromRecovery: fromRecovery, fromWeakLogin: fromWeakLogin }) })), safeTab === 'users' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(UserListComponent, { roles: activeRoles, currentUser: user, extraColumns: userListExtraColumns, extraRowActions: userListExtraRowActions, extraContext: userListExtraContext, refreshTrigger: userListRefreshTrigger, canEditUser: userListCanEditUser, showNewColumn: userListShowNewColumn, showSuccessfulLoginColumn: userListShowSuccessfulLoginColumn, showRoleColumn: userListShowRoleColumn, onChangeRole: userListOnChangeRole, showDeleteAction: userListShowDeleteAction, canDeleteUser: userListCanDeleteUser, onDeleteUser: userListOnDeleteUser }) })), safeTab === 'invite' && (_jsx(Box, { sx: { mt: 2 }, children: _jsxs(Stack, { spacing: 2.5, children: [canViewAuthPolicy && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(AuthFactorRequirementCard, { canEdit: canWriteAuthPolicy, policy: authPolicy }) })), canViewAuthPolicy && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(RegistrationMethodsManager, { policy: authPolicy, error: authPolicyError, onPolicyChange: setAuthPolicy, canEdit: canWriteAuthPolicy }) })), canSendInvites && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_admin_invite) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(UserInviteComponent, {}) })), canManageAccessCodes && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_access_code) && (_jsxs(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.ACCESS_CODE_MANAGER_TITLE', 'Access Codes') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Account.ACCESS_CODES_HINT', 'Manage access codes for self-registration.') }), _jsx(AccessCodeManager, {})] })), canManageAccessCodes && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_access_code) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(AccessCodeSingleUseToggle, { canEdit: canWriteAuthPolicy, policy: authPolicy, onPolicyChange: setAuthPolicy }) })), canSendInvites && showBulkInviteCsvTab && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_admin_invite) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(BulkInviteCsvTab, Object.assign({}, bulkInviteCsvProps)) })), canViewAuthPolicy && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_email_domain) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(AllowedEmailDomainsManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_email_domain), domains: (authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allowed_email_domains) || [], onPolicyChange: setAuthPolicy, canEdit: canWriteAuthPolicy }) })), canViewAuthPolicy && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(QrSignupValidityManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr), expiryDays: authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.signup_qr_expiry_days, onPolicyChange: setAuthPolicy, canEdit: canWriteAuthPolicy }) })), canManageSignupQr && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(QrSignupManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr), expiryDays: authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.signup_qr_expiry_days }) }))] }) })), safeTab === 'support' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SupportRecoveryRequestsTab, {}) })), activeExtraTab && (_jsx(Box, { sx: { mt: 2 }, children: (_a = activeExtraTab.render) === null || _a === void 0 ? void 0 : _a.call(activeExtraTab, { user, perms, isSuperUser, t }) }))] })] }));
 }

package/docs/TYPE-SCALE.md

@@ -90,6 +90,18 @@ These are inputs for the per-app follow-up after the release, not part of the ba
   1 page h5; survey_app uses h3 on 7 pages, which grows from 24 to 28.
 - **Per-level weight overrides** contradict decision 3: survey_app (h1 to h6 800/700, site builder 800),
   hram (500), spesix (weights). survey_app's held typography revert (`SVA-THEME-1`) is decided by this sheet.
+- **subtitle1 also serves as a title, not only as a section label** (added 2026-10-04, after the freeze; the
+  inventory missed it, because it read subtitle1 only in its section-label role on hram Research). Uses in
+  `src/`: hram 72, jg-ferien 39, ui-core-micha itself 12 (`UserMenu` user name, `SectionNav` active item,
+  announcement titles), innoservice 9, survey_app 7, reimbursements 6, spesix 5. As item or panel titles they
+  fall below body size. **Decided at the jg-ferien pilot `JG-DEPS-4`, 2026-10-04: subtitle1 stays at 13 px.**
+  The operator looked at jg-ferien on the 3.12.0 build, including `FinanceSummaryPanel` with subtitle1 as a
+  panel section title, and accepted it without any remapping. Rollout orders therefore do not remap
+  subtitle1 by default; a remap happens only where an app's own look rejects a specific screen.
+- **Exception to decision 3: spesix keeps its own heading weights** (operator, 2026-10-04, at `SPX-DEP-3`). Its
+  `DESIGN` block (h1 800, h2-h5 700, h6 600, button 700) belongs to a decided design (`SPX-THEME-1`, identity
+  bucket), and the new sizes separate the levels on their own. survey_app's 800/700 weights are not covered by
+  this exception: there the operator found the bold levels themselves to be the problem.
 - webshop-guenter keeps its handoff scale (decided brand, identity bucket). Kira, Cinevia and Gustav use no MUI
   heading variants and are unaffected.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micha.bigler/ui-core-micha",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "sideEffects": [

package/src/pages/AccountPage.jsx

@@ -53,6 +53,7 @@ export function AccountPage({
   showBulkInviteCsvTab = false,
   bulkInviteCsvProps = {},
   extraTabs = [],
+  showProfileStatements = true,
 }) {
   const { t, i18n } = useTranslation();
   const { user, login, loading } = useContext(AuthContext);
@@ -253,6 +254,7 @@ export function AccountPage({
             showName
             showPrivacy
             showCookies
+            showStatements={showProfileStatements}
           />
         </Box>
       )}

package/tests/AccountPage.profileStatements.test.jsx

@@ -0,0 +1,162 @@
+// @vitest-environment jsdom
+import React from 'react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { ThemeProvider, createTheme } from '@mui/material/styles';
+import { MemoryRouter, Route, Routes } from 'react-router-dom';
+
+vi.mock('react-i18next', () => {
+  const KEYS = {
+    'Account.TITLE': 'Account & Administration',
+    'Account.PAGE_TITLE': 'Account',
+    'Account.TAB_PROFILE': 'Profile',
+    'Account.TAB_SECURITY': 'Security',
+    'Account.GROUP_MY_ACCOUNT': 'My account',
+    'Profile.ACCEPT_PRIVACY_LABEL': 'Accept privacy statement',
+    'Profile.ACCEPT_COOKIES_LABEL': 'Accept convenience cookies',
+    'Profile.PRIVACY_STATEMENT_TITLE': 'Privacy statement',
+    'Profile.COOKIES_STATEMENT_TITLE': 'Cookie statement',
+    'Profile.SAVE_BUTTON': 'Save',
+    'Profile.PRIVACY_SECTION_TITLE': 'Privacy and cookies',
+    'Profile.USERNAME_LABEL': 'Username',
+    'Profile.EMAIL_LABEL': 'Email',
+    'Profile.FIRST_NAME_LABEL': 'First name',
+    'Profile.LAST_NAME_LABEL': 'Last name',
+  };
+  const t = (key, fallback) => KEYS[key] ?? fallback ?? key;
+  return {
+    useTranslation: () => ({
+      t,
+      i18n: { exists: (key) => Object.hasOwn(KEYS, key), t },
+    }),
+  };
+});
+
+vi.mock('../src/auth/authApi', () => ({
+  fetchAuthPolicy: vi.fn(),
+  fetchPrivacyStatement: vi.fn(),
+  fetchCookieStatement: vi.fn(),
+  updateUserProfile: vi.fn(),
+}));
+
+vi.mock('../src/components/SecurityComponent', () => ({ SecurityComponent: () => null }));
+vi.mock('../src/components/UserListComponent', () => ({ UserListComponent: () => null }));
+vi.mock('../src/components/UserInviteComponent', () => ({ UserInviteComponent: () => null }));
+vi.mock('../src/components/AccessCodeManager', () => ({ AccessCodeManager: () => null }));
+vi.mock('../src/components/AllowedEmailDomainsManager', () => ({ AllowedEmailDomainsManager: () => null }));
+vi.mock('../src/components/RegistrationMethodsManager', () => ({ RegistrationMethodsManager: () => null }));
+vi.mock('../src/components/AuthFactorRequirementCard', () => ({ AuthFactorRequirementCard: () => null }));
+vi.mock('../src/components/AccessCodeSingleUseToggle', () => ({ AccessCodeSingleUseToggle: () => null }));
+vi.mock('../src/components/QrSignupManager', () => ({ QrSignupManager: () => null }));
+vi.mock('../src/components/QrSignupValidityManager', () => ({ QrSignupValidityManager: () => null }));
+vi.mock('../src/components/SupportRecoveryRequestsTab', () => ({ SupportRecoveryRequestsTab: () => null }));
+vi.mock('../src/components/BulkInviteCsvTab', () => ({ BulkInviteCsvTab: () => null }));
+
+import { AuthContext } from '../src/auth/AuthContext';
+import {
+  fetchCookieStatement,
+  fetchPrivacyStatement,
+  updateUserProfile,
+} from '../src/auth/authApi';
+import { AccountPage } from '../src/pages/AccountPage';
+
+const theme = createTheme();
+const user = {
+  email: 'person@example.com',
+  username: 'person',
+  first_name: 'Pat',
+  last_name: 'Example',
+  accepted_privacy_statement: false,
+  accepted_convenience_cookies: true,
+  is_superuser: false,
+  ui_permissions: {},
+  available_roles: [],
+};
+
+function setViewportWidth(width) {
+  window.matchMedia = vi.fn().mockImplementation((query) => ({
+    matches: query.includes('max-width') ? width <= 900 : width > 900,
+    media: query,
+    onchange: null,
+    addEventListener: vi.fn(),
+    removeEventListener: vi.fn(),
+    addListener: vi.fn(),
+    removeListener: vi.fn(),
+    dispatchEvent: vi.fn(),
+  }));
+}
+
+function renderAccount({ showProfileStatements } = {}) {
+  const login = vi.fn();
+  return {
+    login,
+    ...render(
+      <ThemeProvider theme={theme}>
+        <AuthContext.Provider value={{ user, login, loading: false }}>
+          <MemoryRouter initialEntries={['/account']}>
+            <Routes>
+              <Route
+                path="/account"
+                element={<AccountPage showProfileStatements={showProfileStatements} />}
+              />
+            </Routes>
+          </MemoryRouter>
+        </AuthContext.Provider>
+      </ThemeProvider>,
+    ),
+  };
+}
+
+describe('AccountPage profile statements', () => {
+  beforeEach(() => {
+    setViewportWidth(1280);
+    vi.mocked(fetchPrivacyStatement).mockResolvedValue('Privacy text');
+    vi.mocked(fetchCookieStatement).mockResolvedValue('Cookie text');
+    vi.mocked(updateUserProfile).mockResolvedValue({ ...user, accepted_privacy_statement: true });
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.clearAllMocks();
+  });
+
+  it('fetches and presents both statement panels when the prop is omitted', async () => {
+    renderAccount();
+
+    expect(await screen.findByText('Privacy statement')).toBeTruthy();
+    expect(screen.getByText('Cookie statement')).toBeTruthy();
+    await waitFor(() => {
+      expect(fetchPrivacyStatement).toHaveBeenCalledOnce();
+      expect(fetchCookieStatement).toHaveBeenCalledOnce();
+    });
+    expect(await screen.findByText('Privacy text')).toBeTruthy();
+    expect(screen.getByText('Cookie text')).toBeTruthy();
+  });
+
+  it('hides statements and skips requests while retaining editable consent submission', async () => {
+    const { login } = renderAccount({ showProfileStatements: false });
+
+    expect(screen.queryByText('Privacy statement')).toBeNull();
+    expect(screen.queryByText('Cookie statement')).toBeNull();
+    expect(fetchPrivacyStatement).not.toHaveBeenCalled();
+    expect(fetchCookieStatement).not.toHaveBeenCalled();
+
+    const privacyConsent = screen.getByRole('checkbox', { name: 'Accept privacy statement' });
+    const cookieConsent = screen.getByRole('checkbox', { name: 'Accept convenience cookies' });
+    expect(privacyConsent.checked).toBe(false);
+    expect(cookieConsent.checked).toBe(true);
+    fireEvent.click(privacyConsent);
+    fireEvent.click(cookieConsent);
+    fireEvent.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => {
+      expect(updateUserProfile).toHaveBeenCalledWith({
+        first_name: 'Pat',
+        last_name: 'Example',
+        accepted_privacy_statement: true,
+        accepted_convenience_cookies: false,
+      });
+    });
+    expect(login).toHaveBeenCalledOnce();
+  });
+});

package/work-orders/UCM-AUTH-12.md

@@ -0,0 +1,98 @@
+# UCM-AUTH-12: Optional profile statement text on the account page
+
+# A. Envelope — operator-approved scope
+
+## Goal and expected outcome
+
+Expose `AccountPage.showProfileStatements` so an app without privacy/cookie statement
+endpoints can suppress the explanatory statement panels and their requests. The default
+is `true`, preserving every existing consumer's behavior. With `false`, the account profile
+still renders and submits both existing consent fields.
+
+The operator explicitly approved this switch, its release and the innoservice pin bump on
+2026-10-13. innoservice CI38387014900 records privacy/cookie 404s; auth policy returns 200.
+
+## Scope and non-goals
+
+- Add the optional prop and pass it to the existing ProfileComponent statement switch.
+- Publish a minor release 3.13.0; innoservice consumes it under INNO-FIX-13.
+- Do not change consent defaults, payloads, validation, permissions, authentication,
+  account navigation, statement fetching implementation, theme tokens or other consumers.
+- Do not fix UCM-SHELL-8 or invent statement endpoints/content.
+- No new visual design or prototype; this config uses the existing ProfileComponent surface.
+
+## Tier, risk and required tests
+
+Tier 3: source inside shared-core on an account surface. Compatibility rests on default true.
+Tests to write: render the real AccountPage and ProfileComponent; omission of the new prop
+fetches both statements and presents the existing panels; false performs neither request and
+hides the panels, while both consent controls remain editable and their values reach the
+existing updateUserProfile submission. Keep the existing account-navigation tests.
+
+# B. Implementation map — ADDRESSED TO THE IMPLEMENTER
+
+## Target and ownership
+
+Target: `C:/Users/Micha Bigler/Documents/webapps/ui-core-micha`.
+Native bootstrap retains workspace-root cwd; use explicit absolute paths and workdirs.
+You are not alone in the workspace. Own only:
+- `src/pages/AccountPage.jsx`
+- new `tests/AccountPage.profileStatements.test.jsx`
+
+## Context package
+
+`src/pages/AccountPage.jsx:39` exports named AccountPage with destructured optional props.
+Its profile branch near line228 renders ProfileComponent with showName/showPrivacy/showCookies.
+Its existing handleProfileSubmit calls updateUserProfile(payload), then AuthContext.login(updated).
+`src/components/ProfileComponent.jsx:23` exports named ProfileComponent; showStatements defaults
+true, independently of showPrivacy/showCookies. Its statement-loading effect at83 returns before
+either fetch when showStatements is false. Panels at255 are also controlled by showStatements.
+Consent controls at230/242 and payload at130/133 depend only on showPrivacy/showCookies.
+Use that established switch; leave this component untouched.
+
+Read only these targets plus `tests/AccountPage.test.jsx` for theme/router/AuthContext setup,
+and `src/auth/authApi.jsx` for the four API export names if necessary. Do not explore broadly.
+The existing navigation test mocks ProfileComponent, so it cannot prove the no-request and
+consent invariant: write a separate test file rendering both real components. Stub network API
+functions and unrelated account children only. Relevant real accessible labels are translation
+keys Profile.ACCEPT_PRIVACY_LABEL, Profile.ACCEPT_COOKIES_LABEL, Profile.PRIVACY_STATEMENT_TITLE,
+Profile.COOKIES_STATEMENT_TITLE and Profile.SAVE_BUTTON.
+Use the suite's established translation seam; never mock AccountPage/ProfileComponent under test.
+
+## Preamble
+
+> This committed WO is the COMPLETE spec. You are the initial implementer, not the reviewer.
+> Preserve other edits. Edit only the two owned source/test paths using explicit UTF-8 I/O.
+> Do not edit dependencies, lockfiles, package/version/changelog/register/README/governance,
+> settings, environment, other repos or memory. Never read .env or dump settings/environment.
+> No installs, package-manager commands, containers, git operations, self-review or subagents.
+> Write the required tests and run your own new file ONCE with the existing Node/Vitest runtime,
+> maxWorkers=2; no affected/full suite, build or app startup. If unavailable, report the obstacle.
+> The orchestrator's tests and separate reviews are the acceptance gate. Leave uncommitted.
+> Start PLAN, emit PROGRESS before relevant actions without silence over two minutes, then
+> exactly one final RESULT: DONE or RESULT: BLOCKED.
+
+# C. Orchestrator only — NOT ADDRESSED TO THE IMPLEMENTER
+
+> IMPLEMENTER STOP HERE. You ARE the initial implementation instance. No steps below belong to you.
+
+Gate #1: operator explicitly approved the exact API/default, retained consents, release and pin
+bump in the innoservice orchestration chat on 2026-10-13. Native plain worker requested
+codex/gpt-6-luna, fresh context, full committed WO inline. Record accepted ID and actual metadata;
+effective provider/model stays unverified when the API does not expose it. No protection-parity claim.
+
+Parent owns version/changelog/README/register and pnpm state. Independent four lenses plus UI
+and security concurrently, full scoped context, CLI read-only without bypass. Parent fixes findings.
+Scoped gate: new real-component tests, existing AccountPage navigation and affected auth tests.
+Publish workflow on main already runs build/full tests; shared-core ripple justifies that existing
+release suite. Do not dispatch publish manually; normal reviewed main push triggers it. Check
+publish job success before app pin. Minor 3.13.0 is additive; read exact release diff before app bump.
+Final core row includes deduplicated review totals and test results; second register commit before
+one main push. innoservice AccountPage/WelcomePage statements false and capture evidence remain
+INNO-FIX-13; keep existing consents, request diagnostics and capture checks intact.
+
+Accepted native implementer: `/root/kit_account_statements`, explicit requested gpt-6-luna,
+high reasoning, fresh context, complete WO inline. Effective native provider/model metadata
+was not exposed and remains unverified. Source/test edits only; the one permitted author test
+attempt failed before collection with temporary-file EPERM (zero tests). Parent runs the
+authoritative scoped gate through the normal runtime approval path. No author review or git.