@micha.bigler/ui-core-micha 3.13.2 → 3.14.4

package/.github/workflows/ci.yml

@@ -0,0 +1,35 @@
+name: CI
+
+on: workflow_dispatch
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+
+      - name: Set up Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: '24.21.0'
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: 12.10.1
+
+      - name: Install dependencies (pnpm)
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm run build
+
+      - name: Run tests
+        run: pnpm run test

package/.github/workflows/publish.yml

@@ -20,14 +20,14 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 2
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
-          node-version: '24.15.0'
+          node-version: '24.21.0'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Decide whether to publish
@@ -99,7 +99,7 @@ jobs:
         if: steps.version_check.outputs.should_publish == 'true'
         uses: pnpm/action-setup@v6
         with:
-          version: 11.1.2
+          version: 12.10.1
 
       - name: Show version from package.json
         if: steps.version_check.outputs.should_publish == 'true'

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 3.14.4 - UCM-DEP-1
+
+Dependency updates. The runtime dependency `@fontsource/dm-sans` moves to ^5.3.0; the peer dependency ranges are
+unchanged. Tooling: TypeScript 7 (`moduleResolution: Bundler` in `tsconfig.build.json`), vitest 5, jsdom 30, pnpm 12
+and updated GitHub Actions in both workflows. No source or API change.
+
+## 3.14.3 - UCM-CHAT-1 publish fix
+
+3.14.0 to 3.14.2 were never published: `themeCompleteness` rejected the chat components' inline `sx` on baseline-styled
+MUI components. The chat surface now follows the kit convention (exported top-level `sx` constants registered in
+`KIT_COMPONENT_SX_REGISTRY`; no `sx` that repeats a theme value such as the button minimum height). No behaviour
+change; this release contains everything from 3.14.0 to 3.14.2.
+
+## 3.14.2 - UCM-CHAT-2
+
+The chat model picker shows readable, translated names for the drivers `claude_cli`, `anthropic_api` and
+`openai_api` as group heading and accessible name (`Chat.driver.<id>`, de/en/fr/sw). An unknown driver id still
+appears as its raw id. No other chat text or behaviour changes.
+
+## 3.14.1 - UCM-CHAT-1 post-landing review
+
+`ChatThread` starts at most one older-turns request at a time, also for rapid scroll events. `ModelPicker` shows no
+trailing separator when a chat has no effort set.
+
+## 3.14.0 - UCM-CHAT-1
+
+New shared AI chat surface. `ChatWorkspace` shows the user's chats (rename, archive, restore, delete), streams
+answers into a thread, renders them as Markdown (no raw HTML, no images, links as text), shows the sources of each
+answer as chips and lets the user pick model and effort per chat. The parts are exported on their own:
+`ChatList`, `ChatThread`, `ChatComposer`, `ModelPicker`, `MarkdownReply`, `useChatSocket`.
+`createChatApi(overrides, { apiBase })` returns the full default REST client; overriding one function keeps the
+others. Strings are in `chatTranslations` (de, en, fr, sw), included in `uiCoreTranslations`. Adds the dependencies
+`react-markdown` and `remark-gfm`. The wire shape (URLs, frame and field names) is isolated in `src/chat/wire.js`
+and follows `django-core-micha/DCM-CHAT-1`.
+
 ## 3.13.2 - UCM-AUTH-13
 
 `ProfileComponent` preserves edited names and consent values when the same person's

package/WORK_ORDERS.md

@@ -14,12 +14,14 @@ rules are defined centrally in `webapps/AGENTS.md` → "Work-Order Register".
 | `CHART-*` | Shared chart / data-viz kit (`ChartFrame` + MUI X-Charts presets + neutral palette/formatters) |
 | `THEME-*` | Shared MUI theme baseline (`createAppTheme` factory, token surfaces, completeness assertion) |
 | `MSG-*` | Shared messaging platform, Phase B (dcm register is canonical; this repo's rows are its ucm-side WOs) |
+| `CHAT-*` | Shared AI chat surface (chat list, streaming thread, sources, model picker). The django-core-micha register is canonical for the core (`DCM-CHAT-*`); this repo's rows are its ucm-side WOs |
 | `DX-*` | Developer experience / repo tooling (ucm-local prefix; unrelated to `django-core-micha`'s own `DX-*`) |
 | `AUTH-*` | Auth components UX (login/password/MFA/profile forms, auth error i18n, and the account screen's own surfaces) |
 | `I18N-*` | The shared kit's i18n **contract** — how a consumer registers ucm's strings, and what happens when it forgets. Distinct from `AUTH-*`, which owns the auth strings themselves |
 | `PRIM-*` | Shared dashboard/data primitives — small presentational components that are neither chart (`CHART-*`) nor app chrome (`SHELL-*`) |
 | `SHELL-*` | Shared app chrome and navigation shells (`UserMenu`, mobile bottom nav, secondary-navigation shell) — used since `SHELL-1`, documented here 2026-08-11 |
 | `TEST-*` | Consumer integration checks the kit ships for apps to run in their own suites |
+| `CI-*` | This repository's own CI workflows (dispatch-only verification runs; `publish.yml` stays the publish path) |
 
 Introduce a new prefix when none fits and add it here. New WOs always get a
 prefixed ID; never reuse a bare flat number across workstreams.
@@ -28,11 +30,15 @@ prefixed ID; never reuse a bare flat number across workstreams.
 
 | ID | Titel | Beschreibung | Datum | Status | Commit(s) | Notiz |
 |---|---|---|---|---|---|---|
-| UCM-AUTH-13 | [Preserve profile edits during refresh](work-orders/UCM-AUTH-13.md) | Keep unsaved names and consent for the same person; reset at account boundaries. Patch release and Spesix consumption approved. | 2026-10-14 | in-review | ab85c60 | Tier 3. Gate #1 approved by the operator in the Spesix orchestration chat on 2026-10-14. Fresh native configured codex/gpt-6-luna/high author `/root/ucm_auth13_author`; workspace-root cwd bootstrap, absolute target paths; effective provider/cwd/sandbox not exposed. Foreign scratchpad excluded. review: codex/gpt-6-luna · lenses: envelope,regression,duplication,tests,ui,security · 2 raised · 0 accepted · worst accepted: none. Parent 11 focused tests and TypeScript build passed. Patch 3.13.2 release and Spesix consumption pending; detailed dispositions in WO C. |
+| UCM-CHAT-2 | [Readable driver names in the chat model picker](work-orders/UCM-CHAT-2.md) | Picker group headings (and any other driver display) show translated names for `claude_cli`, `anthropic_api`, `openai_api` instead of the raw ids; unknown ids fall back to the raw id. Correction to UCM-CHAT-1, found at acceptance against its prototype. | 2026-10-15 | done | f35b6ea | Tier 3 · Codex gpt-6-luna dispatched once, RESULT: DONE; Orchestrator reviewed and added the real-i18n test. review: codex/gpt-6-luna · lenses: envelope, regression, duplication, tests, ui · 3 raised · 2 accepted · worst accepted: defect (accepted: picker tests only saw mocked keys, effort-via-t() unpinned; both fixed with tests/chatDriverNames.test.jsx on the real translations; rejected: 'divider shows raw driver id' raised by two lenses, false: the divider shows model and effort only, no driver). Batch also covered the 3.14.1 delta da068fb and a tests lens given the actual test files (operator request 2026-10-15). Scoped tests 63 pass, tsc clean. Published as 3.14.2 by push to main; cockpit/CP-CHAT-4 pins it. Gate #1 recorded at ui-core-micha@8a9737b. |
+| UCM-CHAT-1 | [Shared AI chat surface: chat list, streaming thread, sources, model and effort picker](work-orders/UCM-CHAT-1.md) | Workspace plus individually exported parts against the DCM-CHAT-1 contract; Markdown via `react-markdown` + `remark-gfm` (allow-listed: no raw HTML, no images); per-chat model and effort picker; source chips; edge states. Prototype [work-orders/assets/UCM-CHAT-1-ai-chat.html](work-orders/assets/UCM-CHAT-1-ai-chat.html). | 2026-10-15 | done | 2dede28 | Tier 3 · Prototyp. Codex gpt-6-luna dispatched once, returned BLOCKED with a skeleton; Orchestrator (Claude) completed it, so author = Claude. review: codex/gpt-6-luna · lenses: envelope, regression, duplication, tests, ui · 18 raised · 13 accepted · worst accepted: defect. Last fix batch (reconnect chip, status-first load, scroll pinning, effort i18n) re-checked by scoped tests only, not re-reviewed. Scoped chat tests 64 pass, tsc build clean; packageTreeShaking fails locally on Windows symlink EPERM, runs in publish.yml (tests before publish). Wire shape (URLs, frame/field names) pinned from maana in src/chat/wire.js because DCM-CHAT-1 is unpublished. Rendered 375/1280 side-by-side runs in cockpit/CP-CHAT-4. Docs row: webapp-management 955c2e8. Published as 3.14.0 by push to main. Gate #1 approved by the operator 2026-10-15 (click in session local_03d1141f-9577-4c9e-8ccf-3343b3b34a19). post-landing re-review of fix batch (operator request 2026-10-15): codex/gpt-6-luna · lenses: envelope, regression, duplication, tests, ui + sec (Markdown path, socket/url) · 4 raised · 2 accepted · worst accepted: defect; accepted: overlapping older-turn loads, trailing separator in picker label (fixed in da068fb, 3.14.1, +4 tests); rejected: wsUrl/apiBase scheme checks (developer-supplied host config, not user input) x2; tests lens could not ground a verdict (no test files in its material); the 3.14.1 delta itself is covered by scoped tests (68 pass) only. Markdown path: no raw HTML, image fetch or active link reachable. 3.14.1 delta da068fb and the tests lens were covered in the UCM-CHAT-2 batch (tests lens given the test files of 2dede28, 3.14.1 and UCM-CHAT-2): 0 defects against the 3.14.1 delta (single-flight guard and picker label are pinned by assertions); 1 raised, 1 accepted (effort-via-t() was not pinned; fixed with tests/chatDriverNames.test.jsx), worst accepted: defect. |
+| UCM-AUTH-13 | [Preserve profile edits during refresh](work-orders/UCM-AUTH-13.md) | Keep unsaved names and consent for the same person; reset at account boundaries. Patch release and Spesix consumption approved. | 2026-10-14 | done | f29d1dd | Tier 3. Gate #1 approved by the operator in the Spesix orchestration chat on 2026-10-14. Fresh native configured codex/gpt-6-luna/high author `/root/ucm_auth13_author`; workspace-root cwd bootstrap, absolute target paths; effective provider/cwd/sandbox not exposed. Foreign scratchpad excluded. review: codex/gpt-6-luna · lenses: envelope,regression,duplication,tests,ui,security · 2 raised · 0 accepted · worst accepted: none. Parent 11 focused tests and TypeScript build passed. Released3.13.2: publish CI38640512864 build/90 test files/publish passed, registry confirmed. Spesix a30de18 installed-package consumer8 tests passed; separate SPX-DEP-5 owns real browser CI38641555651. Detailed dispositions in WO C. |
 | UCM-AUTH-12 | [Optional account profile statement text](work-orders/UCM-AUTH-12.md) | AccountPage showProfileStatements defaults true; false suppresses statement panels/requests while preserving both consent controls and their payload. Minor release 3.13.0, consumed by innoservice INNO-FIX-13. | 2026-10-13 | done | 97b7d83 | Tier 3 (shared-core account surface). Gate #1 explicitly approved in the innoservice Codex chat on 2026-10-13, including release and app pin bump. Separate configured Luna implementation and independent reviews; existing default and consent behavior are invariants.  review: codex/gpt-6-luna · lenses: envelope, regression, duplication, tests, ui, security · 0 raised · 0 accepted · worst accepted: none. Parent scoped tests: AccountPage.profileStatements.test.jsx + AccountPage.test.jsx, 6 passed, correct kit cwd, maxWorkers2. Native author attempt EPERM before collection; parent gate green. Reviewed additive API/default and package release metadata; main push triggers the existing release build/suite/publish. Released 3.13.0: CI38422682968 build, release suite and npm Trusted Publishing all succeeded. App consumption/capture remains tracked under INNO-FIX-13. |
 | UCM-SHELL-8 | SectionNav lists contain direct button children | Grouped and overview entries need genuine list items containing the existing navigation buttons, preserving selection, drawer behavior and presentation. | 2026-10-13 | done | `d399f51` | Tier 3. Gate #1 approved by the operator on 2026-10-13: structural correction, tests/review, patch release and innoservice pin bump. Full scope and context: [work-orders/UCM-SHELL-8.md](work-orders/UCM-SHELL-8.md). Original CI38387014900/source9937adb evidence remains in innoservice/work-orders/assets/INNO-FIX-11-axe-nodes.json; CI38425506007/sourceebc35e1 reproduces the three account list violations on 3.13.0, recorded in INNO-FIX-11-candidate-b-axe-nodes.json. Initial native author /root/kit_sectionnav requested codex/gpt-6-luna; effective native metadata unexposed. Source and two focused test cases delivered; author run EPERM before collection, zero tests. Parent tests and independent review pending. review: codex/gpt-6-luna · lenses: envelope, regression, duplication, tests + UI · 1 raised · 0 accepted · worst accepted: none. Disposition in WO Part C: fabricated class-stub identity demand rejected against the real revert failure and preserved existing behavior checks. Parent 21 scoped tests passed (maxWorkers=2), TypeScript build exit 0. Core source accepted; publication, app pin and fresh consumer capture pending. Closing proof:3.13.1 published CI38435441867 (744tests89files/build/npm success); app exact pin/sourcec527918, CI38444366349 account375/1280 both axe0,console/network0,rubric22yes and parent actual-image inspection; all three list violations gone. No source change since reviewed d399f51. |
 | UCM-THEME-17 | Decide a less compressed baseline type scale | Design round (design-language process): inventory, instrument with 2-3 candidate scales next to today's baseline and MUI on real screens (hram, a survey site, jg-ferien, kerzenziehen), value rounds, frozen sheet. Measured 2026-10-04: page/card/section titles differ by 1-3 px, hierarchy rests on weight alone. Full order [`work-orders/UCM-THEME-17.md`](work-orders/UCM-THEME-17.md) | 2026-10-04 | done | `68dfc6a`, `998e36c`, `cb9dd89`, `c452224` | Tier 2 (document only) · operator decision 2026-10-04: baseline finding, not per-app overrides · implementation order follows the freeze · survey_app SVA-THEME-1 typography revert held until then · **frozen 2026-10-04** after two value rounds: candidate B, mobile h4 23, h1-h3 36/32/28; value source [`docs/TYPE-SCALE.md`](docs/TYPE-SCALE.md) · review: none, document order, the operator freeze is the gate · implementation UCM-THEME-18 |
 | UCM-THEME-18 | Ship the frozen baseline type scale | `tokens.js` typography per `docs/TYPE-SCALE.md`: h1-h3 36/32/28, h4 24 (23 below `sm`), h5 20, subtitle1 13; light fixture typography entries; minor release 3.12.0. Full order [`work-orders/UCM-THEME-18.md`](work-orders/UCM-THEME-18.md) | 2026-10-04 | 5be83d5 | | Tier 3 (shared-core) · reviewer + ui_reviewer · downstream per-app orders (h5 page titles -> h4, per-level weight overrides) written after the release - 2026-10-04: Codex implemented (gpt-6-luna; probe of stale 2026-10-03 record succeeded, available) - orchestrator fixed review findings - review: codex/gpt-6-luna - lenses: envelope,regression,duplication,tests + ui_review - 3 raised - 2 accepted - worst accepted: defect (h4 mobile key now follows an app-overridden sm, test added; completeness test strengthened; rejected: breakpointDownQuery vs theme.breakpoints.down, no theme exists at token time) - light fixture diff limited to typography entries - no rendered side-by-side (no prototype; values asserted from the resolved theme in light and dark) - release 3.12.0 |
+| UCM-DEP-1 | All open Renovate updates in one change on main, one CI run | PRs #17 to #24 (npm non-major, actions, jsdom 30, pnpm 12, TypeScript 7, vitest 5) in one change; release only if runtime dependencies changed. Full order [work-orders/UCM-DEP-1.md](work-orders/UCM-DEP-1.md) | 2026-10-15 | planned | | Tier 3 (shared core, dependencies). Part of the PR close-out round of 2026-10-15 (operator decision 2026-10-15). Envelope by the Infra Expertenchat. Gate #1 approved by the operator 2026-10-15 (click in session local_1e5f212a-77db-4423-a507-983adf826bc4). |
+| UCM-CI-1 | A dispatch-only CI workflow for ui-core-micha | `.github/workflows/ci.yml`: install, build, test on Linux, `workflow_dispatch` only, no publish, no secrets, so a candidate ref can be proven without releasing. Full order [work-orders/UCM-CI-1.md](work-orders/UCM-CI-1.md) | 2026-10-15 | done | 69b8920 | Tier 3 (CI). Requested by the operator in the UCM-CHAT Orchestrator session 2026-10-15 as the verification path for UCM-DEP-1; that instruction is the Gate #1 approval. Codex gpt-6-luna dispatched once, RESULT: DONE; file matches the Envelope. review: codex/gpt-6-luna · lenses: envelope+security (combined, one run; regression, duplication and tests not applicable to a 30-line dispatch-only file) · 0 raised · 0 accepted · worst accepted: none. Evidence: dispatched run 38739752689 on ci-test/UCM-CI-1 green (install, build, full test suite incl. packageTreeShaking on Linux); the ref was deleted. |
 | UCM-I18N-5 | [User-list pagination range text is hard-coded English](work-orders/UCM-I18N-5.md) | `UserListComponent`'s `TablePagination` sets `labelRowsPerPage` but no `labelDisplayedRows`, so German shows "1–4 of 4". | 2026-10-01 | done | 6b9d557 | Found in jg-ferien's rendered check 2026-10-01. Follows `UCM-I18N-4`. Tier 3. Done = released AND jg-ferien pin bumped. Envelope written 2026-10-01; operator: hand to the jg Paket-4 session. Implementation map filled 2026-10-02 (`a732025`): the translation bundle carries FOUR locales (de/fr/en/sw), not three — confirmed by reading `authTranslations.ts` directly; proposed two keys (exact-count + "more than" form) with a best-effort, not native-verified, Swahili wording. Implemented by codex/gpt-5.6-luna exactly per the map: `labelDisplayedRows` resolves `UserList.DISPLAYED_ROWS`/`UserList.DISPLAYED_ROWS_MORE_THAN` through `t()`, both keys added in all four locales. review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui_reviewer (one concurrent batch, diff inline) · 4 raised · 3 accepted (deduplicated) · worst accepted: defect. Accepted: the rendered English test would still pass against a reverted implementation, since the EN wording was deliberately made identical to MUI's own hardcoded default — added a second test swapping in a distinctive marker string for just that key, proving the render genuinely resolves through i18next, not MUI's fallback; `authTranslations.test.js`'s new key-parity check only asserted non-empty strings, not that each locale actually carries the `{{from}}`/`{{to}}`/`{{count}}` placeholders the others do — strengthened with an explicit per-locale placeholder check; self-identified (corroborated by the `tests` lens's own closing remark) that the `count === -1` ("more than") branch can never be reached through a render of `UserListComponent` itself (its own `count` prop is always a real array length) — extracted the inline callback into an exported, directly unit-tested `formatDisplayedRowsLabel(t)` rather than leaving it permanently untested dead code. Rejected: `regression`'s claim that hard-coding `labelDisplayedRows` "overrides any consuming app's MUI theme customisation" — speculative, no actual consumer override exists (same explicit-prop design as `labelRowsPerPage` since `UCM-I18N-4`), and the reviewer's own repo search found zero consumer snapshots/assertions relying on the old English text. `envelope`'s "release + pin bump missing from the diff" was correct but not a code defect — addressed by the remaining steps below, not a fix to the reviewed diff. `duplication`: 0 findings. `ui_reviewer`: 0 blocking findings; confirmed placeholder consistency across all 8 strings; Swahili wording flagged as advisory-only ("structurally plausible to a non-native reviewer, native-speaker verification advisable" — not re-asked of a native speaker here, recorded as open). Tests: 37/37 green (`userScreenTranslations.test.jsx`, `authTranslations.test.js`, `UserListComponent.test.jsx`). Released as `3.11.1` (patch — continues `UCM-I18N-4`'s i18n-gap category, not a new capability area), commit `6b9d557`; npm Trusted Publishing confirmed via the Actions job log (not a registry re-query — provenance publishes can lag), tarball `@micha.bigler/ui-core-micha@3.11.1`. jg-ferien's pin bumped 3.7.0 -> 3.11.1 same day, closed as jg's own `JG-DEPS-3` (`2c1d6e3`) — see that repo's `WORK_ORDERS.md` for the empirical safety checks (status-colour palette diff, `UserListComponent`-unused confirmation, full-suite run) this multi-version jump required. |
 | UCM-TEST-1 | A kit integration check every app runs in its own suite | Exported `checkKitIntegration({ i18n, wrapper, pages })` -> `{ findings }` (shape of `assertThemeComplete`): kit keys present in the app's i18n, one `i18next` instance, kit pages render in the app's providers without raw keys, the `invalid`-email case shows the field text. Replaces per-app hand-written wiring tests and manual auth walks. Full order [`work-orders/UCM-TEST-1.md`](work-orders/UCM-TEST-1.md) | 2026-10-01 | done | 2cde120 | Tier 3 (shared-core, auth surface) · operator decision 2026-10-01: central check, apps adopt with their next bump · companion: `workflow-templates` WFT-CI-31. Codex implemented (available today, no fallback). Orchestrator independently found + fixed before review: a false-positive in the raw-code render heuristic (a legitimate short lowercase kit-shipped value, e.g. German `"oder"` for `Auth.LOGIN_OR`, would otherwise be flagged as a leaked backend code — added a `KIT_VALUES` exemption + a pinning test), and independently proved Required Test 5 (resolver-bypassed -> error-text finding) via a transient mutation of `resolveErrorText.js`, restored clean. Independent `reviewer` (all 4 lenses) + `ui_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui · 9 raised · 6 accepted · worst accepted: blocker**. Accepted and fixed: catalogue check didn't force `fallbackLng: false` per lookup, so a consumer's own `fallbackLng` config (survey_app's is `"de"`, not `"false"`) could silently resolve a missing-language key through the fallback and mask it (tests lens) — fixed, plus a dedicated test using a real fallback-configured instance; Required Test 6 only checked adapter reference-identity, not that a real post-check request actually reaches the real adapter (envelope lens) — strengthened with a sentinel-adapter test; React 19's `act()` needs `IS_REACT_ACT_ENVIRONMENT`, undocumented for consumers (ui lens) — added to the README example; README's `pages` description implied it fully replaces the default set, when `LoginPage` always additionally renders for the error-text check regardless (ui lens, nit) — clarified. Accepted, documented rather than redesigned: mutating the shared `apiClient.defaults.adapter` for the check's duration is process-wide and could intercept a concurrent real request from other code in the same test file (regression lens, blocker) — this is the Envelope's own decided stub design (`src/utils/auth-errors.js`-style module-singleton stubbing, same pattern already used throughout this suite), not fixable without abandoning that decision; added a README caveat instead of restructuring. Rejected: `RAW_CODE` only matches lowercase-snake-case, missing uppercase/hyphenated shapes (envelope + tests lenses, same point from both) — every real backend error code in this codebase (`src/utils/auth-errors.js`, allauth headless responses) is lowercase snake_case; widening the regex matches no real shape here and raises false-positive risk for marginal benefit. `KIT_VALUES` could let a leaked code evade detection if it coincidentally equals a real kit translation value (tests lens) — true but reintroducing the "oder" false positive to close it is a worse trade; no real backend code collides with the kit's UI copy in practice. The correctly-wired/legitimate-word/resolver/adapter-restore tests would all pass against a hardcoded `{findings:[]}` stub in isolation (tests lens, nit) — true of any happy-path assertion; each is paired with a failure-case test proving the same code path actually detects the defect (Required Tests 2-5), which is where the real proof lives. `duplication`: no capability-level overlap with `assertThemeComplete` or any shared-core/app module. **Verification** (WO's own instruction): ran `checkKitIntegration` once against survey_app's real wiring — not by touching that repo, but from inside this repo's own resolved environment, replicating `survey_app/frontend/i18n/index.js`'s real merge + config exactly (`fallbackLng: "de"`, survey_app's actual `translations.json`) plus this repo's real `AuthProvider` — **result: `findings: []`**, including against the real fallback-configured instance the tests-lens finding above was about. Orchestrator's own scoped run: `tests/checkKitIntegration.test.jsx` + `tests/resolveErrorText.test.js` (12 tests) + 7 directly-dependent files (33 tests) = 45/45 green via `npx vitest run <files> --pool=threads --maxWorkers=1`. No rendered gate — library-only change, no running app to preview. **Released as `3.10.0`** (minor — new exported capability, per the WO's own instruction). Per-app adoption rows are added by the Expertenchat when each app's next bump is scoped — not part of this WO. |
 | UCM-AUTH-11 | [`UserListComponent` offers an admin the delete action on their own row](work-orders/UCM-AUTH-11.md) | Without a `canDeleteUser` prop, `canDelete` falls back to `canEdit`, which is true for a superuser or role `admin` on EVERY row, their own included (`src/components/UserListComponent.jsx` `defaultCanEdit`/`canDelete`, ~l.128-156); the backend (dcm) still allows an admin's generic self-delete. Default should never offer deleting one's own row. | 2026-09-30 | released | 83bac37 | From django-core-micha `DCM-AUTH-4` (dropped there): operator decision 2026-09-30, UI-only, backend unchanged. Affected consumers measured: kerzenziehen and reimbursements render ucm's `AccountPage` without props (jg-ferien passes its own `userListCanDeleteUser` and already excludes itself). Both apps pin ucm **2.41.3**, so reaching them needs a major bump (3.0.0 removed chart layout props) — tracked as its own follow-up, not this WO. Gate #1 approved 2026-09-30 (operator handover). Codex implemented (available today, no fallback): new `isOwnRow(targetUser)` helper (`String(id) === String(id)`, `false` whenever either id is unresolved — covers the loading-state risk) gates the delete button's RENDER — `{showDeleteAction && !isOwnRow(row) && (...)}` — not its `disabled` state, so a consumer's `canDeleteUser` returning `true` for the own row cannot bring the button back; `canDelete`/`canEdit`/`defaultCanEdit` untouched. Independent `reviewer` (all 4 lenses) + `ui_reviewer` + `sec_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui,sec · 3 raised · 1 accepted · worst accepted: nit**. Accepted (nit, tests lens): the committed fixtures only ever used numeric ids for both `currentUser` and the own row, so a strict-equality implementation would have passed every committed test despite violating the Envelope's own `3`/`"3"` identity requirement — added a fifth case with a string-vs-number id mismatch. Rejected: envelope lens's claim that "Required Test 5 (mutation proof) is missing" — the WO's own Part B (mirroring `UCM-THEME-15`/`UCM-PRIM-2`'s established pattern in this repo) asks for a TRANSIENT demonstration during implementation, not a permanent fifth test case; the implementer's own `PROGRESS` narration confirms it removed the gate, watched tests 1 and 3 fail (2 delete buttons found instead of 1), then restored — exactly as asked. Envelope lens's claim that "package.json remains 3.9.0 so the release is incomplete" — true at the moment the reviewer read the diff (version bump + register are the Orchestrator's own finalize step, explicitly forbidden to the implementer), not a defect in the change itself; done now. `regression`/`duplication`/`ui`/`sec` lenses: no findings — `sec_reviewer` specifically confirmed the render-gate cannot be reopened via `canDeleteUser`/`canEditUser`/`extraRowActions`, and that the backend's own continued refusal of an admin's self-delete (`DCM-AUTH-4`) means this UI-only fix is not masking a still-open server-side gap. Orchestrator's own scoped run: `tests/UserListComponent.test.jsx` 7/7 green + `tests/userScreenTranslations.test.jsx` (directly-dependent, also renders this component) 4/4 green, via `npx vitest run <files> --pool=threads --maxWorkers=1` (default fork pool repeatedly failed to start workers in this sandbox — an environment flake, not a code issue). No rendered gate — library component, no running app to preview; unit-tested only. **Released as `3.9.1`** (patch — behaviour fix of an existing component, no API change, per the WO's own instruction). `npm view @micha.bigler/ui-core-micha version` will read `3.9.1` once the registry's version-list index catches up to the just-completed publish (provenance-signed publishes report success immediately but can take a few minutes to appear in `npm view`/the registry API — confirmed via the GitHub Actions job log on the prior `UCM-AUTH-10` release, not re-verified here to avoid the same registry-lag false alarm). **Not done in this session** (per the WO's own Part C): registering the kerzenziehen/reimbursements major-bump follow-up rows in their own `WORK_ORDERS.md` registers — flagged for whoever next works in those repos. |

package/dist/auth/UserMenu.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useContext, useState } from 'react';
 import { Avatar, Box, Divider, IconButton, Menu, MenuItem, Typography, } from '@mui/material';
 import { useTheme } from '@mui/material/styles';

package/dist/auth/apiClient.js

@@ -149,20 +149,21 @@ function extractAuthSignal(data) {
     return { code: null, i18nKey: null };
 }
 apiClient.interceptors.response.use((response) => response, async (error) => {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
-    const status = (_b = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _b !== void 0 ? _b : null;
-    const data = (_d = (_c = error === null || error === void 0 ? void 0 : error.response) === null || _c === void 0 ? void 0 : _c.data) !== null && _d !== void 0 ? _d : {};
+    var _a, _b, _c, _d, _e;
+    var _f, _g, _h, _j;
+    const status = (_f = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _f !== void 0 ? _f : null;
+    const data = (_g = (_b = error === null || error === void 0 ? void 0 : error.response) === null || _b === void 0 ? void 0 : _b.data) !== null && _g !== void 0 ? _g : {};
     const { code, i18nKey } = extractAuthSignal(data);
     const isAuthStatus = status === 401 || status === 403;
     const isNotAuthenticated = code === "not_authenticated" || i18nKey === "auth.not_authenticated";
     // Reauthentication gate: allauth returns 401 + flows[{id:"reauthenticate"}]
     // when the session is stale before a sensitive operation (e.g. adding a passkey).
     // Show the password-confirm modal, wait for it to complete, then retry once.
-    const flows = (_g = (_f = (_e = data === null || data === void 0 ? void 0 : data.data) === null || _e === void 0 ? void 0 : _e.flows) !== null && _f !== void 0 ? _f : data === null || data === void 0 ? void 0 : data.flows) !== null && _g !== void 0 ? _g : [];
+    const flows = (_j = (_h = (_c = data === null || data === void 0 ? void 0 : data.data) === null || _c === void 0 ? void 0 : _c.flows) !== null && _h !== void 0 ? _h : data === null || data === void 0 ? void 0 : data.flows) !== null && _j !== void 0 ? _j : [];
     const needsReauth = status === 401 &&
         Array.isArray(flows) &&
         flows.some((f) => f.id === "reauthenticate");
-    if (needsReauth && !((_h = error.config) === null || _h === void 0 ? void 0 : _h._reauthRetried)) {
+    if (needsReauth && !((_d = error.config) === null || _d === void 0 ? void 0 : _d._reauthRetried)) {
         try {
             await requestReauth();
             return apiClient(Object.assign(Object.assign({}, error.config), { _reauthRetried: true }));
@@ -175,7 +176,7 @@ apiClient.interceptors.response.use((response) => response, async (error) => {
     // expect to handle 401 silently and must not trigger a redirect-on-mount.
     // Carried as an axios config property, so it never travels to the backend
     // (would otherwise trigger a CORS preflight on cross-origin requests).
-    const skipRedirect = ((_j = error === null || error === void 0 ? void 0 : error.config) === null || _j === void 0 ? void 0 : _j.skipAuthRedirect) === true;
+    const skipRedirect = ((_e = error === null || error === void 0 ? void 0 : error.config) === null || _e === void 0 ? void 0 : _e.skipAuthRedirect) === true;
     if (isAuthStatus && isNotAuthenticated && !skipRedirect) {
         redirectToLoginOnce();
     }

package/dist/chat/ChatComposer.js

@@ -0,0 +1,23 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import React from 'react';
+import { Button, Stack, TextField } from '@mui/material';
+import { useTranslation } from 'react-i18next';
+/**
+ * Message input. Send is disabled while a turn runs, for an archived chat and while the connection is down;
+ * Stop replaces it during a turn. Enter sends, Shift+Enter inserts a line break.
+ */
+export function ChatComposer({ value = '', onChange, onSend, onStop, running = false, archived = false, connected = true, sx }) {
+    const { t } = useTranslation();
+    const blocked = archived || !connected;
+    const canSend = !running && !blocked && value.trim().length > 0;
+    const submit = () => { if (canSend)
+        onSend === null || onSend === void 0 ? void 0 : onSend(); };
+    return (_jsxs(Stack, { direction: "row", alignItems: "flex-end", gap: 1, sx: Object.assign({ p: { xs: 1, md: 2 }, borderTop: 1, borderColor: 'divider' }, sx), children: [_jsx(TextField, { multiline: true, maxRows: 6, fullWidth: true, size: "small", value: value, disabled: blocked, placeholder: t('Chat.message'), slotProps: { htmlInput: { 'aria-label': t('Chat.message') } }, onChange: (event) => onChange === null || onChange === void 0 ? void 0 : onChange(event.target.value), onKeyDown: (event) => {
+                    var _a;
+                    if (event.key === 'Enter' && !event.shiftKey && !((_a = event.nativeEvent) === null || _a === void 0 ? void 0 : _a.isComposing)) {
+                        event.preventDefault();
+                        submit();
+                    }
+                } }), running ? _jsx(Button, { variant: "outlined", onClick: onStop, children: t('Chat.stop') }) : null, _jsx(Button, { variant: "contained", onClick: submit, disabled: !canSend, children: t('Chat.send') })] }));
+}
+export default ChatComposer;

package/dist/chat/ChatList.js

@@ -0,0 +1,30 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import React, { useState } from 'react';
+import { Badge, Box, Button, Collapse, Dialog, DialogActions, DialogContent, DialogContentText, DialogTitle, IconButton, List, ListItem, ListItemButton, ListItemText, Menu, MenuItem, Stack, TextField } from '@mui/material';
+import { MoreVert } from '@mui/icons-material';
+import { useTranslation } from 'react-i18next';
+export const CHAT_LIST_ROW_ACTION_SX = { width: 40, height: 40 };
+export const CHAT_LIST_ARCHIVED_ACTION_SX = { justifyContent: 'space-between', px: 2 };
+/**
+ * The chat list: active chats, then an "Archived" entry that expands the archived ones (read-only, restorable).
+ * Rename, Archive/Restore and Delete sit in each row's overflow menu; Delete asks for confirmation first.
+ */
+export function ChatList({ chats = [], archivedChats = [], activeId, hasMore = false, onSelect, onNew, onRename, onArchive, onRestore, onDelete, onLoadMore, sx }) {
+    const { t } = useTranslation();
+    const [menu, setMenu] = useState(null); // { anchor, chat, archived }
+    const [dialog, setDialog] = useState(null); // { kind: 'rename' | 'delete', chat }
+    const [title, setTitle] = useState('');
+    const [showArchived, setShowArchived] = useState(false);
+    const openMenu = (event, chat, archived) => { event.stopPropagation(); setMenu({ anchor: event.currentTarget, chat, archived }); };
+    const closeMenu = () => setMenu(null);
+    const startRename = () => { setTitle(menu.chat.title || ''); setDialog({ kind: 'rename', chat: menu.chat }); closeMenu(); };
+    const startDelete = () => { setDialog({ kind: 'delete', chat: menu.chat }); closeMenu(); };
+    const toggleArchive = () => { var _a; (_a = (menu.archived ? onRestore : onArchive)) === null || _a === void 0 ? void 0 : _a(menu.chat); closeMenu(); };
+    const closeDialog = () => setDialog(null);
+    const confirmRename = () => { onRename === null || onRename === void 0 ? void 0 : onRename(dialog.chat, title.trim()); closeDialog(); };
+    const confirmDelete = () => { onDelete === null || onDelete === void 0 ? void 0 : onDelete(dialog.chat); closeDialog(); };
+    const row = (chat, archived) => (_jsx(ListItem, { disablePadding: true, secondaryAction: _jsx(IconButton, { edge: "end", "aria-label": t('Chat.actions'), onClick: (event) => openMenu(event, chat, archived), sx: CHAT_LIST_ROW_ACTION_SX, children: _jsx(MoreVert, { fontSize: "small" }) }), children: _jsx(ListItemButton, { selected: chat.id === activeId, onClick: () => onSelect === null || onSelect === void 0 ? void 0 : onSelect(chat), sx: { minHeight: 48, pr: 6 }, children: _jsx(ListItemText, { primary: chat.title || t('Chat.untitled'), slotProps: { primary: { noWrap: true } } }) }) }, chat.id));
+    return (_jsxs(Stack, { sx: Object.assign({ minWidth: 0, height: '100%', overflowY: 'auto' }, sx), component: "nav", "aria-label": t('Chat.chats'), children: [_jsx(Box, { sx: { p: 1.5 }, children: _jsx(Button, { fullWidth: true, variant: "contained", onClick: onNew, children: t('Chat.newChat') }) }), _jsx(List, { disablePadding: true, children: chats.map((chat) => row(chat, false)) }), hasMore ? _jsx(Button, { onClick: onLoadMore, children: t('Chat.loadMore') }) : null, archivedChats.length > 0 ? (_jsxs(_Fragment, { children: [_jsxs(Button, { color: "inherit", onClick: () => setShowArchived((value) => !value), "aria-expanded": showArchived, sx: CHAT_LIST_ARCHIVED_ACTION_SX, children: [t('Chat.archived'), _jsx(Badge, { color: "default", badgeContent: archivedChats.length, sx: { mr: 1.5 } })] }), _jsx(Collapse, { in: showArchived, unmountOnExit: true, children: _jsx(List, { disablePadding: true, children: archivedChats.map((chat) => row(chat, true)) }) })] })) : null, _jsxs(Menu, { anchorEl: menu === null || menu === void 0 ? void 0 : menu.anchor, open: Boolean(menu), onClose: closeMenu, children: [_jsx(MenuItem, { onClick: startRename, children: t('Chat.rename') }), _jsx(MenuItem, { onClick: toggleArchive, children: (menu === null || menu === void 0 ? void 0 : menu.archived) ? t('Chat.restore') : t('Chat.archive') }), _jsx(MenuItem, { onClick: startDelete, children: t('Chat.delete') })] }), _jsxs(Dialog, { open: (dialog === null || dialog === void 0 ? void 0 : dialog.kind) === 'rename', onClose: closeDialog, fullWidth: true, maxWidth: "xs", children: [_jsx(DialogTitle, { children: t('Chat.rename') }), _jsx(DialogContent, { children: _jsx(TextField, { autoFocus: true, fullWidth: true, margin: "dense", value: title, onChange: (event) => setTitle(event.target.value), slotProps: { htmlInput: { 'aria-label': t('Chat.renameLabel'), maxLength: 120 } }, onKeyDown: (event) => { if (event.key === 'Enter' && title.trim())
+                                confirmRename(); } }) }), _jsxs(DialogActions, { children: [_jsx(Button, { onClick: closeDialog, children: t('Chat.cancel') }), _jsx(Button, { variant: "contained", disabled: !title.trim(), onClick: confirmRename, children: t('Chat.save') })] })] }), _jsxs(Dialog, { open: (dialog === null || dialog === void 0 ? void 0 : dialog.kind) === 'delete', onClose: closeDialog, fullWidth: true, maxWidth: "xs", children: [_jsx(DialogTitle, { children: t('Chat.delete') }), _jsx(DialogContent, { children: _jsx(DialogContentText, { children: t('Chat.deleteConfirm') }) }), _jsxs(DialogActions, { children: [_jsx(Button, { onClick: closeDialog, children: t('Chat.cancel') }), _jsx(Button, { color: "error", variant: "contained", onClick: confirmDelete, children: t('Chat.delete') })] })] })] }));
+}
+export default ChatList;

package/dist/chat/ChatThread.js

@@ -0,0 +1,70 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import React, { useEffect, useLayoutEffect, useRef } from 'react';
+import { Alert, Box, Button, Chip, Stack, Tooltip, Typography } from '@mui/material';
+import { useTranslation } from 'react-i18next';
+import MarkdownReply from './MarkdownReply';
+export const CHAT_THREAD_TOOL_CHIP_SX = { alignSelf: 'flex-start' };
+export const CHAT_THREAD_NOTICE_SX = { mb: 2 };
+const selectionLine = (turn, t) => [turn.model, turn.effort && t(`Chat.effort.${turn.effort}`)].filter(Boolean).join(' · ');
+const sameSelection = (a, b) => a.driver === b.driver && a.model === b.model && a.effort === b.effort;
+function SourceChips({ sources }) {
+    const { t } = useTranslation();
+    if (!(sources === null || sources === void 0 ? void 0 : sources.length))
+        return null;
+    return (_jsx(Stack, { direction: "row", flexWrap: "wrap", gap: 0.75, role: "list", "aria-label": t('Chat.sources'), children: sources.map((source, index) => (_jsx(Tooltip, { title: source.reference || '', describeChild: true, children: _jsx(Chip, { role: "listitem", size: "small", variant: "outlined", label: source.label }) }, `${source.label}-${index}`))) }));
+}
+function Answer({ turn, tool, onRetry }) {
+    const { t } = useTranslation();
+    const generating = turn.state === 'generating';
+    const failed = ['failed', 'cancelled'].includes(turn.state) && turn.error_code;
+    return (_jsxs(Stack, { spacing: 1, "aria-busy": generating, children: [turn.assistant_text ? _jsx(MarkdownReply, { text: turn.assistant_text }) : null, generating && !turn.assistant_text && !tool ? _jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Chat.typing') }) : null, generating && tool ? _jsx(Chip, { size: "small", color: "primary", variant: "outlined", label: tool.label, sx: CHAT_THREAD_TOOL_CHIP_SX }) : null, _jsx(SourceChips, { sources: turn.sources }), !generating && selectionLine(turn, t) ? _jsx(Typography, { variant: "caption", color: "text.secondary", children: selectionLine(turn, t) }) : null, turn.state === 'interrupted' ? (_jsxs(Stack, { direction: "row", alignItems: "center", gap: 1, children: [_jsx(Chip, { size: "small", color: "warning", label: t('Chat.interrupted') }), onRetry ? _jsx(Button, { size: "small", onClick: () => onRetry(turn), children: t('Chat.retry') }) : null] })) : null, failed ? (_jsx(Alert, { severity: "error", action: onRetry ? _jsx(Button, { color: "inherit", size: "small", onClick: () => onRetry(turn), children: t('Chat.retry') }) : null, children: t('Chat.answerIncomplete') })) : null] }));
+}
+/**
+ * The turns of one chat. The streaming answer is simply the last turn in state `generating`; the caller keeps its text
+ * up to date. `notice` is a connection or limit message shown under the last turn. `readOnly` (an archived chat) hides Retry.
+ */
+export function ChatThread({ turns = [], tool = null, notice = null, hasOlder = false, olderBusy = false, onLoadOlder, onRetry, readOnly = false, sx }) {
+    var _a;
+    const { t } = useTranslation();
+    const end = useRef(null);
+    const scroller = useRef(null);
+    const heightBeforeOlder = useRef(null);
+    const pinned = useRef(true); // follow the stream only while the reader is at the bottom
+    const last = turns[turns.length - 1];
+    // Follow the stream, but only when new content arrives at the end (not when older turns are prepended).
+    useEffect(() => { var _a, _b; if (pinned.current)
+        (_b = (_a = end.current) === null || _a === void 0 ? void 0 : _a.scrollIntoView) === null || _b === void 0 ? void 0 : _b.call(_a, { block: 'end' }); }, [last === null || last === void 0 ? void 0 : last.id, last === null || last === void 0 ? void 0 : last.assistant_text, last === null || last === void 0 ? void 0 : last.state]);
+    // Keep the reader's position when older turns are prepended.
+    useLayoutEffect(() => {
+        const el = scroller.current;
+        if (el && heightBeforeOlder.current !== null)
+            el.scrollTop += el.scrollHeight - heightBeforeOlder.current;
+        heightBeforeOlder.current = null;
+    }, [(_a = turns[0]) === null || _a === void 0 ? void 0 : _a.id]);
+    const loadingOlder = useRef(false); // one request at a time, also across rapid scroll events
+    const loadOlder = async () => {
+        var _a;
+        var _b;
+        if (loadingOlder.current)
+            return;
+        loadingOlder.current = true;
+        heightBeforeOlder.current = (_b = (_a = scroller.current) === null || _a === void 0 ? void 0 : _a.scrollHeight) !== null && _b !== void 0 ? _b : null;
+        try {
+            await (onLoadOlder === null || onLoadOlder === void 0 ? void 0 : onLoadOlder());
+        }
+        finally {
+            loadingOlder.current = false;
+        }
+    };
+    return (_jsxs(Box, { ref: scroller, onScroll: (event) => {
+            const el = event.currentTarget;
+            pinned.current = el.scrollHeight - el.scrollTop - el.clientHeight < 80;
+            if (hasOlder && !olderBusy && el.scrollTop <= 40)
+                loadOlder();
+        }, role: "log", "aria-live": "polite", "aria-label": t('Chat.thread'), sx: Object.assign({ minHeight: 0, flex: 1, overflowY: 'auto', p: { xs: 1.5, md: 2.5 } }, sx), children: [hasOlder ? (_jsx(Box, { sx: { textAlign: 'center', mb: 2 }, children: _jsx(Button, { size: "small", onClick: loadOlder, disabled: olderBusy, children: t('Chat.loadOlder') }) })) : null, turns.length === 0 ? (_jsx(Typography, { variant: "h6", color: "text.secondary", align: "center", sx: { mt: 6 }, children: t('Chat.emptyTitle') })) : null, turns.map((turn, index) => {
+                var _a;
+                const previous = turns[index - 1];
+                return (_jsxs(Box, { sx: { mb: 3 }, children: [previous && !sameSelection(previous, turn) ? (_jsxs(Stack, { direction: "row", alignItems: "center", gap: 1, sx: { mb: 2, color: 'text.secondary' }, role: "separator", children: [_jsx(Box, { sx: { flex: 1, borderTop: 1, borderColor: 'divider' } }), _jsx(Typography, { variant: "caption", children: t('Chat.modelChanged', { model: selectionLine(turn, t) }) }), _jsx(Box, { sx: { flex: 1, borderTop: 1, borderColor: 'divider' } })] })) : null, _jsx(Box, { sx: { display: 'flex', justifyContent: 'flex-end', mb: 1.5 }, children: _jsx(Typography, { sx: { maxWidth: '85%', whiteSpace: 'pre-wrap', overflowWrap: 'anywhere', bgcolor: 'action.hover', borderRadius: 2, px: 1.5, py: 1 }, children: turn.user_text }) }), _jsx(Answer, { turn: turn, tool: index === turns.length - 1 ? tool : null, onRetry: readOnly ? undefined : onRetry })] }, (_a = turn.id) !== null && _a !== void 0 ? _a : index));
+            }), notice ? (_jsx(Alert, { severity: notice.severity || 'warning', sx: CHAT_THREAD_NOTICE_SX, action: notice.action ? _jsx(Button, { color: "inherit", size: "small", onClick: notice.action.onClick, children: notice.action.label }) : null, children: notice.text })) : null, _jsx("div", { ref: end })] }));
+}
+export default ChatThread;

package/dist/chat/ChatWorkspace.js

@@ -0,0 +1,218 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import React, { useCallback, useEffect, useMemo, useState } from 'react';
+import { Alert, Box, Button, Chip, Drawer, Stack, Typography, useMediaQuery, useTheme } from '@mui/material';
+import { useTranslation } from 'react-i18next';
+import { createChatApi } from './api';
+import { useChatSocket } from './useChatSocket';
+import ChatList from './ChatList';
+import ChatThread from './ChatThread';
+import ChatComposer from './ChatComposer';
+import ModelPicker from './ModelPicker';
+const PENDING_ID = 'pending';
+const bySeq = (a, b) => { var _a, _b; return ((_a = a.seq) !== null && _a !== void 0 ? _a : Number.MAX_SAFE_INTEGER) - ((_b = b.seq) !== null && _b !== void 0 ? _b : Number.MAX_SAFE_INTEGER); };
+const chronological = (turns) => [...(turns || [])].sort(bySeq);
+const isGenerating = (turn) => turn.state === 'generating';
+/** Replaces the turn that was generating (or has the same id) with the final one; appends it when neither exists. */
+const settleTurn = (turns, final) => {
+    const index = turns.findIndex((turn) => turn.id === final.id || isGenerating(turn));
+    if (index < 0)
+        return chronological([...turns, final]);
+    return [...turns.slice(0, index), final, ...turns.slice(index + 1)];
+};
+const failGenerating = (turns, code) => turns.map((turn) => (isGenerating(turn)
+    ? Object.assign(Object.assign({}, turn), { state: 'failed', error_code: code === 'quota_exceeded' ? null : code }) : turn));
+const appendDelta = (turns, text) => {
+    const index = turns.findLastIndex(isGenerating);
+    if (index < 0)
+        return turns;
+    return turns.map((turn, i) => (i === index ? Object.assign(Object.assign({}, turn), { assistant_text: `${turn.assistant_text || ''}${text}` }) : turn));
+};
+/**
+ * The complete chat surface: chat list, thread, composer and model picker for one user.
+ *
+ * Props: `apiBase` and `wsUrl` (where the app mounted the chat routes), `api` (partial overrides of the REST
+ * calls; every function not given keeps its default), `scope` (passed when creating a chat), `sx`.
+ */
+export function ChatWorkspace({ apiBase, wsUrl, api: apiOverrides, scope, sx }) {
+    const { t } = useTranslation();
+    const theme = useTheme();
+    const narrow = useMediaQuery(theme.breakpoints.down('md'));
+    const api = useMemo(() => createChatApi(apiOverrides, { apiBase }), [apiOverrides, apiBase]);
+    const [status, setStatus] = useState('loading'); // loading | available | not_configured | error
+    const [catalogue, setCatalogue] = useState({ entries: [], default: null });
+    const [chats, setChats] = useState([]);
+    const [archived, setArchived] = useState([]);
+    const [nextChats, setNextChats] = useState(null);
+    const [chat, setChat] = useState(null);
+    const [turns, setTurns] = useState([]);
+    const [olderCursor, setOlderCursor] = useState(null);
+    const [olderBusy, setOlderBusy] = useState(false);
+    const [tool, setTool] = useState(null);
+    const [draft, setDraft] = useState('');
+    const [problem, setProblem] = useState(null); // an error code or close reason, shown as a notice
+    const [listOpen, setListOpen] = useState(false);
+    const [pickerOpen, setPickerOpen] = useState(false);
+    const [openedOnce, setOpenedOnce] = useState(false); // distinguishes a reconnect from the first connect
+    const running = turns.some(isGenerating);
+    const isArchived = Boolean(chat === null || chat === void 0 ? void 0 : chat.archived_at);
+    const selection = (chat === null || chat === void 0 ? void 0 : chat.selection) || catalogue.default;
+    const activeEntry = catalogue.entries.find((entry) => entry.id === (selection === null || selection === void 0 ? void 0 : selection.entry));
+    const loadLists = useCallback(async () => {
+        const [active, old] = await Promise.all([api.listChats(), api.listChats({ archived: true })]);
+        setChats(active.results || []);
+        setNextChats(active.next || null);
+        setArchived(old.results || []);
+    }, [api]);
+    useEffect(() => {
+        let live = true;
+        api.getStatus()
+            .then(async (state) => {
+            if (state.status !== 'available') {
+                if (live)
+                    setStatus(state.status);
+                return;
+            }
+            const [entries] = await Promise.all([api.getCatalogue(), loadLists()]);
+            if (live) {
+                setStatus(state.status);
+                setCatalogue(entries);
+            }
+        })
+            .catch(() => { if (live)
+            setStatus('error'); });
+        return () => { live = false; };
+    }, [api, loadLists]);
+    useEffect(() => {
+        setTurns([]);
+        setOlderCursor(null);
+        setTool(null);
+        setProblem(null);
+        setDraft('');
+        setOpenedOnce(false);
+        if (!(chat === null || chat === void 0 ? void 0 : chat.id))
+            return undefined;
+        let live = true;
+        api.listTurns(chat.id)
+            .then((page) => { if (live) {
+            setTurns(chronological(page.results));
+            setOlderCursor(page.next || null);
+        } })
+            .catch(() => { if (live)
+            setProblem('load_error'); });
+        return () => { live = false; };
+    }, [api, chat === null || chat === void 0 ? void 0 : chat.id]);
+    const onFrame = useCallback((frame, chatId) => {
+        if (chatId !== (chat === null || chat === void 0 ? void 0 : chat.id))
+            return;
+        if (frame.type === 'history')
+            setTurns(chronological(frame.turns));
+        else if (frame.type === 'delta')
+            setTurns((current) => appendDelta(current, frame.text || ''));
+        else if (frame.type === 'tool')
+            setTool(frame.phase === 'start' ? { label: frame.label, name: frame.name } : null);
+        else if (frame.type === 'turn' && frame.turn) {
+            setTool(null);
+            setTurns((current) => settleTurn(current, frame.turn));
+            if (frame.turn.error_code === 'quota_exceeded')
+                setProblem('quota_exceeded');
+        }
+        else if (frame.type === 'error') {
+            setTool(null);
+            setTurns((current) => failGenerating(current, frame.code));
+            setProblem(frame.code);
+        }
+    }, [chat === null || chat === void 0 ? void 0 : chat.id]);
+    const onOpen = useCallback(() => { setOpenedOnce(true); setProblem((current) => (current === 'connection_lost' ? null : current)); }, []);
+    const onClose = useCallback(({ reason, retrying }) => { if (!retrying)
+        setProblem(reason); }, []);
+    const socket = useChatSocket(chat === null || chat === void 0 ? void 0 : chat.id, { wsUrl, onFrame, onOpen, onClose });
+    const guarded = (action) => async (...args) => {
+        try {
+            return await action(...args);
+        }
+        catch (_a) {
+            setProblem('action_error');
+            return null;
+        }
+    };
+    const selectChat = (next) => { setChat(next); setListOpen(false); };
+    const createChat = guarded(async () => {
+        const created = await api.createChat(scope ? { scope } : {});
+        setChats((current) => [created, ...current]);
+        selectChat(created);
+    });
+    const updateChat = guarded(async (target, patch) => {
+        const updated = await api.updateChat(target.id, patch);
+        if ((chat === null || chat === void 0 ? void 0 : chat.id) === target.id)
+            setChat(updated);
+        await loadLists();
+    });
+    const deleteChat = guarded(async (target) => {
+        await api.deleteChat(target.id);
+        setChats((current) => current.filter((item) => item.id !== target.id));
+        setArchived((current) => current.filter((item) => item.id !== target.id));
+        if ((chat === null || chat === void 0 ? void 0 : chat.id) === target.id)
+            setChat(null);
+    });
+    const loadMoreChats = guarded(async () => {
+        const page = await api.listChats({ cursor: nextChats });
+        setChats((current) => [...current, ...(page.results || [])]);
+        setNextChats(page.next || null);
+    });
+    const loadOlder = guarded(async () => {
+        setOlderBusy(true);
+        try {
+            const page = await api.listTurns(chat.id, { cursor: olderCursor });
+            setTurns((current) => chronological([...(page.results || []), ...current]));
+            setOlderCursor(page.next || null);
+        }
+        finally {
+            setOlderBusy(false);
+        }
+    });
+    const startTurn = (message) => {
+        if (!socket.send({ type: 'send', message }))
+            return false;
+        setProblem(null);
+        setTurns((current) => [...current, {
+                id: PENDING_ID, user_text: message, assistant_text: '', state: 'generating', sources: [],
+                driver: activeEntry === null || activeEntry === void 0 ? void 0 : activeEntry.driver, model: (activeEntry === null || activeEntry === void 0 ? void 0 : activeEntry.label) || (activeEntry === null || activeEntry === void 0 ? void 0 : activeEntry.model), effort: selection === null || selection === void 0 ? void 0 : selection.effort,
+            }]);
+        return true;
+    };
+    const send = () => { if (startTurn(draft))
+        setDraft(''); };
+    const retry = (turn) => {
+        if (!socket.connected)
+            return;
+        setTurns((current) => current.filter((item) => item.id !== turn.id));
+        startTurn(turn.user_text);
+    };
+    const noticeFor = () => {
+        const texts = {
+            session_ended: 'Chat.sessionEnded', access_lost: 'Chat.accessLost', rate_limited: 'Chat.rateLimited',
+            load_error: 'Chat.loadError', action_error: 'Chat.actionError',
+        };
+        if (problem === 'quota_exceeded') {
+            return { text: t('Chat.usageLimit', { model: (activeEntry === null || activeEntry === void 0 ? void 0 : activeEntry.label) || (activeEntry === null || activeEntry === void 0 ? void 0 : activeEntry.model) || '' }), action: { label: t('Chat.changeModel'), onClick: () => setPickerOpen(true) } };
+        }
+        if (problem === 'connection_lost')
+            return { text: t('Chat.connectionLost'), action: { label: t('Chat.reconnect'), onClick: socket.reconnect } };
+        if (problem === 'not_configured')
+            return null;
+        if (texts[problem])
+            return { text: t(texts[problem]), severity: 'warning' };
+        return null;
+    };
+    const list = (_jsx(ChatList, { chats: chats, archivedChats: archived, activeId: chat === null || chat === void 0 ? void 0 : chat.id, hasMore: Boolean(nextChats), onSelect: selectChat, onNew: createChat, onRename: (target, title) => updateChat(target, { title }), onArchive: (target) => updateChat(target, { archived: true }), onRestore: (target) => updateChat(target, { archived: false }), onDelete: deleteChat, onLoadMore: loadMoreChats }));
+    const unavailable = status === 'not_configured' || problem === 'not_configured';
+    if (status === 'loading')
+        return _jsx(Box, { sx: sx, "aria-busy": "true" });
+    if (status === 'error')
+        return _jsx(Box, { sx: sx, children: _jsx(Alert, { severity: "error", children: t('Chat.loadError') }) });
+    if (unavailable) {
+        return (_jsxs(Stack, { alignItems: "center", justifyContent: "center", spacing: 1, sx: Object.assign({ minHeight: 320, p: 3, textAlign: 'center' }, sx), children: [_jsx(Typography, { variant: "h6", children: t('Chat.unavailable') }), _jsx(Typography, { color: "text.secondary", children: t('Chat.noModel') })] }));
+    }
+    return (_jsxs(Box, { sx: Object.assign({ display: 'grid', gridTemplateColumns: narrow ? 'minmax(0, 1fr)' : 'minmax(240px, 320px) minmax(0, 1fr)', height: '100%', minHeight: 480, border: 1, borderColor: 'divider', borderRadius: 1, overflow: 'hidden', bgcolor: 'background.paper' }, sx), children: [narrow ? null : _jsx(Box, { sx: { borderRight: 1, borderColor: 'divider', minHeight: 0 }, children: list }), _jsxs(Stack, { sx: { minWidth: 0, minHeight: 0 }, children: [_jsxs(Stack, { direction: "row", alignItems: "center", gap: 1, sx: { px: 1.5, py: 0.5, borderBottom: 1, borderColor: 'divider', minHeight: 56 }, children: [narrow ? _jsx(Button, { color: "inherit", onClick: () => setListOpen(true), children: t('Chat.chats') }) : null, _jsx(Typography, { noWrap: true, sx: { flex: 1, fontWeight: 600 }, children: chat ? (chat.title || t('Chat.untitled')) : '' }), socket.status === 'connecting' && openedOnce ? _jsx(Chip, { size: "small", color: "warning", variant: "outlined", label: t('Chat.reconnecting') }) : null, isArchived ? _jsx(Chip, { size: "small", label: t('Chat.archived') }) : null, isArchived ? _jsx(Button, { size: "small", onClick: () => updateChat(chat, { archived: false }), children: t('Chat.restore') }) : null, chat ? (_jsx(ModelPicker, { entries: catalogue.entries, selection: selection, disabled: isArchived || running, open: pickerOpen, onOpenChange: setPickerOpen, onChange: (next) => updateChat(chat, { selection: next }) })) : null] }), chat ? (_jsxs(_Fragment, { children: [_jsx(ChatThread, { turns: turns, tool: tool, notice: noticeFor(), hasOlder: Boolean(olderCursor), olderBusy: olderBusy, onLoadOlder: loadOlder, onRetry: retry, readOnly: isArchived }), isArchived ? _jsx(Typography, { variant: "caption", color: "text.secondary", sx: { px: 2, pb: 1 }, children: t('Chat.archivedReadOnly') }) : null, _jsx(ChatComposer, { value: draft, onChange: setDraft, onSend: send, onStop: () => socket.send({ type: 'stop' }), running: running, archived: isArchived, connected: socket.connected })] })) : (_jsxs(Stack, { alignItems: "center", justifyContent: "center", spacing: 2, sx: { flex: 1, p: 3 }, children: [_jsx(Typography, { color: "text.secondary", align: "center", children: t('Chat.selectChat') }), _jsx(Button, { variant: "contained", onClick: createChat, children: t('Chat.newChat') })] }))] }), narrow ? _jsx(Drawer, { open: listOpen, onClose: () => setListOpen(false), slotProps: { paper: { sx: { width: 'min(320px, 86vw)' } } }, children: list }) : null] }));
+}
+export default ChatWorkspace;

package/dist/chat/MarkdownReply.js

@@ -0,0 +1,21 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import React, { memo } from 'react';
+import { Box } from '@mui/material';
+import { useTranslation } from 'react-i18next';
+import ReactMarkdown from 'react-markdown';
+import remarkGfm from 'remark-gfm';
+export const MARKDOWN_LIMIT = 200000;
+const allowed = ['p', 'br', 'hr', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'strong', 'em', 'del', 'ul', 'ol', 'li', 'blockquote', 'code', 'pre', 'table', 'thead', 'tbody', 'tr', 'th', 'td', 'a', 'img'];
+const plainText = (children) => (Array.isArray(children) ? children : [children]).map((child) => typeof child === 'string' ? child : '').join('');
+function MarkdownReply({ text = '' }) {
+    const { t } = useTranslation();
+    if (text.length > MARKDOWN_LIMIT)
+        return _jsx(Box, { sx: { whiteSpace: 'pre-wrap', overflowWrap: 'anywhere' }, children: text });
+    return _jsx(Box, { sx: { minWidth: 0, overflowWrap: 'anywhere', '& p': { my: 1 }, '& table': { borderCollapse: 'collapse' }, '& th,& td': { border: 1, borderColor: 'divider', p: 1 }, '& pre': { overflowX: 'auto', bgcolor: 'action.hover', p: 1, borderRadius: 1 }, '& blockquote': { borderLeft: 2, borderColor: 'divider', pl: 1, color: 'text.secondary' } }, children: _jsx(ReactMarkdown, { remarkPlugins: [remarkGfm], allowedElements: allowed, unwrapDisallowed: true, components: {
+                a: ({ href, children }) => { const label = plainText(children); return _jsxs("span", { children: [children, href && href !== label ? ' (' + href + ')' : ''] }); },
+                img: ({ alt, src }) => _jsx("span", { children: alt || src || '' }),
+                table: ({ children }) => _jsx(Box, { role: "region", tabIndex: 0, "aria-label": t('Chat.markdownTable'), sx: { overflowX: 'auto', maxWidth: '100%' }, children: _jsx("table", { children: children }) }),
+                pre: ({ children }) => _jsx("pre", { tabIndex: 0, "aria-label": t('Chat.markdownCode'), children: children }),
+            }, children: text }) });
+}
+export default memo(MarkdownReply);