@micha.bigler/ui-core-micha 3.14.3 → 4.0.0

package/work-orders/AUTH-8.md

@@ -1,184 +0,0 @@
-# AUTH-8 — `extractErrorInfo`'s hardcoded `'GENERIC'` code must not out-rank the caller's own default
-
----
-
-# A. Envelope — authored by the Expertenchat
-
-## Goal & expected outcome
-- Ziel: `extractErrorInfo` (`src/utils/auth-errors.js:2-27`) gibt für jeden Backend-Fehler der
-  Form `{"detail": "..."}` (Djangos generisches Fehlerformat — u.a. DRF `Throttled`, `Http404`,
-  `PermissionDenied`, jede unbehandelte `APIException`; exakt die Form des 429/409, das die
-  gesamte `KIRA-TRACK-3`/`AUTH-7`-Untersuchung ausgelöst hat) den hartcodierten Code `'GENERIC'`
-  zurück. `normaliseApiError` (Zeile 29-38) wählt dann `info.code || defaultCode` — da `'GENERIC'`
-  ein truthy String ist, GEWINNT er IMMER gegen den von JEDER der 39 bestehenden Aufrufstellen in
-  diesem Repo übergebenen, spezifischen `defaultCode` (z. B. `'Auth.LOGIN_FAILED'`,
-  `'Auth.PROFILE_UPDATE_FAILED'`, …). `'GENERIC'` ist an KEINER Stelle als i18n-Key registriert
-  (verifiziert: kein Treffer in `src/i18n/`, keine Erwähnung ausserhalb dieser einen Zeile) — die
-  UI zeigt also für JEDEN `{detail}`-förmigen Backend-Fehler den rohen String `"GENERIC"` statt
-  einer übersetzten Meldung, gleich welcher Aufrufer betroffen ist.
-- Expected outcome: ein `{detail}`-förmiger Fehler liefert `code === <übergebener defaultCode>`
-  (übersetzt, wie jeder andere fehlende/unbekannte Code auch) — `data.detail`s Text bleibt weiterhin
-  in `.message` erhalten (nützlich für Logs/Debugging), beeinflusst aber nicht mehr `.code`.
-
-## Scope + non-goals
-- In scope: ausschliesslich `src/utils/auth-errors.js` — die EINE Zeile, die `code: 'GENERIC'`
-  zurückgibt, wird zu `code: null` (dann gewinnt in `normaliseApiError` korrekt der übergebene
-  `defaultCode`, exakt wie bei jedem anderen Fehler ohne erkennbaren Code).
-- Explizite Non-Goals / nicht anfassen: die ANDEREN beiden Zweige von `extractErrorInfo`
-  (`data.errors[0].code`, `data.code`) liefern einen ECHTEN, vom Backend gesetzten Code — dieses
-  Verhalten ist korrekt und bleibt unverändert; nicht "verbessern" oder umbauen.
-  `normaliseApiError`s Signatur/Rückgabeform (`Error` mit `.code`/`.status`/`.raw`) bleibt gleich.
-  Keine neue i18n-Übersetzung für `'GENERIC'` selbst nötig — der Fix macht den String obsolet,
-  statt ihn übersetzbar zu machen. Keine Änderung an `LoginPage.jsx`/`SecurityComponent.jsx`/
-  anderen Konsumenten — die lesen bereits `err.code || '<eigener Default>'` und profitieren
-  automatisch, ohne selbst geändert zu werden.
-
-## Tier · precondition / gate
-- Tier: 3 — Shared-Core (`ui-core-micha`), betrifft laut Aufrufstellen-Scan ALLE 39 bestehenden
-  `normaliseApiError(...)`-Aufrufe in diesem Repo (jede Funktion in `src/auth/authApi.jsx` und
-  `src/utils/authService.js`). Kein Precondition/Gate.
-- **Wichtig fürs Versionsschema:** anders als `AUTH-7` (rein additiv) ändert dieser Fix
-  BEOBACHTBARES Verhalten für jeden Aufrufer, der aktuell (fehlerhaft) `.code === 'GENERIC'`
-  bekommt — das ist der Bug selbst, aber jede konsumierende App, die diese Version zieht, sieht ab
-  sofort eine ANDERE (korrekte) übersetzte Meldung an Stellen, wo bisher der rohe String
-  `"GENERIC"` erschien. Deshalb MINOR-Bump (nicht PATCH) vorgesehen, siehe Teil C.
-
-## Risks
-- Wird der Fix zu breit gefasst (z. B. `'GENERIC'` komplett aus dem Vokabular entfernt statt nur
-  die eine Codepfad-Priorität zu korrigieren), könnte das `.message`-Feld (der rohe `data.detail`-
-  Text) verlorengehen — das wird von KEINEM bekannten Aufrufer als Anzeige-Text verwendet (alle
-  lesen `.code` fürs Rendering, s.o.), aber sicherheitshalber in den Tests absichern.
-- Die beiden UNVERÄNDERTEN Zweige (`data.errors[].code`, `data.code`) müssen per Regressionstest
-  nachweislich unverändert bleiben.
-
-## Required tests to WRITE
-Neue Datei `tests/authErrors.test.js` (reiner Unit-Test, kein React/Testing-Library nötig — direkter
-Import von `normaliseApiError`/`extractErrorInfo` aus `../src/utils/auth-errors.js`):
-1. `{ response: { status: 429, data: { detail: 'Die Anfrage wurde gedrosselt...' } } }` mit
-   `normaliseApiError(err, 'Auth.LOGIN_FAILED')` aufgerufen → `.code === 'Auth.LOGIN_FAILED'` (NICHT
-   `'GENERIC'`), `.message === 'Die Anfrage wurde gedrosselt...'`, `.status === 429`.
-2. Ohne übergebenen `defaultCode` (Default-Parameter) mit demselben `{detail}`-Fehler → `.code ===
-   'Auth.GENERIC_ERROR'` (der Funktions-Default, nicht `'GENERIC'`).
-3. Regression: `{ response: { data: { errors: [{ code: 'enter_current_password', message: 'x' }] } } }`
-   → `.code === 'enter_current_password'` (übergebener `defaultCode` NICHT verwendet — echter
-   Backend-Code gewinnt weiterhin, unverändert).
-4. Regression: `{ response: { data: { code: 'invalid_credentials' } } }` → `.code ===
-   'invalid_credentials'` (unverändert).
-
----
-
-# B. Implementation map — filled by the Orchestrator — ADDRESSED TO THE IMPLEMENTER
-
-## Context package
-
-**Named file to change:** `src/utils/auth-errors.js:21-24`:
-
-```js
-  // Fallback for generic Django errors
-  if (typeof data.detail === 'string') {
-    return { status, code: 'GENERIC', message: data.detail, raw: data };
-  }
-```
-
-Ändere die zurückgegebene `code`-Property von `'GENERIC'` zu `null`:
-
-```js
-  // Fallback for generic Django errors. `code: null` here (not a fake sentinel)
-  // lets normaliseApiError's `info.code || defaultCode` correctly prefer the
-  // caller's own specific default — `data.detail` is Django's generic
-  // human-readable message field, never a machine code, and no caller of
-  // normaliseApiError anywhere in this repo expects to see 'GENERIC' as a code
-  // (grepped: zero references outside this one line, zero i18n key for it).
-  if (typeof data.detail === 'string') {
-    return { status, code: null, message: data.detail, raw: data };
-  }
-```
-
-**Do NOT touch** the other two branches (lines 11-15 `data.errors[0]`, lines 17-19 `data.code`) or
-`normaliseApiError` itself (lines 29-38) — its `info.code || defaultCode` logic is already correct;
-the bug was entirely in what `extractErrorInfo` fed it.
-
-**Invariants / Pitfalls:**
-- `normaliseApiError`'s OWN default parameter is `defaultCode = 'Auth.GENERIC_ERROR'` (line 29) —
-  this is a DIFFERENT string (`'Auth.GENERIC_ERROR'`, already namespaced like every other code in
-  this file) from the bug's `'GENERIC'` sentinel. Do not confuse the two or "fix" the wrong one.
-- `data.detail` being falsy/absent already falls through correctly to the final `return { status,
-  code: null, message: null, raw: data }` (line 26) — that path is already correct and untouched.
-- No i18n file needs a new key — this fix does not introduce any new user-visible string; it makes
-  the ALREADY-TRANSLATED caller-specific keys (e.g. `Auth.LOGIN_FAILED`, confirmed translated in
-  de/fr/en/sw) reachable again.
-
-Directive: Arbeite ausschliesslich aus diesem Kontext-Paket; öffne nur `src/utils/auth-errors.js`
-und die neue Testdatei zur Verifikation. Kein breites Erkunden in `authApi.jsx`/`authService.js` —
-deren 39 Aufrufstellen sind bereits korrekt (sie übergeben schon einen sinnvollen `defaultCode`);
-sie müssen nicht einzeln angeschaut werden.
-
-## Target repo working directory (absolute)
-
-`C:\Users\Micha Bigler\Documents\webapps\ui-core-micha`
-
-## Preamble — REQUIRED, part of this file
-
-> The text above is the COMPLETE spec — the committed WO file's content, not a plan to refine;
-> there is no separate plan file. Read the nearest `AGENTS.md`, the relevant
-> `.codex/skills/<role>/SKILL.md`, and the app `MEMORY.md` ONLY for conventions. Stay in scope; do
-> not touch auth/permissions/deps/schema/CI unless the spec says so; do not update `MEMORY.md`.
-> **Do NOT edit `WORK_ORDERS.md`** — the register row and the review verdicts are the
-> orchestrator's alone. **Your tools are for editing source and test files and for running the
-> tests you wrote — nothing else.** Do NOT install dependencies, touch a lockfile, run a package
-> manager, or tidy up stray files; if something in the repo state blocks you, stop and report it as
-> `RESULT: BLOCKED <reason>` instead of fixing it. Do NOT `git add`/`commit`/`push` — leave every
-> change uncommitted in the working tree for the orchestrator's independent review. WRITE the
-> tests the `Required tests` section calls for AND **RUN the tests you just wrote** to confirm
-> they execute and pass — that is the ONLY test run you do (NOT the app's affected/full suite, NOT
-> any review). The orchestrator re-runs the authoritative set + does the independent review after
-> you finish — those are the gate; your own run does not count as the gate.
->
-> Narrate continuously: a `PLAN: <step1> | <step2> | …` line up front, then a single-line
-> `PROGRESS: [<n>/<total>] <present-tense action>` before every relevant action (and `… done` on
-> completion), spaced so no gap exceeds ~2 min, stdout unbuffered, plus exactly one final
-> `RESULT: DONE|BLOCKED <reason>`.
-
----
-
-# C. Orchestrator only — NOT ADDRESSED TO THE IMPLEMENTER
-
-> **If you are the implementer reading this work order as your own specification: STOP at this
-> line. Everything below describes what the Orchestrator does AFTER you finish. You do none of it
-> — no reviewers, no verification run, no register edit, no commit.** You ARE the invocation
-> described below; do NOT shell out to `codex exec`.
-
-## Execution directive
-
-Implement through `codex exec` in the background, invoked directly via Bash with both mandatory
-flags. Fallback to direct Claude implementation only on Codex quota/rate-limit/non-zero exit
-(flips authorship — independent reviewer becomes mandatory, already mandatory at Tier 3). Codex
-confirmed available today (two successful dispatches already this session, `KIRA-TRACK-3`/
-`AUTH-7`) — no fresh probe needed.
-
-## Review routing
-
-Tier 3, full set, all concurrent in one background batch: `reviewer` (all 4 lenses — `regression`
-matters most here given 39 call sites; `envelope` needs Part A inline), `ui_reviewer` (this is
-specifically an i18n/error-rendering correctness fix — narrow context: the diff + confirmation that
-every `defaultCode` used across `authApi.jsx`/`authService.js` is actually a translated key in all
-shipped locales), `sec_reviewer` (confirm `.message`/`.raw` still expose no more than before — this
-diff should REDUCE not increase what reaches the UI, since `'GENERIC'` is replaced by `null`).
-Orchestrator's own targeted pass runs alongside.
-
-## Verification
-
-Authoritative test run: `npx vitest run tests/authErrors.test.js tests/authErrorCodeRendering.test.jsx
-tests/authApiLogin.test.js tests/authApiRegistration.test.js` (affected area — everything touching
-`auth-errors.js` and its consumers). No prototype artifact, no rendered side-by-side (no markup
-changed).
-
-## Register + commit
-
-Bump `package.json`'s `version` — **MINOR**, not PATCH, per the Envelope's tier note (observable
-behavior change for existing `{detail}`-shaped-error callers, not purely additive) — from whatever
-`AUTH-7` landed at, to the next `3.x.0`. `CHANGELOG.md` entry MUST explicitly warn: existing
-consumers who upgrade will see a DIFFERENT (correct, translated) message wherever they previously
-saw the raw string `"GENERIC"` for a `{detail}`-shaped backend error — re-check that UI surface
-after bumping the pin, don't assume silent compatibility the way `AUTH-7`'s bump was. Commit on
-`main`. `WORK_ORDERS.md` row for `AUTH-8` → `done`, named review verdict, landing SHA.

package/work-orders/CHART-1.md

@@ -1,285 +0,0 @@
-# CHART-1 — Shared chart kit: themed `ChartFrame` + MUI X-Charts Bar/Line presets
-
-- **Repo:** `ui-core-micha` (`@micha.bigler/ui-core-micha`), branch `main` (library, publish-from-main; no `develop`)
-- **Tier:** 2 (new shared-library public API + a dependency change + governance-anchored contract)
-- **Status:** done (f1b3614)
-- **Workstream:** `CHART-*` (chart / data-viz kit)
-
-> This file has two halves. **Part A (Envelope)** below is authored by the Expertenchat and is the
-> authoritative WHAT/WHY — changing it is a scope change that returns to the operator. **Part B
-> (Implementation map)** is filled by the Orchestrator on `git pull` from repo knowledge, refined
-> against the landed code, without altering Part A.
-
----
-
-## Part A — Envelope (authoritative WHAT/WHY)
-
-### Goal (Ziel)
-
-Build the **shared chart kit** that this stack's governance already references as a not-yet-existing
-dependency (`.codex/skills/frontend-engineering/SKILL.md` §"Charts / data-viz": *"use the shared
-chart kit (a themed `ChartFrame` + MUI X-Charts primitives) once it exists"*; `ui_reviewer`
-checklist mirrors it). Today every hram Results/Research panel re-implements the same
-`Paper + title + toolbar + loading/error/empty + fixed-height box + export buttons` scaffolding
-(~20 panels, ~200 lines of boilerplate each), and there is no reusable frame. This WO delivers the
-reusable estate-wide primitives so charts stop being the recurring quality trap.
-
-### Expected outcome
-
-A new additive, barrel-exported (`src/index.js`) chart module in `ui-core-micha`, published as an
-additive **minor** version bump (`2.12.0 → 2.15.0`, publish-from-main per the dcm/ucm publish
-topology), providing exactly:
-
-1. **`ChartFrame` — the chart-type-agnostic scaffolding.** This is the primary value; it wraps *any*
-   chart body via `children` (an MUI X-Charts primitive **or** a bespoke raw-`<svg>` body), so it
-   serves all ~20 hram panels including the SVG specialists. It owns:
-   - a `Paper` container (default `variant="outlined"`, matching hram's Research panels),
-   - `title` (required) + optional `subtitle`,
-   - a `toolbar` slot (`ReactNode`, rendered in the header row — for the panels' `ToggleButtonGroup`/
-     selectors),
-   - mutually-exclusive state rendering with precedence **loading → error → empty → children**:
-     `loading` (spinner), `error` (`Alert severity="error"`), `isEmpty` + `emptyMessage`
-     (`Alert severity="info"`),
-   - a **responsive, container-sized** chart area (governance: *"container-sized, not fixed px"*),
-     with an optional `minHeight`/`aspect` fallback so migrated panels don't reflow unexpectedly,
-   - optional **Export SVG / Export PNG** controls in the footer (consolidating the per-panel export
-     hram already hand-rolls), shown only when export is enabled, operating on the rendered chart
-     container,
-   - basic **a11y** (frame `title`/`aria-label`, `role="img"` or equivalent on the chart region).
-   All of ChartFrame's own user-facing strings (empty/error defaults, export button labels) go
-   through `react-i18next` — no hardcoded copy.
-
-2. **`BarChart` preset** — a thin wrapper over MUI X-Charts `BarChart` that bakes in the governance
-   chart contract so callers cannot forget it: **axis labels on both axes (with units)** required via
-   props, **legend auto-shown only when >1 series**, **tooltip on**, **theme-token colours** (accepts
-   a caller palette / per-series colours, defaults to the kit's neutral palette — never hardcoded
-   hex), **responsive container**. Must cover the variants hram actually uses: single-series, grouped
-   (multi-metric), and stacked (incl. the dual-axis case in `GenericAnalysisPlot`).
-
-3. **`LineChart` preset** — same contract, for multi-series time-series (covers
-   `ResultsTimelinePanel` / `ExpertTimelinePanel`).
-
-4. **Neutral palette + locale-aware formatter helpers** — a theme-aware (light **and** dark)
-   categorical + sequential palette and number formatters (percentage, compact, ratio) that the
-   presets default to and that apps may pass through. The kit provides the **neutral default and the
-   pass-through seam only**; domain palettes and domain labels stay in the consuming app (see
-   non-goals).
-
-**Acceptance = the `ui_reviewer` chart checklist is satisfiable by construction:** any chart built
-with the presets has axis labels (both axes), a legend when multi-series, a tooltip, theme-token
-colours, container-sized responsiveness, i18n-able labels, and empty/loading states + basic a11y
-from the frame.
-
-### Scope
-
-- New chart module (e.g. `src/components/charts/`), exported from `src/index.js` (additive only).
-- `ChartFrame`, `BarChart`, `LineChart`, and the neutral palette/formatter helpers.
-- Add `@mui/x-charts` as a **`peerDependency`** (see Precondition — this is the one approval-gated
-  item). Peer, not a direct dep, so the consuming app owns the version and there is no double-bundle;
-  hram already depends on `@mui/x-charts` and satisfies the peer.
-- Kit-owned strings wired through the existing ucm `react-i18next` setup (`src/i18n`).
-- Additive minor version bump + publish (`2.15.0`).
-
-### Non-goals / do-not-touch (explicit)
-
-- **No SVG chart primitives in v1.** No generic scatter/bubble, tornado, heatmap, confidence-interval,
-  or Pareto-frontier component. hram's bespoke SVG panels keep their own `<svg>` **body**, rendered
-  **inside `ChartFrame`** (so they gain the shared frame + export). This is a **deliberately surfaced
-  partial state**, not a silent half-solution: retiring the raw SVG by lifting these into MUI
-  X-Charts / kit primitives is a tracked future **CHART-2**, gated separately. (Governance's
-  "extend the kit, don't hand-roll" is the direction; v1 intentionally does not yet cover these.)
-- **No geo/maps** — `react-leaflet` stays app-side.
-- **No tables** — MUI `Table` stays app-side.
-- **No domain palettes or domain labels** — hram's `dataViz` palette (coverage/dalys/cost/…) and its
-  `Results.*` i18n keys stay in hram; the kit ships only the neutral default + pass-through seam.
-- **Do not migrate hram in this WO.** hram adoption (pin bump + panel migration) is a separate
-  follow-on WO in the `hram` repo, gated on `2.15.0` being published (see Precondition).
-- Do not touch auth, CI, or any existing ucm export beyond additively adding the chart exports.
-
-### Precondition / execution-gate / ordering
-
-1. **Dependency-change approval (blocking):** adding `@mui/x-charts` as a `peerDependency` is a
-   dependency change → **explicit operator approval required before the Orchestrator adds it**
-   (AGENTS.md "Require explicit approval before touching: dependency changes").
-2. **Publish before adoption:** the kit lands + publishes as the **next free additive minor**. At
-   authoring, `2.13.0` (NOTIF-13) and `2.14.0` (NOTIF-12) are already claimed, so the target is
-   `2.15.0` — but the registry is the source of truth (publish-from-main; the ucm `version_check`
-   compares against it). The Orchestrator confirms the next free minor against the registry at
-   publish time and adjusts if the NOTIF workstream has advanced further; then confirms it is live
-   before any consumer pins it (per the dcm/ucm publish-topology note).
-3. **hram adoption is gated** on `2.15.0` published; its follow-on WO pins `ui-core-micha >= 2.15.0`.
-
-### Risks
-
-- **API-fit risk (primary):** ChartFrame's props must let all ~20 hram panels — including the
-  SVG-bodied ones — slot in as `children` without escape hatches; if the frame is too opinionated the
-  migration fights it. Mitigation: frame stays deliberately thin and children-based; the presets, not
-  the frame, own chart specifics.
-- **Responsive vs. fixed height:** governance wants container-sized; hram currently hardcodes
-  `height: 300`. The frame defaults responsive but must offer a `minHeight`/`aspect` fallback so the
-  later migration doesn't silently reflow every panel.
-- **Export consolidation:** hram hand-rolls per-panel SVG/PNG export. A generic export from a
-  container ref must handle both an MUI X-Charts body (SVG under the hood) and a raw-`<svg>` body.
-  **Reuse hram's existing export mechanism / a stdlib-level approach; do NOT add a heavy new
-  dependency for PNG rendering without separate approval** (that would be another dependency gate).
-  If a clean generic export can't be done without a new dep, ship the SVG-serialize path and defer
-  PNG — surface the choice, don't silently drop it.
-- **Theme/dark-mode:** the neutral palette must resolve correctly in both light and dark MUI themes.
-- **i18n:** no hardcoded user-facing strings in the kit; all through ucm's `react-i18next`.
-
-### Required tests to WRITE (narrow — component-level, scoped to this change)
-
-Written as part of implementation (the implementer writes the test code); **run only by the
-Orchestrator**. Use ucm's existing frontend test setup (Vitest + React Testing Library, per prior
-ucm WOs). Scoped to the new components — not the ucm full suite.
-
-- **ChartFrame:** renders `title`/`subtitle`; `loading` shows the spinner and hides children;
-  `error` shows an error Alert; `isEmpty` shows `emptyMessage`; **state precedence
-  loading → error → empty → children** holds; the `toolbar` slot renders; export controls appear
-  only when export is enabled and invoke the handler / produce output; a11y `title`/`aria`/role
-  present on the chart region.
-- **BarChart preset:** axis labels render on **both** axes; **legend appears only when >1 series**;
-  tooltip is enabled; colours come from theme tokens / passed palette (assert **no hardcoded hex**);
-  container is responsive (not a fixed px width); single, grouped, and stacked variants each render.
-- **LineChart preset:** multi-series renders; both-axis labels; legend when multi-series; tooltip on.
-- **Palette + formatters:** neutral palette resolves in both light and dark theme; number formatters
-  are locale-aware (percentage + compact) across at least two locales.
-- **i18n:** the kit's own strings resolve via i18n, not hardcoded (missing-key / alternate-locale
-  check).
-
-(Do **not** run the ucm full suite for this WO — that is the promotion gate's job. Run only the new
-components' scoped tests, once, as the per-WO gate, alongside the single independent review on the
-full assembled diff.)
-
----
-
-## Part B — Implementation map (filled by the Orchestrator on `git pull`)
-
-**Dependency approval:** operator explicitly approved adding `@mui/x-charts` as a `peerDependency`
-(2026-07-30, in-chat). Cleared to proceed.
-
-**Target version:** current `package.json` `version` is `2.14.0` (NOTIF-12 already published) →
-next free additive minor is **`2.15.0`**, matching the Envelope's target. Confirm still free against
-the npm registry immediately before publish.
-
-### Named files to change
-
-- `src/components/charts/ChartFrame.jsx` — new. Frame component (Paper/title/toolbar/state
-  precedence/export/a11y).
-- `src/components/charts/BarChart.jsx` — new. Preset over `@mui/x-charts` `BarChart`.
-- `src/components/charts/LineChart.jsx` — new. Preset over `@mui/x-charts` `LineChart`.
-- `src/components/charts/palette.js` — new. Neutral theme-aware categorical + sequential palette,
-  resolved from the active MUI theme (light/dark), NOT hardcoded hex in consumer-visible API.
-- `src/components/charts/formatters.js` — new. Locale-aware number formatters (percentage, compact,
-  ratio) built on `Intl.NumberFormat`, driven off `i18next.language`.
-- `src/components/charts/exportChart.js` — new. Generic SVG/PNG export util operating on a container
-  `ref`, mirroring hram's `XMLSerializer` → `Blob` → (PNG: `canvas` 2x-scale) → anchor-download
-  pattern (see hram `AllocationPerformancePanel.jsx` `handleExportSvg`/`handleExportPng`, no new
-  dependency).
-- `src/index.js` — add barrel exports for `ChartFrame`, `BarChart`, `LineChart`, palette/formatter
-  helpers, additive only, alongside the existing "Components" export block (~lines 1-72).
-- `src/i18n/chartsTranslations.ts` — new namespace, mirrors the existing
-  `notificationsTranslations.ts` shape (`{ 'ChartFrame.KEY': { de, fr, en, sw } }`); register it
-  wherever `notificationsTranslations`/`onboardingTranslations` are aggregated into the i18n bundle.
-- `package.json` — add `"@mui/x-charts": "^8.0.0"` (or the loosest range compatible with hram's
-  pinned `8.28.2`) to `peerDependencies`; bump `"version"` to `2.15.0` (confirm free at publish time
-  per above); add `@mui/x-charts` to `devDependencies` too (peer deps aren't auto-installed, tests
-  need it present).
-- `tests/ChartFrame.test.jsx`, `tests/BarChart.test.jsx`, `tests/LineChart.test.jsx`,
-  `tests/chartsPalette.test.js` (or similar) — new, in the existing `/tests/` root dir (not
-  co-located), `@vitest-environment jsdom` pragma, Vitest + RTL per `tests/NotificationSettings.test.jsx`
-  conventions.
-
-### Architecture/contract slice
-
-- **Component style:** plain `.jsx` (no TypeScript, no PropTypes — JSDoc only), MUI `sx` prop for
-  styling, functional components with hooks. Mirror `src/components/ProfileComponent.jsx`.
-- **i18n:** `useTranslation()` from `react-i18next`; keys namespaced `Category.KEY_NAME` (e.g.
-  `ChartFrame.EXPORT_SVG_LABEL`, `ChartFrame.EMPTY_DEFAULT`). Translation objects are flat
-  `{ key: { de, fr, en, sw } }` dictionaries per `src/i18n/notificationsTranslations.ts` — follow
-  that exact shape for `chartsTranslations.ts`, all four locales required.
-- **Barrel export:** `src/index.js` groups exports by category with comment headers (Auth Context,
-  API/Services, Layouts, Pages, Components, Translations, Notifications, Onboarding) — add a
-  `// Charts` section, export components + `chartsTranslations` alongside the others.
-- **Theme:** no centralized theme file exists in ucm today (components rely on the MUI default
-  theme via `sx` and `useTheme()`). The palette module must read `theme.palette.mode` via
-  `useTheme()` to select light/dark variants — do not assume a specific app theme shape beyond
-  standard MUI.
-- **Peer deps:** current `peerDependencies` list (`@mui/material ^7.3.11`, `react ^19.2.6`, etc.) —
-  add `@mui/x-charts` alongside, do not touch existing entries.
-- **hram reference (adoption target, NOT touched in this WO):** `hram/frontend/src/components/
-  OutputComponents/Results/ResultsTimelinePanel.jsx` and `ExpertTimelinePanel.jsx` show the
-  Paper→Typography(h6)→toolbar(ToggleButtonGroup)→loading/error/empty(Alert)→chart→footer skeleton
-  ChartFrame must replicate structurally; `AllocationPerformancePanel.jsx` (~lines 198-238) has the
-  reference export functions; `hram/frontend/src/.../theme.js` `dataViz` palette (~lines 20-30) is
-  the domain palette that stays app-side — the kit's neutral palette is a separate, generic
-  categorical/sequential set, not a copy of `dataViz`.
-
-### Key snippets (for the implementer to mirror, not copy verbatim)
-
-hram's existing Paper/title/toolbar/state scaffolding (`ResultsTimelinePanel.jsx`/
-`ExpertTimelinePanel.jsx`):
-```jsx
-<Paper variant="outlined" sx={{ p: 2 }}>
-  <Box sx={{ display: "flex", alignItems: "center", justifyContent: "space-between" }}>
-    <Typography variant="h6">{t("...")}</Typography>
-    <ToggleButtonGroup exclusive size="small" ...>...</ToggleButtonGroup>
-  </Box>
-  {loading && <CircularProgress />}
-  {error && <Alert severity="error">...</Alert>}
-  {isEmpty && <Alert severity="info">...</Alert>}
-  {!loading && !error && !isEmpty && children}
-</Paper>
-```
-hram's export pattern (`AllocationPerformancePanel.jsx`): `XMLSerializer().serializeToString(svgRef.current)`
-→ `Blob(['image/svg+xml'])` → anchor download for SVG; for PNG, load the SVG blob into an `Image`,
-draw to a 2x-scaled `<canvas>` with a white background fill, then `canvas.toBlob()` → anchor download.
-`exportChart.js` should generalize this to accept a container ref (find the first `<svg>` descendant)
-so it works for both an MUI X-Charts body and a raw-`<svg>` body.
-
-### Invariants / do-not-touch / pitfalls
-
-- Additive exports only — do not modify or remove any existing `src/index.js` export line.
-- `@mui/x-charts` is a **peerDependency**, never a direct `dependency` (hram supplies its own
-  installed copy; ucm must not double-bundle it).
-- No hardcoded hex/palette values in the public API surface — palette resolves from
-  `useTheme().palette.mode`; tests must assert this (e.g. render under both a light and dark MUI
-  theme, assert different resolved values).
-- Container-sized/responsive by default — do not hardcode chart pixel width; offer `minHeight`/
-  `aspect` as an opt-in fallback only.
-- Every user-facing string in the kit goes through `t('ChartFrame....')` — no literal English
-  strings in JSX.
-- Do not touch hram, `dataViz`, or any hram i18n keys — this WO is ucm-only.
-- State precedence is strict: `loading` beats `error` beats `isEmpty` beats `children` — write the
-  test asserting this order, not just each state individually.
-- No new heavy dependency for PNG export (e.g. no `html2canvas`/`dom-to-image`) — reuse the
-  serialize+canvas approach; if a clean generic path is not achievable without a new dep, ship
-  SVG-export only and explicitly note PNG deferred in the `RESULT:` — do not silently drop it.
-
-### Progress contract
-
-Codex must emit: one `PLAN: <step1> | <step2> | …` line up front; a single-line
-`PROGRESS: [<n>/<total>] <present-tense action>` before every file/edit/step and `… done` on
-completion, spaced so no gap exceeds ~2 min; exactly one final `RESULT: DONE|BLOCKED <reason>`.
-stdout unbuffered.
-
-### Execution directive
-
-Implement through `codex exec` in the background, invoked **directly via Bash** (never the
-`debugger`/`*_coder` Agent wrappers), with **both** `--skip-git-repo-check` and
-`--dangerously-bypass-approvals-and-sandbox`, prompt passed as a positional argument read from this
-committed file (`"$(cat work-orders/CHART-1.md)"`). cwd = `ui-core-micha` repo root (this repo),
-**never** the workspace root `…/webapps`. Fall back to direct Claude implementation only on Codex
-quota/rate-limit/non-zero exit. Codex WRITES the required tests but MUST NOT RUN them and MUST NOT
-run any review or `git add`/`commit`/`push` — leave the working tree uncommitted for the
-Orchestrator's independent review, which runs after Codex finishes.
-
----
-
-## Pastable mini-handover (for the fresh Orchestrator session)
-
-> Orchestrator: implement `work-orders/CHART-1.md` in `ui-core-micha` (branch `main`). `git pull`
-> first, read the WO, then follow the `orchestrate-codex` skill (Codex-first, fill Part B, run your
-> own independent review + scoped tests, commit on green). NOTE the blocking precondition: adding
-> `@mui/x-charts` as a `peerDependency` is a dependency change needing explicit operator approval
-> before it is added.