@micha.bigler/ui-core-micha 3.6.0 → 3.8.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 3.8.0 — UCM-THEME-15
+
+`createAppTheme` can now derive baseline status `main` colours and control-border colours against the theme's own
+page background when their WCAG contrast would otherwise fail. Values that already pass remain byte-identical, and
+app-supplied values are unchanged. When a status `main` is derived, its `light` and `dark` shades move with it too,
+so components using `error.dark` for hover may change on tinted pages.
+
 Only notable, user-facing changes. Not every version — see `WORK_ORDERS.md` for the full history.
 
 ## 3.6.0 — AUTH-8

package/DESIGN.md

@@ -6,6 +6,14 @@ These principles are the spec a **prototype** encodes and the implementation mat
 
 ## Identity
 
+The baseline's page-derived colours are `success.main`, `warning.main`, `error.main`, `info.main`,
+`controlBorder.main`, `controlBorder.hover`, and `controlBorder.error`, alongside the existing
+`controlBorder.focus`: a fixed colour cannot promise WCAG contrast on every page background. The baseline therefore
+tries for a passing colour rather than a fixed hex that must appear unchanged on every site — derivation is capped
+(the same bounded darken/alpha steps `controlBorder.focus` already used) and can still leave a contrast finding on a
+page extreme enough that no derived shade clears the threshold; values that already pass remain byte-identical,
+while baseline values that fail are derived against the theme's own page.
+
 1. **Honor the shared baseline and the app's identity; don't invent a parallel system.** `ui-core-micha`'s `createAppTheme` deliberately owns the complete visual baseline. Each app supplies its identity through `palette.primary` and `fontFamily`, plus reviewed overrides where its real design requires them (hram: primary blue `#468AB2`). **Match first, then elevate.** Never invent a parallel language — a made-up teal / pills / breadcrumb vocabulary was the v1 mistake.
 2. **One accent, deliberately placed.** Interactive = the app's one accent colour. **Data colours are a separate layer with a shared default that apps may override.** Status (green / amber / red) is semantic and is NEVER repurposed as a series colour. Restraint over decoration.
 3. **Commit to the app's theme reality — with intent.** If the app is single-theme (hram is light-only), commit to that deliberately rather than bolting on dark mode as an afterthought — a decision, not an omission. The estate does NOT mandate light-only; it is per-app — but whichever it is, it is on purpose.
@@ -14,7 +22,7 @@ These principles are the spec a **prototype** encodes and the implementation mat
 
 4. **Scan and operate, not read.** Summary before detail; state encoded in form (chips, knee-markers); interactive things look interactive.
 5. **The user's language, not the system's.** Humanize labels (`incidence_scale` → "Incidence scale"); keep the raw name reachable on hover for the technicians — readability without losing traceability. Words are design material.
-6. **Reduce help, don't remove it.** Explanation lives in on-demand affordances (ⓘ-popover, provisional-chip), not permanent banners — less noise, same information.
+6. **Reduce help to the minimum, don't remove it.** Explanation lives in on-demand affordances (ⓘ-popover, provisional-chip), never in permanent banners or helper sentences — in doubt a chip, not a sentence; less noise, same information.
 7. **Design the edge-states, not just the happy path.** An empty / "no frontier" state gets a real design (statement + CTA), never a bare alert.
 
 ## Charts (read by humans, executed by code)

package/README.md

@@ -13,3 +13,5 @@ Spread `uiCoreTranslations` into the default i18n namespace as the supported agg
 ## Dashboard primitives
 
 `StatTile` (a bordered KPI tile) and `SoftChip` (a soft tinted annotation/status chip, tones derived from `theme.palette[tone]`) live under `src/components/` and are exported from the package root.
+
+`EmptyState` (an icon/title/description/action empty-section placeholder, built from theme tokens) lives under `src/components/` and is exported from the package root.

package/WORK_ORDERS.md

@@ -27,6 +27,14 @@ prefixed ID; never reuse a bare flat number across workstreams.
 
 | ID | Titel | Beschreibung | Datum | Status | Commit(s) | Notiz |
 |---|---|---|---|---|---|---|
+| UCM-THEME-15 | Derive status and control-border colours against the theme's own page | Baseline-supplied status `main` and `controlBorder` colours are derived against `#FFFFFF` + `background.default` (like `controlBorder.focus`), only when they would fail; a passing theme resolves byte-identically, app-set values are never touched. Full order [`work-orders/UCM-THEME-15.md`](work-orders/UCM-THEME-15.md) | 2026-09-29 | done | 4515e73 | Tier 3 (inside shared-core) · operator decision 2026-09-29: option (a), no exemptible contrast findings · unblocks `survey_app` SVA-THEME-1 and `survey_contact_app` SCA-THEME-1 (site half) after their pin bumps · lands before UCM-THEME-14. Gate #1 carried by the committed Envelope + mini-handover. Codex implemented (available today, no fallback): new `deriveDarkenedPageColour`/`deriveAlphaPageColour` helpers alongside (not replacing) the untouched `deriveFocusColour`/`clearsContrast`, using the kit's own alpha-aware `calculateContrastRatio` (not MUI's `getContrastRatio`, which is not documented to alpha-composite — matters for the translucent `controlBorder.main`/`.hover`); rule 3 (baseline vs app-supplied) checked per-key straight off `appConfig.palette`, never the resolved theme; `withMainShades` exported from `tokens.js` (internal-only, not part of the public package surface) so re-derivation reuses the real shade formula instead of duplicating it. Independent `reviewer` (all 4 lenses) + `ui_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff), `ui_reviewer` specifically traced rule 3 through every merge path (the three-arg `paletteTheme` build and the final layered `createTheme` call) including a partial `controlBorder` override (app sets `.hover` only) — confirmed no defect, per-key checks hold: **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui · 6 raised · 3 accepted · worst accepted: defect**. Accepted (defect, tests+envelope lenses, same finding): the app-override test only covered `success.main`/`controlBorder.main`, leaving `warning`/`error`/`info` and `controlBorder.hover`/`.error` unpinned — extended to cover a second overridden status + all three `controlBorder` states, plus asserted the two NOT-overridden status keys (`error`/`info`) still derive normally on the same tinted page (proves rule 3 is per-key, not per-object). (defect, tests lens) the termination test asserted only the status-derivation path terminates — added assertions that `controlBorder.main/hover/error` are also defined (not thrown) on the unreachable page. (nit, ui_reviewer) `DESIGN.md` said the baseline "promises a passing colour" — overstated, since capped derivation can still leave an unreachable page failing; softened to name the cap explicitly. Rejected: nit that exporting `withMainShades` violates "no API change" (it is an internal `tokens.js`↔`createAppTheme.js` module export, never re-exported from the public `src/index.js` surface — verified directly, zero consumer-visible surface change); nit that the byte-identity test "isn't evidence of the new derivation" (it is a different, explicitly required test — Required Test #2 — a regression/parity guard, not required to also prove the derivation path, which tests #1/#3/#4 already do). Orchestrator's own scoped run: `tests/createAppThemePageContrast.test.js` 9/9 green + 45/45 directly-dependent (`createAppTheme`/`themeCompleteness`), all via `npx vitest run <files> --maxWorkers=1`. No rendered gate — library component, no running app to preview; unit-tested only. **Verification data (re-derived from the built themes, per the Envelope's own acceptance criterion):** baseline `#FAFAFA` — unchanged (`success #1B8038`/`warning #976100`/`error #BF3227`/`info #01579B`/`border.main rgba(33,37,41,.50)`/`border.hover rgba(33,37,41,.65)`/`border.error #BF3227`). `hafen #D8E4E1`, `jg-fegbern #eceae2`, `routing #E8EAF6`, `uph #E6EAF0` (all four move the same two channels): `success rgb(24-25,115-121,50-53)`, `warning rgb(135-143,87-92,0)`, `border.main rgba(33,37,41,0.55)`; `error`/`info`/`border.hover`/`border.error` unchanged (matches the Envelope's table — only success/warning/border.main failed on these). `ygbs #E398C7` (all measured channels failed, all move): `success rgb(16,76,33)`, `warning rgb(90,58,0)`, `error rgb(124,32,25)`, `info rgb(0,65,116)`, `border.main rgba(33,37,41,0.6)`, `border.error rgb(171,45,35)`; `border.hover` unchanged (`.65` alpha already clears 3:1 even on this page). **Released as `3.8.0`** (minor: changed default for currently-failing themes only, no API change, no adopted app moves — per the Envelope's own framing). `npm view @micha.bigler/ui-core-micha version` should read `3.8.0` once `publish.yml` runs on this push. Next: add `planned` pin-bump rows in `survey_app/WORK_ORDERS.md` and `survey_contact_app/WORK_ORDERS.md` (from `2.41.3`, classify via the dependency-bump test in `AGENTS.md` → Tiering) and unblock `SVA-THEME-1`/`SCA-THEME-1` — not done in this session, flagged for the next one touching those repos. |
+| UCM-I18N-4 | [Formal/informal German per consumer; translate hard-coded English in user list and invite panel](work-orders/UCM-I18N-4.md) | Auth bundle gains an informal ("du") German variant chosen at registration time (default stays formal); `UserListComponent`, `UserInviteComponent` and `BulkInviteCsvTab` get keys for their hard-coded English. | 2026-09-29 | done | f4dfbe6 | Raised from jg-ferien's local browser test 2026-09-29; operator 2026-09-29: generic fixes go to ucm. From jg `JG-UX-10`. Tier 3 (inside shared-core). Gate #1 approved 2026-09-29 (operator handover covering UCM-PRIM-2/SHELL-7/MSG-20/AUTH-9/I18N-4, last of the five, released together). Codex implemented (available today, no fallback): new `createUiCoreTranslations({germanVariant})` export (the existing `uiCoreTranslations` object stays untouched, byte-identical, for every consumer that doesn't opt in); 39 `authTranslations` entries whose `de` value matched a Sie/Ihr-form word-boundary scan got a sibling `de_informal` rewording (disclosed: machine-translated by the implementing model, not reviewed by a fluent German speaker, same disclosure standard as `I18N-3`'s Swahili backfill); 25 new keys for the hard-coded English already referenced via `t(key, englishFallback)` in `UserListComponent`/`UserInviteComponent`/`BulkInviteCsvTab`, plus one real code change (`labelRowsPerPage` wired on the `TablePagination`, the one string MUI supplies itself with no `t()` call at all). Independent `reviewer` (all 4 lenses) + `ui_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui · 9 raised · 2 accepted · worst accepted: defect**. Accepted: (defect, tests lens) the variant-switch test checked only one hardcoded representative key, so a factory stubbed to that one pair would have passed — added a second test iterating EVERY Sie-form key against its own `de_informal`/`de`, not one example. (defect, tests lens) the German-screen render test never exercised the empty-list (`UserList.NO_USERS`) or CSV-parse-error paths — added a case for both. Rejected: 3 lenses (envelope, regression, ui) claimed `UserList.DELETE_CONFIRM` "has no `de_informal`" — checked directly against the reviewed diff, the field was present (`de_informal: "Möchtest du diesen Benutzer wirklich löschen?"`); a stale/misread finding, not a real gap. "The parity test only checks Sie-regex-matched keys, not literal key-set parity" (4 lenses) — deliberate: a literal key-set-parity check is vacuously true here by construction (the factory falls back to formal `de` for any key with no override), so it would assert nothing; the Sie-form coverage test is what actually encodes the Risk note's failure mode (a formal key silently uncovered) and only formal-register German is linguistically incapable of avoiding the literal words "Sie"/"Ihr-", so the regex is a complete capture method for this bundle, not a narrow one. "`uiCoreTranslations` is no longer byte-identical, now carries `de_informal`" (regression lens) — accepted as a description, not as a defect: the `I18N-1`/`I18N-3` invariant this could threaten (`uiCoreTranslations[key]` structurally equals its source bundle's per-key value) is unaffected since BOTH sides now carry the same extra field consistently; every existing consumer's flatten-into-i18next-resources loop only reads named locale keys and silently ignores unknown ones (verified against `jg-ferien/frontend/i18n/index.js`'s actual merge loop). **Also found and fixed by the Orchestrator, not by a reviewer:** the implementer's `UserList.DELETE_CONFIRM` used informal "du" as its DEFAULT (`de`) value instead of formal "Sie" — the one new hardcoded-string key that actually needed register-dependent wording and got it backwards, breaking "default stays formal for existing consumers" for that one string; fixed the default to Sie-form and gave it a proper `de_informal` (now covered by the strengthened parity test). Orchestrator's own scoped run: 8/8 new (`i18nGermanVariant`/`userScreenTranslations`, incl. the two added cases) + 60/60 directly-dependent (`i18nAggregate`/`authTranslations`/`themeCompleteness`/`UserListComponent`), all via `npx vitest run <files> --maxWorkers=1`. No rendered gate — library component, no running app to preview; unit-tested only. **Released as `3.7.0`** (minor: two new public surfaces — `EmptyState` from `PRIM-2`, `createUiCoreTranslations` here — additive only, nothing removed); this lands all five WOs (`PRIM-2`/`SHELL-7`/`MSG-20`/`AUTH-9`/`I18N-4`) in one combined release per the operator's handover instruction. **`npm view @micha.bigler/ui-core-micha version` should read `3.7.0` once `publish.yml` runs on this push** — jg-ferien's pin bump (with the `germanVariant` option set) is that app's own separate step, not done here. |
+| UCM-AUTH-9 | [Auth flows that dead-end: rejected invite password hides the form, closed signup looks open](work-orders/UCM-AUTH-9.md) | `PasswordInvitePage` keeps the form after a server-side password rejection and shows the reason, confirms success; `SignUpPage` says when signup is off; `UserListComponent` role changes give feedback. | 2026-09-29 | done | fc28d74 | Raised from jg-ferien's local browser test 2026-09-29; operator 2026-09-29: generic fixes go to ucm. From jg `JG-UX-19` + the role-feedback part of `JG-UX-12`. Tier 3 (inside shared-core). Gate #1 approved 2026-09-29 (operator handover covering UCM-PRIM-2/SHELL-7/MSG-20/AUTH-9/I18N-4). Codex implemented (available today, no fallback): `PasswordInvitePage` split one shared `errorKey` into link-validity (`errorKey`, hides the form) vs submit rejection (`submitErrorKey`, keeps it, reads `err.raw.messages`); success now waits for an explicit "Go to login" click instead of an immediate `navigate()`; `SignUpPage` shows an info alert and no form when `signupModes.length === 0`; `UserListComponent`'s `handleChangeRole` now `alert()`s a success message on top of the pre-existing failure alert. Independent `reviewer` (all 4 lenses) + `ui_reviewer` + `sec_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui,sec · 9 raised · 4 accepted · worst accepted: blocker**. Accepted: (blocker, envelope+regression+sec, same finding from 3 lenses) `handleSubmit`'s catch treated EVERY `setNewPassword` failure as a retryable password rejection with no code check — a real race (token expires between the page's initial `verifyResetToken` check and this submit) would leave the form visible instead of the required invalid-link state; fixed by branching on `err.code === 'Auth.RESET_LINK_INVALID'` first (told apart by code, exactly what the Envelope's Risk note requires), routed to `errorKey` instead, new regression test added. (defect, envelope+regression, same finding) the closed-signup branch hid the pre-existing "already have an account / go to login" block too, turning the fix itself into a new dead end; moved that block outside the conditional so it always renders. (nit, duplication) the new `Auth.SIGNUP_CLOSED` key duplicated the existing, already-4-locale `Auth.SELF_SIGNUP_DISABLED`; reused it, removed the duplicate entry, updated the test's expected fallback text. Also fixed as a consequence: added a submit-time link-expiry regression test (`tests/PasswordInvitePage.test.jsx`) that would have failed against the original implementation. Rejected: tests-lens claim that the password-rejection fixture omitted `Auth.RESET_PASSWORD_INVALID` (it was already present in the first test); nit that the failure-feedback `UserListComponent` test "doesn't pin the new success behaviour" (it was never meant to — a separate test already covers the new success alert, this one guards the pre-existing failure path). Orchestrator's own scoped run: 17/17 (`PasswordInvitePage`/`SignUpPage`/`UserListComponent`, +1 new race-case test) + 58/58 directly-dependent (`i18nAggregate`/`themeCompleteness`/`authTranslations`), all via `npx vitest run <files> --maxWorkers=1`. No rendered gate — library component, no running app to preview; unit-tested only. **Released as `3.7.0`** together with `PRIM-2`/`SHELL-7`/`MSG-20`/`I18N-4` in one combined release — see `I18N-4`'s row for the release note; jg-ferien's pin bump is that app's own separate step. |
+| UCM-MSG-20 | [Message composer collapses on narrow screens](work-orders/UCM-MSG-20.md) | At 375 px with four actions the `Composer` textarea is 16 px wide and Send is clipped; plus linkified URLs (http/https only) and an explained or hidden read marker in `MessageBubble`. | 2026-09-29 | done | fcd4ae6 | Raised from jg-ferien's local browser test 2026-09-29; operator 2026-09-29: generic fixes go to ucm. From jg `JG-UX-14`. dcm register is canonical for `MSG-*`; this is the ucm-side row. Tier 3 (inside shared-core). Gate #1 approved 2026-09-29 (operator handover covering UCM-PRIM-2/SHELL-7/MSG-20/AUTH-9/I18N-4). Codex implemented (available today, no fallback): `Composer`'s action row split into an icon row + a message-field/send row (`sx={{flex:1,minWidth:120}}`/`sx={{flexShrink:0}}`); new `linkifyText.jsx` (strict `https?://` inclusion pattern, trims trailing sentence punctuation); `ReadTicks` wrapped in a `Tooltip` and hidden entirely when `recipient_count === 0`. Independent `reviewer` (all 4 lenses) + `ui_reviewer` + `sec_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui,sec · 6 raised · 3 accepted · worst accepted: defect** — the composer test only asserted CSS values, not that the actions actually moved to a separate DOM row (a same-row implementation with the same sx values would have passed); the read-marker/linkify test suite lacked a structural row-separation proof; and `linkifyText`'s raw `<a>` diverged from the kit's own `Link` primitive already used elsewhere (`CookieConsentStep.jsx`). Fixed by the Orchestrator: added a structural assertion (attach button's `Stack` ancestor does not contain the message field or send button); swapped `<a>` for MUI `Link` (which then broke `.closest('.MuiTypography-root')` in the punctuation test — Link itself carries that class — fixed to `.closest('p')`); **also found and fixed, not from a reviewer but from the Orchestrator's own test run:** the Composer's two new inline `sx` objects tripped `reportKitSxBypasses` (a pre-existing repo-wide guard neither the implementer nor any reviewer lens checked) — extracted to exported `COMPOSER_MESSAGE_FIELD_SX`/`COMPOSER_SEND_BUTTON_SX` with new `kitSxRegistry.js` entries. Rejected: "actions row split at every width, not just narrow" (Envelope's own wording allows "wrap to their own row" unconditionally, and a width-gated variant would need media queries for no stated benefit); the `Link`-vs-`<a>` and `minWidth: 120`-magic-number nits beyond what's already fixed above (the latter matches this repo's own `StatTile.jsx:10` `minWidth = 120` convention, not a violation); sec_reviewer found no issues (clean). Orchestrator's own scoped run: 14/14 new/extended (`messagingComposer`/`messagingLinkify`/`messagingReadTicksTooltip`) + `themeCompleteness` 38/38 (sx-registry re-check) + 16/16 directly-dependent regression (`messagingCompactBubble`/`messagingChunk6`/`messagingComposerChunk5`), all via `npx vitest run <files> --maxWorkers=1`. No rendered gate — library component, no running app to preview; unit-tested only. **Released as `3.7.0`** together with `PRIM-2`/`SHELL-7`/`AUTH-9`/`I18N-4` in one combined release — see `I18N-4`'s row for the release note; jg-ferien's pin bump is that app's own separate step. |
+| UCM-SHELL-7 | [User-menu avatar initials fail contrast](work-orders/UCM-SHELL-7.md) | `UserMenu` avatar renders MUI default white-on-grey initials at 1.83:1; take colours from theme tokens with a passing fallback. | 2026-09-29 | done | 04a29fe | Raised from jg-ferien's local browser test 2026-09-29; operator 2026-09-29: generic fixes go to ucm. From jg `JG-DL-12`. Tier 3 (inside shared-core). Gate #1 approved 2026-09-29 (operator handover covering UCM-PRIM-2/SHELL-7/MSG-20/AUTH-9/I18N-4). Codex implemented (available today, no fallback): avatar background = `primary.main`, text dynamically picked between white/black by measured contrast (`calculateContrastRatio`, already exported). Independent `ui_reviewer` only (Codex gpt-5.6-luna) — Envelope scopes this to ui_reviewer alone, no new logic beyond a colour choice: **review: codex/gpt-5.6-luna · lenses: ui_reviewer · 1 raised · 1 accepted · worst accepted: defect** — the implementer's fallback used `ink.primary` (#212529, luminance ~0.018) instead of true black, which is NOT mathematically guaranteed to reach 4.5:1 together with `background.paper`: for a `primary.main` in the ~0.183–0.257 luminance band neither branch cleared 4.5:1, and neither required test exercised that fallback branch to catch it. Fixed by the Orchestrator: switched both branches to `theme.palette.common.white`/`.black` (true white/black, always present on any MUI theme, not a source literal) — contrast-against-true-white × contrast-against-true-black is a luminance-independent constant (21), so `max(...) >= sqrt(21) ~= 4.58` holds for every possible `primary.main`, closing the gap rather than narrowing it. Added a third test with a synthetic mid-grey `primary.main` (`#808080`, ~3.95:1 on white) to actually exercise the black-fallback branch. Orchestrator's own scoped run: `tests/UserMenu.test.jsx` 10/10 green (`npx vitest run tests/UserMenu.test.jsx --maxWorkers=1`). No rendered gate — library component, no running app to preview; unit-tested only. **Released as `3.7.0`** together with `PRIM-2`/`MSG-20`/`AUTH-9`/`I18N-4` in one combined release — see `I18N-4`'s row for the release note; jg-ferien's pin bump is that app's own separate step. |
+| UCM-PRIM-2 | [Shared EmptyState primitive](work-orders/UCM-PRIM-2.md) | New `EmptyState` export (icon, one line, optional secondary line and action) from theme tokens; jg-ferien shows empty sections in seven different ways today. | 2026-09-29 | done | 059e9f0 | Raised from jg-ferien's local browser test 2026-09-29; operator 2026-09-29: generic fixes go to ucm. Adopted in jg `JG-UX-9`. Tier 3 (new public export, additive). Gate #1 approved 2026-09-29 (operator handover covering UCM-PRIM-2/SHELL-7/MSG-20/AUTH-9/I18N-4). Codex implemented (available today, no fallback). Independent `reviewer` (Codex gpt-5.6-luna, all 4 lenses) + `ui_reviewer` (Codex gpt-5.6-luna), concurrent background batch on the full diff: **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui · 5 raised · 3 accepted · worst accepted: defect** — missing README doc entry (Envelope required one, added), action button missing `type="button"` (form-submit risk, fixed), two test assertions passed for a would-be hardcoded stub (title/description always rendered the same fixed string across all 3 tests; strengthened with a second distinct-value render + negative assertion). Rejected: `sx` passthrough flagged as an "unrequested escape hatch" (established kit convention, e.g. `Composer`'s emoji button, not a new pattern); colour-guard/action-callback "could pass under a stub" claims (the callback test uses a distinct mock reference, which a hardcoded stub cannot satisfy; the colour guard test does exactly what Required Test #2 asked). Orchestrator's own scoped run: `tests/EmptyState.test.jsx` 4/4 green, `tests/themeCompleteness.test.js` (directly-dependent, directory-enumerated palette scan) 38/38 green. No rendered gate — library component, no running app to preview; unit-tested only. **Released as `3.7.0`** together with `SHELL-7`/`MSG-20`/`AUTH-9`/`I18N-4` in one combined release — see `I18N-4`'s row for the release note. |
+| UCM-THEME-14 | Dark mode in `createAppTheme`, from the central token file | `palette.mode: 'dark'` selects a dark baseline palette in `tokens.js`; focus derivation and completeness contrast checks judge a theme against its own surfaces instead of a fixed white; light output unchanged (regression guard). Full order [`work-orders/UCM-THEME-14.md`](work-orders/UCM-THEME-14.md) | 2026-09-29 | planned | | Tier 3 (inside shared-core) · precondition: UCM-THEME-13 frozen · downstream: `webshop-guenter` WSG-THEME-1 |
+| UCM-THEME-13 | Freeze a dark-mode baseline token set | Reference sheet `docs/DARK-TOKENS.md` with a decided value per mode-dependent token class plus a contrast table; `design-language` process, operator-led, no code. Full order [`work-orders/UCM-THEME-13.md`](work-orders/UCM-THEME-13.md) | 2026-09-29 | planned | | Tier 2 (document only) · operator decision 2026-09-29: dark mode gets its own kit order · only consumer today: `webshop-guenter` |
 | AUTH-7 | `loginWithPassword`s 409-Retry gegen Zweitfehlschlag haerten | allauth-headless antwortet mit 409 ("already authenticated"), wenn die Session bereits gueltig ist; `loginWithPassword` ruft dann `fetchCurrentUser()` erneut auf. Schlaegt dieser Retry ebenfalls fehl, wurde der Fehler bisher roh durchgereicht statt normalisiert. Spec [`work-orders/AUTH-7.md`](work-orders/AUTH-7.md) | 2026-09-05 | done | ae7aa89 | **Tier 3** (Shared-Core). Ausgeloest durch `kira`: ein erschoepfter globaler Throttle-Bucket (siehe `kira/KIRA-TRACK-3`) liess den 409-Retry selbst mit 429 fehlschlagen, roh statt normalisiert durchgereicht. Rein additiver Bugfix, kein Prop-/Verhaltensvertrag geaendert. **Implementiert (Codex gpt-5.6-luna):** genau wie geplant, `src/auth/authApi.jsx` + neue `tests/authApiLogin.test.js`. review: codex/gpt-5.6-luna (`reviewer` 4 Lenses + `ui_reviewer` + `sec_reviewer`, ein Hintergrund-Batch) 3 raised · 1 accepted · 2 rejected · worst accepted: defect (aber ausserhalb des Scopes dieser WO, siehe unten) — `envelope`/`regression`/`duplication`/`sec_reviewer`: 0 raised. `tests`-Lens: 2 raised, BEIDE empirisch widerlegt (Fix testweise zurueckgerollt, betroffener Test schlug korrekt fehl — sind keine echten Luecken) → rejected. `ui_reviewer`: 1 raised, akzeptiert als real (empirisch bestaetigt: `normaliseApiError('...', 'Auth.LOGIN_FAILED')` liefert bei einem DRF-`{"detail": "..."}`-Fehler `code: 'GENERIC'` statt des übergebenen Default-Codes, weil `extractErrorInfo` in `src/utils/auth-errors.js` `'GENERIC'` bereits als gesetzten Wert zurückgibt, der `info.code || defaultCode` gewinnt) — **PRE-EXISTING in einer anderen Datei, nicht durch diesen Diff verursacht, an JEDER anderen Call-Site derselben Funktion bereits vorhanden** → out-of-scope fuer AUTH-7, nicht hier gefixt, nachverfolgt als `AUTH-8`. Tests: `npx vitest run tests/authApiLogin.test.js tests/AuthContext.test.jsx tests/authApiRegistration.test.js` 7/7 gruen. **PATCH-Bump 3.5.0 -> 3.5.1** (`package.json` + `CHANGELOG.md`), kein Consumer-Pin-Bump noetig (rein additiv). |
 | AUTH-8 | `extractErrorInfo`s `GENERIC`-Code ueberschreibt jeden `defaultCode` | Bei jedem DRF-Fehler mit `{"detail": "..."}`-Form (u.a. Django `Throttled`/`Http404`/`PermissionDenied` — genau die Form, die den urspruenglichen 429 aus `kira` ausloeste) liefert `extractErrorInfo` (`src/utils/auth-errors.js`) `code: 'GENERIC'`; `normaliseApiError`s `info.code \|\| defaultCode` waehlt dann IMMER `'GENERIC'`, nie den vom Aufrufer uebergebenen `defaultCode` (z. B. `'Auth.LOGIN_FAILED'`). `'GENERIC'` ist an keiner Stelle als i18n-Key registriert — die UI zeigt vermutlich den rohen String statt einer Uebersetzung. **Betrifft JEDE bestehende `normaliseApiError(...)`-Call-Site in diesem Repo**, nicht nur `loginWithPassword`. Spec [`work-orders/AUTH-8.md`](work-orders/AUTH-8.md) | 2026-09-05 | done | d3af6ac | Gefunden von `ui_reviewer` waehrend `AUTH-7`s Review, empirisch bestaetigt (`node --input-type=module -e "..."` gegen die echte Funktion). Operator-Entscheidung 2026-09-05: zuerst angehen. **Implementiert (Codex gpt-5.6-luna):** `code: 'GENERIC'` -> `code: null` im `data.detail`-Zweig, die anderen zwei Zweige unveraendert; neue `tests/authErrors.test.js` (4 Tests). review: codex/gpt-5.6-luna (`reviewer` 4 Lenses + `ui_reviewer` + `sec_reviewer`, ein Hintergrund-Batch) 1 raised · 1 accepted · worst accepted: defect — `envelope`/`regression`/`duplication`/`tests`/`sec_reviewer`: 0 raised (regression bestaetigte zusaetzlich per Grep: keine bestehende Test-Assertion haengt am alten `'GENERIC'`-Wert). `ui_reviewer` fand einen ECHTEN, empirisch bestaetigten Zusatzbefund: 7 von 39 im Code verwendeten `defaultCode`-Schluesseln (`Auth.RECOVERY_LOGIN_FAILED`, `Auth.USER_LIST_FAILED`, `Auth.USER_DELETE_FAILED`, `Auth.USER_ROLE_UPDATE_FAILED`, `Auth.USER_SUPPORT_UPDATE_FAILED`, `Auth.PASSKEY_CANCELLED`, `Auth.MFA_CHALLENGE_FAILED`) waren in KEINER der 4 Sprachen registriert — waeren also auch nach dem Code-Precedence-Fix weiterhin roh statt uebersetzt angezeigt worden. Auf Operator-Wunsch ("zuerst das angehen... stoert mich schon lange, auch dass die Meldungen nicht sauber uebersetzt sind") direkt mitgefixt: alle 7 Keys in `src/i18n/authTranslations.ts` ergaenzt (de/fr/en/sw), Stil an bestehende Nachbar-Keys angelehnt. Erneuter Scan aller 39 Aufrufstellen gegen die Uebersetzungsdatei: 0 fehlend. Tests: `npx vitest run tests/authErrors.test.js tests/authErrorCodeRendering.test.jsx tests/authApiLogin.test.js tests/authApiRegistration.test.js tests/authTranslations.test.js tests/i18nAggregate.test.js` 29/29 gruen. **MINOR-Bump 3.5.1 -> 3.6.0** (nicht PATCH) — aendert beobachtbares Verhalten fuer jeden `{detail}`-foermigen Fehler, keine rein additive Aenderung; Changelog warnt Konsumenten explizit, ihre Fehleranzeige nach dem Pin-Bump gegenzupruefen. |
 | MSG-19 | `DirectMessageLauncher` recipient picker: searchable Autocomplete replaces the flat List | Operator request: the new-DM recipient picker had no search, the same friction the fleet's own "Einfache Bedienung schlägt Vollständigkeit" rule already names ("a picker without search stops working long before the list feels long"). The `List`/`ListItemButton` picker is replaced with an MUI `Autocomplete` bound to the same `selectedId`/`selectedCandidate` state; the component's public prop contract (`candidates`, `scope`, `onOpen`) and its `start()`/scope-resolution logic are unchanged — only the picker's own rendering and selection mechanism changed. | 2026-09-05 | done | 7d99d82 | No WO file — operator-requested, fixed directly. Tier 3 (shared-core, `ui-core-micha`). Only current consumer of this component: jg-ferien (confirmed via a fleet-wide grep for `DirectMessageLauncher`), and jg-ferien's own tests fully mock it, so this change has zero blast radius there until jg-ferien separately bumps its `@micha.bigler/ui-core-micha` pin. Implemented directly in Claude (no Codex dispatch — pure component-level UI change). **review: claude/sonnet · 0 raised** (verified null-safety of `isOptionEqualToValue`/`getOptionLabel` against MUI's own `useAutocomplete` source, confirmed the rewritten test file preserves every one of the original 7 cases plus one new filtering case, confirmed i18n completeness) + **ui_reviewer: claude/sonnet · 4 raised · 4 accepted · worst accepted: defect** — (U1: the new "typed query matches nothing" state had no `noOptionsText` and would have shown MUI's hardcoded, untranslated English default — added `MessagingDirect.NO_MATCHES` in all 4 languages plus a test; U2: the Autocomplete was missing `fullWidth`, breaking from this repo's own one other Autocomplete-in-Dialog convention (`SupportRecoveryRequestsTab.jsx`) and regressing from the old List's full-width block layout — added; U3: reused `MessagingDirect.CANDIDATES`'s old plural-noun wording ("Recipients") as a visible single-select field label read awkwardly — reworded to an instruction-style label ("Select recipient") matching the sibling component's own convention, in all 4 languages; U4 (inferred, not rendered/verified): `autoFocus` on the TextField combined with the dialog's `fullScreen` mobile breakpoint could open the virtual keyboard unprompted — removed `autoFocus` entirely, since MUI's own `Dialog` already focuses the first focusable descendant on open by design, making it redundant). Two additional self-found nits fixed post-review: a defensive null-guard added to `candidateLabel` (matching the sibling `getUserOptionLabel` convention, even though confirmed unreachable under MUI's current calling contract) and a one-line update to `docs/messaging-deviations.md` item 18 (stale reference to "displays... candidate list" not mentioning the new search). Tests: `messagingDirectMessageLauncher.test.jsx` rewritten (9/9 green, up from 7 — the rewrite required discovering and documenting a real jsdom/RTL gotcha: MUI's `Autocomplete` only reacts to a typed value once the input is genuinely `.focus()`-ed, not merely `mouseDown`-ed) + `i18nAggregate.test.js` (4/4) both green; `tsc -p tsconfig.build.json` clean. Version bumped 3.4.0 → 3.5.0 (minor — additive UI capability, no prop-contract change) via the repo's `publish.yml` (push-to-`main` + version bump). jg-ferien bumps its pin separately, in its own repo, once this lands on npm. |

package/dist/auth/UserMenu.js

@@ -1,8 +1,10 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useContext, useState } from 'react';
 import { Avatar, Box, Divider, IconButton, Menu, MenuItem, Typography, } from '@mui/material';
+import { useTheme } from '@mui/material/styles';
 import { useTranslation } from 'react-i18next';
 import { AuthContext } from './AuthContext';
+import { calculateContrastRatio } from '../theme';
 function getInitials(user) {
     var _a, _b, _c, _d, _e, _f;
     if (!user)
@@ -22,8 +24,22 @@ function getDisplayName(user) {
 export function UserMenu({ resolveLink, items = [], profileLink = '/account', avatarSrc }) {
     const { t } = useTranslation();
     const { user, logout } = useContext(AuthContext);
+    const theme = useTheme();
     const [anchorEl, setAnchorEl] = useState(null);
     const open = Boolean(anchorEl);
+    const avatarBackground = theme.palette.primary.main;
+    // True white/black (theme.palette.common.*, always present on any MUI theme,
+    // never a source-level literal), not background.paper/ink.primary: contrast
+    // against true white and true black multiplies to a constant 21 regardless
+    // of the background's luminance, so max(contrastWhite, contrastBlack) is
+    // mathematically guaranteed to be >= sqrt(21) =~ 4.58 for ANY primary.main a
+    // consumer sets -- a near-black token like ink.primary (#212529, luminance
+    // ~0.018, not 0) does not carry that guarantee and left a real gap for a
+    // medium-luminance primary (caught by ui_reviewer, neither required test
+    // exercised the fallback branch that gap lived in).
+    const avatarText = calculateContrastRatio(theme.palette.common.white, avatarBackground) >= 4.5
+        ? theme.palette.common.white
+        : theme.palette.common.black;
     const handleClose = () => setAnchorEl(null);
     const handleProfile = () => {
         handleClose();
@@ -38,6 +54,12 @@ export function UserMenu({ resolveLink, items = [], profileLink = '/account', av
         handleClose();
         (_a = item.onSelect) === null || _a === void 0 ? void 0 : _a.call(item);
     };
-    return (_jsxs(_Fragment, { children: [_jsx(IconButton, { "aria-label": t('UserMenu.TITLE'), color: "inherit", onClick: (event) => setAnchorEl(event.currentTarget), children: _jsx(Avatar, { src: avatarSrc, sx: { width: 32, height: 32, fontSize: '0.8rem' }, children: avatarSrc ? null : getInitials(user) }) }), _jsxs(Menu, { anchorEl: anchorEl, anchorOrigin: { horizontal: 'right', vertical: 'bottom' }, onClose: handleClose, open: open, transformOrigin: { horizontal: 'right', vertical: 'top' }, children: [_jsxs(Box, { sx: { minWidth: 240, px: 2, py: 1 }, children: [_jsx(Typography, { variant: "subtitle1", noWrap: true, children: getDisplayName(user) }), (user === null || user === void 0 ? void 0 : user.email) && user.email !== getDisplayName(user) && (_jsx(Typography, { variant: "body2", color: "text.secondary", noWrap: true, children: user.email }))] }), _jsx(Divider, {}), _jsx(MenuItem, { onClick: handleProfile, children: t('UserMenu.PROFILE') }), items.length > 0 && _jsx(Divider, {}), items.map((item) => (_jsx(MenuItem, { onClick: () => handleItemSelect(item), children: item.label }, item.id))), _jsx(Divider, {}), _jsx(MenuItem, { onClick: handleLogout, children: t('UserMenu.LOGOUT') })] })] }));
+    return (_jsxs(_Fragment, { children: [_jsx(IconButton, { "aria-label": t('UserMenu.TITLE'), color: "inherit", onClick: (event) => setAnchorEl(event.currentTarget), children: _jsx(Avatar, { src: avatarSrc, sx: {
+                        width: 32,
+                        height: 32,
+                        fontSize: '0.8rem',
+                        bgcolor: avatarBackground,
+                        color: avatarText,
+                    }, children: avatarSrc ? null : getInitials(user) }) }), _jsxs(Menu, { anchorEl: anchorEl, anchorOrigin: { horizontal: 'right', vertical: 'bottom' }, onClose: handleClose, open: open, transformOrigin: { horizontal: 'right', vertical: 'top' }, children: [_jsxs(Box, { sx: { minWidth: 240, px: 2, py: 1 }, children: [_jsx(Typography, { variant: "subtitle1", noWrap: true, children: getDisplayName(user) }), (user === null || user === void 0 ? void 0 : user.email) && user.email !== getDisplayName(user) && (_jsx(Typography, { variant: "body2", color: "text.secondary", noWrap: true, children: user.email }))] }), _jsx(Divider, {}), _jsx(MenuItem, { onClick: handleProfile, children: t('UserMenu.PROFILE') }), items.length > 0 && _jsx(Divider, {}), items.map((item) => (_jsx(MenuItem, { onClick: () => handleItemSelect(item), children: item.label }, item.id))), _jsx(Divider, {}), _jsx(MenuItem, { onClick: handleLogout, children: t('UserMenu.LOGOUT') })] })] }));
 }
 export default UserMenu;

package/dist/components/EmptyState.js

@@ -0,0 +1,17 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Box, Button, Typography } from '@mui/material';
+import { cloneElement } from 'react';
+/**
+ * A shared, compact presentation for an empty section: optional decorative icon,
+ * title, supporting description, and an optional outlined action.
+ */
+export default function EmptyState({ icon, title, description, action, sx }) {
+    return (_jsxs(Box, { sx: [{
+                display: 'flex',
+                flexDirection: 'column',
+                alignItems: 'center',
+                gap: 1,
+                p: 2,
+                textAlign: 'center',
+            }, sx], children: [icon && (_jsx(Box, { sx: { color: 'text.secondary', display: 'flex' }, children: cloneElement(icon, { 'aria-hidden': true, focusable: false }) })), _jsx(Typography, { component: "p", children: title }), description && (_jsx(Typography, { component: "p", variant: "body2", color: "text.secondary", children: description })), action && (_jsx(Button, { type: "button", variant: "outlined", onClick: action.onClick, children: action.label }))] }));
+}

package/dist/components/UserListComponent.js

@@ -84,6 +84,7 @@ export function UserListComponent({ roles = DEFAULT_ROLES, currentUser, extraCol
                 await updateUserRole(userId, newRole);
             }
             await loadUsers();
+            alert(t('UserList.ROLE_UPDATE_SUCCESS', 'Role updated.'));
         }
         catch (err) {
             alert(t(err.code || 'Auth.USER_ROLE_UPDATE_FAILED'));
@@ -375,5 +376,5 @@ export function UserListComponent({ roles = DEFAULT_ROLES, currentUser, extraCol
     return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('UserList.TITLE', 'All Users') }), _jsx(Box, { sx: { mb: 2, maxWidth: 420 }, children: _jsx(TextField, { fullWidth: true, size: "small", label: t('Common.SEARCH', 'Search'), placeholder: t('UserList.SEARCH_PLACEHOLDER', 'Search users...'), value: searchQuery, onChange: (event) => setSearchQuery(event.target.value) }) }), error && _jsx(Alert, { severity: "error", sx: USER_LIST_ALERT_SX, children: t(error) }), loading && (_jsx(Box, { sx: { display: 'flex', justifyContent: 'center', p: 3 }, children: _jsx(CircularProgress, {}) })), !loading && (_jsxs(Box, { sx: { width: '100%' }, children: [_jsx(TableContainer, { sx: { border: 1, borderColor: 'divider', borderRadius: 1 }, children: _jsxs(Table, { size: "small", children: [_jsx(TableHead, { sx: { bgcolor: 'action.hover' }, children: _jsx(TableRow, { children: columns.map((col) => (_jsx(TableCell, { align: col.headerAlign || col.align || 'left', sortDirection: sortField === col.field ? sortDir : false, sx: [USER_LIST_HEADER_CELL_SX, { minWidth: col.minWidth }], children: col.sortable !== false ? (_jsx(TableSortLabel, { active: sortField === col.field, direction: sortField === col.field ? sortDir : 'asc', onClick: () => handleSortClick(col.field), children: col.headerName })) : (col.headerName) }, col.field))) }) }), _jsx(TableBody, { children: pagedUsers.length === 0 ? (_jsx(TableRow, { children: _jsx(TableCell, { colSpan: columns.length, align: "center", sx: USER_LIST_EMPTY_CELL_SX, children: t('UserList.NO_USERS', 'No users found.') }) })) : (pagedUsers.map((row) => (_jsx(TableRow, { hover: true, children: columns.map((col) => (_jsx(TableCell, { align: col.align || 'left', sx: USER_LIST_BODY_CELL_SX, children: col.renderCell(row) }, col.field))) }, row.id)))) })] }) }), _jsx(TablePagination, { component: "div", count: sortedUsers.length, page: page, onPageChange: (_, newPage) => setPage(newPage), rowsPerPage: pageSize, onRowsPerPageChange: (event) => {
                             setPageSize(Number(event.target.value));
                             setPage(0);
-                        }, rowsPerPageOptions: [10, 25, 50, 100] })] }))] }));
+                        }, labelRowsPerPage: t('UserList.ROWS_PER_PAGE', 'Rows per page:'), rowsPerPageOptions: [10, 25, 50, 100] })] }))] }));
 }