@micha.bigler/ui-core-micha 3.9.0 → 3.10.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 3.10.0 — UCM-TEST-1
+
+Added the exported `checkKitIntegration` consumer check for app i18n, providers, kit page rendering, and auth error translation wiring.
+
+## 3.9.1 — UCM-AUTH-11
+
+`UserListComponent` no longer offers an administrator the delete action for their own account, including when a consumer-supplied `canDeleteUser` callback returns true.
+
 ## 3.9.0 — UCM-AUTH-10
 
 Kit auth errors now resolve through explicit backend i18n keys, field-specific keys, code translations,

package/README.md

@@ -10,6 +10,22 @@ To add an entry, create a small component in `dev/entries.jsx` and append it to
 
 Spread `uiCoreTranslations` into the default i18n namespace as the supported aggregate; per-feature translation exports remain available to selective apps that accept responsibility for pairing every adopted feature with its bundle.
 
+## Consumer integration check
+
+```js
+import { checkKitIntegration } from '@micha.bigler/ui-core-micha';
+import i18n from '../i18n';
+import { AppProviders } from '../AppProviders';
+
+it('kit integration is sound', async () => {
+  globalThis.IS_REACT_ACT_ENVIRONMENT = true; // skip if your test setup already sets this
+  const { findings } = await checkKitIntegration({ i18n, wrapper: AppProviders });
+  expect(findings).toEqual([]);
+});
+```
+
+`pages` controls which additional kit pages render (default: `LoginPage`, `SignUpPage`, `PasswordInvitePage`); `LoginPage` itself always renders once more for the error-text check regardless of what `pages` contains. Run this check on its own in its test file — it stubs the kit's shared `apiClient` transport for its duration, so a test running real requests through `apiClient` at the same time would see them intercepted too.
+
 ## Dashboard primitives
 
 `StatTile` (a bordered KPI tile) and `SoftChip` (a soft tinted annotation/status chip, tones derived from `theme.palette[tone]`) live under `src/components/` and are exported from the package root.

package/WORK_ORDERS.md

@@ -19,6 +19,7 @@ rules are defined centrally in `webapps/AGENTS.md` → "Work-Order Register".
 | `I18N-*` | The shared kit's i18n **contract** — how a consumer registers ucm's strings, and what happens when it forgets. Distinct from `AUTH-*`, which owns the auth strings themselves |
 | `PRIM-*` | Shared dashboard/data primitives — small presentational components that are neither chart (`CHART-*`) nor app chrome (`SHELL-*`) |
 | `SHELL-*` | Shared app chrome and navigation shells (`UserMenu`, mobile bottom nav, secondary-navigation shell) — used since `SHELL-1`, documented here 2026-08-11 |
+| `TEST-*` | Consumer integration checks the kit ships for apps to run in their own suites |
 
 Introduce a new prefix when none fits and add it here. New WOs always get a
 prefixed ID; never reuse a bare flat number across workstreams.
@@ -27,6 +28,8 @@ prefixed ID; never reuse a bare flat number across workstreams.
 
 | ID | Titel | Beschreibung | Datum | Status | Commit(s) | Notiz |
 |---|---|---|---|---|---|---|
+| UCM-TEST-1 | A kit integration check every app runs in its own suite | Exported `checkKitIntegration({ i18n, wrapper, pages })` -> `{ findings }` (shape of `assertThemeComplete`): kit keys present in the app's i18n, one `i18next` instance, kit pages render in the app's providers without raw keys, the `invalid`-email case shows the field text. Replaces per-app hand-written wiring tests and manual auth walks. Full order [`work-orders/UCM-TEST-1.md`](work-orders/UCM-TEST-1.md) | 2026-10-01 | done | 2cde120 | Tier 3 (shared-core, auth surface) · operator decision 2026-10-01: central check, apps adopt with their next bump · companion: `workflow-templates` WFT-CI-31. Codex implemented (available today, no fallback). Orchestrator independently found + fixed before review: a false-positive in the raw-code render heuristic (a legitimate short lowercase kit-shipped value, e.g. German `"oder"` for `Auth.LOGIN_OR`, would otherwise be flagged as a leaked backend code — added a `KIT_VALUES` exemption + a pinning test), and independently proved Required Test 5 (resolver-bypassed -> error-text finding) via a transient mutation of `resolveErrorText.js`, restored clean. Independent `reviewer` (all 4 lenses) + `ui_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui · 9 raised · 6 accepted · worst accepted: blocker**. Accepted and fixed: catalogue check didn't force `fallbackLng: false` per lookup, so a consumer's own `fallbackLng` config (survey_app's is `"de"`, not `"false"`) could silently resolve a missing-language key through the fallback and mask it (tests lens) — fixed, plus a dedicated test using a real fallback-configured instance; Required Test 6 only checked adapter reference-identity, not that a real post-check request actually reaches the real adapter (envelope lens) — strengthened with a sentinel-adapter test; React 19's `act()` needs `IS_REACT_ACT_ENVIRONMENT`, undocumented for consumers (ui lens) — added to the README example; README's `pages` description implied it fully replaces the default set, when `LoginPage` always additionally renders for the error-text check regardless (ui lens, nit) — clarified. Accepted, documented rather than redesigned: mutating the shared `apiClient.defaults.adapter` for the check's duration is process-wide and could intercept a concurrent real request from other code in the same test file (regression lens, blocker) — this is the Envelope's own decided stub design (`src/utils/auth-errors.js`-style module-singleton stubbing, same pattern already used throughout this suite), not fixable without abandoning that decision; added a README caveat instead of restructuring. Rejected: `RAW_CODE` only matches lowercase-snake-case, missing uppercase/hyphenated shapes (envelope + tests lenses, same point from both) — every real backend error code in this codebase (`src/utils/auth-errors.js`, allauth headless responses) is lowercase snake_case; widening the regex matches no real shape here and raises false-positive risk for marginal benefit. `KIT_VALUES` could let a leaked code evade detection if it coincidentally equals a real kit translation value (tests lens) — true but reintroducing the "oder" false positive to close it is a worse trade; no real backend code collides with the kit's UI copy in practice. The correctly-wired/legitimate-word/resolver/adapter-restore tests would all pass against a hardcoded `{findings:[]}` stub in isolation (tests lens, nit) — true of any happy-path assertion; each is paired with a failure-case test proving the same code path actually detects the defect (Required Tests 2-5), which is where the real proof lives. `duplication`: no capability-level overlap with `assertThemeComplete` or any shared-core/app module. **Verification** (WO's own instruction): ran `checkKitIntegration` once against survey_app's real wiring — not by touching that repo, but from inside this repo's own resolved environment, replicating `survey_app/frontend/i18n/index.js`'s real merge + config exactly (`fallbackLng: "de"`, survey_app's actual `translations.json`) plus this repo's real `AuthProvider` — **result: `findings: []`**, including against the real fallback-configured instance the tests-lens finding above was about. Orchestrator's own scoped run: `tests/checkKitIntegration.test.jsx` + `tests/resolveErrorText.test.js` (12 tests) + 7 directly-dependent files (33 tests) = 45/45 green via `npx vitest run <files> --pool=threads --maxWorkers=1`. No rendered gate — library-only change, no running app to preview. **Released as `3.10.0`** (minor — new exported capability, per the WO's own instruction). Per-app adoption rows are added by the Expertenchat when each app's next bump is scoped — not part of this WO. |
+| UCM-AUTH-11 | [`UserListComponent` offers an admin the delete action on their own row](work-orders/UCM-AUTH-11.md) | Without a `canDeleteUser` prop, `canDelete` falls back to `canEdit`, which is true for a superuser or role `admin` on EVERY row, their own included (`src/components/UserListComponent.jsx` `defaultCanEdit`/`canDelete`, ~l.128-156); the backend (dcm) still allows an admin's generic self-delete. Default should never offer deleting one's own row. | 2026-09-30 | released | 83bac37 | From django-core-micha `DCM-AUTH-4` (dropped there): operator decision 2026-09-30, UI-only, backend unchanged. Affected consumers measured: kerzenziehen and reimbursements render ucm's `AccountPage` without props (jg-ferien passes its own `userListCanDeleteUser` and already excludes itself). Both apps pin ucm **2.41.3**, so reaching them needs a major bump (3.0.0 removed chart layout props) — tracked as its own follow-up, not this WO. Gate #1 approved 2026-09-30 (operator handover). Codex implemented (available today, no fallback): new `isOwnRow(targetUser)` helper (`String(id) === String(id)`, `false` whenever either id is unresolved — covers the loading-state risk) gates the delete button's RENDER — `{showDeleteAction && !isOwnRow(row) && (...)}` — not its `disabled` state, so a consumer's `canDeleteUser` returning `true` for the own row cannot bring the button back; `canDelete`/`canEdit`/`defaultCanEdit` untouched. Independent `reviewer` (all 4 lenses) + `ui_reviewer` + `sec_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui,sec · 3 raised · 1 accepted · worst accepted: nit**. Accepted (nit, tests lens): the committed fixtures only ever used numeric ids for both `currentUser` and the own row, so a strict-equality implementation would have passed every committed test despite violating the Envelope's own `3`/`"3"` identity requirement — added a fifth case with a string-vs-number id mismatch. Rejected: envelope lens's claim that "Required Test 5 (mutation proof) is missing" — the WO's own Part B (mirroring `UCM-THEME-15`/`UCM-PRIM-2`'s established pattern in this repo) asks for a TRANSIENT demonstration during implementation, not a permanent fifth test case; the implementer's own `PROGRESS` narration confirms it removed the gate, watched tests 1 and 3 fail (2 delete buttons found instead of 1), then restored — exactly as asked. Envelope lens's claim that "package.json remains 3.9.0 so the release is incomplete" — true at the moment the reviewer read the diff (version bump + register are the Orchestrator's own finalize step, explicitly forbidden to the implementer), not a defect in the change itself; done now. `regression`/`duplication`/`ui`/`sec` lenses: no findings — `sec_reviewer` specifically confirmed the render-gate cannot be reopened via `canDeleteUser`/`canEditUser`/`extraRowActions`, and that the backend's own continued refusal of an admin's self-delete (`DCM-AUTH-4`) means this UI-only fix is not masking a still-open server-side gap. Orchestrator's own scoped run: `tests/UserListComponent.test.jsx` 7/7 green + `tests/userScreenTranslations.test.jsx` (directly-dependent, also renders this component) 4/4 green, via `npx vitest run <files> --pool=threads --maxWorkers=1` (default fork pool repeatedly failed to start workers in this sandbox — an environment flake, not a code issue). No rendered gate — library component, no running app to preview; unit-tested only. **Released as `3.9.1`** (patch — behaviour fix of an existing component, no API change, per the WO's own instruction). `npm view @micha.bigler/ui-core-micha version` will read `3.9.1` once the registry's version-list index catches up to the just-completed publish (provenance-signed publishes report success immediately but can take a few minutes to appear in `npm view`/the registry API — confirmed via the GitHub Actions job log on the prior `UCM-AUTH-10` release, not re-verified here to avoid the same registry-lag false alarm). **Not done in this session** (per the WO's own Part C): registering the kerzenziehen/reimbursements major-bump follow-up rows in their own `WORK_ORDERS.md` registers — flagged for whoever next works in those repos. |
 | UCM-AUTH-10 | Error texts never show a raw backend code | One resolver for every kit error display: backend `i18nKey` > field key `Auth.field.<field>.<code>` > code key (AUTH-2) > backend message > caller default; `apiClient` sends the UI language as `Accept-Language`; `invalid`/`required` field keys for every submitted field; ~40 call sites migrated; reconstructs the missing 3.7.0 changelog entry. Full order [`work-orders/UCM-AUTH-10.md`](work-orders/UCM-AUTH-10.md) | 2026-09-30 | done | 9019d3d | Tier 3 (shared-core, auth screens, header on every request) · operator decision 2026-09-30: code-based UI, backend message as last specific fallback, UI language sent to the backend · found in `survey_app` SVA-DEP-1 acceptance (pre-existing, not a bump regression). Codex implemented (available today, no fallback): new `src/utils/resolveErrorText.js` (plain function, not a hook — called inside `catch` blocks) implementing steps 0-4 via `i18n.exists`/`i18n.t`; `extractErrorInfo`/`normaliseApiError` now carry `field` (`param` allauth / `field` dcm, normalised to one name), `i18nKey`, and `backendMessage` (never falls back to the code — the literal bug) as separate fields; `apiClient` gained a request interceptor sending `Accept-Language: i18next.language` only when `i18next.isInitialized` (never guesses); ~40 call sites across 22 files migrated to the uniform pattern (state now always holds resolved display text, never a bare key; render sites dropped their `t()` wrapper); 48 new `Auth.field.<field>.{invalid,required}` keys (24 fields, enumerated from `authApi.jsx`, all 4 locales + `de_informal` where wording differs); `CHANGELOG.md`'s missing `3.7.0` entry reconstructed. Independent `reviewer` (all 4 lenses) + `ui_reviewer` + `sec_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui,sec · 12 raised · 4 accepted · worst accepted: defect**. Accepted: (defect, envelope lens — a real guard blind spot) `MFAComponent.jsx`'s `setErrorKey('Auth.MFA_TOTP_ALREADY_ACTIVE')` was a plain literal-key setter the mechanical sweep missed — the call-site-guard test only matches the `.code` pattern, not "any literal setter needs `t()` now that render dropped its wrapper"; would have displayed the raw key on screen, exactly the bug this WO exists to fix. Fixed (wrapped in `t()`); no dedicated test exists for this component, fix verified by direct code inspection only. (nit, ui_reviewer) the new field-key catalogue omitted `RegistrationMethodsManager.jsx`'s 5 boolean policy-toggle fields (`allow_admin_invite`, `allow_self_signup_{access_code,open,email_domain,qr}`); added, all 4 locales. (nit, tests lens) `resolveErrorText.test.js`'s "dcm field shape" case was byte-identical to the allauth-shape case, testing nothing new (the param/field normalisation it claimed to cover already happens one layer down, in `extractErrorInfo`, and is genuinely tested there); removed the redundant duplicate. Rejected: 2 lenses (envelope, ui_reviewer) claimed `SupportRecoveryRequestsTab.jsx` calls `resolveErrorText(i18n, …)` without destructuring `i18n` — verified directly against the file twice, `const { t, i18n } = useTranslation()` is present at line 42 and every call site is a closure over it; a stale/misread finding from both lenses, not a real defect. 3 lenses (envelope, regression, tests) flagged step 3 (`backendMessage` rendered verbatim) as an exposure risk — this is the Envelope's own **decided** design (`Operator decision: … the backend message as the last specific fallback`), not an implementation defect; `sec_reviewer` — the lens specifically briefed with dcm's S4 audit-log rationale and tasked with exactly this question — found no HTML-injection path and confirmed React's text-node escaping covers every render site, which is what the Envelope's own risk-review request was actually asking. `sec_reviewer` additionally flagged `BulkInviteCsvTab.jsx:88`'s `err.message` and `PasswordInvitePage.jsx:117`'s `err.raw.messages` as chain bypasses — the former is a purely local CSV-file-read error with no backend response involved at all (confirmed no `apiClient` call in that `try` block), the latter is `UCM-AUTH-9`'s already-shipped, already-reviewed password-rejection-reason display, unchanged by this WO and out of scope per its own non-goal ("no change to which errors are shown, where, or what triggers one"). `envelope`+`tests` lenses' claim that `auth-errors.js`'s native `.message` still falls back to the code — deliberate, per this WO's own Part B ("you may leave `err.message` with its existing fallback-to-code behaviour untouched") and covered by the implementer's own test; the field the resolver actually reads (`backendMessage`) correctly never falls back, which is what the Envelope's separation requirement is about. Orchestrator's own scoped run: 14 files, 102 tests green (`resolveErrorText`/`loginPageErrorResolution`/`errorCallSiteGuard`/`apiClientLanguage`/`authErrors`/`AccountPage`/`PasswordInvitePage`/`SignUpPage`/`UserListComponent`/`QrSignupManager.registrationContext`/`i18nAggregate`/`authTranslations`/`themeCompleteness`/`i18nGermanVariant`), via `npx vitest run <files> --pool=threads --maxWorkers=1` (the default fork pool repeatedly failed to start workers in this sandbox — an environment flake, not a code issue; the threads pool is stable). **Verification (the operator's exact screenshot case, rendered end to end):** `en` → "Enter a valid email address."; `de` → "Bitte geben Sie eine gültige E-Mail-Adresse ein." — both resolve via step 1 (`Auth.field.email.invalid`), never the raw `invalid` code, confirmed by `tests/loginPageErrorResolution.test.jsx` (`en`) and by the locale-agnostic resolver design (same key, `de` value) for `de`. No rendered browser gate — verified via the real `LoginPage` component rendered against a real i18next instance in the test harness. **Released as `3.9.0`** (minor, per the Envelope's own instruction — `resolveErrorText` is internal-only, not part of the public `src/index.js` surface). `npm view @micha.bigler/ui-core-micha version` should read `3.9.0` once `publish.yml` runs on this push. No consumer bump in this session (non-goal). |
 | UCM-THEME-15 | Derive status and control-border colours against the theme's own page | Baseline-supplied status `main` and `controlBorder` colours are derived against `#FFFFFF` + `background.default` (like `controlBorder.focus`), only when they would fail; a passing theme resolves byte-identically, app-set values are never touched. Full order [`work-orders/UCM-THEME-15.md`](work-orders/UCM-THEME-15.md) | 2026-09-29 | done | 4515e73 | Tier 3 (inside shared-core) · operator decision 2026-09-29: option (a), no exemptible contrast findings · unblocks `survey_app` SVA-THEME-1 and `survey_contact_app` SCA-THEME-1 (site half) after their pin bumps · lands before UCM-THEME-14. Gate #1 carried by the committed Envelope + mini-handover. Codex implemented (available today, no fallback): new `deriveDarkenedPageColour`/`deriveAlphaPageColour` helpers alongside (not replacing) the untouched `deriveFocusColour`/`clearsContrast`, using the kit's own alpha-aware `calculateContrastRatio` (not MUI's `getContrastRatio`, which is not documented to alpha-composite — matters for the translucent `controlBorder.main`/`.hover`); rule 3 (baseline vs app-supplied) checked per-key straight off `appConfig.palette`, never the resolved theme; `withMainShades` exported from `tokens.js` (internal-only, not part of the public package surface) so re-derivation reuses the real shade formula instead of duplicating it. Independent `reviewer` (all 4 lenses) + `ui_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff), `ui_reviewer` specifically traced rule 3 through every merge path (the three-arg `paletteTheme` build and the final layered `createTheme` call) including a partial `controlBorder` override (app sets `.hover` only) — confirmed no defect, per-key checks hold: **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui · 6 raised · 3 accepted · worst accepted: defect**. Accepted (defect, tests+envelope lenses, same finding): the app-override test only covered `success.main`/`controlBorder.main`, leaving `warning`/`error`/`info` and `controlBorder.hover`/`.error` unpinned — extended to cover a second overridden status + all three `controlBorder` states, plus asserted the two NOT-overridden status keys (`error`/`info`) still derive normally on the same tinted page (proves rule 3 is per-key, not per-object). (defect, tests lens) the termination test asserted only the status-derivation path terminates — added assertions that `controlBorder.main/hover/error` are also defined (not thrown) on the unreachable page. (nit, ui_reviewer) `DESIGN.md` said the baseline "promises a passing colour" — overstated, since capped derivation can still leave an unreachable page failing; softened to name the cap explicitly. Rejected: nit that exporting `withMainShades` violates "no API change" (it is an internal `tokens.js`↔`createAppTheme.js` module export, never re-exported from the public `src/index.js` surface — verified directly, zero consumer-visible surface change); nit that the byte-identity test "isn't evidence of the new derivation" (it is a different, explicitly required test — Required Test #2 — a regression/parity guard, not required to also prove the derivation path, which tests #1/#3/#4 already do). Orchestrator's own scoped run: `tests/createAppThemePageContrast.test.js` 9/9 green + 45/45 directly-dependent (`createAppTheme`/`themeCompleteness`), all via `npx vitest run <files> --maxWorkers=1`. No rendered gate — library component, no running app to preview; unit-tested only. **Verification data (re-derived from the built themes, per the Envelope's own acceptance criterion):** baseline `#FAFAFA` — unchanged (`success #1B8038`/`warning #976100`/`error #BF3227`/`info #01579B`/`border.main rgba(33,37,41,.50)`/`border.hover rgba(33,37,41,.65)`/`border.error #BF3227`). `hafen #D8E4E1`, `jg-fegbern #eceae2`, `routing #E8EAF6`, `uph #E6EAF0` (all four move the same two channels): `success rgb(24-25,115-121,50-53)`, `warning rgb(135-143,87-92,0)`, `border.main rgba(33,37,41,0.55)`; `error`/`info`/`border.hover`/`border.error` unchanged (matches the Envelope's table — only success/warning/border.main failed on these). `ygbs #E398C7` (all measured channels failed, all move): `success rgb(16,76,33)`, `warning rgb(90,58,0)`, `error rgb(124,32,25)`, `info rgb(0,65,116)`, `border.main rgba(33,37,41,0.6)`, `border.error rgb(171,45,35)`; `border.hover` unchanged (`.65` alpha already clears 3:1 even on this page). **Released as `3.8.0`** (minor: changed default for currently-failing themes only, no API change, no adopted app moves — per the Envelope's own framing). `npm view @micha.bigler/ui-core-micha version` should read `3.8.0` once `publish.yml` runs on this push. Next: add `planned` pin-bump rows in `survey_app/WORK_ORDERS.md` and `survey_contact_app/WORK_ORDERS.md` (from `2.41.3`, classify via the dependency-bump test in `AGENTS.md` → Tiering) and unblock `SVA-THEME-1`/`SCA-THEME-1` — not done in this session, flagged for the next one touching those repos. |
 | UCM-I18N-4 | [Formal/informal German per consumer; translate hard-coded English in user list and invite panel](work-orders/UCM-I18N-4.md) | Auth bundle gains an informal ("du") German variant chosen at registration time (default stays formal); `UserListComponent`, `UserInviteComponent` and `BulkInviteCsvTab` get keys for their hard-coded English. | 2026-09-29 | done | f4dfbe6 | Raised from jg-ferien's local browser test 2026-09-29; operator 2026-09-29: generic fixes go to ucm. From jg `JG-UX-10`. Tier 3 (inside shared-core). Gate #1 approved 2026-09-29 (operator handover covering UCM-PRIM-2/SHELL-7/MSG-20/AUTH-9/I18N-4, last of the five, released together). Codex implemented (available today, no fallback): new `createUiCoreTranslations({germanVariant})` export (the existing `uiCoreTranslations` object stays untouched, byte-identical, for every consumer that doesn't opt in); 39 `authTranslations` entries whose `de` value matched a Sie/Ihr-form word-boundary scan got a sibling `de_informal` rewording (disclosed: machine-translated by the implementing model, not reviewed by a fluent German speaker, same disclosure standard as `I18N-3`'s Swahili backfill); 25 new keys for the hard-coded English already referenced via `t(key, englishFallback)` in `UserListComponent`/`UserInviteComponent`/`BulkInviteCsvTab`, plus one real code change (`labelRowsPerPage` wired on the `TablePagination`, the one string MUI supplies itself with no `t()` call at all). Independent `reviewer` (all 4 lenses) + `ui_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui · 9 raised · 2 accepted · worst accepted: defect**. Accepted: (defect, tests lens) the variant-switch test checked only one hardcoded representative key, so a factory stubbed to that one pair would have passed — added a second test iterating EVERY Sie-form key against its own `de_informal`/`de`, not one example. (defect, tests lens) the German-screen render test never exercised the empty-list (`UserList.NO_USERS`) or CSV-parse-error paths — added a case for both. Rejected: 3 lenses (envelope, regression, ui) claimed `UserList.DELETE_CONFIRM` "has no `de_informal`" — checked directly against the reviewed diff, the field was present (`de_informal: "Möchtest du diesen Benutzer wirklich löschen?"`); a stale/misread finding, not a real gap. "The parity test only checks Sie-regex-matched keys, not literal key-set parity" (4 lenses) — deliberate: a literal key-set-parity check is vacuously true here by construction (the factory falls back to formal `de` for any key with no override), so it would assert nothing; the Sie-form coverage test is what actually encodes the Risk note's failure mode (a formal key silently uncovered) and only formal-register German is linguistically incapable of avoiding the literal words "Sie"/"Ihr-", so the regex is a complete capture method for this bundle, not a narrow one. "`uiCoreTranslations` is no longer byte-identical, now carries `de_informal`" (regression lens) — accepted as a description, not as a defect: the `I18N-1`/`I18N-3` invariant this could threaten (`uiCoreTranslations[key]` structurally equals its source bundle's per-key value) is unaffected since BOTH sides now carry the same extra field consistently; every existing consumer's flatten-into-i18next-resources loop only reads named locale keys and silently ignores unknown ones (verified against `jg-ferien/frontend/i18n/index.js`'s actual merge loop). **Also found and fixed by the Orchestrator, not by a reviewer:** the implementer's `UserList.DELETE_CONFIRM` used informal "du" as its DEFAULT (`de`) value instead of formal "Sie" — the one new hardcoded-string key that actually needed register-dependent wording and got it backwards, breaking "default stays formal for existing consumers" for that one string; fixed the default to Sie-form and gave it a proper `de_informal` (now covered by the strengthened parity test). Orchestrator's own scoped run: 8/8 new (`i18nGermanVariant`/`userScreenTranslations`, incl. the two added cases) + 60/60 directly-dependent (`i18nAggregate`/`authTranslations`/`themeCompleteness`/`UserListComponent`), all via `npx vitest run <files> --maxWorkers=1`. No rendered gate — library component, no running app to preview; unit-tested only. **Released as `3.7.0`** (minor: two new public surfaces — `EmptyState` from `PRIM-2`, `createUiCoreTranslations` here — additive only, nothing removed); this lands all five WOs (`PRIM-2`/`SHELL-7`/`MSG-20`/`AUTH-9`/`I18N-4`) in one combined release per the operator's handover instruction. **`npm view @micha.bigler/ui-core-micha version` should read `3.7.0` once `publish.yml` runs on this push** — jg-ferien's pin bump (with the `germanVariant` option set) is that app's own separate step, not done here. |

package/dist/components/UserListComponent.js

@@ -121,6 +121,11 @@ export function UserListComponent({ roles = DEFAULT_ROLES, currentUser, extraCol
         }
         return canEdit(targetUser);
     };
+    const isOwnRow = (targetUser) => {
+        if ((currentUser === null || currentUser === void 0 ? void 0 : currentUser.id) == null || (targetUser === null || targetUser === void 0 ? void 0 : targetUser.id) == null)
+            return false;
+        return String(targetUser.id) === String(currentUser.id);
+    };
     const listContext = useMemo(() => ({
         currentUser,
         extraContext,
@@ -333,7 +338,7 @@ export function UserListComponent({ roles = DEFAULT_ROLES, currentUser, extraCol
                         return (_jsx(Button, { size: "small", variant: "outlined", onClick: () => runRowAction(action, row), disabled: isBusy || isDisabled, sx: USER_LIST_ACTION_SX, children: typeof action.label === 'function'
                                 ? action.label({ user: row, t, currentUser, canEdit: canEdit(row) })
                                 : action.label }, `${action.key}-${row.id}`));
-                    }), showDeleteAction && (_jsx(Tooltip, { title: t('Common.DELETE', 'Delete'), children: _jsx("span", { children: _jsx(Button, { size: "small", variant: "outlined", color: "error", startIcon: _jsx(DeleteIcon, {}), onClick: () => handleDelete(row.id), disabled: !canDelete(row), sx: USER_LIST_ACTION_SX, children: t('Common.DELETE', 'Delete') }) }) }))] })),
+                    }), showDeleteAction && !isOwnRow(row) && (_jsx(Tooltip, { title: t('Common.DELETE', 'Delete'), children: _jsx("span", { children: _jsx(Button, { size: "small", variant: "outlined", color: "error", startIcon: _jsx(DeleteIcon, {}), onClick: () => handleDelete(row.id), disabled: !canDelete(row), sx: USER_LIST_ACTION_SX, children: t('Common.DELETE', 'Delete') }) }) }))] })),
         };
         return [...baseColumns, ...mappedExtraColumns, actionColumn];
     }, [
@@ -352,6 +357,7 @@ export function UserListComponent({ roles = DEFAULT_ROLES, currentUser, extraCol
         loadUsers,
         canEdit,
         canDelete,
+        isOwnRow,
     ]);
     const sortedUsers = useMemo(() => {
         const col = columns.find((c) => c.field === sortField);

package/dist/index.js

@@ -6,6 +6,8 @@
 import './theme/fonts';
 // --- 0. Theme ---
 export { createAppTheme, assertThemeComplete, assertKitSxDisjoint, calculateContrastRatio, KIT_COMPONENT_SX_REGISTRY, reportOffPaletteColours, reportKitSxBypasses, reportRedundantThemeValues, reportThemeAdoption, THEME_COMPLETENESS_SURFACES, } from './theme';
+// --- 0.1 Consumer integration ---
+export { checkKitIntegration } from './testing/checkKitIntegration';
 // --- 1. Auth Context (Essentiell für den Wrapper) ---
 export { AuthContext, AuthProvider } from './auth/AuthContext';
 export { UserMenu } from './auth/UserMenu';

package/dist/testing/checkKitIntegration.js

@@ -0,0 +1,201 @@
+import React, { act } from 'react';
+import { createRoot } from 'react-dom/client';
+import { MemoryRouter } from 'react-router-dom';
+import i18next from 'i18next';
+import apiClient from '../auth/apiClient';
+import { LoginPage } from '../pages/LoginPage';
+import { SignUpPage } from '../pages/SignUpPage';
+import { PasswordInvitePage } from '../pages/PasswordInvitePage';
+import { uiCoreTranslations } from '../i18n/uiCoreTranslations';
+const KIT_LANGUAGES = ['de', 'en', 'fr', 'sw'];
+const LOGIN_PATH = '/api/auth/browser/v1/auth/login';
+const RAW_CODE = /^[a-z][a-z0-9_]*$/;
+function pageName(Page) {
+    return (Page === null || Page === void 0 ? void 0 : Page.displayName) || (Page === null || Page === void 0 ? void 0 : Page.name) || 'page';
+}
+function appLanguages(i18n) {
+    var _a, _b;
+    const candidates = [
+        (_a = i18n === null || i18n === void 0 ? void 0 : i18n.options) === null || _a === void 0 ? void 0 : _a.supportedLngs,
+        Object.keys(((_b = i18n === null || i18n === void 0 ? void 0 : i18n.options) === null || _b === void 0 ? void 0 : _b.resources) || {}),
+        i18n === null || i18n === void 0 ? void 0 : i18n.languages,
+    ];
+    for (const candidate of candidates) {
+        const languages = Array.isArray(candidate)
+            ? candidate.filter((language) => language && language !== 'cimode')
+            : [];
+        if (languages.length > 0)
+            return languages;
+    }
+    return [];
+}
+function textNodes(container) {
+    var _a;
+    const result = [];
+    const document = container.ownerDocument;
+    const filter = ((_a = document.defaultView) === null || _a === void 0 ? void 0 : _a.NodeFilter) || NodeFilter;
+    const walker = document.createTreeWalker(container, filter.SHOW_TEXT);
+    let node;
+    while ((node = walker.nextNode())) {
+        const text = node.textContent.trim();
+        if (text)
+            result.push(text);
+    }
+    return result;
+}
+const KIT_KEYS = new Set(Object.keys(uiCoreTranslations));
+// Every legitimate string the kit itself ships, across all locales -- a short,
+// all-lowercase, no-space word can still be entirely legitimate rendered prose
+// (e.g. `Auth.LOGIN_OR`'s German value is literally "oder", which the bare
+// RAW_CODE shape below would otherwise flag as a raw backend code). Exempting
+// anything that IS one of the kit's own translated values keeps the check
+// looking for text that is NEITHER a key NOR a real translation -- which is
+// exactly what a leaked backend code is, and a legitimate short word never is.
+const KIT_VALUES = new Set(Object.values(uiCoreTranslations).flatMap((entry) => Object.values(entry)));
+function scanPage(container, name) {
+    return textNodes(container)
+        .filter((text) => (KIT_KEYS.has(text)
+        || (!KIT_VALUES.has(text) && text.length > 2 && RAW_CODE.test(text))))
+        .map((text) => ({
+        check: 'render',
+        reason: `${name} rendered raw kit key or backend code: ${text}`,
+    }));
+}
+async function renderPage(Page, wrapper, initialEntries = ['/']) {
+    const container = document.createElement('div');
+    const root = createRoot(container);
+    try {
+        await act(async () => {
+            root.render(React.createElement(MemoryRouter, { initialEntries }, React.createElement(wrapper, null, React.createElement(Page))));
+            await Promise.resolve();
+        });
+        return { container, findings: scanPage(container, pageName(Page)) };
+    }
+    finally {
+        await act(async () => {
+            root.unmount();
+        });
+    }
+}
+function transportFailure(config) {
+    return Promise.reject(new Error(`checkKitIntegration blocked request: ${(config === null || config === void 0 ? void 0 : config.url) || 'unknown'}`));
+}
+function loginFailure() {
+    return Promise.reject({
+        response: {
+            status: 400,
+            data: {
+                errors: [{
+                        code: 'invalid',
+                        param: 'email',
+                        message: 'The email address is invalid.',
+                    }],
+            },
+        },
+    });
+}
+async function renderFindings(Page, wrapper, initialEntries) {
+    try {
+        const rendered = await renderPage(Page, wrapper, initialEntries);
+        return rendered.findings;
+    }
+    catch (error) {
+        return [{
+                check: 'render',
+                reason: `${pageName(Page)} threw while rendering: ${(error === null || error === void 0 ? void 0 : error.message) || String(error)}`,
+            }];
+    }
+}
+async function errorTextFindings(i18n, wrapper) {
+    const Page = LoginPage;
+    const name = pageName(Page);
+    const container = document.createElement('div');
+    const root = createRoot(container);
+    try {
+        await act(async () => {
+            root.render(React.createElement(MemoryRouter, { initialEntries: ['/login'] }, React.createElement(wrapper, null, React.createElement(Page))));
+            await Promise.resolve();
+        });
+        const inputs = Array.from(container.querySelectorAll('input'));
+        const email = inputs.find((input) => input.type === 'email');
+        const password = inputs.find((input) => input.type === 'password');
+        const form = container.querySelector('form');
+        if (!email || !password || !form) {
+            return [{ check: 'error-text', reason: `${name} did not render its login form.` }];
+        }
+        const setValue = (input, value) => {
+            const setter = Object.getOwnPropertyDescriptor(input.ownerDocument.defaultView.HTMLInputElement.prototype, 'value').set;
+            setter.call(input, value);
+            input.dispatchEvent(new Event('input', { bubbles: true }));
+            input.dispatchEvent(new Event('change', { bubbles: true }));
+        };
+        await act(async () => {
+            setValue(email, 'not-an-email@example.com');
+            setValue(password, 'password');
+            form.dispatchEvent(new Event('submit', { bubbles: true, cancelable: true }));
+            await Promise.resolve();
+            await Promise.resolve();
+        });
+        const expected = i18n.t('Auth.field.email.invalid');
+        const renderedTexts = textNodes(container);
+        if (renderedTexts.includes(expected))
+            return [];
+        return [{
+                check: 'error-text',
+                reason: `${name} did not show ${expected} for the allauth invalid-email response.`,
+            }];
+    }
+    catch (error) {
+        return [{
+                check: 'error-text',
+                reason: `${name} error flow failed: ${(error === null || error === void 0 ? void 0 : error.message) || String(error)}`,
+            }];
+    }
+    finally {
+        await act(async () => {
+            root.unmount();
+        });
+    }
+}
+/** Check that an app's i18n instance and providers wire the kit pages correctly. */
+export async function checkKitIntegration({ i18n, wrapper, pages = [LoginPage, SignUpPage, PasswordInvitePage], }) {
+    const findings = [];
+    const languages = appLanguages(i18n);
+    const sharedLanguages = KIT_LANGUAGES.filter((language) => languages.includes(language));
+    for (const [key] of Object.entries(uiCoreTranslations)) {
+        for (const language of sharedLanguages) {
+            // fallbackLng: false forces a true per-language check -- without it, a
+            // consumer's own fallbackLng config (e.g. "en") would let a key missing
+            // in "fr" silently resolve through the fallback and read as present.
+            if (!(i18n === null || i18n === void 0 ? void 0 : i18n.exists(key, { lng: language, fallbackLng: false }))) {
+                findings.push({
+                    check: 'catalogue',
+                    reason: `Missing kit translation key ${key} for language ${language}.`,
+                });
+            }
+        }
+    }
+    if (!i18next.isInitialized || i18n !== i18next) {
+        findings.push({
+            check: 'instance',
+            reason: 'The app i18n is not the initialized kit default instance; Accept-Language will be missing or wrong.',
+        });
+    }
+    const originalAdapter = apiClient.defaults.adapter;
+    apiClient.defaults.adapter = async (config) => {
+        if ((config === null || config === void 0 ? void 0 : config.url) === LOGIN_PATH || String((config === null || config === void 0 ? void 0 : config.url) || '').endsWith(LOGIN_PATH)) {
+            return loginFailure();
+        }
+        return transportFailure(config);
+    };
+    try {
+        for (const Page of pages) {
+            findings.push(...await renderFindings(Page, wrapper));
+        }
+        findings.push(...await errorTextFindings(i18n, wrapper));
+    }
+    finally {
+        apiClient.defaults.adapter = originalAdapter;
+    }
+    return { findings };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micha.bigler/ui-core-micha",
-  "version": "3.9.0",
+  "version": "3.10.0",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "sideEffects": [

package/src/components/UserListComponent.jsx

@@ -155,6 +155,11 @@ export function UserListComponent({
     return canEdit(targetUser);
   };
 
+  const isOwnRow = (targetUser) => {
+    if (currentUser?.id == null || targetUser?.id == null) return false;
+    return String(targetUser.id) === String(currentUser.id);
+  };
+
   const listContext = useMemo(() => ({
     currentUser,
     extraContext,
@@ -435,7 +440,7 @@ export function UserListComponent({
             );
           })}
 
-          {showDeleteAction && (
+          {showDeleteAction && !isOwnRow(row) && (
             <Tooltip title={t('Common.DELETE', 'Delete')}>
               <span>
                 <Button
@@ -473,6 +478,7 @@ export function UserListComponent({
     loadUsers,
     canEdit,
     canDelete,
+    isOwnRow,
   ]);
 
   const sortedUsers = useMemo(() => {

package/src/index.js

@@ -20,6 +20,9 @@ export {
   THEME_COMPLETENESS_SURFACES,
 } from './theme';
 
+// --- 0.1 Consumer integration ---
+export { checkKitIntegration } from './testing/checkKitIntegration';
+
 // --- 1. Auth Context (Essentiell für den Wrapper) ---
 export { AuthContext, AuthProvider } from './auth/AuthContext';
 export { UserMenu } from './auth/UserMenu';

package/src/testing/checkKitIntegration.js

@@ -0,0 +1,233 @@
+import React, { act } from 'react';
+import { createRoot } from 'react-dom/client';
+import { MemoryRouter } from 'react-router-dom';
+import i18next from 'i18next';
+
+import apiClient from '../auth/apiClient';
+import { LoginPage } from '../pages/LoginPage';
+import { SignUpPage } from '../pages/SignUpPage';
+import { PasswordInvitePage } from '../pages/PasswordInvitePage';
+import { uiCoreTranslations } from '../i18n/uiCoreTranslations';
+
+const KIT_LANGUAGES = ['de', 'en', 'fr', 'sw'];
+const LOGIN_PATH = '/api/auth/browser/v1/auth/login';
+const RAW_CODE = /^[a-z][a-z0-9_]*$/;
+
+function pageName(Page) {
+  return Page?.displayName || Page?.name || 'page';
+}
+
+function appLanguages(i18n) {
+  const candidates = [
+    i18n?.options?.supportedLngs,
+    Object.keys(i18n?.options?.resources || {}),
+    i18n?.languages,
+  ];
+
+  for (const candidate of candidates) {
+    const languages = Array.isArray(candidate)
+      ? candidate.filter((language) => language && language !== 'cimode')
+      : [];
+    if (languages.length > 0) return languages;
+  }
+  return [];
+}
+
+function textNodes(container) {
+  const result = [];
+  const document = container.ownerDocument;
+  const filter = document.defaultView?.NodeFilter || NodeFilter;
+  const walker = document.createTreeWalker(container, filter.SHOW_TEXT);
+  let node;
+  while ((node = walker.nextNode())) {
+    const text = node.textContent.trim();
+    if (text) result.push(text);
+  }
+  return result;
+}
+
+const KIT_KEYS = new Set(Object.keys(uiCoreTranslations));
+// Every legitimate string the kit itself ships, across all locales -- a short,
+// all-lowercase, no-space word can still be entirely legitimate rendered prose
+// (e.g. `Auth.LOGIN_OR`'s German value is literally "oder", which the bare
+// RAW_CODE shape below would otherwise flag as a raw backend code). Exempting
+// anything that IS one of the kit's own translated values keeps the check
+// looking for text that is NEITHER a key NOR a real translation -- which is
+// exactly what a leaked backend code is, and a legitimate short word never is.
+const KIT_VALUES = new Set(
+  Object.values(uiCoreTranslations).flatMap((entry) => Object.values(entry)),
+);
+
+function scanPage(container, name) {
+  return textNodes(container)
+    .filter((text) => (
+      KIT_KEYS.has(text)
+      || (!KIT_VALUES.has(text) && text.length > 2 && RAW_CODE.test(text))
+    ))
+    .map((text) => ({
+      check: 'render',
+      reason: `${name} rendered raw kit key or backend code: ${text}`,
+    }));
+}
+
+async function renderPage(Page, wrapper, initialEntries = ['/']) {
+  const container = document.createElement('div');
+  const root = createRoot(container);
+  try {
+    await act(async () => {
+      root.render(React.createElement(
+        MemoryRouter,
+        { initialEntries },
+        React.createElement(wrapper, null, React.createElement(Page)),
+      ));
+      await Promise.resolve();
+    });
+    return { container, findings: scanPage(container, pageName(Page)) };
+  } finally {
+    await act(async () => {
+      root.unmount();
+    });
+  }
+}
+
+function transportFailure(config) {
+  return Promise.reject(new Error(`checkKitIntegration blocked request: ${config?.url || 'unknown'}`));
+}
+
+function loginFailure() {
+  return Promise.reject({
+    response: {
+      status: 400,
+      data: {
+        errors: [{
+          code: 'invalid',
+          param: 'email',
+          message: 'The email address is invalid.',
+        }],
+      },
+    },
+  });
+}
+
+async function renderFindings(Page, wrapper, initialEntries) {
+  try {
+    const rendered = await renderPage(Page, wrapper, initialEntries);
+    return rendered.findings;
+  } catch (error) {
+    return [{
+      check: 'render',
+      reason: `${pageName(Page)} threw while rendering: ${error?.message || String(error)}`,
+    }];
+  }
+}
+
+async function errorTextFindings(i18n, wrapper) {
+  const Page = LoginPage;
+  const name = pageName(Page);
+  const container = document.createElement('div');
+  const root = createRoot(container);
+  try {
+    await act(async () => {
+      root.render(React.createElement(
+        MemoryRouter,
+        { initialEntries: ['/login'] },
+        React.createElement(wrapper, null, React.createElement(Page)),
+      ));
+      await Promise.resolve();
+    });
+
+    const inputs = Array.from(container.querySelectorAll('input'));
+    const email = inputs.find((input) => input.type === 'email');
+    const password = inputs.find((input) => input.type === 'password');
+    const form = container.querySelector('form');
+    if (!email || !password || !form) {
+      return [{ check: 'error-text', reason: `${name} did not render its login form.` }];
+    }
+
+    const setValue = (input, value) => {
+      const setter = Object.getOwnPropertyDescriptor(
+        input.ownerDocument.defaultView.HTMLInputElement.prototype,
+        'value',
+      ).set;
+      setter.call(input, value);
+      input.dispatchEvent(new Event('input', { bubbles: true }));
+      input.dispatchEvent(new Event('change', { bubbles: true }));
+    };
+
+    await act(async () => {
+      setValue(email, 'not-an-email@example.com');
+      setValue(password, 'password');
+      form.dispatchEvent(new Event('submit', { bubbles: true, cancelable: true }));
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    const expected = i18n.t('Auth.field.email.invalid');
+    const renderedTexts = textNodes(container);
+    if (renderedTexts.includes(expected)) return [];
+    return [{
+      check: 'error-text',
+      reason: `${name} did not show ${expected} for the allauth invalid-email response.`,
+    }];
+  } catch (error) {
+    return [{
+      check: 'error-text',
+      reason: `${name} error flow failed: ${error?.message || String(error)}`,
+    }];
+  } finally {
+    await act(async () => {
+      root.unmount();
+    });
+  }
+}
+
+/** Check that an app's i18n instance and providers wire the kit pages correctly. */
+export async function checkKitIntegration({
+  i18n,
+  wrapper,
+  pages = [LoginPage, SignUpPage, PasswordInvitePage],
+}) {
+  const findings = [];
+  const languages = appLanguages(i18n);
+  const sharedLanguages = KIT_LANGUAGES.filter((language) => languages.includes(language));
+
+  for (const [key] of Object.entries(uiCoreTranslations)) {
+    for (const language of sharedLanguages) {
+      // fallbackLng: false forces a true per-language check -- without it, a
+      // consumer's own fallbackLng config (e.g. "en") would let a key missing
+      // in "fr" silently resolve through the fallback and read as present.
+      if (!i18n?.exists(key, { lng: language, fallbackLng: false })) {
+        findings.push({
+          check: 'catalogue',
+          reason: `Missing kit translation key ${key} for language ${language}.`,
+        });
+      }
+    }
+  }
+
+  if (!i18next.isInitialized || i18n !== i18next) {
+    findings.push({
+      check: 'instance',
+      reason: 'The app i18n is not the initialized kit default instance; Accept-Language will be missing or wrong.',
+    });
+  }
+
+  const originalAdapter = apiClient.defaults.adapter;
+  apiClient.defaults.adapter = async (config) => {
+    if (config?.url === LOGIN_PATH || String(config?.url || '').endsWith(LOGIN_PATH)) {
+      return loginFailure();
+    }
+    return transportFailure(config);
+  };
+
+  try {
+    for (const Page of pages) {
+      findings.push(...await renderFindings(Page, wrapper));
+    }
+    findings.push(...await errorTextFindings(i18n, wrapper));
+  } finally {
+    apiClient.defaults.adapter = originalAdapter;
+  }
+
+  return { findings };
+}