@ultimat3/admin 19.2.0 → 19.3.1

package/CLAUDE.md

@@ -77,6 +77,12 @@ Two products, one package, **two entry points**: `@ultimat3/admin/dev` (`src/dev
   into plain objects, where `__proto__` reads a prototype (so `?? 0` never fires) and WRITES through
   the setter, dropping the row: the policy matrix reported a permission unreachable while an actor
   held it. `Map` + `Object.fromEntries`, which DEFINES each key.
+- **A `/_x` panel orders by CODE UNIT, never `localeCompare`.** `dev/panel-routes.ts` sorted its
+  rows with it, and with no locale argument `localeCompare` answers from the runtime's ICU default
+  locale and collation version — so the same route table reads in a different order on a
+  developer's machine than in the container the same build runs in, and a screenshot of one does
+  not match the other. `(a < b ? -1 : a > b ? 1 : 0)`, inlined: `@ultimat3/render`'s `byCodeUnit`
+  is package-internal, and a comparator is not worth widening a barrel for.
 - **The locale picker reads `registeredLocales()`, not a bundled list.** It was
   `['en','es','de','fr','pt','ja']`, one line under a comment forbidding exactly that for IANA
   zones: an app registering `it` could not pick it, and an app with only `en` was offered five

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/admin",
-  "version": "19.2.0",
+  "version": "19.3.1",
   "description": "Two dashboards: the /_x framework dev panels and the generated, AI-first app admin",
   "license": "MIT",
   "type": "module",
@@ -32,20 +32,20 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/action": "19.2.0",
-    "@ultimat3/ai": "19.2.0",
-    "@ultimat3/cache": "19.2.0",
-    "@ultimat3/core": "19.2.0",
-    "@ultimat3/db": "19.2.0",
-    "@ultimat3/entity": "19.2.0",
-    "@ultimat3/i18n": "19.2.0",
-    "@ultimat3/jobs": "19.2.0",
-    "@ultimat3/mcp": "19.2.0",
-    "@ultimat3/money": "19.2.0",
-    "@ultimat3/policy": "19.2.0",
-    "@ultimat3/query": "19.2.0",
-    "@ultimat3/render": "19.2.0",
-    "@ultimat3/schema": "19.2.0",
-    "@ultimat3/ui": "19.2.0"
+    "@ultimat3/action": "19.3.1",
+    "@ultimat3/ai": "19.3.1",
+    "@ultimat3/cache": "19.3.1",
+    "@ultimat3/core": "19.3.1",
+    "@ultimat3/db": "19.3.1",
+    "@ultimat3/entity": "19.3.1",
+    "@ultimat3/i18n": "19.3.1",
+    "@ultimat3/jobs": "19.3.1",
+    "@ultimat3/mcp": "19.3.1",
+    "@ultimat3/money": "19.3.1",
+    "@ultimat3/policy": "19.3.1",
+    "@ultimat3/query": "19.3.1",
+    "@ultimat3/render": "19.3.1",
+    "@ultimat3/schema": "19.3.1",
+    "@ultimat3/ui": "19.3.1"
   }
 }

package/src/dev/panel-routes.ts

@@ -36,7 +36,12 @@ export const routesPanel: DevPanel<RoutesPanelData> = {
     for (const route of routes) counts.set(route.render, (counts.get(route.render) ?? 0) + 1);
     const byRenderMode = Object.fromEntries(counts);
     return {
-      routes: [...routes].sort((a, b) => a.path.localeCompare(b.path)),
+      // Code units, never `localeCompare`: with no locale argument it answers from the runtime's
+      // ICU default locale and collation version, so the same route table reads in a different
+      // order on a developer's machine than in the container the same build runs in. The
+      // comparator is inlined rather than imported — `@ultimat3/render`'s `byCodeUnit` is
+      // package-internal, and a comparator is not public API worth widening a barrel for.
+      routes: [...routes].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),
       byRenderMode,
       overBudget: routes
         .filter((route) => kb(route.budget.js) > BUDGET_LIMIT_KB)

package/src/dev/server.ts

@@ -125,24 +125,36 @@ let stylePromise: Promise<string> | undefined;
  * served under, and the `style-src` hash it needs is of THIS text — a host that hashed its own
  * copy would send a policy that blocks the document this function actually writes.
  */
-export async function devShellStyle(): Promise<string> {
-  stylePromise ??= import('@ultimat3/ui').then(({ colorTokens }) => {
-    const block = (theme: 'light' | 'dark'): string =>
-      SHELL_ROLES.map((role) => `--x-color-${role}: ${colorTokens[theme][role]};`).join(' ');
-    return `
+export function devShellStyle(): Promise<string> {
+  // One memo, and the clearing catch is attached where the promise is CREATED — the shape
+  // `packages/db/src/pglite.ts`'s `connect()` uses. Re-wrapping on every call
+  // (`stylePromise = stylePromise.catch(…)`, which is what this did) publishes a new promise per
+  // call, each one retaining the last: `/_x` grew that chain by a link per request for the life of
+  // the dev server, and no caller could rely on the memo's identity.
+  if (stylePromise === undefined) {
+    const attempt: Promise<string> = loadShellStyle().catch((error: unknown) => {
+      // A rejected import (a transient resolution failure) must not be memoised, or `/_x` is
+      // unstyled for the life of the process — the `jwks.ts` inflight pattern. Guarded on
+      // identity: a late rejection clears its OWN attempt, never a newer one that has replaced it.
+      if (stylePromise === attempt) stylePromise = undefined;
+      throw error;
+    });
+    stylePromise = attempt;
+  }
+  return stylePromise;
+}
+
+/** The read itself. Dynamic, so the 46-component barrel stays out of the production graph. */
+async function loadShellStyle(): Promise<string> {
+  const { colorTokens } = await import('@ultimat3/ui');
+  const block = (theme: 'light' | 'dark'): string =>
+    SHELL_ROLES.map((role) => `--x-color-${role}: ${colorTokens[theme][role]};`).join(' ');
+  return `
 :root { ${block('light')} }
 @media (prefers-color-scheme: dark) { :root { ${block('dark')} } }
 html[data-theme="light"] { ${block('light')} }
 html[data-theme="dark"] { ${block('dark')} }
 ${SHELL_LAYOUT}`;
-  });
-  // A rejected import (a transient resolution failure) must not be memoised, or `/_x` is
-  // unstyled for the life of the process — the `jwks.ts` inflight pattern.
-  stylePromise = stylePromise.catch((error: unknown) => {
-    stylePromise = undefined;
-    throw error;
-  });
-  return stylePromise;
 }
 
 function shell(