web-mojo 2.2.101 → 2.3.0

package/CHANGELOG.md

@@ -2,7 +2,610 @@
 
 ## Unreleased
 
+### Feature — Cross-origin auth handoff
+
+- `TokenManager.handleAuthCodeFromURL(app)` and `TokenManager.exchangeAuthCode(app, code)` redeem a `?auth_code=<32-hex>` URL param against `POST /api/auth/exchange` on bootstrap. The URL is scrubbed via `history.replaceState` before the network call (security bullet from the django-mojo review) and concurrent callers share one in-flight POST via the same single-flight pattern as `refreshToken()`.
+- `PortalApp.checkAuthStatus()` calls `handleAuthCodeFromURL` before deciding the user is unauthenticated, so portals deployed on a different origin from the auth server boot directly into the authenticated state — no `/login` bounce, no countdown.
+- Parity helpers added to the standalone auth surfaces: `MojoAuth.handleAuthCodeFromURL()` / `MojoAuth.exchangeAuthCode(code)` in `src/extensions/mojo-auth/mojo-auth.js`, and `auth.handleAuthCodeFromURL()` / `auth.exchangeAuthCode(code)` on the object returned by `createAuthClient` in `web-mojo/auth`.
+- New event: `auth:exchange:failed` with `{ error }` payload. Existing `auth:login` is now also emitted by `TokenManager` on a successful exchange. Same-origin auth flows are unchanged — when no `?auth_code=` is present, `handleAuthCodeFromURL` is a synchronous no-op with no network call and no event.
+
+### CSS — Admin assistant panel: dark theme coverage
+
+- The Admin extension's AI Assistant panel (`AssistantPanelView` + the
+  modal-fullscreen `AssistantView`) now honors `[data-bs-theme="dark"]`.
+  Previously the panel header, empty-state hero, suggestion chips,
+  composer input, history rail, conversation search, and thinking
+  indicator all rendered against hardcoded `#fff` / `#f7f7f8` surfaces —
+  loud against the framework's dark portal page (and especially loud
+  against the new `#0a0d11` mission-control palette). Each surface now
+  picks up `--bs-body-bg` / `--bs-tertiary-bg` / `--bs-secondary-bg`
+  under the dark theme. Hover/active states on conversation rows and
+  panel header buttons swap their `rgba(0, 0, 0, ...)` tints for the
+  matching `rgba(255, 255, 255, ...)` values. Light theme is unchanged;
+  no `!important`.
+
+### Feature — Map: disable scroll/zoom interaction at construction time
+
+- New constructor options on `MapView`, `MapLibreView`, and (via
+  `mapOptions`) `MetricsCountryMapView`:
+  - `interactive` (default `true`) — master switch; `false` freezes all
+    user interaction (pan, zoom, keyboard, rotate).
+  - `scrollZoom`, `dragPan`, `doubleClickZoom`, `keyboard`, `touchZoom`
+    (all default `true`) — granular per-handler toggles.
+- Cross-cutting names are translated per backend: `scrollZoom` →
+  Leaflet `scrollWheelZoom`, `dragPan` → Leaflet `dragging`, `touchZoom`
+  → MapLibre `touchZoomRotate`. Both views accept the same wrapper API.
+- Defaults preserve today's fully-interactive behavior; existing call
+  sites are unchanged.
+- `showZoomControl` / `showNavigationControl` remain independent — UI
+  buttons can still be shown on a non-interactive map.
+- Programmatic camera changes (`setView()`, `setZoom()`, `flyTo()`,
+  `setPitch()`, `setBearing()`) are unaffected; the flags only gate
+  user input.
+- Portal example pages (`extensions/map-view`, `extensions/map-libre-view`)
+  show both modes side-by-side.
+
+### CSS — Dark theme: deeper mission-control surface as default
+
+- The framework's `[data-bs-theme="dark"]` palette now uses the deep
+  near-black surfaces previously scoped to `SecurityDashboardPage`:
+  page `#0a0d11`, card/tertiary `#11161d`, secondary `#161b22`, border
+  `#1f2630`, emphasis text `#e6ecf3`, muted text `#8a96a6`. Every
+  dark-mode page in consuming apps will look noticeably deeper and
+  more contrasty on upgrade.
+- **Light theme is unchanged.**
+- **Opt out:** apps that want the previous Bootstrap defaults can
+  override `--bs-body-bg`, `--bs-tertiary-bg`, etc. in their own CSS
+  under `[data-bs-theme="dark"]` — the framework block uses no
+  `!important`, so any later/higher-specificity rule wins.
+- **Removed:** the `SecurityDashboardPage`-scoped overrides in
+  `charts.css` (`.portal-layout:has(.security-dashboard-page)`,
+  `.security-dashboard-page`, and the defensive `.page-container` /
+  `.portal-content` fall-throughs). The dashboard now inherits the
+  global palette seamlessly — no visual change.
+- **Removed:** the `KPITile` `[data-bs-theme="dark"]` `--mojo-kpi-tile-*`
+  variable block. The tile component already falls back through
+  `--bs-tertiary-bg` / `--bs-emphasis-color` / `--bs-secondary-color` /
+  `--bs-border-color`, which now match the original dashboard values
+  1:1, so the dedicated overrides became redundant. The
+  delta-badge and hover tints are kept since they don't map to a
+  Bootstrap token.
+- **`--mojo-sidebar-dark-bg`** now drops to `#0d1117` under
+  `[data-bs-theme="dark"]` so `topnav-dark` and `sidebar-dark` sit
+  one tier above the page (`#0a0d11`) and one tier below cards
+  (`#11161d`) — portal chrome reads as a band rather than a raised
+  tile. The light-mode default (`#343a40`) is unchanged.
+- **`[data-bs-theme="dark"] .sidebar-light`** now uses
+  `var(--bs-secondary-bg)` instead of a hardcoded `#2a2f36`, so the
+  rail stays one step above the page automatically and tracks any
+  future palette tweak.
+- **Topbar default unchanged:** `--mojo-topnav-bg` still resolves to
+  `var(--bs-primary)` (brand-blue topbar) when no `topnav-*` class is
+  set. Consumers who want a deep mission-control topbar should use
+  `topnav-dark`, which now picks up the new `#0d1117`.
+
+### Changed — Admin sidebar Security menu restructured
+
+- **Security Dashboard** is now a top-level sidebar item, placed directly
+  below the system **Dashboard** (route `?page=system/incident-dashboard`,
+  icon `bi-shield-check`).
+- The single 12-child **Security** group has been split into three smaller
+  groups: **System Security** (Tickets, Incidents, Events, Rules),
+  **Network Security** (IPs, IP Sets, Blocked, Firewall Log), and
+  **Bouncer** (Signals, Devices, Bots).
+- Labels were tightened: `Rule Engine` → `Rules`, `GeoIP` → `IPs`,
+  `Blocked IPs` → `Blocked`, `Bouncer Signals` → `Signals`,
+  `Bouncer Devices` → `Devices`, `Bot Signatures` → `Bots`.
+- Routes and per-item permissions are unchanged. Pure menu-config edit in
+  `src/admin.js`; no page registrations or framework APIs changed.
+
+### Feature — SeriesChart axis label visibility
+
+- New `showXLabels` / `showYLabels` options (default `true`) hide the X /
+  Y text labels independently. Gridlines (`showGrid`) are unaffected.
+- When labels are hidden, the plot area grows into the freed padding
+  (`padBottom` 24→8 with `showXLabels: false`, `padLeft` 40→8 with
+  `showYLabels: false`). The X-label auto-rotation extra-padding path is
+  skipped when X labels are hidden.
+- Plumbed through `MetricsChart` so dashboard panels can hide axis text
+  for compact tile-style displays.
+
+### Behavior — SeriesChart hover-dim is now opt-in
+
+- New `highlightOnHover` option on SeriesChart (default `false`). Hovering
+  a bar or dot no longer dims the other series — the dim effect was
+  visually noisy on stacked-bar charts and distracting in dashboard
+  contexts.
+- Pass `highlightOnHover: true` to restore the earlier always-on behavior.
+- Plumbed through `MetricsChart`.
+
+### Behavior — SeriesChart legend default is now top-left
+
+- New `legendJustify: 'start' | 'center' | 'end'` option (default
+  `'start'`). Combined with the existing `legendPosition: 'top'` default,
+  the SeriesChart legend now sits **top-left** instead of top-center.
+- `legendJustify` maps to CSS `justify-content` for both the horizontal
+  flex (top/bottom legends) and the column flex (left/right legends).
+- Invalid values fall back to `'start'` with a `console.warn`.
+- To restore the prior top-center look, pass `legendJustify: 'center'`.
+- Plumbed through `MetricsChart` (and via that, every dashboard chart
+  built on the metrics fetch path).
+
+### Fixed — Modal: descendant dropdowns/popovers no longer clipped at the card edge
+
+- `.modal-content` had `overflow: hidden` (added with the hero-band redesign in
+  `ff27795`) which clipped any absolutely-positioned descendant — `MultiSelectDropdown`,
+  `ComboBox`, `CollectionMultiSelect`, plain Bootstrap `.dropdown-menu`, and any
+  context menu rendered inside a modal body.
+- The hero band's `::before` pseudo-element already declares its own matching
+  `border-radius: 14px 14px 0 0`, so the ancestor clip was unnecessary for the
+  rounded chrome. Removing `overflow: hidden` restores Bootstrap's default
+  modal behavior — popovers can escape the card edge.
+- No JS or component changes; the fix is a single CSS-rule removal in
+  `src/core/css/core.css`.
+
+### Feature — Security Dashboard rebuild + new framework primitives
+
+- **`SecurityDashboardPage`** replaces the older tabbed
+  `IncidentDashboardPage` with a single scrolling mission-control page.
+  Route stays `system/incident-dashboard`. Seven sections answer the
+  one question a sysadmin actually asks: *what should I be doing right
+  now?*
+  - **Pulse** — 8 KPI tiles via one batched
+    `/api/metrics/series?with_delta=true` + parallel REST counts. Tiles
+    track NEW incidents (untriaged), not OPEN (already claimed).
+  - **Needs Attention** — list of priority>=8, status=new incidents.
+    Click row opens the existing `IncidentView` modal. Hover-revealed
+    inline resolve/pause actions for users with `manage_security`.
+  - **Threat Composition** — single 30-day stacked bar chart that
+    condenses `incident_events` / `firewall:blocks` / `bouncer:blocks`
+    / `auth:failures` into one view. 7D / 30D / 90D toggle.
+  - **Geography** — `MetricsCountryMapView` with slug-family selector
+    (Events / Incidents / Firewall / Logins).
+  - **Distributions** — three cards: status donut, priority bucket bars,
+    bouncer funnel (assessments → monitors → blocks).
+  - **Top Sources** — top IPs + top categories (last 7d). Tries
+    server-side `group_by` first; falls back to client-side aggregation
+    of recent 500 events when unsupported, with a fallback note in the
+    card subtitle.
+  - **Auth Failures** — uses the new `auth:failures` aggregate slug
+    directly (no client-side composition); 4 sub-tiles for password
+    resets / TOTP failures / sessions revoked / accounts deactivated.
+  - **System Health** — single `/api/incident/health/summary` call,
+    one row per discovered category, color dot from `level`, click row
+    drills into the linked incident.
+  - Sections 3-7 use **lazy mount** so they don't fetch until scrolled
+    into view.
+  - Refresh tiers via `Page.scheduleRefresh`: 60s for pulse +
+    needs-attention; 5min for everything else; manual refresh button
+    fires all tiers.
+  - Drill-downs use `Modal.drawer` for day / country / status-filter /
+    priority-bucket / IP / category / auth sub-tile clicks.
+
+- **New framework primitives** (charts):
+  - **`KPITile`** (`web-mojo/charts`) — compact presentation-only tile:
+    label, big tabular value, color-coded delta badge, embedded
+    `MiniChart` sparkline. Renders pre-fetched data via constructor or
+    `setData()`. Click emits `tile:click`. Sits between `MiniChart`
+    (sparkline only) and `MetricsMiniChartWidget` (rich self-fetching
+    card). Delta rendering rules:
+    - `deltaPct` present → "+12%" / "−8%"
+    - `deltaPct` omitted (prev=0) + `delta` present → "+4" absolute
+    - both null → no badge
+    - never renders `Infinity%`
+    - `severity` (critical/high/warn/info/good) adds left-stripe accent
+    - `tone` ('bad' or 'good') decides whether rising = red or green
+  - **`KPIStrip`** (`web-mojo/charts`) — orchestrator for N `KPITile`s.
+    Single batched `/api/metrics/series?with_delta=true` call populates
+    all metric tiles, parallel REST count calls populate tiles defined
+    with `rest:` config, and one batched `/api/metrics/fetch` populates
+    sparklines for all metric tiles.
+
+- **Extensions to existing components:**
+  - **`PieChart`** — new `centerLabel` and `centerSubLabel` options
+    render text in the donut center (when `cutout > 0`). Accept either
+    a static string or a function called with `({ total, segments })`.
+  - **`MetricsChart`** — new `withDelta` flag passes through to the
+    series endpoint; new `compactHeader` mode hides the gear menu and
+    shrinks the range toggle for use inside dashboard panels.
+  - **`Modal.drawer({ eyebrow, title, meta, view })`** — standardised
+    drill-down modal header (eyebrow tag, title, meta row of icon-
+    prefixed spans). Accepts a `View` instance OR raw HTML body.
+  - **`Page.scheduleRefresh(handler, intervalMs, { tier, immediate })`**
+    — registers a recurring handler that auto-clears in `onExit`.
+    Replaces the `setInterval`/`clearInterval` boilerplate in every
+    dashboard. `runScheduledRefreshes(tier?)` fires all (or one tier).
+  - **`View.addChild(child, { lazyMount: true })`** — defers the
+    child's render until its container scrolls into viewport via
+    `IntersectionObserver`. Container gets a 1px placeholder min-height
+    so the observer can detect 0-content placeholders. Disconnects on
+    destroy. Falls back to immediate render when IO isn't available.
+
+- **Examples portal:**
+  - New `KPIStripExample` at `extensions/charts/kpi-strip` —
+    demonstrates standalone `KPITile`s (delta rules) and `KPIStrip`
+    (batched fetch).
+  - `PieChartExample` updated to show the new doughnut center label.
+
+### Feature — App-level theme management
+
+- **`WebApp` now owns the user's light/dark theme.** New public API:
+  - `app.setTheme('light' | 'dark' | 'system')` — persists the preference,
+    applies `data-bs-theme` to `<html>`, emits `'theme:changed'` on
+    `app.events` with `{ theme, resolved }`.
+  - `app.getTheme()` — returns the stored preference.
+  - `app.getResolvedTheme()` — returns the currently applied
+    `'light' | 'dark'` (resolves `'system'` via `prefers-color-scheme`).
+- **Default preference is `'system'`** — first-time visitors automatically
+  get the theme that matches their OS. The `prefers-color-scheme` media
+  listener tracks OS theme changes live while the preference is `'system'`.
+- **Storage:** the preference is persisted to `localStorage` under
+  `${appName}:theme` (mirrors the existing PortalApp sidebar-state
+  pattern). All reads/writes are wrapped in try/catch — private mode and
+  disabled storage degrade gracefully.
+- **No flash:** the manager runs in the WebApp constructor so
+  `data-bs-theme` is set before the first view renders.
+- **PortalApp auto-injects a topbar theme toggle** into the usermenu:
+  Light / Dark / System items with `bi-sun`, `bi-moon-stars`,
+  `bi-circle-half` icons. The currently selected option is marked
+  active. Opt out with `topbar.themeToggle: false`.
+- **TopNav dropdown items now honor an `active: true` flag** — the
+  template renders `class="dropdown-item active"` for selected items
+  (used by the new theme toggle and available to any caller).
+- **`examples/portal/app.js` simplified** — the manual `theme-light` /
+  `theme-dark` action handlers are gone; the framework toggle handles
+  them.
+- **New module:** `src/core/utils/ThemeManager.js`.
+
+### CSS — Dark-theme coverage for sidebar treatments, SideNavView, ChatView, TimelineView
+
+- **`sidebar-light` under `data-bs-theme="dark"`** now renders against a
+  softer dark surface (`#2a2f36`) instead of bright white. Hover, active,
+  group-header, and muted-text selectors all adapt to the dark palette.
+  Treatment classes remain independent of the global theme — devs can
+  still mix `sidebar-light` / `sidebar-dark` with either.
+- **`sidebar-dark` under `data-bs-theme="dark"`** got a sanity-pass hover
+  override so the active state remains distinguishable from the base.
+- **`SideNavView`** now has dark-theme overrides in `portal.css` covering
+  the rail bg, active accent, hover, group-label, and dropdown-collapse
+  mode. Base inline styles in the component template are unchanged.
+- **`ChatView` (`chat.css`)** picks up dark-theme rules for the
+  container, message bubbles (left), input area, attachment states,
+  file-attachment overlay, and the WebKit scrollbar. Bubble `right`
+  keeps `--bs-primary` from the base rule (theme-aware).
+- **`TimelineView`** ships its own `src/extensions/timeline/timeline.css`
+  for the first time — class-based base styles for the connector line,
+  marker, dot, content card, and meta surfaces, plus `data-bs-theme="dark"`
+  overrides where Bootstrap tokens aren't enough on their own.
+  Auto-imported from `TimelineView.js`.
+
+### Refactor — In-`src/` callers migrated from Dialog.* to Modal.* / ModalView
+
+- **All in-`src/` callers** migrated from the deprecated `Dialog.*` API
+  to the canonical `Modal.*` (static API) / `ModalView` (instance class)
+  surface. 60 files touched across `src/core/`, `src/extensions/admin/*`,
+  `src/extensions/lightbox/*`, `src/extensions/charts/*`,
+  `src/extensions/map/*`, `src/extensions/user-profile/*`.
+  - **Pure fire-and-forget `new Dialog({...})` sites** (7) collapsed to
+    one-line `Modal.show(view, { size, header, title })` calls.
+  - **Instance-handle `new Dialog({...})` sites** (11) now use
+    `new ModalView({...})` — same instance API (`on('action:*')`,
+    `setLoading`, `element`, `hide()`, `destroy()`) since `Dialog`
+    already re-exported `ModalView` under the hood.
+  - **`Dialog.show*()` static calls** mechanically renamed: `showDialog
+    → dialog`, `showForm → form`, `showModelForm → modelForm`, `showData
+    → data`, `showCode → code`, `showModelView → showModelView`,
+    `updateModelImage → updateModelImage`, `showBusy/hideBusy` (alias
+    preserved on `Modal.*`), `alert/confirm/prompt` (identical signatures).
+  - **`WebApp.showLoading/hideLoading/showModelView/showModelForm/showForm/
+    showDialog/showAlert`** internal lazy imports now resolve `Modal.js`
+    instead of `Dialog.js`.
+- **Pre-existing bug fixed**: `JobHealthView.onActionSystemSettings()`
+  called `Dialog.showAlert(...)` — `showAlert` was never wired on the
+  shim. The System Settings button now resolves through `Modal.alert`.
+- **`Model.showError()`** also migrated from a (broken, unimported)
+  `Dialog.alert(...)` global reference to a dynamic `Modal.alert`
+  import, matching the lazy-import pattern WebApp uses.
+- **Public surface unchanged**: the `Dialog.js` shim and the public
+  `Dialog` re-exports in `src/index.js` / `src/lite/index.js` remain in
+  place for downstream consumers. Their removal is a separate breaking
+  change PR.
+
+### Refactor — Dialog.js split into ModalView + Modal + focused helpers
+
+- **`Dialog.js` (1,987 lines) split** into focused modules in
+  `src/core/views/feedback/`:
+  - **`ModalView.js`** — the underlying `View` class. Owns Bootstrap 5
+    modal mechanics (lifecycle, sizing, z-index stacking, header/body/
+    footer composition, button rendering, context menu).
+  - **`Modal.js`** — canonical static API: `dialog`, `show`, `showModel`,
+    `showModelView`, `alert`, `confirm`, `prompt`, `form`, `modelForm`,
+    `data`, `code`, `htmlPreview`, `updateModelImage`, `loading`. A new
+    `_renderAndAwait` helper consolidates ~300 lines of duplicated
+    render/show/resolve/destroy code.
+  - **`BusyIndicator.js`** — singleton frosted-glass loading overlay.
+  - **`CodeViewer.js`** — Prism-highlighted code block view + statics.
+  - **`HtmlPreview.js`** — sandboxed iframe preview view.
+  - **`Dialog.js`** — thin compatibility shim. Default-exports
+    `ModalView`; every legacy static (`Dialog.alert`, `Dialog.showForm`,
+    `Dialog.showBusy`, …) is a one-line forward to the matching
+    `Modal.*` method. Existing `new Dialog({...})` and `Dialog.show*()`
+    callers continue to work unchanged.
+- **Busy-indicator overlays consolidated**. The legacy dark
+  `mojo-busy-indicator` is gone; only the modern frosted-card
+  `mojo-loading-overlay` remains. `Modal.loading()` / `Modal.showBusy()`
+  / `Dialog.showBusy()` all route through the same singleton.
+- **`ModalView` is now a public export** (`src/index.js`,
+  `src/lite/index.js`) — use it directly when you need a long-lived
+  modal handle (streaming `setContent`, external event wiring,
+  subclassing). Most callers should still prefer the static `Modal.*`
+  API.
+- **No consumer change required.** The 24 `new Dialog({...})` and
+  `Dialog.show*()` sites already in `src/` continue to work via the
+  shim. A separate request (`planning/requests/migrate-legacy-dialog-callers.md`)
+  tracks the eventual sweep.
+- New docs: `docs/web-mojo/components/ModalView.md`. Updated:
+  `components/Modal.md`, `components/Dialog.md` (now a deprecation
+  notice + migration table), `README.md`, `docs/agent/architecture.md`.
+
+### Improved — SeriesChart axis labels (nice numbers, formats, rotation)
+
+- **Y-axis ticks** now snap to clean `1/2/5 × 10ⁿ` values via the Heckbert
+  nice-number algorithm. The "API Metrics" chart and similar `MetricsChart`
+  consumers now show `0, 25, 50, 75, 100` instead of `0, 28.77, 57.54,
+  86.31, 115.08, 143.85`. `gridLines` becomes a target count; the algorithm
+  picks the closest clean fit.
+- **X-axis labels auto-rotate** `-45°` when they would overlap their slots.
+  The chart's bottom padding expands automatically. No configuration
+  required; rotation kicks in when labels collide.
+- **`MetricsChart` defaults `xLabelFormat`** based on `granularity`:
+  `minutes`/`hours` → `date:'HH:mm'` (`17:00`), `days`/`weeks` → `date:'MMM
+  D'` (`Apr 26`), `months` → `date:'MMM YYYY'` (`Apr 2026`). Caller-supplied
+  `tooltip.x` still wins. The default is re-applied when `setGranularity()`
+  is called.
+- Truncation cap raised from 10 → 24 chars (rotation handles long labels;
+  truncation is the fallback for pathological cases like UUIDs).
+- `_formatAxisValue` adds a `B` (billion) branch and step-aware decimal
+  precision so very small or very large nice-tick ranges read cleanly.
+
+### Docs — Phase 3 of taxonomy realignment (undocumented public exports)
+
+- New doc pages in `docs/web-mojo/`:
+  - `core/Router.md` — `Router` class: `?page=` URL handling, `navigate`, route patterns, `route:changed` / `route:notfound` events.
+  - `components/ProgressView.md` — file-upload progress UI; `updateProgress`, `markCompleted`, etc.
+  - `components/SimpleSearchView.md` — searchable list bound to a `Collection`; emits `item:selected`.
+  - `utils/MustacheFormatter.md` — lower-level template renderer behind `View`; `registerFormatter` for custom pipes.
+  - `mixins/FileDropMixin.md` — `applyFileDropMixin(ViewClass)` + `enableFileDrop({…})` + `onFileDrop(files, …)`.
+- **Breaking**: `DataWrapper` named export removed from `src/index.js`. Triage found zero consumers (no `src/`, no `examples/`, no `test/` references). The class itself remains in `src/core/utils/MOJOUtils.js`; only the public re-export is gone.
+- README + AGENT cross-links updated to surface the new pages.
+
+### Added — Assistant: `assistant_text` event + chart-option passthrough
+
+- **New `assistant_text` WS event** is now handled in `AssistantView`,
+  `AssistantPanelView`, and `AssistantContextChat`. When the model writes
+  prose alongside tool calls in the same turn, that intermediate text now
+  renders as an assistant bubble before the tool-call status indicators.
+  `assistant_response` remains the terminal signal that clears the thinking
+  indicator and re-enables input. Conversations that don't emit
+  `assistant_text` are unchanged.
+- **`AssistantContextChat` gains a small `_adoptConversationId` helper** so
+  all three assistant views handle new-conversation events uniformly. The
+  adapter remains the canonical owner of `conversationId`.
+- **Chart blocks now forward new `SeriesChart` / `PieChart` options** from
+  the LLM into the chart constructor via a strict snake_case → camelCase
+  allowlist. New block-level fields: `stacked`, `grouped`, `crosshair_tracking`,
+  `cutout`, `show_labels`, `show_percentages`, `colors`, `show_legend`,
+  `legend_position`. New per-series fields: `color`, `fill`, `smoothing`.
+  Existing minimal chart blocks render identically.
+- Stale doc comment in `AssistantMessageView._renderChartBlock` corrected
+  (`MiniPieChart`/`MiniSeriesChart` → `PieChart`/`SeriesChart`).
+
+### Docs — Phase 2 of taxonomy realignment
+
+- New doc pages in `docs/web-mojo/`:
+  - `extensions/Auth.md` — `mountAuth` + `createAuthClient` (`web-mojo/auth`).
+  - `extensions/UserProfile.md` — `UserProfileView`, `PasskeySetupView`, the 11 section views (`web-mojo/user-profile`).
+  - `extensions/DocIt.md` — `DocItApp` and the four documentation pages (`web-mojo/docit`).
+  - `services/TokenManager.md` — JWT lifecycle, single-flight refresh, the auth gate.
+  - `utils/DjangoLookups.md` — `field__lookup` syntax, `LOOKUPS` map, `parseFilterKey`, `formatFilterDisplay`.
+  - `utils/ConsoleSilencer.md` — log-level filtering, URL/`localStorage` runtime overrides.
+- `src/extensions/auth/README.md` deleted (the new `extensions/Auth.md` is canonical).
+- `src/extensions/mojo-auth/mojo-auth.js` gets a `LEGACY shim` JSDoc header. No package entry, no internal callers; new code uses `web-mojo/auth`. File is kept for downstream apps still linking it directly.
+- `docs/web-mojo/README.md`, `docs/web-mojo/AGENT.md`, and root `AGENT.md` cross-links updated to surface the new pages.
+- `planning/notes/taxonomy-audit.md` notes that `src/core/utils/TemplateResolver.js` is orphaned (zero consumers, not exported) — tracked for a future cleanup pass.
+
+### Bug fixes — typed alerts now actually render their type
+
+- `Dialog.alert(message, title, options)` (and `Modal.alert(...)`) silently
+  dropped the second and third arguments — every typed alert rendered as
+  `info` regardless of the `type` option. The signature is now correctly
+  honored: `Modal.alert('Saved!', 'Done', { type: 'success' })` produces a
+  success-styled alert. Object-form (`Modal.alert({ message, title, type })`)
+  and single-string form (`Modal.alert('hi')`) continue to work unchanged.
+- `WebApp.showError / showSuccess / showInfo / showWarning` were broken in
+  the same way and rendered identically. They now produce visually distinct
+  typed alerts and route through `Modal.alert` directly.
+- `WebApp.confirm` also routes through `Modal.confirm` for consistency.
+
+### API direction — Modal is the canonical modal/dialog surface
+
+- `Modal.alert / Modal.confirm / Modal.prompt` are now the canonical
+  implementations. `Dialog.alert / Dialog.confirm / Dialog.prompt` have been
+  rewritten as thin pass-throughs that delegate to Modal — all existing
+  `Dialog.*` callers continue to work unchanged, but new code should call
+  `Modal.*` directly.
+- `Dialog` itself (the underlying View class) is unchanged: the constructor,
+  `Dialog.showDialog / showForm / showModelForm / showCode / showHtmlPreview`,
+  z-index management, and `Dialog.showBusy / hideBusy` continue to live there.
+  Only the three top-level helpers moved.
+- `docs/web-mojo/components/Modal.md` is now the canonical doc; Dialog.md
+  retains its deprecation banner with pass-through notes under each helper.
+
+### UI / CSS — refreshed dialog chrome and typed-alert accents
+
+- All dialogs share a refreshed chrome: rounded corners (14px), soft
+  drop-shadow, gradient header tint, and a small offset circular close
+  button anchored to the top-right corner.
+- Typed alerts (`Modal.alert(... { type })`) now get a 6px colored hero
+  band across the top of the modal card and a subtle tinted card background,
+  so each type is visually distinct without relying on an icon alone. Color
+  tokens: success=`#198754`, error=`#dc3545`, warning=`#ffc107`;
+  info/default uses `--mojo-dialog-accent` (see below).
+- New CSS variable `--mojo-dialog-accent`, defined at `:root` and defaulting
+  to `var(--bs-primary)`. Drives the header gradient tint and the info-typed
+  alert accent. Override at `:root` (or any scope) to set a custom brand
+  color without touching `--bs-primary`.
+- Dark-mode rules added under `prefers-color-scheme: dark`, mirroring the
+  shape of the existing toast.css dark-mode block.
+- Internal styling hook: typed alerts add `modal-alert modal-alert-{type}`
+  to the modal root for downstream apps that want to override the look.
+
+### Breaking — Admin models moved to a separate package entry
+
+- 14 admin-coupled `Model` / `Collection` classes have moved out of `src/core/models/`
+  into `src/extensions/admin/models/`. The affected models: `AWS`, `Assistant`,
+  `Bouncer`, `Email`, `Incident`, `IPSet`, `Job`, `JobRunner`, `LoginEvent`,
+  `PublicMessage`, `Push`, `Phonehub`, `ScheduledTask`, `Tickets`.
+- 7 of those (`AWS`, `Email`, `Incident`, `Job`, `JobRunner`, `Push`, `Tickets`)
+  were previously re-exported from the main `web-mojo` entry. They are no longer.
+  **Migration**: switch to the new `web-mojo/admin-models` entry.
+  ```js
+  // before
+  import { Job, JobList, Incident } from 'web-mojo';
+  // after
+  import { Job, JobList, Incident } from 'web-mojo/admin-models';
+  ```
+- New package entry `web-mojo/admin-models` ships the 14 admin models as **data
+  only** — no DOM, Bootstrap, or template deps. Use this entry from a Node
+  script, an API client, or any non-portal UI. The `web-mojo/admin` entry
+  remains the way to get the admin **pages** (sidebar, dashboards, table pages).
+- `Log` and `ShortLink` stay in `src/core/models/` because they have legitimate
+  non-admin consumers (`FileView`'s share-link feature, `user-profile`'s
+  activity section). The audit's "admin-only" classification was overzealous on
+  those two; their import paths and main-entry export are unchanged.
+- `docs/web-mojo/models/BuiltinModels.md` now covers only the 10 still-core
+  models. Admin models documented in `docs/web-mojo/extensions/Admin.md`.
+- 73 internal `@core/models/<X>.js` import statements rewritten to
+  `@ext/admin/models/<X>.js` across the 58 admin files that consume them.
+
+### Examples Portal — area-mismatch realignment
+
+- `TabView` moved from `extensions/` → `components/` (source has always been at
+  `src/core/views/navigation/TabView.js`). Routes change:
+  `?page=extensions/tab-view` → `?page=components/tab-view`. Doc moves to
+  `docs/web-mojo/components/TabView.md`.
+- `TablePage` doc moved from `components/` → `pages/` (source is at
+  `src/core/pages/TablePage.js`). Doc path:
+  `docs/web-mojo/pages/TablePage.md`. Example folder unchanged (already at
+  `examples/portal/examples/pages/TablePage/`).
+- `FileUpload` moved from `extensions/` → `services/` (source is at
+  `src/core/services/FileUpload.js`). Routes change:
+  `?page=extensions/file-upload` → `?page=services/file-upload`. Doc moves to
+  `docs/web-mojo/services/FileUpload.md`.
+- `docs/web-mojo/extensions/metricsminichartwidget.md` renamed to
+  `MetricsMiniChartWidget.md` to match sibling-doc casing.
+- New `FormBuilder` example at
+  `examples/portal/examples/forms/FormBuilder/FormBuilderExample.js`. Demos
+  `buildFormHTML()` and `buildFieldsHTML()`. `FormBuilder` is now exported
+  from the main `web-mojo` entry (was previously only available via
+  `@core/forms/FormBuilder.js`).
+- Dead `src/core/views/map/MapView.js` duplicate removed (canonical version
+  is `src/extensions/map/MapView.js`, exported via `web-mojo/map`).
+- `docs/web-mojo/forms/FORMS_DOCUMENTATION_PLAN.md` (an internal planning
+  doc that snuck into published docs) moved to `planning/notes/`.
+
+### Examples Portal — hub-and-spoke navigation
+
+- Replaced the single 75-item sidebar with a hub menu plus four topic
+  sub-sidebars: **Architecture**, **Components**, **Forms**, **Extensions**.
+  The hub pins a curated **Start Here** path (View, Templates, Model, Page,
+  WebApp). Each topic sub-sidebar ends with a "Back to Examples" item that
+  returns to the hub, mirroring the existing admin "Exit Admin" pattern.
+- Component variants (Dialog form / context-menu / custom-body, TableView
+  batch-actions / custom-row / server-collection, …) now collapse under their
+  parent in the sidebar instead of rendering as siblings. Routes are unchanged.
+- `examples.registry.json` now exposes a `topics` tree (each topic → groups →
+  items with optional one-level children), and every page record carries
+  `topic` and `group` fields. The legacy `menu` array is kept for one cycle.
+- `docs/web-mojo/examples.md` is regenerated under H2/H3 topic/group
+  headings and now correctly links each variant row to its own source file.
+- Sidebar widened from the framework default 250px to 300px in this portal
+  (set via `--mojo-sidebar-width` CSS variable; framework default unchanged).
+- No framework changes — `Sidebar` already supported multiple registered
+  menus, route-driven menu switching, and per-item `handler` callbacks.
+
+### Breaking — Charts extension rebuilt on native SVG
+
+- **Chart.js dependency removed.** `BaseChart` previously injected
+  `https://cdn.jsdelivr.net/npm/chart.js@4.4.0/dist/chart.umd.js` at runtime;
+  that fetch no longer happens. `chart.js` was never in `package.json` and
+  remains absent. ~2,400 LOC of source removed: `BaseChart.js` (1,329),
+  the old Chart.js-backed `SeriesChart.js` (533), and the old `PieChart.js` (567).
+- **`SeriesChart` rewritten as a native SVG component** (promoted from
+  `MiniSeriesChart`). Multi-dataset line/bar/area, click-to-toggle legend,
+  hover-isolated highlighting, animated `setData` updates (`animate: false`
+  to opt out), built-in 10-color palette + golden-angle HSL fallback, and
+  per-series `color` overrides.
+- **Bar charts default to stacked.** `chartType: 'bar'` is stacked unless you
+  pass `stacked: false` (or the alias `grouped: true`). `stacked: 'auto'` is
+  the default and resolves to `true` for bar, `false` for line/area.
+- **`PieChart` rewritten as a native SVG component** (promoted from
+  `MiniPieChart`). Adds slice-edge labels, `chart:click` drill-down, animated
+  slice tweens, and an optional `endpoint:` shim that auto-fetches via
+  `app.rest.GET` in `onInit`.
+- **`MetricsChart` rewritten on top of native `SeriesChart`.** Public API
+  preserved: `endpoint`, `account`, `granularity`, `slugs`, `category`,
+  `dateStart`/`dateEnd`, `defaultDateRange`, `quickRanges`, `availableMetrics`,
+  `maxDatasets`, `groupRemainingLabel`, `chartType`, `title` (HTML), `height`,
+  `yAxis`, `tooltip`, `showDateRange`, `showGranularity`. Methods unchanged:
+  `fetchData`, `refresh`, `setGranularity`, `setDateRange`, `setMetrics`,
+  `getStats`. Admin call sites (`AdminDashboardPage`, `CloudWatchChart`,
+  `ShortLinkView`, `PushDashboardPage`) need no changes.
+- **PNG export moved out of charts into a standalone helper.**
+  `MetricsChart.export(format)` removed. Use:
+  `import { exportChartPng } from 'web-mojo/charts'; exportChartPng(chart);`
+  Works on any view containing an `<svg>`.
+- **`MiniSeriesChart` and `MiniPieChart` exports removed.** The dynamic imports
+  in `AssistantMessageView` were updated to `SeriesChart`/`PieChart`. If any
+  downstream code imported `MiniSeriesChart`/`MiniPieChart` directly, switch
+  to `SeriesChart`/`PieChart`.
+- **Removed at the chart level**: WebSocket integration, `autoRefresh`,
+  `setEndpoint`, `setWebSocketUrl`, theme toggle, `chartOptions` passthrough,
+  `dataTransform`. Pages own those concerns.
+- New examples portal entries: `SeriesChartExample.js`, `PieChartExample.js`.
+  `ChartsExample.js` continues to demo `MiniChart` (the dedicated single-series
+  sparkline — kept as-is).
+- `src/charts.js` bumped from 2.1.0 → 3.0.0.
+
+### Added — Charts: floating crosshair tooltip on line charts
+
+- **`SeriesChart` gains optional `crosshairTracking` mode** for line/area
+  charts. With `crosshairTracking: true`, a transparent rect overlays the
+  plot area; on `mousemove` the chart snaps to the nearest column and shows
+  a vertical crosshair, a per-dataset ghost dot, and the existing multi-row
+  tooltip. Off by default — bar charts ignore the flag.
+- **Bootstrap-theme-aware** — the crosshair line uses
+  `var(--bs-secondary-color)` via `currentColor` and auto-adapts under
+  `data-bs-theme="dark"`. Pass `crosshairColor` for an explicit override
+  (accepts CSS color strings or `var(--…)` references) and `crosshairWidth`
+  for a thicker line.
+- **`chart:click` semantics** — in tracking mode, click emits the column
+  for the first visible dataset (matches Chart.js `mode: 'index'`). Per-
+  dataset clicks remain available with `crosshairTracking: false`.
+- New examples-portal demo card under
+  `examples/portal/examples/extensions/Charts/SeriesChartExample.js`.
+
 ### Changed
+- **Examples directory rewritten** — The previous `examples/portal/` (37 pages, 17 templates, ~13k LOC) and all standalone HTML demos have been moved to `examples/legacy/` (with git history preserved). The new `examples/portal/` is a single canonical [`PortalWebApp`](docs/web-mojo/core/PortalWebApp.md) shell whose taxonomy mirrors `docs/web-mojo/`. Each documented component has a folder under `examples/portal/examples/<area>/<Component>/` with a single-file canonical-and-demo `<Component>Example.js` (≤150 LOC, inline template, imports only from `web-mojo`) and an `example.json` manifest. The portal sidebar and route registration are generated by `examples/portal/scripts/build-registry.js` from those manifests, so adding an example never touches `app.js`. Coverage: **59 examples across 8 areas** (`core`, `pages`, `services`, `components`, `extensions`, `forms`, `forms/inputs`, `models`).
+- **`docs/web-mojo/examples.md`** — Generated index of every example file, written by the registry generator. Linked from `docs/web-mojo/README.md`.
+- **Per-doc cross-links** — Each component doc under `docs/web-mojo/` now ends with an `## Examples` section listing the runnable example file(s) for that component. Sections are managed by `examples/portal/scripts/cross-link-docs.js` and bracketed with `<!-- examples:cross-link begin/end -->` markers so reruns are idempotent.
+- **`vite.config.js`** — Added `web-mojo/timeline` and `web-mojo/models` aliases so per-extension package imports resolve in dev.
+
+### Added
+- **`examples/auth/`** — Fresh standalone login flow built on `FormView` + `Rest`, posts to `/login` and redirects to `/examples/portal/` on success. Replaces the old multi-page auth example (now under `examples/legacy/auth/`).
+- **`docs/web-mojo/components/ContextMenu.md`**, **`docs/web-mojo/forms/MultiStepWizard.md`**, **`docs/web-mojo/forms/SearchFilterForms.md`** — Three new doc pages covering components and patterns the legacy portal demonstrated but the docs hadn't.
+
+### Changed (legacy)
 - **FileView consolidated** — The three overlapping file components (`src/core/views/data/FileView.js` legacy, `src/extensions/admin/storage/FileView.js` admin, and the small `FilePreviewView` chat card) have been reduced to one canonical `FileView` at `src/core/views/data/FileView.js`, exported from both `web-mojo` and `web-mojo/admin`. The new component uses a `SideNavView` layout (Preview / Details / Renditions / Metadata) and drives its Preview section from the backend `category` field (`image`, `video`, `audio`, `pdf`, `document`, `spreadsheet`, `presentation`, `archive`, `other`) — each category gets a purpose-built preview (inline `<video>`/`<audio>`, lightbox gallery, PDF viewer, or download-focused card). `LightboxGallery` and `PDFViewer` are accessed optionally via `window.MOJO.plugins.*` and fall back to `window.open` when the lightbox extension isn't loaded. Metadata section is hidden when empty. `FilePreviewView` (chat attachment card) is unchanged.
 - **FileView handles async renditions** — The backend now generates renditions asynchronously: `upload_status` flips to `completed` immediately while thumbnails/transcodes run on a background worker. FileView now shows a "Renditions are being generated" placeholder in the Renditions section (with a manual Refresh button) when `File.isRenditionsProcessing()` returns true, and kicks off an automatic background poll (`model.fetch()` every 5s, up to 5 minutes) that stops as soon as the renditions map populates. The poll is cancelled in `onBeforeDestroy`. Preview and Renditions sections listen for `change` on the model and re-render in place as the new URLs arrive, so video posters and rendition rows appear without a manual refresh.
 - **`File` model helpers** — Added `getCategory()` (with content_type fallback), `hasRenditions()`, `isRenditionsProcessing()`, `getRenditions()`, `getBestImageRendition()`, `getThumbnailUrl()`, and `regenerateRenditions(roles?)` to the `File` model.

package/README.md

@@ -131,7 +131,7 @@ Complete authentication system with JWT tokens, login/register forms, and sessio
 Image and PDF viewers with editing capabilities including cropping and annotation.
 
 #### 📊 Charts (`web-mojo/charts`)
-Interactive charts built on Chart.js with PieChart, SeriesChart, and more.
+Native SVG charts (SeriesChart, PieChart, MetricsChart) with no Chart.js dependency. `SeriesChart` supports opt-in `crosshairTracking` for floating crosshair + multi-row tooltip on line/area charts. Y-axis ticks snap to clean values via the Heckbert nice-number algorithm; X labels auto-rotate when they overflow their slots. `MetricsChart` defaults `xLabelFormat` from granularity (minutes/hours → `HH:mm`, days/weeks → `MMM D`, months → `MMM YYYY`).
 
 #### 📚 Documentation (`web-mojo/docit`)
 Full-featured documentation portal system with markdown editing and syntax highlighting.
@@ -316,7 +316,7 @@ Our documentation is organized into focused sections — browse online or click
 - [DataView](https://nativemojo.com/web-mojo/#components/DataView.md) — structured data display
 
 ### Extensions
-- [Charts](https://nativemojo.com/web-mojo/#extensions/Charts.md) — Chart.js integration (SeriesChart, PieChart)
+- [Charts](https://nativemojo.com/web-mojo/#extensions/Charts.md) — Native SVG charts (SeriesChart, PieChart, MetricsChart)
 - [Admin](https://nativemojo.com/web-mojo/#extensions/Admin.md) — pre-built admin pages and views
 - [TabView](https://nativemojo.com/web-mojo/#extensions/TabView.md) — tab navigation
 - [MapView](https://nativemojo.com/web-mojo/#extensions/MapView.md) / [MapLibreView](https://nativemojo.com/web-mojo/#extensions/MapLibreView.md) — maps