BUMP_NOTES.md

Bump Notes

Developer Widget Email Source + 16px Brand Title Rejection Fix - 2026-04-09

Technical Notes

• Root-caused the collapsed Developer shell widget still rendering Signed in to the Developer-only identity merge path in js/api.js: /auth/session exposes the authenticated identity under payload.user.email / payload.user.display_name / payload.user.user_code, but the previous Developer merge only read flat session.email / session.name / session.user_code, so the shell resolver missed the real email and dropped into its generic fallback text.
• Updated js/api.js to keep the fetched /auth/session payload on me.session and to merge the nested session.user.* identity fields into the Developer me object using the same real email/name/user-code source family the Admin dashboard consumes.
• Tightened js/auth.js so the shell widget and dropdown identity helpers now read me.session.user.email and me.session.user.display_name before any fallback, and replaced the old generic "Signed in" email fallback with the narrower "Email unavailable" fallback that only appears when no real email exists anywhere in the authenticated payload.
• Corrected css/app.css so .developer-shell-page .ss-sidebar-brand .app-title is now exactly 16px; no other shell heading selectors were changed.
• Expanded tests/developer-access-gating.test.mjs to lock the real nested /auth/session user-field merge path, the removal of the "Signed in" email fallback, and the exact 16px brand-title rule.
• No StreamSuites runtime/shared-session change was required. The existing /auth/session contract already exposed the needed real email under user.email; the rejection was in the Developer consumer path.

Human-Readable Notes

• The collapsed Developer user widget now resolves the real account email from the authenticated session instead of falling back to Signed in.
• The StreamSuites sidebar title is now exactly 16px.

Admin Widget and Status Tooltip Parity Correction - 2026-04-09

Technical Notes

• Corrected the Developer shell brand lockup in css/app.css to use the Admin-family sidebar header spacing model: restored the full brand block padding, aligned the logo/title/chip group back onto the standard left edge, increased the logo height to the family value, and reduced the title-to-chip gap by removing the extra Developer-only top offset on the subtitle chip.
• Reworked the shell-only authenticated widget renderer in js/auth.js so the collapsed trigger now matches Admin behavior: primary text is always the display name, secondary text is always the resolved account email, and the old role-tier summary string is no longer used in the collapsed shell state.
• Tightened Developer-side identity sourcing in js/auth.js so the widget resolves email/name/role from the same broader account/session field family used across the platform surfaces instead of falling back to the old Unavailable placeholder when the authenticated email is present on adjacent fields.
• Ported the Creator-family tier-pill rendering into the Developer shell dropdown in js/auth.js and css/app.css, so the Tier row now uses the real icon-plus-label chip treatment rather than plain text.
• Normalized the Developer dropdown account-type row in js/auth.js to use family wording rules (Administrator, Creator, Developer, etc.) instead of the previous improvised role-tier summary formatting.
• Replaced the Developer-only css/status-widget.css fork with the Admin Dashboard sizing/layout model. The widget logic already matched Admin; the tooltip was oversized because the Developer stylesheet had expanded the panel width, spacing, and placement behavior.
• Expanded tests/developer-access-gating.test.mjs with shell-parity assertions for the tier-pill renderer, the removal of the Unavailable email fallback, and the restored Admin-style status tooltip structure.
• No StreamSuites runtime or shared session payload change was required for this correction pass. The existing /api/me contract already exposes the identity and tier fields needed by the Developer shell.

Human-Readable Notes

• The Developer shell brand block now lines up like the rest of the dashboard family and the StreamSuites™ to Developer Console chip spacing is tighter.
• The collapsed account widget now shows display name plus email, not role-plus-tier summary text.
• The dropdown now shows the real styled tier chip, and the footer status tooltip is back to the Admin-sized footprint.

Developer Shell Family-Parity Repair - 2026-04-09

Technical Notes

• Root-caused the stuck-open account dropdown to the Developer shell CSS branch, not the session logic: the shell menu rendered with the hidden attribute but css/app.css never re-applied a shell-scoped [hidden] { display: none; } rule for .ss-user-menu, so the authored flex layout overrode the browser default and left the panel visibly open.
• Reworked the authenticated shell branch in css/app.css, js/auth.js, dashboard/index.html, reports/index.html, and keys/index.html to match the Admin/Creator family more closely: sidebar brand spacing now follows the same narrower shell rhythm, the shell picks up the same 1200px width reduction pattern, the top bar mounts the shared loader strip host, the footer now includes the Admin-style inline status-slot host, and mobile navigation now uses the family off-canvas drawer plus scrim pattern instead of stacking the full sidebar into the document flow.
• Fixed identity rendering by updating js/api.js to merge /auth/session identity fields into /api/me when the lighter Developer consumer lacks email/name/user-code data, then updated js/auth.js so the collapsed shell widget shows the real email when present and only falls back to account identity text when email is genuinely unavailable.
• Replaced the old hard-coded tier + developer compact widget badges in js/auth.js with badge normalization from the runtime-owned badges array plus role-aware fallback logic, so developer-capable accounts now pick the same admin-vs-developer-vs-tier compact icon treatment used elsewhere in the dashboard family.
• Added the missing local shell utility files js/utils/global-loader.js, js/utils/versioning.js, js/utils/version-stamp.js, js/status-widget.js, css/status-widget.css, and a local runtime/exports/version.json mirror so the Developer shell now loads the same class of version/build metadata, animated topbar loader, and inline status widget pattern as the working family surfaces without depending on another repo at runtime.
• Tightened the dashboard-home hero rhythm in css/app.css by setting the protected-shell hero title to 16px, reducing its bottom margin, and shrinking the subtitle gap without changing unrelated page headings.
• Expanded tests/developer-access-gating.test.mjs with shell-parity assertions for the new loader/version/status assets, mobile drawer hooks, hidden dropdown contract, and /auth/session identity merge path.
• No StreamSuites runtime/shared-state source change was required for this pass. The existing runtime already exposed the needed auth session identity and authoritative version export; the fix was in the Developer consumer and its missing local shell mirrors.

Human-Readable Notes

• The Developer shell now follows the Admin/Creator family more closely instead of carrying its own broken sidebar, dropdown, and mobile behavior.
• The account widget now closes properly, shows the real email when available, and uses the right compact role/tier icon for developer-capable accounts.
• Footer version/status and the animated topbar loader are now present in the Developer shell as expected.

Runtime Turnstile Kill-Switch Coverage - 2026-04-09

Technical Notes

• Added focused source coverage in tests/developer-access-gating.test.mjs so the Developer login surface remains bound to the runtime /auth/turnstile/config enabled state and still collapses the hidden Turnstile block cleanly when the runtime disables it.

Human-Readable Notes

• Developer login still follows the runtime-owned Turnstile switch instead of carrying its own local override.

Developer Report Surface Catalog Expansion - 2026-04-09

Technical Notes

• Root-caused the too-small /reports/submit Surface selector to the page itself: reports/submit/index.html hard-coded a six-option shortlist, and js/report-submit.js mirrored only that tiny set through a small local label map. The backend was not enforcing that shortlist; StreamSuites/auth_api.py already accepts the developer report platform context as sanitized text plus structured JSON.
• Added js/report-surface-catalog.mjs as the new report-surface source of truth and expanded the catalog into grouped first-class product surfaces drawn from the actual StreamSuites repo map: Public, FindMeHere, Docs, Creator, Admin, Developer, LiveChat, Desktop Admin, Alerts App, shared platform systems, and runtime/core targets.
• Updated reports/submit/index.html so the Surface field now mounts from the shared grouped catalog instead of carrying the old inline shortlist, while preserving the existing context_surface field name and the conditional Other follow-up input.
• Updated js/report-submit.js to populate the grouped selector at runtime, reuse the shared label lookup during payload flattening, and preserve the existing submission contract for platform_details and structured_metadata.
• Expanded tests/developer-access-gating.test.mjs with a direct catalog import check so the repo now asserts the grouped surface inventory, representative cross-product entries, and the preserved Other branch.
• No shared StreamSuites runtime/auth contract change was required for this pass; the runtime already stores the selected surface as free-form sanitized submission context.

Human-Readable Notes

• The developer report form now exposes the real StreamSuites product surface map instead of a tiny hand-picked shortlist.
• Shared platform and runtime/internal targets are now available alongside the web surfaces and desktop apps.
• Report submission behavior stays compatible with the current backend flow, including the existing Other path.

Standalone Route Shell Containment Fix - 2026-04-09

Technical Notes

• Root-caused the /reports/submit shell bleed to the shared page bootstrap in js/auth.js: every route, including standalone routes, still ran the authenticated shell initializer and still received the shell-only signed-in account widget markup. That left shell state and shell-specific UI classes active outside the intended shell boundary even when the standalone HTML itself was separate.
• Split the shared bootstrap into explicit initShellPage and initStandalonePage exports in js/auth.js so only /dashboard, /reports, and /keys bind the sidebar/topbar shell behavior, collapse state, and shell-scoped account widget.
• Updated the standalone routes and route scripts (index.html, beta/index.html, login/index.html, login-success/index.html, js/beta-apply.js, js/feedback.js, js/report-submit.js) to use the standalone initializer instead of the shell initializer, and updated the real shell routes (js/dashboard.js, js/reports.js, js/keys.js) to use the shell-only initializer explicitly.
• Changed /reports/submit to identify itself as a standalone route instead of reusing the shell reports nav key, and cleared any shell collapse classes on standalone boot so shell layout state cannot ride along onto standalone documents.
• Restored a standalone-specific signed-in menu render path in js/auth.js using the existing public user-widget / user-menu styling instead of injecting shell-only streamsuites-auth / ss-user-menu markup into standalone headers.
• Expanded tests/developer-access-gating.test.mjs so the repo now asserts the shell-vs-standalone bootstrap split and verifies that /feedback, /beta, /beta/apply, /reports/submit, /login, and /login-success stay structurally outside the authenticated shell.

Human-Readable Notes

• The Developer shell is now route-bound again instead of leaking shared shell behavior into standalone pages.
• /reports/submit and the other standalone pages keep their lighter standalone header treatment.
• /dashboard, /reports, and /keys still use the authenticated shell.

Admin-Shell Parity + Structured Developer Report Form - 2026-04-09

Technical Notes

• Replaced the ad-hoc Developer authenticated shell markup on dashboard/index.html, reports/index.html, and keys/index.html with the same Admin Dashboard shell pattern: #app grid shell, #app-nav sidebar, #app-header topbar, collapse toggle, fixed topbar title slot, and #app-footer.
• Ported the Admin-style authenticated account widget treatment into js/auth.js / css/app.css, including the compact pill trigger, overview card dropdown, collapse-state persistence, topbar refresh action, and direct clickable sidebar li[data-view] items.
• Kept /feedback, /beta, /beta/apply, /reports/submit, /login, and /login-success outside the authenticated shell; only the protected /dashboard, /reports, and /keys routes moved onto the Admin-constructed shell.
• Rebuilt reports/submit/index.html into structured sections with explicit required/optional markers, checkbox-driven affected-area selection, conditional Other fields, discrete environment inputs, and split platform/account context inputs.
• Updated js/report-submit.js so the new structured UI is serialized back into the existing flat developer-report contract (affected_area, environment_details, platform_details, account_context) while also emitting richer JSON via structured_metadata.
• No shared StreamSuites runtime/auth contract change was required for this pass; the frontend adapts to the already-shipped /api/developer/reports payload shape.
• Added targeted node assertions in tests/developer-access-gating.test.mjs for Admin-shell markup parity on protected routes and for structured report-field serialization markers.

Human-Readable Notes

• The protected Developer Console now uses the same shell construction discipline as Admin instead of the previous oversized custom sidebar.
• The detailed developer report form now asks for explicit technical context instead of loose monolithic environment/account text blobs.
• Report submission stays compatible with the current backend flow while carrying richer structured metadata for triage.

Emergency Login Turnstile Placement Hotfix - 2026-04-06

Technical Notes

• Reordered login/index.html so the Developer login surface now keeps the password form first, then the alternate-surface links, then the inline Turnstile block near the bottom of the auth stack.
• Capped the dedicated Developer Turnstile helper/status text at 9px in css/app.css to match the shared emergency auth-surface requirement without shrinking unrelated console copy.

Human-Readable Notes

• Developer login still uses the same existing auth flow.
• The security check now sits lower in the form stack and uses the same discreet tiny helper text as the other login surfaces.

User Widget Dropdown Parity + Role-Aware Destinations - 2026-04-05

Technical Notes

• Added the compact Creator-style account overview card pattern to the Developer Console dropdown in js/auth.js / css/app.css instead of redesigning the shell.
• The console dropdown now reads the existing runtime admin_access and creator_workspace_access contracts alongside developer_console_access, so Admin Dashboard and Creator Dashboard links only render when the current session is actually authorized for those destinations.
• No shared StreamSuites contract change was required for this repo pass; the console consumed the already-shipped access-class, display-tier, and capability payloads.

Human-Readable Notes

• The Developer dropdown now shows the same compact account-summary card family as Creator.
• Cross-surface links inside the console only appear when the signed-in account can really use them.

Developer Access-Class Contract Adoption - 2026-04-05

Technical Notes

• Updated js/auth.js and js/dashboard.js to consume the new runtime access_class plus effective_tier.display_tier_label contract so protected-console gating keeps relying on runtime-owned developer authorization while the console shell stops reading the old tier shortcut as identity.
• The Developer Console menu/account summaries now derive their visible identity string from access class plus backend display tier, collapsing duplicate Developer · Developer output down to one label when the display chip matches the access class.
• Added a focused node regression proving the shared auth helper now expects access_class and display-tier data alongside the existing developer_console_access payload.

Human-Readable Notes

• Protected Developer routes still honor the runtime developer-access decision, but the console now presents Developer identity from the new account-class model instead of the retired fake plan tier.

CURRENT VER= 0.4.2-alpha / PENDING VER= 0.4.3-alpha

Developer Console First-Class Surface Auth Fix - 2026-04-04

Technical Notes

• Root-caused the live /login-success/ confirmation loop to the remaining cross-repo surface mismatch, not to missing credentials on the fetch itself: js/auth-success.js was already calling GET /auth/session with credentials: "include", but the Developer repo still identified login starts as surface: "creator" while the runtime still treated console.streamsuites.app as creator-origin auth traffic instead of a first-class console surface.
• Updated the Developer login entry points to speak the correct surface contract. js/config.js now exports the console auth surface key, and js/login.js now sends both password and OAuth login starts with surface=console while keeping the existing /login and /login-success route model plus nested return_to handling intact.
• Hardened the same-origin Pages auth proxy in functions/_shared/auth-api-proxy.js so it forwards every upstream Set-Cookie header instead of collapsing auth responses down to a single cookie line. That keeps password and OAuth handoffs honest when the runtime returns multiple cookies during login/callback cleanup.
• Added concise browser-side auth diagnostics in js/auth-success.js for the confirmation request target, final status, and rejection reason so future session-bootstrap regressions can be identified from the console without adding noisy debug-only scaffolding.

Human-Readable Notes

• The Developer Console now identifies itself as the Developer Console during login instead of pretending to be the creator surface.
• Auth handoffs keep all cookies that the runtime returns, and /login-success/ now records a useful reason when session confirmation still fails.

Files / Areas Touched

• BUMP_NOTES.md
• functions/_shared/auth-api-proxy.js
• js/auth-success.js
• js/config.js
• js/login.js

Developer Console Post-Login Loop Fix - 2026-04-04

Technical Notes

• Root-caused the remaining console login loop to a surface-handoff mismatch rather than a bad credential exchange: the Developer repo preserved return_to, but it sent OAuth starts directly back to protected console routes and its /login-success page only used a timed redirect instead of confirming the newly-issued session first.
• Reworked the Developer console handoff to match the proven Creator/Public pattern. js/login.js now sends OAuth providers to /login-success/ with the original protected console target nested in return_to, and password login now lands on the same completion page after the existing short /api/me settle check.
• Replaced the old js/auth-success.js timer-only redirect with a real /auth/session confirmation step that retries briefly on expected cookie-settle misses, preserves the requested console route, and only falls back to /login/ when the runtime still reports no valid authenticated session.
• Added console-local return-target normalization helpers in js/config.js so auth pages cannot become their own final return_to target and accidentally re-enter the login loop.

Human-Readable Notes

• Password and OAuth login now complete through a real session-confirmation handoff before the console enters /dashboard, /reports, /keys, or other protected routes.
• /login-success is now a real auth completion page rather than a blind timed bounce.

Files / Areas Touched

• BUMP_NOTES.md
• js/auth-success.js
• js/config.js
• js/login.js

Developer Login Redirect-Mode Regression Fix - 2026-04-04

Technical Notes

• Root-caused the live NetworkError when attempting to fetch resource. regression on the Developer /login password submit to js/login.js: the page still posted to POST /auth/login/password with a normal fetch, but the auth runtime finalizes successful password login with an HTTP 302 plus session cookie, so the browser fetch followed the redirect chain instead of treating the response as an auth handoff.
• Kept the new access-code gate UI and unlock flow intact while changing the password-login branch to the same safe pattern used by the public auth surface: redirect: "manual" on the password fetch, explicit handling for 401 / 429 / verification-required responses, and short session polling through /api/me before navigating back to return_to.
• Preserved the existing Developer route structure, same-origin auth proxy usage, OAuth/provider button wiring, and surface: "creator" payload semantics; only the password-submit success handling changed.

Human-Readable Notes

• The access-code control remains on the Developer login page and still unlocks login when auth is gated.
• Password login no longer relies on a fetch-followed redirect that browsers can surface as a network error on success.

Files / Areas Touched

• BUMP_NOTES.md
• js/login.js

Developer Login Access-Code Gate Fix - 2026-04-04

Technical Notes

• Root-caused the missing Developer login access-code control to the repo-local auth proxy: functions/auth/[[path]].js allowed password and OAuth starts, but it did not allow /auth/access-state or /auth/debug/unlock, so the page could not load or execute the real public-style auth gate flow after deploy.
• Reworked login/index.html and js/login.js so the Developer /login page now uses the public auth surface's real access-code pattern instead of the earlier custom bypass variant: the control is labeled Access code, gate state is fetched with cached /auth/access-state reads, unlocks persist in session storage until expiry, and password/OAuth starts are disabled or reopened behind the gate exactly as the public flow does.
• Updated the narrow login-specific gate styling in css/app.css so the unlocked/open states and disabled OAuth buttons match the Developer surface without changing unrelated shell or layout work.

Human-Readable Notes

• The Developer login page now shows the real access-code gate behavior instead of a decorative or disconnected bypass variant.
• Password login, OAuth sign-in, and return_to handoff still use the existing routes, but they now wait on the same unlock step the public login uses when auth is gated.

Files / Areas Touched

• BUMP_NOTES.md
• css/app.css
• functions/auth/[[path]].js
• js/login.js
• login/index.html

Developer Console IA / Shell / Login Parity Polish Pass - 2026-04-04

Technical Notes

• Replaced the old shared horizontal-nav treatment with two explicit chrome systems in the Developer repo: authenticated console routes now use a real sidebar plus topbar shell on /dashboard, /reports, and /keys, while /feedback, /beta, /beta/apply, /reports/submit, /login, and /login-success stay on a lighter standalone header.
• Refactored css/app.css around wider shared content widths and a reduced heading scale so the console keeps the same visual family without the earlier cramped layout and oversized page titles.
• Expanded js/auth.js from a simple status-chip slot into a reusable session widget with avatar/name metadata, dropdown actions, logout wiring, and active-route handling for both standalone pages and the authenticated shell.
• Added a new authenticated /reports hub page plus js/reports.js, and moved the actual detailed developer report form to canonical /reports/submit/.
• Replaced report/submit/index.html with a redirect stub and updated _redirects so legacy /report/submit and /report/submit/ both resolve to /reports/submit/ cleanly after deploy.
• Updated js/report-submit.js so submissions now identify themselves with source_route: "/reports/submit/", keeping route metadata aligned with the new canonical page.
• Added login-page auth-gate parity in login/index.html and js/login.js: the page now consumes /auth/access-state, exposes a bypass-code unlock form backed by /auth/debug/unlock, and renders Google, GitHub, and Discord provider icons while preserving the already-working return_to flow and existing auth starts.
• Shortened both legacy browser-facing auth pages under auth/login/index.html and auth/success/index.html into explicit redirect stubs because /login and /login-success remain the browser-facing routes after the earlier proxy-namespace fix.

Human-Readable Notes

• The console now has a real authenticated shell instead of scattered top links.
• Standalone public and intake pages still feel connected to the console, but they stay outside the protected shell.
• /reports/submit is now the real report page, and the old /report/submit path redirects there.
• The login page now includes the bypass-code field pattern and provider icons without regressing the working sign-in handoff.

Files / Areas Touched

• BUMP_NOTES.md
• DEPLOYMENT_SETUP.md
• README.md
• _headers
• _redirects
• index.html
• auth/login/index.html
• auth/success/index.html
• beta/index.html
• beta/apply/index.html
• css/app.css
• dashboard/index.html
• feedback/index.html
• js/auth.js
• js/config.js
• js/login.js
• js/report-submit.js
• js/reports.js
• keys/index.html
• login/index.html
• login-success/index.html
• report/submit/index.html
• reports/index.html
• reports/submit/index.html

Developer Console Auth Start Routing Fix - 2026-04-04

Technical Notes

• Root-caused live sign-in failure to a Cloudflare Pages route collision: the browser-facing login and success pages were mounted under /auth/*, but functions/auth/[[path]].js also owns that namespace and intercepted /auth/login/ with the proxy's 404 {"success":false,"error":"Not Found"} response before static HTML could render.
• Moved the browser-facing handoff pages to /login/ and /login-success/, which matches the proven Creator pattern of keeping human-facing login pages outside the proxied /auth/* namespace while still sending provider starts to /auth/login/{provider} and password posts to /auth/login/password.
• Added exact legacy redirects from /auth/login and /auth/success (with and without trailing slash) to the new non-conflicting pages so older links and bookmarks still resolve after deploy.

Human-Readable Notes

• Console sign-in no longer relies on a page route that the auth proxy was swallowing.
• The login page now lives at /login/, while the actual auth API starts stay on the existing proxied /auth/... endpoints.

Files / Areas Touched

• BUMP_NOTES.md
• DEPLOYMENT_SETUP.md
• README.md
• _redirects
• index.html
• js/config.js
• login/index.html
• login-success/index.html

Developer Console Foundation Scaffold - 2026-04-04

Technical Notes

• Scaffolded the existing StreamSuites-Developer repo as a Cloudflare Pages-oriented multi-route console surface using static HTML, shared CSS/JS modules, and same-origin Pages Function proxies for authoritative Auth/API access.
• Established the first public routes at /, /feedback, /beta, and /beta/apply, plus authenticated routes at /dashboard, /report/submit, /keys, /auth/login, and /auth/success.
• Kept console.streamsuites.app as the canonical hostname in repo positioning and docs while preserving enough naming flexibility for later alias attachment.
• The feedback hub now combines new public intake with the existing approved-request board pattern rather than duplicating or inventing a second request authority.
• The report route is intentionally developer-only and aligns with runtime-owned validation and safe artifact handling instead of local form-only persistence.
• Added deployment/setup notes for the manual GitHub, Cloudflare Pages, custom-domain, environment-variable, and redirect verification steps that still happen outside this code milestone.

Human-Readable Notes

• The developer repo now has a real first-pass console scaffold instead of an empty shell.
• Public users can reach feedback and beta routes, while authenticated users can reach the dashboard, developer report route, and the future keys placeholder.
• This repo stays honest about its boundary: it is the console surface, not the runtime authority.

Files / Areas Touched

• README.md
• BUMP_NOTES.md
• .gitignore
• .env.example
• _headers
• _redirects
• DEPLOYMENT_SETUP.md
• index.html
• feedback/index.html
• beta/index.html
• beta/apply/index.html
• dashboard/index.html
• report/submit/index.html
• keys/index.html
• auth/login/index.html
• auth/success/index.html
• css/app.css
• js/*.js
• functions/_shared/auth-api-proxy.js
• functions/api/[[path]].js
• functions/auth/[[path]].js
• functions/oauth/[[path]].js

Task 3X - Turnstile Auth Rollout Verification - 2026-04-04

Technical Notes

• Extended the developer-console Turnstile rollout beyond /login to the public feedback and beta/apply submission forms, using the existing inline panel styling plus a shared explicit-render helper exported from js/auth.js.
• Both forms now request /auth/turnstile/config, require a fresh token before submit, and forward turnstile_token to the authoritative runtime endpoints /api/public/feedback and /api/public/beta/apply.
• This closes the request-access and public-intake gap that the interrupted rollout left behind.

Human-Readable Notes

• The developer console now protects public beta-application and feedback submissions with the same inline Cloudflare Turnstile approach already used on login, without redesigning those forms.

Files / Areas Touched

• beta/apply/index.html
• feedback/index.html
• js/auth.js
• js/beta-apply.js
• js/feedback.js
• BUMP_NOTES.md

Risks / Follow-Ups

• Public intake abuse is reduced, not eliminated. Cloudflare WAF/rate limiting should still sit in front of the feedback, beta-apply, and auth-start endpoints.

Task 3Y - Developer Console Access Repair Pass - 2026-04-05

Technical Notes

• Reworked the protected Developer Console page bootstrap so /dashboard, /reports, /reports/submit, and /keys now opt into explicit developer-required gating instead of only checking for any authenticated session.
• Updated js/auth.js to consume the runtime-owned developer_console_access payload, redirect authenticated non-developer accounts away from protected console routes, and keep the signed-in menu from advertising protected console links to accounts that only have access to the public Developer routes.
• Aligned the login page lockout control with the public auth treatment by changing the access-code action to the small key-style button, tightening Turnstile spacing, adding alternate-surface links, and adding a lightweight source-audit regression at tests/developer-access-gating.test.mjs.

Task 3Z - Auth Surface Login Repair Follow-up - 2026-04-05

Technical

• Cleaned up the developer login vertical rhythm by grouping the existing access notice, Turnstile panel, alternate-surface links, password form, and status line into a dedicated auth stack without changing the auth logic or developer access model.
• Restored the missing access-code button icon by pointing the masked icon treatment at the required assets/icons/ui/key.svg, and replaced the old Elsewhere strip with a collapsed Login to other surfaces section using new ss-public.svg, ss-creator.svg, ss-admin.svg, and ss-developer.svg assets.
• Expanded tests/developer-access-gating.test.mjs to cover the new collapsed alternate-surface wording and the corrected key icon asset path.

Human

• The Developer login page now breathes properly around the existing auth controls instead of feeling stacked too tightly.
• The old flat selector text was removed because it read poorly and made the alternate destinations look like leftover debug links rather than intentional secondary navigation.

Human-Readable Notes

• Non-developer accounts no longer get to sit inside the protected Developer Console shell just because they have a valid StreamSuites session.
• The Developer login page now matches the public access-code treatment more closely and exposes the same subtle links to the other login surfaces.

Files / Areas Touched

• login/index.html
• css/app.css
• js/auth.js
• js/dashboard.js
• js/reports.js
• js/keys.js
• tests/developer-access-gating.test.mjs
• README.md
• BUMP_NOTES.md

Risks / Follow-Ups

• This pass still relies on the current shared StreamSuites identity model. The later dedicated Developer identity/admin-model task should revisit how protected-console eligibility is granted and presented, but it no longer needs to fix the immediate shell-access leak first.