Refine widget logout and floating CalorieApp shortcuts

[xrpbanks]

The CalorieApp page currently places a long joint-logout button above the iframe, while other pages label the widget button “Sign out both”. Floating shortcuts also still use the Integrated Exchange destination and do not have the requested transparent CalorieApp mark.

This maintenance PR prepares plugin 0.3.22 from the installed 0.3.21 merge 6f754c837cf80b05422d347b5a43c512aa3c9dea.

• Moves the existing embedded-page logout button and status into the XUMM account widget after the embed controller initializes. Both website buttons read “Log out”, with device-scoped title/accessible text.
• Reuses the same bound button, trusted iframe and logout completion handshake. The complete calorieapp-embed.js, PHP authentication methods and accepted startup/session checks stay unchanged.
• Updates existing floating Brizy Integrated Exchange shortcuts to CalorieApp, retains their icon size/wrappers, and omits Home on Home and CalorieApp on CalorieApp.
• Uses nine original vector paths extracted from the project's calorieappdraft3.ai Illustrator file for a transparent phone logo. No new logo is drawn; source and mark boundaries are documented. The SVG is included in the deterministic release archive.
• Keeps inline content links and other shortcut destinations intact. The current app template has no Brizy floating shortcuts; the rule applies if these are added. This change does not create an extra floating bar.

The matching app label and Open Food Facts contribution footer are in #129, based on accepted main. Do not merge this maintenance branch into app main.

Validation before review: 15 JavaScript tests pass, including both real logout controllers after relocation, retry/trust behavior, responsive header lifecycle and current-page navigation. All 8 release-builder tests pass. CI runs PHP lint, the real PHP renderer test and those same checks. The original SVG has been rendered and visually inspected. The candidate was installed with the user's approval and native mobile/desktop rendering was checked on 2026-09-07. The previously noted smaller-desktop widget clipping is a separate followup.

Package:

3144e53de84148f79e0315f0df28072c604c5ca3d284e5e75ffef686f866e7fa  calorieapp-identity-bridge-0.3.22.zip
ZIP bytes: 52223

See docs/STEP_3_SESSION_NAVIGATION.md for the change boundary and source details. Merged and installed with the user's approval on 2026-09-07.

Final review: the maintenance CI passed on head ed0995f66fb07531c3eba58e7abe8414ca85aacb (tree 6b6cf048d83f90c442ec743334089e57b134eee8). Copilot reviewed 15/16 changed files on this exact head, generated zero comments, and recorded COMMENTED with approval recommended. The SVG was separately inspected from the original vector source and rendered with transparent exterior and phone opening. All 37 available committed source/test files matched their Git blob hashes; all 22 ZIP members exactly matched the committed plugin sources. Both reviewed PRs have now been merged into their intended, separate base branches.

Installation verification: maintenance merge df216a14218303cec0907c1b0f8fd8310f0aa343 preserves the reviewed tree. WordPress accepted the verified 52,223-byte archive through its native plugin replacement flow (0.3.21 → 0.3.22) and reported Plugin updated successfully. All four live bridge assets report ver=0.3.22. On the CalorieApp page exactly one Log out button is present inside .xl-card, with none remaining above the iframe.

Live visual/navigation checks: desktop viewport 1363 × 936; native Customizer mobile preview 320px wide. The mobile widget measures 280 × 148px and its logout button is 44px high; the menu opens below the widget without overlap. Home shows the original transparent CalorieApp phone shortcut and no Home shortcut. FAQ retains both Home and CalorieApp shortcuts. The mobile CalorieApp shortcut successfully navigates from Home to the app; the app template has no redundant self shortcut. The new Open Food Facts footer from #129 was also verified inside the iframe on desktop and mobile. No Customizer settings were changed or published. Existing smaller-desktop widget clipping remains a separate follow-up; no physical-phone wallet sign-in/logout was performed during these visual checks.

[Copilot]

🟢 Approval recommended

The changes are narrowly scoped, preserve the existing logout handshake, and add/extend automated tests and packaging/provenance updates that cover the new behaviors.

Pull request overview

This PR prepares CalorieApp Identity Bridge plugin 0.3.22 by relocating the existing embedded-page logout UI into the XUMM account card (without changing the underlying logout handshake), and by updating Brizy floating shortcuts to point to CalorieApp with the requested transparent project mark.

Changes:

• Relocate the embedded-page logout/status nodes into the .xl-card after the embed controller initializes, and unify both website logout buttons to the label “Log out” with device-scoped accessible text.
• Add a new front-end navigation script that updates/hides floating Brizy Home/CalorieApp shortcuts based on the current page and replaces the legacy Integrated Exchange shortcut destination with CalorieApp plus the bundled SVG mark.
• Package/document the new SVG mark deterministically (release builder glob + provenance/notices/docs) and extend CI coverage with a dedicated navigation test.

File summaries

File	Description
wordpress-plugins/calorieapp-identity-bridge/THIRD_PARTY_NOTICES.md	Documents the bundled CalorieApp SVG mark source and usage scope.
wordpress-plugins/calorieapp-identity-bridge/README.md	Summarizes 0.3.22 behavior changes (logout relocation + floating shortcuts).
wordpress-plugins/calorieapp-identity-bridge/includes/class-calorieapp-identity-bridge-integrated-login.php	Adds navigation dataset config; unifies logout label + accessibility text in both render paths.
wordpress-plugins/calorieapp-identity-bridge/calorieapp-identity-bridge.php	Bumps plugin version to 0.3.22 and enqueues the new navigation script.
wordpress-plugins/calorieapp-identity-bridge/assets/calorieapp-site-session.js	Moves the embedded-page logout/status nodes into the XUMM card without creating a new logout flow.
wordpress-plugins/calorieapp-identity-bridge/assets/calorieapp-site-navigation.js	New script to retarget/hide floating Brizy Home/CalorieApp shortcuts and apply the SVG mark.
wordpress-plugins/calorieapp-identity-bridge/assets/calorieapp-logo.svg	Adds the transparent CalorieApp phone mark used for floating shortcuts.
wordpress-plugins/calorieapp-identity-bridge/assets/calorieapp-embed.css	Updates styling hooks to target the relocated .calorieapp-site-session-actions inside .xl-card.
tools/tests/wordpress_site_session.test.mjs	Updates session controller harness to reflect embed relocation and new logout label.
tools/tests/wordpress_site_session_markup.test.php	Asserts new dataset attributes and logout label/accessibility text in rendered markup.
tools/tests/wordpress_site_navigation.test.mjs	New test coverage for floating shortcut rewriting/hiding and hardening against foreign asset config.
tools/tests/calorieapp_embed_readiness.test.mjs	Extends embed readiness test to ensure relocation preserves the existing logout handler.
tools/build_wordpress_plugin_release.py	Includes SVG assets in deterministic release packaging.
docs/STEP_3_SESSION_NAVIGATION.md	Adds boundary/source documentation and verification commands for this maintenance step.
contracts/identity-bridge/v1/code-provenance.json	Records provenance/licensing classification for the new SVG and navigation script.
.github/workflows/bridge-maintenance-checks.yml	Adds CI run for the new floating navigation test.

Review details

• Files reviewed: 15/16 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.