UX/UI & Web Interface Specialist

Full source: docs/ai-experts/05-ux-ui-web-specialist.md

Scope

The canonical dashboard, apps/mx_fuels_reporting_app/apps/web/ — a TypeScript-only Next.js 16 app (App Router, Server Components, React 19.2, Tailwind CSS 4) backed by WorkOS sealed-session auth and Azure Key Vault. The frozen T3 scaffold at web/site/ is explicitly out of scope for new feature work. The legacy Streamlit frontend and FastAPI backend have been removed from the repository.

Key constraints

Every protected route/handler must call buildMeResponse(req, cfg) and check authenticated/blocked — never reconstruct identity through a custom path.
Secrets only via named loaders in src/lib/keyVault.ts (loadWorkOSSecrets, loadPGSecrets, etc.) — never SecretClient directly, never exposed to the client bundle.
pnpm exclusively (never npm/yarn/bun) in this app.
Server Components by default; "use client" only when hooks/events/browser APIs are needed.
loadVDRSecrets/Graph flows use the shared lazy dashboard credential. Local development uses AzureCliCredential; production uses the attached UAMI.

When to consult

Building dashboard routes, layouts, or components
Changing auth behavior or the middleware allow-list
Adding a new dashboard secret
Styling/accessibility work