SUPPLY-001D8: patch Babel SystemJS compiler chain

GITHUB_ISSUES.md

@@ -189,12 +189,12 @@ Repository changes can implement tests/workflow shape, but OIDC/IAM/environment
 ## SUPPLY-001 — Remove vulnerable dependency chains and stage SDK/build upgrades
 
 **Labels:** `priority:P0`, `type:maintenance`, `type:security`, `area:web`, `area:firebase`, `area:stripe`, `size:L`
-**Status:** Partial; SUPPLY-001A is represented by [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127), SUPPLY-001B by [#192](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/192), and SUPPLY-001C source/tests by [#202](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/202); D–G remain open
+**Status:** Partial; SUPPLY-001A is represented by [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127), SUPPLY-001B by [#192](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/192), SUPPLY-001C source/tests by [#202](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/202), and focused SUPPLY-001D8 by [#453](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/453); the main D–G upgrades remain open
 **Depends on:** CI-001A
 
 ### Problem
 
-The 2026-07-12 baseline production audit reported 33 root advisories (3 critical, 9 high) and 9 Functions advisories (1 high). SUPPLY-001A/#127 removes the unused `gpxparser` and obsolete `jsdom/request/form-data` chain; on a fresh Node 20 install, the root production audit falls to 22 advisories (1 critical, 8 high) while production bundle hashes remain identical. SUPPLY-001B/#192 pins the compatible React Router 6.30.4 graph and removes all three router findings, reducing that root audit to 19 advisories (1 critical, 5 high). SUPPLY-001C/#202 pins the last Firebase 11 compatibility release and its matching Rules helper; its fresh production audit reports 6 advisories (0 critical, 3 high). Firebase Admin still needs a staged major upgrade, Create React App remains unmaintained, and scanning/policy automation remains open.
+The 2026-07-12 baseline production audit reported 33 root advisories (3 critical, 9 high) and 9 Functions advisories (1 high). SUPPLY-001A/#127 removes the unused `gpxparser` and obsolete `jsdom/request/form-data` chain; on a fresh Node 20 install, the root production audit falls to 22 advisories (1 critical, 8 high) while production bundle hashes remain identical. SUPPLY-001B/#192 pins the compatible React Router 6.30.4 graph and removes all three router findings, reducing that root audit to 19 advisories (1 critical, 5 high). SUPPLY-001C/#202 pins the last Firebase 11 compatibility release and its matching Rules helper; its fresh production audit reports 6 advisories (0 critical, 3 high). Later focused lock repairs reduce the exact-main snapshot to 4 findings (3 high, 1 low) before SUPPLY-001D8/#453; D8 removes the high-severity SystemJS compiler finding through an already-compatible parent range. Firebase Admin and the Firebase CLI still need staged major upgrades, Create React App remains unmaintained, and scanning/policy automation remains open.
 
 ### Scope
 
@@ -225,10 +225,11 @@ Deliver as small ordered PRs:
 - SUPPLY-001A/#127: source search finds no runtime use; a fresh Node 20 lockfile install contains no `gpxparser`; 50 entries are removed with no retained package identity change; the root production audit changes from 33 to 22; all 47 frontend and 10 standalone SPA tests pass; and optimized JS/CSS asset hashes match the baseline exactly.
 - SUPPLY-001B/#192: the root declaration and only the three router package records change; a fresh Node 20 production audit changes from 22 findings (1 critical, 8 high, 12 moderate, 1 low) to 19 (1 critical, 5 high, 12 moderate, 1 low), with no remaining router entry. A fail-before/pass-after test covers the compatibility warnings; the focused suite also covers double-slash normalization, wildcard-to-home navigation, login return-path handling, account routing, and the 10-test standalone callback boundary.
 - SUPPLY-001C/#202: exact Firebase 11.10.0 and Rules helper 4.0.1 resolve the root production `protobufjs` path to 7.6.5 and remove Firebase's root `undici` path. The fresh production audit changes from 19 findings (1 critical, 5 high, 12 moderate, 1 low) to 6 (0 critical, 3 high, 2 moderate, 1 low). A red test proves the upgraded Rules helper cannot discover the emulator in the old Jest sandbox; the Node 20 native-web-API environment makes all 348 Rules cases pass. Focused Firebase/Auth/App Check tests pass 71/71, the frontend passes 198/198, Functions pass 1,077/1,077 applicable unit tests, and the callback and release-safety suites pass. Reproducible clean builds change the optimized main bundle from `main.fdd058b4.js` to `main.56edbdb7.js`: +8.29 kB gzip (about 3.3%) and +180 KiB on disk overall (about 1.0%). A dev-only older `protobufjs` remains nested under `firebase-tools`; the remaining six root and nine Functions production findings are still open.
+- SUPPLY-001D8/#453: keep `package.json` and `@babel/preset-env` 7.26.9 byte-compatible while moving the sole `@babel/plugin-transform-modules-systemjs` resolution from affected 7.25.9 to reviewed 7.29.7 through the existing `^7.25.9` range. The exact lock closure is 16 entries. A dependency-free RED test pins the identity/topology and reproduces upstream's safe string-export case: the old plugin emits malformed identifier syntax, while the patched plugin emits a computed string key. A fresh Node 20 production audit changes from 4 findings (3 high, 1 low) to 3 (2 high, 1 low) with no GHSA-fv7c-fp4j-7gwp. All 49 non-source-map build files are byte-identical; only the main source map changes, retaining the same 477 sources and contents while its updated mapping/name tables add 2,574 bytes.
 
 ### Agent handoff
 
-Never use `npm audit fix --force`. Do not combine all upgrades in one unreviewable lockfile diff. SUPPLY-001A, B, and C are represented by #127, #192, and #202; do not publish duplicates. #202 is source/test evidence only: it does not publish the website, deploy Firebase, change provider settings, or prove live behavior. Stop if a later provider SDK change needs a product/runtime decision.
+Never use `npm audit fix --force`. Do not combine all upgrades in one unreviewable lockfile diff. SUPPLY-001A, B, C, and focused D8 are represented by #127, #192, #202, and #453; do not publish duplicates. #202 and #453 are source/test evidence only: they do not publish the website, deploy Firebase, change provider settings, or prove live behavior. The remaining Babel-core, brace-expansion, minimatch, Firebase CLI, and Functions findings are unresolved and not accepted as safe. Stop if a later provider SDK change needs a product/runtime decision.
 
 ---
 

GITHUB_ISSUE_SLICES.md

@@ -25,6 +25,7 @@ An agent-ready child has one observable outcome, one trust boundary, explicit de
 | SUPPLY-001A | published as [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127); CI-001A | Prove `gpxparser` unused and remove its obsolete transitive chain. | `rg`/tree proof, before/after audits, root lockfile diff, full frontend checks. |
 | SUPPLY-001B | source/test delivery tracked in [#192](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/192); CI-001A | Pin React Router DOM/Router 6.30.4 and `@remix-run/router` 1.23.3; opt the declarative routers into `v7_startTransition` and `v7_relativeSplatPath` without a route redesign. | Exact three-node lock diff; Node 20 production audit 22→19 and high 8→5 with no router finding; focused route/future-flag tests, standalone callback suite, full CI, and build. |
 | SUPPLY-001C | source/tests tracked in live [#202](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/202); CI-001A | Pin the Firebase browser SDK to 11.10.0 and its Rules test helper to 4.0.1; bridge Node 20's native web APIs into the isolated Jest Rules environment without changing application behavior or provider settings. | Root production audit 19→6, critical 1→0, and high 5→3; focused Firebase/Auth/App Check tests, full frontend/Functions/Rules suites, standalone callback and safety suites, diagnostic build, dependency tree, and bundle comparison. Website publication, Firebase deployment, provider configuration, and live behavior remain unproven. |
+| SUPPLY-001D8 | source/tests tracked in [#453](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/453); CI-001A | Resolve the sole root SystemJS compiler transform from affected 7.25.9 to reviewed 7.29.7 through the unchanged `@babel/preset-env` 7.26.9 `^7.25.9` range, with no manifest or application change. | RED identity and upstream string-export regression; exact 16-entry lock closure; Node 20 production audit 4→3 and high 3→2 with GHSA-fv7c-fp4j-7gwp absent; all 49 non-map build files byte-identical and only the main source map's mapping/name tables changed. No website, Firebase, provider, or live claim. |
 | SUPPLY-001D | proposed; CI-001A | Upgrade Firebase Admin/Functions in one supported set. | Node 20 lint/unit/emulator/trigger tests and deploy compatibility notes. |
 | SUPPLY-001E | proposed; PAY-003C | Upgrade Stripe SDK and deliberately select/test an API version. | Signed fixture/test-mode diff and rollback notes; no live endpoint change. |
 | SUPPLY-001F | proposed; CI-001B2, A–C | Replace CRA while preserving env handling, SPA callbacks, sitemap/SEO, code splitting, and deploy output. | Full CI, bundle/SEO comparison, staging dry run. |

OPERATIONS_RUNBOOK.md

@@ -330,6 +330,10 @@ The upgraded Rules helper fails before rule evaluation if Jest does not receive
 
 This is source and synthetic test evidence only. It does not publish the website, deploy Firebase, change an outside provider, or prove production behavior. Use the protected release process and record each affected surface separately before making any live claim.
 
+SUPPLY-001D8 [#453](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/453) is the focused source/test record for GHSA-fv7c-fp4j-7gwp. It keeps `package.json` and `@babel/preset-env` 7.26.9 unchanged while the existing `^7.25.9` range resolves the sole SystemJS transform from affected 7.25.9 to reviewed 7.29.7. The lock changes exactly 16 records. The dependency test pins the public-registry identity and uses upstream's safe string-export case to prove computed property output. A clean Node 20 production audit changes from 4 findings (3 high, 1 low) to 3 (2 high, 1 low), with the SystemJS advisory absent. The remaining Babel-core, brace-expansion, and minimatch results are still open and are not accepted as safe.
+
+Clean before/after builds keep the same 49 non-map files, 9,975,968 bytes, and aggregate SHA-256 `3fa30c6d66827277432dcf7d42b0ead9e9fd543c9907571b092cfa43ba3f1e46`. Only the main source map changes. Its 477 source paths and contents are identical; updated mapping/name tables add 2,574 bytes. This does not change public runtime code. It does not publish the website, deploy Firebase, configure a provider, inspect production data, or prove live behavior.
+
 ### Race checkout request boundary — SOURCE ONLY, NOT LIVE
 
 PAY-001B1 [#219](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/219) makes the race checkout Function reject malformed or unexpected signup data in two steps. First, it checks one exact, bounded request shape before opening Firestore. Second, after the read-only commerce admission returns the event snapshot, it checks every submitted answer against the event's bounded participant or volunteer field definitions. A denial uses one fixed message and must occur before a rate-limit write, role or capacity call, token creation, registration write, Stripe Product creation, or Stripe Checkout Session call.