@happyvertical/smrt-ui 0.52.0 → 0.53.1

package/dist/components/forms/__tests__/signature-pad-logic.test.js

@@ -0,0 +1,54 @@
+/**
+ * Pure SignaturePad input logic, no DOM (smrt#3290). Ported from teamworks-os
+ * `signature-pad-logic.test.ts`.
+ */
+import { describe, expect, it } from 'vitest';
+import { isAcceptedPointerType, mapPointerToCanvasPoint, } from '../signature-pad-logic.js';
+describe('isAcceptedPointerType', () => {
+    it('accepts only pen input when stylusOnly is true', () => {
+        expect(isAcceptedPointerType('pen', true)).toBe(true);
+        expect(isAcceptedPointerType('touch', true)).toBe(false);
+        expect(isAcceptedPointerType('mouse', true)).toBe(false);
+    });
+    it('accepts pen, touch, and mouse when stylusOnly is false', () => {
+        expect(isAcceptedPointerType('pen', false)).toBe(true);
+        expect(isAcceptedPointerType('touch', false)).toBe(true);
+        expect(isAcceptedPointerType('mouse', false)).toBe(true);
+    });
+    it('rejects unknown and empty pointer types in both modes', () => {
+        for (const stylusOnly of [true, false]) {
+            expect(isAcceptedPointerType('unknown', stylusOnly)).toBe(false);
+            expect(isAcceptedPointerType('', stylusOnly)).toBe(false);
+        }
+    });
+});
+describe('mapPointerToCanvasPoint', () => {
+    it('subtracts the rect offset unscaled when display and backing sizes match', () => {
+        const rect = { left: 10, top: 20, width: 600, height: 240 };
+        expect(mapPointerToCanvasPoint(110, 70, rect, 600, 240)).toEqual({
+            x: 100,
+            y: 50,
+        });
+    });
+    it('scales up when displayed smaller than the backing resolution', () => {
+        const rect = { left: 0, top: 0, width: 300, height: 120 };
+        expect(mapPointerToCanvasPoint(30, 12, rect, 600, 240)).toEqual({
+            x: 60,
+            y: 24,
+        });
+    });
+    it('scales down when displayed larger than the backing resolution', () => {
+        const rect = { left: 0, top: 0, width: 1200, height: 480 };
+        expect(mapPointerToCanvasPoint(1200, 480, rect, 600, 240)).toEqual({
+            x: 600,
+            y: 240,
+        });
+    });
+    it('falls back to 1:1 for a zero-size (not laid out) rect', () => {
+        const rect = { left: 5, top: 5, width: 0, height: 0 };
+        expect(mapPointerToCanvasPoint(15, 25, rect, 600, 240)).toEqual({
+            x: 10,
+            y: 20,
+        });
+    });
+});

package/dist/components/forms/__tests__/touch-density.fixture.svelte

@@ -0,0 +1,34 @@
+<script lang="ts">
+import ThemeProvider from '../../../themes/ThemeProvider.svelte';
+import DataTable from '../../data/DataTable.svelte';
+import FilterChips from '../../nav/FilterChips.svelte';
+import Button from '../../ui/Button.svelte';
+import Checkbox from '../Checkbox.svelte';
+import Input from '../Input.svelte';
+import Radio from '../Radio.svelte';
+import RadioGroup from '../RadioGroup.svelte';
+import SegmentedControl from '../SegmentedControl.svelte';
+import Select from '../Select.svelte';
+import Switch from '../Switch.svelte';
+import Textarea from '../Textarea.svelte';
+
+let {
+  density = 'touch',
+  target = '48px',
+}: { density?: 'comfortable' | 'touch'; target?: string } = $props();
+</script>
+<ThemeProvider {density} overrides={{ '--smrt-touch-target-min': target }} persist={false} inlineVariables>
+  <Input aria-label="Name" name="name" size={12} />
+  <Select aria-label="Choice"><option value="one">One</option></Select>
+  <Textarea aria-label="Notes" />
+  <Checkbox label="Approve" />
+  <Switch label="Enable" />
+  <RadioGroup name="radio" label="Radio"><Radio value="one" label="Option one" /></RadioGroup>
+  <Button size="sm">Save</Button>
+  <Button href="/details" size="sm">Details</Button>
+  <FilterChips size="sm" options={[{ value: 'one', label: 'One' }, { value: 'off', label: 'Disabled', disabled: true }]} selected="one" />
+  <SegmentedControl label="Segments" options={[{ value: 'one', label: 'One' }, { value: 'two', label: 'Two' }]} />
+  <DataTable data={[{ id: 'one', title: 'Item' }]} columns={[{ id: 'title', label: 'Title', sortable: true }]} sortable rowKey="id" />
+  <Input aria-label="Local touch" density="touch" />
+  <Input aria-label="Local comfortable" density="comfortable" />
+</ThemeProvider>

package/dist/components/forms/__tests__/touch-density.fixture.svelte.d.ts

@@ -0,0 +1,8 @@
+type $$ComponentProps = {
+    density?: 'comfortable' | 'touch';
+    target?: string;
+};
+declare const TouchDensity: import("svelte").Component<$$ComponentProps, {}, "">;
+type TouchDensity = ReturnType<typeof TouchDensity>;
+export default TouchDensity;
+//# sourceMappingURL=touch-density.fixture.svelte.d.ts.map

package/dist/components/forms/__tests__/touch-density.fixture.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"touch-density.fixture.svelte.d.ts","sourceRoot":"","sources":["../../../../src/components/forms/__tests__/touch-density.fixture.svelte.ts"],"names":[],"mappings":"AAgBC,KAAK,gBAAgB,GAAI;IAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAsCjF,QAAA,MAAM,YAAY,sDAAwC,CAAC;AAC3D,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AACpD,eAAe,YAAY,CAAC"}

package/dist/components/forms/__tests__/touch-density.test.js

@@ -0,0 +1,66 @@
+import { render, screen } from '@testing-library/svelte';
+import { createRawSnippet } from 'svelte';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import DataTable from '../../data/DataTable.svelte';
+import FilterChips from '../../nav/FilterChips.svelte';
+import Button from '../../ui/Button.svelte';
+import Checkbox from '../Checkbox.svelte';
+import Input from '../Input.svelte';
+import RadioGroup from '../RadioGroup.svelte';
+import SegmentedControl from '../SegmentedControl.svelte';
+import Select from '../Select.svelte';
+import Switch from '../Switch.svelte';
+import Textarea from '../Textarea.svelte';
+import TouchDensityFixture from './touch-density.fixture.svelte';
+describe('touch density', () => {
+    beforeEach(() => {
+        window.matchMedia = vi.fn().mockReturnValue({
+            matches: false,
+            addEventListener: vi.fn(),
+            removeEventListener: vi.fn(),
+        });
+    });
+    it.each([
+        ['Input', Input, {}],
+        [
+            'RadioGroup',
+            RadioGroup,
+            {
+                name: 'choice',
+                children: createRawSnippet(() => ({
+                    render: () => '<span>Options</span>',
+                })),
+            },
+        ],
+        [
+            'Select',
+            Select,
+            {
+                children: createRawSnippet(() => ({
+                    render: () => '<option value="one">One</option>',
+                })),
+            },
+        ],
+        ['Textarea', Textarea, {}],
+        ['Checkbox', Checkbox, {}],
+        ['Switch', Switch, {}],
+        ['Button', Button, {}],
+        ['FilterChips', FilterChips, { options: [], selected: '' }],
+        ['SegmentedControl', SegmentedControl, { options: [], label: 'Segments' }],
+        ['DataTable', DataTable, { columns: [], data: [] }],
+    ])('%s consumes density on its target root', (_name, component, props) => {
+        const { container } = render(component, {
+            props: { ...props, density: 'touch' },
+        });
+        expect(container.querySelector('[data-density="touch"]')).toBeTruthy();
+        expect(container.querySelector('[density]')).toBeNull();
+    });
+    it('inherits global density while preserving native size and local overrides', () => {
+        const { container } = render(TouchDensityFixture);
+        expect(container.querySelector('.smrt-theme-root')).toHaveAttribute('style', expect.stringContaining('--smrt-control-target-min: var(--smrt-touch-target-min, 48px)'));
+        expect(screen.getByRole('textbox', { name: 'Name' })).toHaveAttribute('size', '12');
+        expect(screen.getByRole('textbox', { name: 'Name' })).not.toHaveAttribute('data-density');
+        expect(screen.getByRole('textbox', { name: 'Local comfortable' })).toHaveAttribute('data-density', 'comfortable');
+        expect(screen.getByRole('textbox', { name: 'Local touch' })).toHaveAttribute('data-density', 'touch');
+    });
+});

package/dist/components/forms/camera-capture-session.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Framework-free `getUserMedia()` lifecycle for `CameraCapture.svelte`.
+ *
+ * Owns exactly one acquired `MediaStream`: requesting it, classifying a
+ * rejection into one of the states the component renders, and releasing every
+ * track it acquired. It never touches a `<video>` or `<canvas>`, so permission
+ * denied, no camera, unsupported browser and stream cleanup are unit-testable
+ * against a fake `MediaDevices` with no DOM at all. The component stays thin
+ * DOM glue around it.
+ *
+ * Guards one race a naive "await getUserMedia, then store the stream" misses:
+ * the user can dismiss the permission prompt late, or the component can be
+ * disabled or unmounted, while `getUserMedia()` is still pending. Storing that
+ * late result would leave the camera light on with nothing left to stop it.
+ * `stop()` and every new `start()` bump a generation counter; `start()`
+ * compares the generation it was issued under once the promise settles and
+ * discards a stale result, stopping any tracks it just acquired.
+ *
+ * Ported from teamworks-os (`camera-capture-session.ts` and
+ * `camera-capture-logic.ts`), smrt#3290.
+ */
+/** Camera facing mode requested from `getUserMedia()`. */
+export type CameraFacingMode = 'environment' | 'user';
+/** The failure states a camera request can surface. */
+export type CameraCaptureErrorKind = 'permission-denied' | 'no-camera' | 'unsupported' | 'error';
+/**
+ * Structural stand-in for `{ mediaDevices?: MediaDevices }`. lib.dom types
+ * `Navigator.mediaDevices` as always present, but a browser without camera
+ * support (or a page outside a secure context) leaves it `undefined`.
+ */
+export interface MaybeMediaDevicesHost {
+    mediaDevices?: {
+        getUserMedia?: unknown;
+    } | undefined;
+}
+/** The part of `MediaDevices` the session needs. */
+export interface MediaDevicesLike {
+    getUserMedia(constraints: MediaStreamConstraints): Promise<MediaStream>;
+}
+/** Result of one `start()` call. `cancelled` means a `stop()` superseded it. */
+export type CameraSessionResult = {
+    ok: true;
+    stream: MediaStream;
+} | {
+    ok: false;
+    kind: CameraCaptureErrorKind | 'cancelled';
+    /** Diagnostic message from the rejection; not localized, not for display. */
+    message: string;
+};
+export interface CameraSessionDeps {
+    /**
+     * `navigator.mediaDevices`, resolved by the caller (`undefined` when the
+     * browser has none) so this module never reaches for a global itself.
+     */
+    mediaDevices: MediaDevicesLike | undefined;
+}
+/**
+ * Whether this runtime exposes `getUserMedia` at all. An unsupported browser is
+ * never reported as "no camera": those states need different recovery copy.
+ */
+export declare function isCameraApiSupported(nav: MaybeMediaDevicesHost | undefined): boolean;
+/**
+ * Maps a `getUserMedia()` rejection to a rendered state by `DOMException.name`
+ * (the cross-browser contract), never by message text.
+ *
+ * Deliberately does not gate on `instanceof Error`: a browser `DOMException`
+ * does not inherit from `Error` in shipping engines, so that check would send
+ * every real rejection to the generic state. Node's `DOMException` happening to
+ * extend `Error` is what hides that bug in local tests.
+ */
+export declare function classifyGetUserMediaError(error: unknown): CameraCaptureErrorKind;
+/** Create a session that owns at most one live camera stream. */
+export declare function createCameraSession(deps: CameraSessionDeps): {
+    start: (facingMode: CameraFacingMode) => Promise<CameraSessionResult>;
+    stop: () => void;
+    /** The live stream, or `null` when none is held. */
+    readonly stream: MediaStream | null;
+};
+/** A camera session created by {@link createCameraSession}. */
+export type CameraSession = ReturnType<typeof createCameraSession>;
+//# sourceMappingURL=camera-capture-session.d.ts.map

package/dist/components/forms/camera-capture-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"camera-capture-session.d.ts","sourceRoot":"","sources":["../../../src/components/forms/camera-capture-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,0DAA0D;AAC1D,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,MAAM,CAAC;AAEtD,uDAAuD;AACvD,MAAM,MAAM,sBAAsB,GAC9B,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,OAAO,CAAC;AAEZ;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,YAAY,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;CACvD;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,WAAW,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACzE;AAED,gFAAgF;AAChF,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACjC;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,sBAAsB,GAAG,WAAW,CAAC;IAC3C,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,YAAY,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC5C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,qBAAqB,GAAG,SAAS,GACrC,OAAO,CAET;AAUD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,GACb,sBAAsB,CAaxB;AAMD,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB;wBAgB3C,gBAAgB,KAC3B,OAAO,CAAC,mBAAmB,CAAC;gBAuCd,IAAI;IASnB,oDAAoD;qBACtC,WAAW,GAAG,IAAI;EAInC;AAED,+DAA+D;AAC/D,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/components/forms/camera-capture-session.js

@@ -0,0 +1,130 @@
+/**
+ * Framework-free `getUserMedia()` lifecycle for `CameraCapture.svelte`.
+ *
+ * Owns exactly one acquired `MediaStream`: requesting it, classifying a
+ * rejection into one of the states the component renders, and releasing every
+ * track it acquired. It never touches a `<video>` or `<canvas>`, so permission
+ * denied, no camera, unsupported browser and stream cleanup are unit-testable
+ * against a fake `MediaDevices` with no DOM at all. The component stays thin
+ * DOM glue around it.
+ *
+ * Guards one race a naive "await getUserMedia, then store the stream" misses:
+ * the user can dismiss the permission prompt late, or the component can be
+ * disabled or unmounted, while `getUserMedia()` is still pending. Storing that
+ * late result would leave the camera light on with nothing left to stop it.
+ * `stop()` and every new `start()` bump a generation counter; `start()`
+ * compares the generation it was issued under once the promise settles and
+ * discards a stale result, stopping any tracks it just acquired.
+ *
+ * Ported from teamworks-os (`camera-capture-session.ts` and
+ * `camera-capture-logic.ts`), smrt#3290.
+ */
+/**
+ * Whether this runtime exposes `getUserMedia` at all. An unsupported browser is
+ * never reported as "no camera": those states need different recovery copy.
+ */
+export function isCameraApiSupported(nav) {
+    return typeof nav?.mediaDevices?.getUserMedia === 'function';
+}
+function readStringField(value, field) {
+    if (typeof value !== 'object' || value === null || !(field in value)) {
+        return undefined;
+    }
+    const read = value[field];
+    return typeof read === 'string' ? read : undefined;
+}
+/**
+ * Maps a `getUserMedia()` rejection to a rendered state by `DOMException.name`
+ * (the cross-browser contract), never by message text.
+ *
+ * Deliberately does not gate on `instanceof Error`: a browser `DOMException`
+ * does not inherit from `Error` in shipping engines, so that check would send
+ * every real rejection to the generic state. Node's `DOMException` happening to
+ * extend `Error` is what hides that bug in local tests.
+ */
+export function classifyGetUserMediaError(error) {
+    switch (readStringField(error, 'name')) {
+        case 'NotAllowedError':
+        case 'PermissionDeniedError':
+        case 'SecurityError':
+            return 'permission-denied';
+        case 'NotFoundError':
+        case 'DevicesNotFoundError':
+        case 'OverconstrainedError':
+            return 'no-camera';
+        default:
+            return 'error';
+    }
+}
+const UNSUPPORTED_MESSAGE = 'getUserMedia is not available in this runtime.';
+const GENERIC_ERROR_MESSAGE = 'Could not access the camera.';
+const CANCELLED_MESSAGE = 'Camera request was superseded by stop().';
+/** Create a session that owns at most one live camera stream. */
+export function createCameraSession(deps) {
+    let stream = null;
+    let generation = 0;
+    function releaseTracks(media) {
+        for (const track of media.getTracks())
+            track.stop();
+    }
+    /**
+     * Request the camera. `facingMode` is a parameter, not a construction-time
+     * dependency, so a caller re-reading a reactive prop always requests the
+     * current value. A new `start()` supersedes the held stream (released now)
+     * and any request still pending (released when it settles), so overlapping
+     * calls can never leak a stream.
+     */
+    async function start(facingMode) {
+        if (stream) {
+            releaseTracks(stream);
+            stream = null;
+        }
+        generation += 1;
+        const requestGeneration = generation;
+        const mediaDevices = deps.mediaDevices;
+        if (!mediaDevices || !isCameraApiSupported({ mediaDevices })) {
+            return { ok: false, kind: 'unsupported', message: UNSUPPORTED_MESSAGE };
+        }
+        try {
+            const media = await mediaDevices.getUserMedia({
+                video: { facingMode },
+                audio: false,
+            });
+            if (requestGeneration !== generation) {
+                releaseTracks(media);
+                return { ok: false, kind: 'cancelled', message: CANCELLED_MESSAGE };
+            }
+            stream = media;
+            return { ok: true, stream: media };
+        }
+        catch (error) {
+            if (requestGeneration !== generation) {
+                return { ok: false, kind: 'cancelled', message: CANCELLED_MESSAGE };
+            }
+            return {
+                ok: false,
+                kind: classifyGetUserMediaError(error),
+                message: readStringField(error, 'message') ?? GENERIC_ERROR_MESSAGE,
+            };
+        }
+    }
+    /**
+     * Stop every track of the held stream, forget it, and invalidate any
+     * `start()` still in flight. Idempotent: a second call (for example from a
+     * `disabled` toggle and then unmount) never stops a track twice.
+     */
+    function stop() {
+        generation += 1;
+        if (stream)
+            releaseTracks(stream);
+        stream = null;
+    }
+    return {
+        start,
+        stop,
+        /** The live stream, or `null` when none is held. */
+        get stream() {
+            return stream;
+        },
+    };
+}

package/dist/components/forms/form-retry/__tests__/boundaries.test.js

@@ -0,0 +1,23 @@
+/**
+ * smrt-ui is the dependency leaf, and the form-retry entry is published
+ * Svelte-free (#3291): its sources must never import `@sveltejs/kit` or
+ * `svelte`, so plain SvelteKit apps, smrt-svelte and plain Node can load it.
+ */
+import { readdirSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+describe('form-retry import boundary', () => {
+    it('imports neither @sveltejs/kit nor svelte', () => {
+        const sources = readdirSync(root).filter((name) => name.endsWith('.ts'));
+        expect(sources.length).toBeGreaterThan(0);
+        for (const name of sources) {
+            const text = readFileSync(join(root, name), 'utf8');
+            const imports = [...text.matchAll(/from\s+['"]([^'"]+)['"]/g)].map((match) => match[1]);
+            for (const specifier of imports) {
+                expect(specifier, `${name} imports ${specifier}`).toMatch(/^\.\//);
+            }
+        }
+    });
+});

package/dist/components/forms/form-retry/__tests__/content-digest.test.js

@@ -0,0 +1,70 @@
+/**
+ * The browser port of `runOnce()`'s content digest (#3291) must agree with
+ * core's `digestRunOnceContent()` byte for byte. These vectors were computed
+ * with `@happyvertical/smrt-core`'s implementation; the same table lives in
+ * `packages/core/src/__tests__/issue-3291-digest-vectors.test.ts`, so a change
+ * to either side fails the other.
+ */
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { digestSubmissionContent } from '../content-digest.js';
+afterEach(() => {
+    vi.unstubAllGlobals();
+});
+function orders() {
+    const fd1 = new FormData();
+    fd1.append('supplier', 'acme');
+    fd1.append('qty', '2');
+    fd1.append('qty', '3');
+    fd1.append('note', 'héllo ✓');
+    const fd2 = new FormData();
+    fd2.append('supplier', 'acme');
+    fd2.append('qty', '3');
+    fd2.append('qty', '2');
+    fd2.append('note', 'héllo ✓');
+    return { fd1, fd2 };
+}
+describe('digestSubmissionContent', () => {
+    it('matches core for plain JSON, toJSON values and the NUL-key escape', async () => {
+        expect(await digestSubmissionContent({
+            b: 1,
+            a: [true, null, 'x'],
+            c: { z: 1.5, y: 'é' },
+        })).toBe('d9ae830ae60cc25876ef0bf6a94b95396a9feb02d8104d0ccca51dbed2b3483d');
+        expect(await digestSubmissionContent({
+            when: new Date('2026-10-01T12:00:00.000Z'),
+            skip: undefined,
+            arr: [undefined, 1],
+        })).toBe('d5333d325d8f37a2421db409a9532616e23153c6c4312a51e42b645c045b7a00');
+        expect(await digestSubmissionContent({ '\u0000FormData': [['a', 'b']] })).toBe('0d345acb479395e8c56d2a4abf52124dd22714777e38accfbe92df2c82bf7174');
+        expect(await digestSubmissionContent(undefined)).toBe('74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b');
+    });
+    it('matches core for FormData: ordered, repeated fields significant', async () => {
+        const { fd1, fd2 } = orders();
+        expect(await digestSubmissionContent(fd1)).toBe('67fc035f5a3f342757e9579c1520b2dd34ae91b921f5e5eab05e56b02553a1d5');
+        expect(await digestSubmissionContent(fd2)).toBe('bc3d36f0e0441e887ffa641432f87a60cc3de592cff32a29cf35f5cb6fc0cd7d');
+        expect(await digestSubmissionContent(new FormData())).toBe('c926873e5af4105c2192c4a1a4e4cd87665c0869cf24c025160416e1c167faec');
+        expect(await digestSubmissionContent({ form: fd1, extra: 'x' })).toBe('2e89c1d455e7007af1f0826465c7e417a5c07900fc862293be42e7ae5928d00c');
+    });
+    it('digests a File by name, type and size — never its bytes', async () => {
+        const withFile = (bytes) => {
+            const data = new FormData();
+            data.append('title', 'Report');
+            data.append('photo', new File([bytes], 'a.jpg', { type: 'image/jpeg' }));
+            data.append('empty', new File([], '', { type: 'application/octet-stream' }));
+            return data;
+        };
+        expect(await digestSubmissionContent(withFile('abc'))).toBe('f16bbad3bdfd6fe4dc441855ecb2260e3fc14ed05d228deb50b5c0860c8f7208');
+        // Same name, type and size, different bytes: the same digest. Re-choosing
+        // the same file after a reload is therefore the same claim.
+        expect(await digestSubmissionContent(withFile('xyz'))).toBe(await digestSubmissionContent(withFile('abc')));
+    });
+    it('rejects values JSON would misrepresent instead of hashing them as {}', async () => {
+        await expect(digestSubmissionContent(new Map([['a', 1]]))).rejects.toThrow(TypeError);
+        await expect(digestSubmissionContent({ s: new Set([1]) })).rejects.toThrow(/Set/);
+        await expect(digestSubmissionContent({ n: 1n })).rejects.toThrow(/bigint/);
+    });
+    it('explains a missing Web Crypto (insecure context)', async () => {
+        vi.stubGlobal('crypto', {});
+        await expect(digestSubmissionContent({ a: 1 })).rejects.toThrow(/secure context/);
+    });
+});