@hexclave/next 1.0.51 → 1.0.52

package/dist/components-page/sign-out.test.js

@@ -0,0 +1,157 @@
+const require_rolldown_runtime = require("../rolldown-runtime-D6vf50IK.js");
+let ___lib_hexclave_app_common_js = require("../lib/hexclave-app/common.js");
+let react = require("react");
+react = require_rolldown_runtime.__toESM(react);
+let react_jsx_runtime = require("react/jsx-runtime");
+let react_dom_client = require("react-dom/client");
+let vitest = require("vitest");
+let __sign_out_js = require("./sign-out.js");
+let ___providers_translation_provider_client_js = require("../providers/translation-provider-client.js");
+//#region src/components-page/sign-out.test.tsx
+// @vitest-environment jsdom
+const appMockState = vitest.vi.hoisted(() => ({
+	app: null,
+	user: null
+}));
+vitest.vi.mock("..", () => ({
+	useStackApp: () => {
+		if (appMockState.app == null) throw new Error("Expected test app to be set before rendering.");
+		return appMockState.app;
+	},
+	useUser: () => appMockState.user
+}));
+vitest.vi.mock("@hexclave/shared/dist/utils/react", async (importOriginal) => {
+	const original = await importOriginal();
+	const promiseStates = /* @__PURE__ */ new WeakMap();
+	return {
+		...original,
+		use: (promise) => {
+			const state = promiseStates.get(promise);
+			if (state == null) {
+				promiseStates.set(promise, { status: "pending" });
+				promise.then((value) => promiseStates.set(promise, {
+					status: "ok",
+					value
+				}), (error) => promiseStates.set(promise, {
+					status: "error",
+					error
+				}));
+				throw promise;
+			}
+			switch (state.status) {
+				case "pending": throw promise;
+				case "error": throw state.error;
+				case "ok": return state.value;
+			}
+		}
+	};
+});
+vitest.vi.mock("@hexclave/ui", async () => {
+	await import("react");
+	return {
+		Button: (props) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+			type: "button",
+			onClick: props.onClick,
+			children: props.children
+		}),
+		Typography: (props) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { children: props.children }),
+		cn: (...classes) => classes.filter(Boolean).join(" ")
+	};
+});
+const previousActEnvironment = Reflect.get(globalThis, "IS_REACT_ACT_ENVIRONMENT");
+function createAppTestDouble(options) {
+	return {
+		redirectToSignIn: vitest.vi.fn(async () => {}),
+		[___lib_hexclave_app_common_js.hexclaveAppInternalsSymbol]: { isTrustedRedirectUrl: vitest.vi.fn(async (url) => options.trustedUrls.includes(url)) }
+	};
+}
+function createUserTestDouble() {
+	return { signOut: vitest.vi.fn(async () => {}) };
+}
+const originalLocation = window.location;
+let locationReplaceMock = vitest.vi.fn();
+let root = null;
+let container = null;
+async function renderSignOut(options) {
+	appMockState.app = options.app;
+	appMockState.user = options.user;
+	container = document.createElement("div");
+	document.body.append(container);
+	root = (0, react_dom_client.createRoot)(container);
+	await (0, react.act)(async () => {
+		root?.render(/* @__PURE__ */ (0, react_jsx_runtime.jsx)(___providers_translation_provider_client_js.TranslationProviderClient, {
+			quetzalKeys: /* @__PURE__ */ new Map(),
+			quetzalLocale: /* @__PURE__ */ new Map(),
+			children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(react.default.Suspense, {
+				fallback: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { "data-testid": "suspense-fallback" }),
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(__sign_out_js.SignOut, { searchParams: options.searchParams })
+			})
+		}));
+	});
+	await (0, react.act)(async () => {
+		await new Promise((resolve) => setTimeout(resolve, 0));
+	});
+}
+(0, vitest.describe)("SignOut", () => {
+	(0, vitest.beforeEach)(() => {
+		Reflect.set(globalThis, "IS_REACT_ACT_ENVIRONMENT", true);
+		locationReplaceMock = vitest.vi.fn();
+		Reflect.deleteProperty(window, "location");
+		Reflect.set(window, "location", {
+			href: "https://demo.example.test/handler/sign-out",
+			replace: locationReplaceMock
+		});
+	});
+	(0, vitest.afterEach)(() => {
+		(0, react.act)(() => {
+			root?.unmount();
+		});
+		container?.remove();
+		root = null;
+		container = null;
+		appMockState.app = null;
+		appMockState.user = null;
+		Reflect.set(window, "location", originalLocation);
+		vitest.vi.restoreAllMocks();
+		Reflect.set(globalThis, "IS_REACT_ACT_ENVIRONMENT", previousActEnvironment);
+	});
+	(0, vitest.it)("signs out with a trusted after_auth_return_to redirect URL", async () => {
+		const app = createAppTestDouble({ trustedUrls: ["/dashboard"] });
+		const user = createUserTestDouble();
+		await renderSignOut({
+			app,
+			user,
+			searchParams: { after_auth_return_to: "/dashboard" }
+		});
+		(0, vitest.expect)(user.signOut).toHaveBeenCalledWith({ redirectUrl: "/dashboard" });
+	});
+	(0, vitest.it)("ignores an untrusted after_auth_return_to and falls back to the default sign-out redirect", async () => {
+		const app = createAppTestDouble({ trustedUrls: [] });
+		const user = createUserTestDouble();
+		await renderSignOut({
+			app,
+			user,
+			searchParams: { after_auth_return_to: "https://evil.example.test/phishing" }
+		});
+		(0, vitest.expect)(user.signOut).toHaveBeenCalledWith({ redirectUrl: void 0 });
+	});
+	(0, vitest.it)("does not follow an untrusted after_auth_return_to when already signed out", async () => {
+		await renderSignOut({
+			app: createAppTestDouble({ trustedUrls: [] }),
+			user: null,
+			searchParams: { after_auth_return_to: "https://evil.example.test/phishing-signed-out" }
+		});
+		(0, vitest.expect)(locationReplaceMock).not.toHaveBeenCalled();
+	});
+	(0, vitest.it)("follows a trusted after_auth_return_to when already signed out", async () => {
+		await renderSignOut({
+			app: createAppTestDouble({ trustedUrls: ["/trusted-dashboard"] }),
+			user: null,
+			searchParams: { after_auth_return_to: "/trusted-dashboard" }
+		});
+		(0, vitest.expect)(locationReplaceMock).toHaveBeenCalledWith("/trusted-dashboard");
+	});
+});
+//#endregion
+
+//# sourceMappingURL=sign-out.test.js.map

package/dist/components-page/sign-out.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-out.test.js","names":["vi","hexclaveAppInternalsSymbol","TranslationProviderClient","React","SignOut"],"sources":["../../src/components-page/sign-out.test.tsx"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n// @vitest-environment jsdom\n\nimport React, { act } from \"react\";\nimport { createRoot, type Root } from \"react-dom/client\";\nimport { afterEach, beforeEach, describe, expect, it, vi } from \"vitest\";\nimport type { CurrentUser } from \"../lib/hexclave-app\";\nimport type { StackClientApp } from \"../lib/hexclave-app/apps/interfaces/client-app\";\nimport { hexclaveAppInternalsSymbol } from \"../lib/hexclave-app/common\";\nimport { TranslationProviderClient } from \"../providers/translation-provider-client\";\nimport { SignOut } from \"./sign-out\";\n\nconst appMockState = vi.hoisted(() => ({\n  app: null as unknown,\n  user: null as unknown,\n}));\n\nvi.mock(\"..\", () => ({\n  useStackApp: () => {\n    if (appMockState.app == null) {\n      throw new Error(\"Expected test app to be set before rendering.\");\n    }\n    return appMockState.app;\n  },\n  useUser: () => appMockState.user,\n}));\n\n// The real `use` delegates to React.use, which breaks in this test setup because the shared\n// package and react-dom resolve different React instances. Replace it with an equivalent\n// Suspense-compatible implementation that doesn't depend on the React dispatcher.\nvi.mock(\"@hexclave/shared/dist/utils/react\", async (importOriginal) => {\n  const original = await importOriginal<typeof import(\"@hexclave/shared/dist/utils/react\")>();\n  type PromiseState = { status: \"pending\" } | { status: \"ok\", value: unknown } | { status: \"error\", error: unknown };\n  const promiseStates = new WeakMap<Promise<unknown>, PromiseState>();\n  return {\n    ...original,\n    use: <T,>(promise: Promise<T>): T => {\n      const state = promiseStates.get(promise);\n      if (state == null) {\n        promiseStates.set(promise, { status: \"pending\" });\n        promise.then(\n          (value) => promiseStates.set(promise, { status: \"ok\", value }),\n          (error) => promiseStates.set(promise, { status: \"error\", error }),\n        );\n        throw promise;\n      }\n      switch (state.status) {\n        case \"pending\": {\n          throw promise;\n        }\n        case \"error\": {\n          throw state.error;\n        }\n        case \"ok\": {\n          // This cast is safe because the value was stored from this exact promise's resolution;\n          // the WeakMap just can't express the per-key type relationship.\n          return state.value as T;\n        }\n      }\n    },\n  };\n});\n\nvi.mock(\"@hexclave/ui\", async () => {\n  const React = await import(\"react\");\n  return {\n    Button: (props: { children: React.ReactNode, onClick?: () => void }) => (\n      <button type=\"button\" onClick={props.onClick}>{props.children}</button>\n    ),\n    Typography: (props: { children: React.ReactNode }) => <div>{props.children}</div>,\n    cn: (...classes: (string | false | null | undefined)[]) => classes.filter(Boolean).join(\" \"),\n  };\n});\n\nconst previousActEnvironment = Reflect.get(globalThis, \"IS_REACT_ACT_ENVIRONMENT\");\n\nfunction createAppTestDouble(options: {\n  trustedUrls: string[],\n}) {\n  const app = {\n    redirectToSignIn: vi.fn(async () => {}),\n    [hexclaveAppInternalsSymbol]: {\n      isTrustedRedirectUrl: vi.fn(async (url: string) => options.trustedUrls.includes(url)),\n    },\n  };\n\n  // This test double intentionally implements only the StackClientApp surface that SignOut and\n  // the rendered signed-out card touch.\n  return app as unknown as StackClientApp<true>;\n}\n\nfunction createUserTestDouble() {\n  const user = {\n    signOut: vi.fn(async () => {}),\n  };\n  // Same as the app test double: only the surface SignOut touches.\n  return user as unknown as CurrentUser & { signOut: ReturnType<typeof vi.fn> };\n}\n\n// jsdom's window.location is not configurable, so it can't be spied on; replace it wholesale.\nconst originalLocation = window.location;\nlet locationReplaceMock = vi.fn();\n\nlet root: Root | null = null;\nlet container: HTMLDivElement | null = null;\n\nasync function renderSignOut(options: {\n  app: StackClientApp<true>,\n  user: unknown,\n  searchParams?: Record<string, string>,\n}) {\n  appMockState.app = options.app;\n  appMockState.user = options.user;\n  container = document.createElement(\"div\");\n  document.body.append(container);\n  root = createRoot(container);\n  await act(async () => {\n    root?.render(\n      <TranslationProviderClient quetzalKeys={new Map()} quetzalLocale={new Map()}>\n        <React.Suspense fallback={<div data-testid=\"suspense-fallback\" />}>\n          <SignOut searchParams={options.searchParams} />\n        </React.Suspense>\n      </TranslationProviderClient>\n    );\n  });\n  await act(async () => {\n    await new Promise((resolve) => setTimeout(resolve, 0));\n  });\n}\n\ndescribe(\"SignOut\", () => {\n  beforeEach(() => {\n    Reflect.set(globalThis, \"IS_REACT_ACT_ENVIRONMENT\", true);\n    locationReplaceMock = vi.fn();\n    Reflect.deleteProperty(window, \"location\");\n    Reflect.set(window, \"location\", { href: \"https://demo.example.test/handler/sign-out\", replace: locationReplaceMock });\n  });\n\n  afterEach(() => {\n    act(() => {\n      root?.unmount();\n    });\n    container?.remove();\n    root = null;\n    container = null;\n    appMockState.app = null;\n    appMockState.user = null;\n    Reflect.set(window, \"location\", originalLocation);\n    vi.restoreAllMocks();\n    Reflect.set(globalThis, \"IS_REACT_ACT_ENVIRONMENT\", previousActEnvironment);\n  });\n\n  it(\"signs out with a trusted after_auth_return_to redirect URL\", async () => {\n    const app = createAppTestDouble({ trustedUrls: [\"/dashboard\"] });\n    const user = createUserTestDouble();\n\n    await renderSignOut({ app, user, searchParams: { after_auth_return_to: \"/dashboard\" } });\n\n    expect(user.signOut).toHaveBeenCalledWith({ redirectUrl: \"/dashboard\" });\n  });\n\n  it(\"ignores an untrusted after_auth_return_to and falls back to the default sign-out redirect\", async () => {\n    const app = createAppTestDouble({ trustedUrls: [] });\n    const user = createUserTestDouble();\n\n    await renderSignOut({ app, user, searchParams: { after_auth_return_to: \"https://evil.example.test/phishing\" } });\n\n    // The untrusted URL is dropped entirely; sign-out proceeds with the default destination.\n    expect(user.signOut).toHaveBeenCalledWith({ redirectUrl: undefined });\n  });\n\n  it(\"does not follow an untrusted after_auth_return_to when already signed out\", async () => {\n    const app = createAppTestDouble({ trustedUrls: [] });\n\n    await renderSignOut({ app, user: null, searchParams: { after_auth_return_to: \"https://evil.example.test/phishing-signed-out\" } });\n\n    expect(locationReplaceMock).not.toHaveBeenCalled();\n  });\n\n  it(\"follows a trusted after_auth_return_to when already signed out\", async () => {\n    const app = createAppTestDouble({ trustedUrls: [\"/trusted-dashboard\"] });\n\n    await renderSignOut({ app, user: null, searchParams: { after_auth_return_to: \"/trusted-dashboard\" } });\n\n    expect(locationReplaceMock).toHaveBeenCalledWith(\"/trusted-dashboard\");\n  });\n});\n"],"mappings":";;;;;;;;;;;AAeA,MAAM,eAAeA,OAAAA,GAAG,eAAe;CACrC,KAAK;CACL,MAAM;AACR,EAAE;AAEFA,OAAAA,GAAG,KAAK,aAAa;CACnB,mBAAmB;EACjB,IAAI,aAAa,OAAO,MACtB,MAAM,IAAI,MAAM,+CAA+C;EAEjE,OAAO,aAAa;CACtB;CACA,eAAe,aAAa;AAC9B,EAAE;AAKFA,OAAAA,GAAG,KAAK,qCAAqC,OAAO,mBAAmB;CACrE,MAAM,WAAW,MAAM,eAAmE;CAE1F,MAAM,gCAAgB,IAAI,QAAwC;CAClE,OAAO;EACL,GAAG;EACH,MAAU,YAA2B;GACnC,MAAM,QAAQ,cAAc,IAAI,OAAO;GACvC,IAAI,SAAS,MAAM;IACjB,cAAc,IAAI,SAAS,EAAE,QAAQ,UAAU,CAAC;IAChD,QAAQ,MACL,UAAU,cAAc,IAAI,SAAS;KAAE,QAAQ;KAAM;IAAM,CAAC,IAC5D,UAAU,cAAc,IAAI,SAAS;KAAE,QAAQ;KAAS;IAAM,CAAC,CAClE;IACA,MAAM;GACR;GACA,QAAQ,MAAM,QAAd;IACE,KAAK,WACH,MAAM;IAER,KAAK,SACH,MAAM,MAAM;IAEd,KAAK,MAGH,OAAO,MAAM;GAEjB;EACF;CACF;AACF,CAAC;AAEDA,OAAAA,GAAG,KAAK,gBAAgB,YAAY;CACpB,MAAM,OAAO;CAC3B,OAAO;EACL,SAAS,UACP,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;GAAQ,MAAK;GAAS,SAAS,MAAM;aAAU,MAAM;EAAiB,CAAA;EAExE,aAAa,UAAyC,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD,EAAA,UAAM,MAAM,SAAc,CAAA;EAChF,KAAK,GAAG,YAAmD,QAAQ,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;CAC7F;AACF,CAAC;AAED,MAAM,yBAAyB,QAAQ,IAAI,YAAY,0BAA0B;AAEjF,SAAS,oBAAoB,SAE1B;CAUD,OAAO;EARL,kBAAkBA,OAAAA,GAAG,GAAG,YAAY,CAAC,CAAC;GACrCC,8BAAAA,6BAA6B,EAC5B,sBAAsBD,OAAAA,GAAG,GAAG,OAAO,QAAgB,QAAQ,YAAY,SAAS,GAAG,CAAC,EACtF;CAKO;AACX;AAEA,SAAS,uBAAuB;CAK9B,OAAO,EAHL,SAASA,OAAAA,GAAG,GAAG,YAAY,CAAC,CAAC,EAGrB;AACZ;AAGA,MAAM,mBAAmB,OAAO;AAChC,IAAI,sBAAsBA,OAAAA,GAAG,GAAG;AAEhC,IAAI,OAAoB;AACxB,IAAI,YAAmC;AAEvC,eAAe,cAAc,SAI1B;CACD,aAAa,MAAM,QAAQ;CAC3B,aAAa,OAAO,QAAQ;CAC5B,YAAY,SAAS,cAAc,KAAK;CACxC,SAAS,KAAK,OAAO,SAAS;CAC9B,QAAA,GAAA,iBAAA,WAAA,CAAkB,SAAS;CAC3B,OAAA,GAAA,MAAA,IAAA,CAAU,YAAY;EACpB,MAAM,OACJ,iBAAA,GAAA,kBAAA,IAAA,CAACE,4CAAAA,2BAAD;GAA2B,6BAAa,IAAI,IAAI;GAAG,+BAAe,IAAI,IAAI;aACxE,iBAAA,GAAA,kBAAA,IAAA,CAACC,MAAAA,QAAM,UAAP;IAAgB,UAAU,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD,EAAK,eAAY,oBAAqB,CAAA;cAC9D,iBAAA,GAAA,kBAAA,IAAA,CAACC,cAAAA,SAAD,EAAS,cAAc,QAAQ,aAAe,CAAA;GAChC,CAAA;EACS,CAAA,CAC7B;CACF,CAAC;CACD,OAAA,GAAA,MAAA,IAAA,CAAU,YAAY;EACpB,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;CACvD,CAAC;AACH;qBAES,iBAAiB;CACxB,CAAA,GAAA,OAAA,WAAA,OAAiB;EACf,QAAQ,IAAI,YAAY,4BAA4B,IAAI;EACxD,sBAAsBJ,OAAAA,GAAG,GAAG;EAC5B,QAAQ,eAAe,QAAQ,UAAU;EACzC,QAAQ,IAAI,QAAQ,YAAY;GAAE,MAAM;GAA8C,SAAS;EAAoB,CAAC;CACtH,CAAC;CAED,CAAA,GAAA,OAAA,UAAA,OAAgB;EACd,CAAA,GAAA,MAAA,IAAA,OAAU;GACR,MAAM,QAAQ;EAChB,CAAC;EACD,WAAW,OAAO;EAClB,OAAO;EACP,YAAY;EACZ,aAAa,MAAM;EACnB,aAAa,OAAO;EACpB,QAAQ,IAAI,QAAQ,YAAY,gBAAgB;EAChD,OAAA,GAAG,gBAAgB;EACnB,QAAQ,IAAI,YAAY,4BAA4B,sBAAsB;CAC5E,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8DAA8D,YAAY;EAC3E,MAAM,MAAM,oBAAoB,EAAE,aAAa,CAAC,YAAY,EAAE,CAAC;EAC/D,MAAM,OAAO,qBAAqB;EAElC,MAAM,cAAc;GAAE;GAAK;GAAM,cAAc,EAAE,sBAAsB,aAAa;EAAE,CAAC;EAEvF,CAAA,GAAA,OAAA,OAAA,CAAO,KAAK,OAAO,CAAC,CAAC,qBAAqB,EAAE,aAAa,aAAa,CAAC;CACzE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,6FAA6F,YAAY;EAC1G,MAAM,MAAM,oBAAoB,EAAE,aAAa,CAAC,EAAE,CAAC;EACnD,MAAM,OAAO,qBAAqB;EAElC,MAAM,cAAc;GAAE;GAAK;GAAM,cAAc,EAAE,sBAAsB,qCAAqC;EAAE,CAAC;EAG/G,CAAA,GAAA,OAAA,OAAA,CAAO,KAAK,OAAO,CAAC,CAAC,qBAAqB,EAAE,aAAa,KAAA,EAAU,CAAC;CACtE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,6EAA6E,YAAY;EAG1F,MAAM,cAAc;GAAE,KAFV,oBAAoB,EAAE,aAAa,CAAC,EAAE,CAE1B;GAAG,MAAM;GAAM,cAAc,EAAE,sBAAsB,gDAAgD;EAAE,CAAC;EAEhI,CAAA,GAAA,OAAA,OAAA,CAAO,mBAAmB,CAAC,CAAC,IAAI,iBAAiB;CACnD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,kEAAkE,YAAY;EAG/E,MAAM,cAAc;GAAE,KAFV,oBAAoB,EAAE,aAAa,CAAC,oBAAoB,EAAE,CAE9C;GAAG,MAAM;GAAM,cAAc,EAAE,sBAAsB,qBAAqB;EAAE,CAAC;EAErG,CAAA,GAAA,OAAA,OAAA,CAAO,mBAAmB,CAAC,CAAC,qBAAqB,oBAAoB;CACvE,CAAC;AACH,CAAC"}

package/dist/dev-tool/dev-tool-core.d.ts

@@ -1,4 +1,4 @@
-import { a as StackClientApp } from "../client-app-Majjw8Xp.js";
+import { a as StackClientApp } from "../client-app-B0kBC67Z.js";
 //#region src/dev-tool/dev-tool-core.d.ts
 declare function createDevTool(app: StackClientApp<true>): () => void;
 //#endregion

package/dist/dev-tool/dev-tool-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-tool-core.d.ts","names":[],"sources":["../../src/dev-tool/dev-tool-core.ts"],"mappings":";;iBAiuEgB,aAAA,CAAc,GAAyB,EAApB,cAAc"}
+{"version":3,"file":"dev-tool-core.d.ts","names":[],"sources":["../../src/dev-tool/dev-tool-core.ts"],"mappings":";;iBAkyEgB,aAAA,CAAc,GAAyB,EAApB,cAAc"}

package/dist/dev-tool/dev-tool-core.js

@@ -5,7 +5,6 @@ let ___in_page_ui_dom_js = require("../in-page-ui/dom.js");
 let ___lib_hexclave_app_common_js = require("../lib/hexclave-app/common.js");
 let _hexclave_shared_dist_utils_urls = require("@hexclave/shared/dist/utils/urls");
 let ___lib_hexclave_app_url_targets_js = require("../lib/hexclave-app/url-targets.js");
-let ___generated_env_js = require("../generated/env.js");
 let ___lib_hexclave_app_apps_implementations_common_js = require("../lib/hexclave-app/apps/implementations/common.js");
 let __dev_tool_styles_js = require("./dev-tool-styles.js");
 let __dev_tool_trigger_position_js = require("./dev-tool-trigger-position.js");
@@ -18,6 +17,8 @@ const MAX_LOG_ENTRIES = 500;
 const CONSOLE_LOG_BATCH_SIZE = 100;
 const DRAG_THRESHOLD = 5;
 const DOCS_URL = "https://docs.hexclave.com";
+const LOCAL_DASHBOARD_ORIGIN = "http://localhost:26700";
+const HOSTED_DASHBOARD_URL = "https://app.hexclave.com";
 const TABS = [
 	{
 		id: "overview",
@@ -137,33 +138,35 @@ function nextId() {
 function resolveApiBaseUrl(app) {
 	return (0, ___lib_hexclave_app_apps_implementations_common_js.getBaseUrl)(app[___lib_hexclave_app_common_js.hexclaveAppInternalsSymbol].getConstructorOptions().baseUrl);
 }
-function shouldShowDashboardTab(app) {
-	return ___generated_env_js.envVars.HEXCLAVE_IS_LOCAL_EMULATOR === "true" && (0, _hexclave_shared_dist_utils_urls.isLocalhost)(resolveApiBaseUrl(app));
+function localDashboardProjectUrl(app) {
+	return `${LOCAL_DASHBOARD_ORIGIN}/projects/${encodeURIComponent(app.projectId)}`;
 }
-function getTabsForApp(app) {
-	if (shouldShowDashboardTab(app)) return TABS;
-	return TABS.filter((tab) => tab.id !== "dashboard");
+function parseProjectAvailabilityResponse(body) {
+	if (typeof body !== "object" || body === null) return false;
+	return "project_available" in body && body.project_available === true;
 }
-function deriveDashboardBaseUrl(apiBaseUrl) {
+const LOCAL_DASHBOARD_PROBE_TIMEOUT_MS = 3e3;
+function canReachLocalDashboard() {
+	return (0, _hexclave_shared_dist_utils_urls.isLocalhost)(window.location.href) && window.location.protocol === "http:";
+}
+async function isLocalDashboardProjectAvailable(app) {
+	if (!canReachLocalDashboard()) return false;
+	const url = `${LOCAL_DASHBOARD_ORIGIN}/api/development-environment/project-availability?project_id=${encodeURIComponent(app.projectId)}`;
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), LOCAL_DASHBOARD_PROBE_TIMEOUT_MS);
 	try {
-		const url = new URL(apiBaseUrl);
-		if (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]") {
-			const port = url.port;
-			if (port && port.endsWith("02")) url.port = port.slice(0, -2) + "01";
-			return url.origin;
-		}
-		if (url.hostname.startsWith("api.")) {
-			url.hostname = "app." + url.hostname.slice(4);
-			return url.origin;
-		}
-		return url.origin;
+		const response = await fetch(url, {
+			method: "GET",
+			signal: controller.signal
+		});
+		if (!response.ok) return false;
+		return parseProjectAvailabilityResponse(await response.json());
 	} catch {
-		return "https://app.hexclave.com";
+		return false;
+	} finally {
+		clearTimeout(timeout);
 	}
 }
-function resolveDashboardUrl(app) {
-	return `${deriveDashboardBaseUrl(resolveApiBaseUrl(app))}/projects/${encodeURIComponent(app.projectId)}`;
-}
 function formatTimestamp(ts) {
 	return new Date(ts).toLocaleTimeString([], {
 		hour: "2-digit",
@@ -428,8 +431,8 @@ function createTabBar(tabs, activeTab, onTabChange, opts) {
 		setActive
 	};
 }
-function createIframeTab(src, title, loadingMsg = "Loading…", errorMsg = "Unable to load content", errorDetail, openExternallyLabel) {
-	const container = (0, ___in_page_ui_dom_js.h)("div", { className: "sdt-iframe-container" });
+function populateIframeTab(container, src, title, loadingMsg = "Loading…", errorMsg = "Unable to load content", errorDetail, openExternallyLabel) {
+	container.innerHTML = "";
 	if (openExternallyLabel != null) container.appendChild((0, ___in_page_ui_dom_js.h)("div", { className: "sdt-iframe-toolbar" }, (0, ___in_page_ui_dom_js.h)("a", {
 		href: src,
 		target: "_blank",
@@ -458,7 +461,7 @@ function createIframeTab(src, title, loadingMsg = "Loading…", errorMsg = "Unab
 		} }, errorDetail));
 		const retryBtn = (0, ___in_page_ui_dom_js.h)("button", { className: "sdt-iframe-error-btn" }, "Retry");
 		retryBtn.addEventListener("click", () => {
-			container.replaceWith(createIframeTab(src, title, loadingMsg, errorMsg, errorDetail, openExternallyLabel));
+			populateIframeTab(container, src, title, loadingMsg, errorMsg, errorDetail, openExternallyLabel);
 		});
 		errDiv.appendChild(retryBtn);
 		const link = (0, ___in_page_ui_dom_js.h)("a", {
@@ -475,7 +478,6 @@ function createIframeTab(src, title, loadingMsg = "Loading…", errorMsg = "Unab
 		container.appendChild(errDiv);
 	});
 	container.appendChild(iframe);
-	return container;
 }
 function hasPersistentTokenStoreForDevTool(app) {
 	return app[___lib_hexclave_app_common_js.hexclaveAppInternalsSymbol].getConstructorOptions().tokenStore !== null;
@@ -1421,7 +1423,35 @@ function createAITab(app) {
 	return container;
 }
 function createDashboardTab(app) {
-	return createIframeTab(resolveDashboardUrl(app), "Hexclave Dashboard", "Loading dashboard…", "Unable to load dashboard", "The dashboard may require authentication or block framing", "Open in New Tab");
+	const container = (0, ___in_page_ui_dom_js.h)("div", { className: "sdt-iframe-container" });
+	function showChecking() {
+		container.innerHTML = "";
+		container.appendChild((0, ___in_page_ui_dom_js.h)("div", { className: "sdt-iframe-loading" }, "Checking development environment…"));
+	}
+	function showUnavailable() {
+		container.innerHTML = "";
+		const message = (0, ___in_page_ui_dom_js.h)("div", { className: "sdt-dashboard-unavailable" });
+		const text = (0, ___in_page_ui_dom_js.h)("div", { className: "sdt-dashboard-unavailable-text" });
+		text.appendChild(document.createTextNode("Navigate to "));
+		text.appendChild((0, ___in_page_ui_dom_js.h)("a", {
+			className: "sdt-dashboard-unavailable-link",
+			href: HOSTED_DASHBOARD_URL,
+			target: "_blank",
+			rel: "noopener noreferrer"
+		}, HOSTED_DASHBOARD_URL));
+		text.appendChild(document.createTextNode(" to view this project's dashboard"));
+		message.appendChild(text);
+		container.appendChild(message);
+	}
+	async function check() {
+		showChecking();
+		const available = await isLocalDashboardProjectAvailable(app);
+		if (!container.isConnected) return;
+		if (available) populateIframeTab(container, localDashboardProjectUrl(app), "Hexclave Dashboard", "Loading dashboard…", "Unable to load dashboard", "The dashboard may require authentication or block framing", "Open in New Tab");
+		else showUnavailable();
+	}
+	(0, _hexclave_shared_dist_utils_promises.runAsynchronously)(check);
+	return container;
 }
 function createSupportTab(app) {
 	const container = (0, ___in_page_ui_dom_js.h)("div", { className: "sdt-support-tab" });
@@ -1817,7 +1847,7 @@ function createPanel(app, state, logStore, onClose) {
 		panel.style.width = state.get().panelWidth + "px";
 		panel.style.height = state.get().panelHeight + "px";
 	}
-	const tabs = getTabsForApp(app);
+	const tabs = TABS;
 	const storedActiveTab = state.get().activeTab;
 	const activeTab = tabs.some((tab) => tab.id === storedActiveTab) ? storedActiveTab : DEFAULT_STATE.activeTab;
 	applyPanelMode(activeTab);