@tangle-network/agent-app 0.45.28 → 0.45.30

package/dist/chunk-COP2K4LF.js

@@ -0,0 +1,190 @@
+// src/alerting/slack.ts
+var SLACK_API = "https://slack.com/api";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var DEFAULT_ATTEMPTS = 3;
+var CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
+  "invalid_auth",
+  "not_authed",
+  "account_inactive",
+  "token_revoked",
+  "token_expired",
+  "no_permission",
+  "missing_scope",
+  "ekm_access_denied"
+]);
+var CHANNEL_ERRORS = /* @__PURE__ */ new Set([
+  "channel_not_found",
+  "not_in_channel",
+  "is_archived",
+  "restricted_action",
+  "restricted_action_read_only_channel"
+]);
+function remedyFor(reason, error, channel) {
+  switch (reason) {
+    case "credential":
+      return `Slack rejected the bot token (${error}) \u2014 no alert can arrive until a human mints a new one. Reinstall the Slack app and update SLACK_BOT_TOKEN wherever it is stored.`;
+    case "channel":
+      return `Slack accepted the token but refused ${channel} (${error}) \u2014 invite the bot to ${channel}, or correct the channel name.`;
+    default:
+      return `Slack refused the post (${error}).`;
+  }
+}
+function classifySlackError(error, channel) {
+  const reason = CREDENTIAL_ERRORS.has(error) ? "credential" : CHANNEL_ERRORS.has(error) ? "channel" : "api";
+  return { delivered: false, reason, detail: remedyFor(reason, error, channel) };
+}
+function retryDelayMs(response, attempt) {
+  const header = Number(response.headers.get("retry-after"));
+  if (Number.isFinite(header) && header > 0) return Math.min(header * 1e3, 3e4);
+  return Math.min(500 * 2 ** (attempt - 1), 8e3);
+}
+var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function postSlackAlert(options) {
+  const token = options.token?.trim();
+  const channel = options.channel?.trim();
+  const webhookUrl = options.webhookUrl?.trim();
+  if (!token && !webhookUrl) {
+    return {
+      delivered: false,
+      reason: "not-configured",
+      detail: "no Slack credential configured \u2014 set SLACK_BOT_TOKEN (preferred, verifiable) or SLACK_WEBHOOK_URL to route alerts to Slack"
+    };
+  }
+  if (token && !channel) {
+    return {
+      delivered: false,
+      reason: "not-configured",
+      detail: "a Slack bot token is set but no channel is \u2014 set the alert channel (e.g. #infra-alerts)"
+    };
+  }
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const sleep = options.sleepImpl ?? defaultSleep;
+  const attempts = Math.max(1, options.attempts ?? DEFAULT_ATTEMPTS);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const transport = token ? { kind: "token", token, channel } : { kind: "webhook", url: webhookUrl };
+  let lastTransient = {
+    delivered: false,
+    reason: "transport",
+    detail: "Slack was never reached"
+  };
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    try {
+      response = await fetchImpl(requestUrl(transport), {
+        method: "POST",
+        headers: requestHeaders(transport),
+        body: JSON.stringify(requestBody(transport, options.text)),
+        signal: controller.signal
+      });
+    } catch (error) {
+      lastTransient = {
+        delivered: false,
+        reason: "transport",
+        detail: `could not reach Slack: ${error instanceof Error ? error.message : String(error)}`
+      };
+      if (attempt < attempts) await sleep(Math.min(500 * 2 ** (attempt - 1), 8e3));
+      continue;
+    } finally {
+      clearTimeout(timer);
+    }
+    if (response.status === 429 || response.status >= 500) {
+      lastTransient = {
+        delivered: false,
+        reason: response.status === 429 ? "rate-limited" : "transport",
+        detail: `Slack returned ${response.status}`
+      };
+      if (attempt < attempts) await sleep(retryDelayMs(response, attempt));
+      continue;
+    }
+    return transport.kind === "token" ? await settleTokenResponse(response, transport.channel) : await settleWebhookResponse(response);
+  }
+  return lastTransient;
+}
+function requestUrl(transport) {
+  return transport.kind === "token" ? `${SLACK_API}/chat.postMessage` : transport.url;
+}
+function requestHeaders(transport) {
+  const headers = { "Content-Type": "application/json; charset=utf-8" };
+  if (transport.kind === "token") headers.Authorization = `Bearer ${transport.token}`;
+  return headers;
+}
+function requestBody(transport, text) {
+  return transport.kind === "token" ? { channel: transport.channel, text } : { text };
+}
+async function settleTokenResponse(response, channel) {
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    return {
+      delivered: false,
+      reason: "api",
+      detail: `Slack returned ${response.status} with an unreadable body`
+    };
+  }
+  if (body.ok === true) {
+    return { delivered: true, channel: body.channel ?? channel, ts: body.ts ?? "" };
+  }
+  return classifySlackError(body.error ?? `http_${response.status}`, channel);
+}
+async function settleWebhookResponse(response) {
+  const body = (await response.text().catch(() => "")).trim();
+  if (response.ok && body === "ok") {
+    return { delivered: true, channel: "(webhook)", ts: "" };
+  }
+  const error = body || `http_${response.status}`;
+  const reason = WEBHOOK_CREDENTIAL_ERRORS.has(error) ? "credential" : WEBHOOK_CHANNEL_ERRORS.has(error) ? "channel" : "api";
+  return {
+    delivered: false,
+    reason,
+    detail: reason === "credential" ? `the Slack webhook is revoked (${error}) \u2014 no alert can arrive until a human mints a new one. Prefer replacing it with a bot token, whose liveness can be checked before an alert needs it.` : reason === "channel" ? `Slack refused the webhook's channel (${error}) \u2014 the channel was archived, or the app lost access.` : `Slack refused the webhook post (${error}).`
+  };
+}
+var WEBHOOK_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set(["no_service", "no_team", "invalid_token"]);
+var WEBHOOK_CHANNEL_ERRORS = /* @__PURE__ */ new Set(["channel_not_found", "channel_is_archived", "action_prohibited"]);
+async function checkSlackCredential(options) {
+  const token = options.token?.trim();
+  if (!token) {
+    return {
+      live: false,
+      reason: "not-configured",
+      detail: "no Slack bot token configured \u2014 set SLACK_BOT_TOKEN"
+    };
+  }
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  try {
+    const response = await fetchImpl(`${SLACK_API}/auth.test`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}` },
+      signal: controller.signal
+    });
+    const body = await response.json();
+    if (body.ok === true) {
+      return { live: true, team: body.team ?? "unknown", botId: body.bot_id ?? "unknown" };
+    }
+    const outcome = classifySlackError(body.error ?? `http_${response.status}`, "(auth.test)");
+    return {
+      live: false,
+      reason: outcome.reason === "channel" ? "credential" : outcome.reason,
+      detail: outcome.detail
+    };
+  } catch (error) {
+    return {
+      live: false,
+      reason: "transport",
+      detail: `could not reach Slack: ${error instanceof Error ? error.message : String(error)}`
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export {
+  postSlackAlert,
+  checkSlackCredential
+};
+//# sourceMappingURL=chunk-COP2K4LF.js.map

package/dist/chunk-COP2K4LF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/alerting/slack.ts"],"sourcesContent":["/**\n * `/alerting` — post an operational alert to Slack, and say honestly when it\n * did not arrive.\n *\n * WHY THIS EXISTS: on 2026-08-06 an audit of every Slack credential the org\n * held found three of four dead — the fleet incoming webhook 404ing\n * (`no_service`), a second company webhook likewise, and the bot token\n * answering `account_inactive`. One ops webhook was still live. Nobody knew\n * which was which until each was tested by hand, and that is the actual\n * problem: the credentials were indistinguishable from where the code stood.\n *\n * This failure has already been paid for once, with numbers: in\n * `agent-dev-container`, a revoked webhook let the CI healthcheck sit dead for\n * 18 days — 2,567 consecutive failures, 27 successes, zero alerts — because\n * fifteen call sites across six workflows posted with no body inspection and\n * then asserted delivery. That repo fixed the reporting (its `post-slack.sh`\n * confirms 2xx AND Slack's literal `ok` body, and fails closed otherwise) and\n * that half of the lesson is theirs, adopted here.\n *\n * What their fix cannot do, and this module can, is answer the question BEFORE\n * an alert needs to fire. A fail-closed post still only discovers a dead\n * credential at the moment a page is lost. That is the second half.\n *\n * Two design consequences, and they are the whole module:\n *\n * 1. **A bot token and `chat.postMessage` is the preferred transport; an\n *    incoming webhook is supported because one is usually what you already\n *    have.** A token reaches every channel (a webhook is bolted to one), is\n *    revocable and rotatable in place, and — the part that matters — is\n *    VERIFIABLE: `auth.test` answers whether the credential is alive without\n *    posting anything, which is what lets `/preflight` fail a deploy on a dead\n *    alerting channel instead of discovering it during an incident. A webhook\n *    can only be tested by posting to it, which is why the three dead\n *    credentials above went unnoticed. A token is never fallen back FROM: if\n *    one is configured and dead, delivering over a webhook instead would hide\n *    the very condition worth reporting.\n *\n * 2. **Slack answers `ok:false` under HTTP 200.** `invalid_auth`,\n *    `channel_not_found` and `not_in_channel` all arrive as a successful\n *    response with a failure inside it, so a status check reads a dead channel\n *    as a delivered page. The body is always parsed, and the outcome\n *    distinguishes a MISSING credential (configuration absent — not an\n *    incident) from a DEAD one (the alerting channel itself is broken — the\n *    loudest thing this module can report). A summary that calls those two the\n *    same thing is the defect wearing a different hat.\n *\n * The caller decides what to do with a non-delivery; this module never throws\n * on one, because an alerting path that can take down the thing it reports on\n * is worse than the outage it was watching for. It is also never the only\n * channel: a durable record (an issue, an audit row) is the caller's job, and\n * that is what survives the credential going dead again.\n *\n * Server-only: holds a bot token. This subpath must never reach a browser\n * bundle.\n */\n\nconst SLACK_API = 'https://slack.com/api'\nconst DEFAULT_TIMEOUT_MS = 10_000\nconst DEFAULT_ATTEMPTS = 3\n\n/**\n * Why an alert did not reach Slack. The split is by what a human must DO about\n * it, since that is the only distinction a caller can act on.\n */\nexport type SlackFailureReason =\n  /** No token or no channel configured. Configuration is absent, nothing is broken. */\n  | 'not-configured'\n  /**\n   * The token is dead — revoked, or its app removed from the workspace. No\n   * alert will EVER arrive until a human mints a new one. This is itself an\n   * incident and the caller should escalate it on a channel that does not\n   * depend on Slack.\n   */\n  | 'credential'\n  /**\n   * The credential is alive but cannot post HERE: the channel is wrong,\n   * archived, or the bot was never invited to it. One human action fixes it.\n   */\n  | 'channel'\n  /** Slack asked us to slow down. Transient; the alert is worth retrying. */\n  | 'rate-limited'\n  /** The request never got an answer — network, DNS, timeout. Transient. */\n  | 'transport'\n  /** Slack refused for some other reason; `detail` carries its error code. */\n  | 'api'\n\n/** An alert that did not arrive, and why. Named because the classifiers only ever produce this half. */\nexport interface SlackAlertFailure {\n  delivered: false\n  reason: SlackFailureReason\n  /** One line naming what is wrong and what fixes it. Safe to log; carries no token. */\n  detail: string\n}\n\n/** What one `postSlackAlert` call did. Never a bare boolean — the caller pages differently per reason. */\nexport type SlackAlertOutcome =\n  | {\n      delivered: true\n      /** The channel id Slack resolved (not necessarily the name that was passed). */\n      channel: string\n      /** Slack's message timestamp — the message's identity, for a later thread reply. */\n      ts: string\n    }\n  | SlackAlertFailure\n\n/** Define configuration options for posting an alert message to a Slack channel */\nexport interface SlackAlertOptions {\n  /**\n   * Slack bot token (`xoxb-…`) with `chat:write`. The PREFERRED transport,\n   * because it is the only one whose liveness can be checked before an alert\n   * needs it. An empty or absent value is `not-configured`, never an error — a\n   * product that has not adopted Slack yet must not fail its alerting path.\n   */\n  token?: string | undefined\n  /**\n   * Channel to post to: a name (`#infra-alerts`) or an id (`C01234567`). The\n   * bot must be a member; Slack answers `not_in_channel` otherwise. Required\n   * with `token`, meaningless with `webhookUrl` (a webhook carries its own\n   * channel, fixed when it was created).\n   */\n  channel?: string | undefined\n  /**\n   * Slack incoming-webhook URL, used only when no `token` is configured.\n   *\n   * It works and it needs no setup, which is why it is supported — but it\n   * cannot be verified without posting, cannot be pointed at a second channel,\n   * and gives back an error token instead of a code. Two of the three webhooks\n   * this org has held were found revoked. Treat it as the transport you have,\n   * not the one you want.\n   *\n   * When a `token` is also configured this is IGNORED rather than used as a\n   * fallback: a dead token must surface as the incident it is, and quietly\n   * succeeding over a second transport is how the last outage stayed invisible.\n   */\n  webhookUrl?: string | undefined\n  /** Message body as Slack mrkdwn. Newlines are preserved. */\n  text: string\n  /**\n   * Attempts for a TRANSIENT failure (429 / 5xx / transport). Default 3. A\n   * dead credential or a wrong channel is never retried — the answer will not\n   * change, and retrying an auth failure is how a token gets rate-limited.\n   */\n  attempts?: number\n  /** Per-request deadline. Default 10s. */\n  timeoutMs?: number\n  /** Injection seam for tests; defaults to global `fetch`. */\n  fetchImpl?: typeof fetch\n  /** Injection seam for tests; defaults to a real delay between retries. */\n  sleepImpl?: (ms: number) => Promise<void>\n}\n\n/** Slack error codes that mean the CREDENTIAL is dead, not the request. */\nconst CREDENTIAL_ERRORS = new Set([\n  'invalid_auth',\n  'not_authed',\n  'account_inactive',\n  'token_revoked',\n  'token_expired',\n  'no_permission',\n  'missing_scope',\n  'ekm_access_denied',\n])\n\n/** Slack error codes that mean the credential is fine but this CHANNEL is not reachable. */\nconst CHANNEL_ERRORS = new Set([\n  'channel_not_found',\n  'not_in_channel',\n  'is_archived',\n  'restricted_action',\n  'restricted_action_read_only_channel',\n])\n\nfunction remedyFor(reason: SlackFailureReason, error: string, channel: string): string {\n  switch (reason) {\n    case 'credential':\n      return (\n        `Slack rejected the bot token (${error}) — no alert can arrive until a human mints a new one. ` +\n        'Reinstall the Slack app and update SLACK_BOT_TOKEN wherever it is stored.'\n      )\n    case 'channel':\n      return (\n        `Slack accepted the token but refused ${channel} (${error}) — ` +\n        `invite the bot to ${channel}, or correct the channel name.`\n      )\n    default:\n      return `Slack refused the post (${error}).`\n  }\n}\n\nfunction classifySlackError(error: string, channel: string): SlackAlertFailure {\n  const reason: SlackFailureReason = CREDENTIAL_ERRORS.has(error)\n    ? 'credential'\n    : CHANNEL_ERRORS.has(error)\n      ? 'channel'\n      : 'api'\n  return { delivered: false, reason, detail: remedyFor(reason, error, channel) }\n}\n\n/** Slack's `Retry-After` is in SECONDS. Bounded so a hostile header cannot park the caller. */\nfunction retryDelayMs(response: Response, attempt: number): number {\n  const header = Number(response.headers.get('retry-after'))\n  if (Number.isFinite(header) && header > 0) return Math.min(header * 1000, 30_000)\n  return Math.min(500 * 2 ** (attempt - 1), 8_000)\n}\n\nconst defaultSleep = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms))\n\n/**\n * Post one alert to a Slack channel.\n *\n * Never throws and never retries a failure whose answer cannot change. The\n * returned outcome is the whole result — a caller that ignores it has an\n * alerting path it cannot prove works, which is the failure this module was\n * written for.\n */\nexport async function postSlackAlert(options: SlackAlertOptions): Promise<SlackAlertOutcome> {\n  const token = options.token?.trim()\n  const channel = options.channel?.trim()\n  const webhookUrl = options.webhookUrl?.trim()\n\n  if (!token && !webhookUrl) {\n    return {\n      delivered: false,\n      reason: 'not-configured',\n      detail:\n        'no Slack credential configured — set SLACK_BOT_TOKEN (preferred, verifiable) ' +\n        'or SLACK_WEBHOOK_URL to route alerts to Slack',\n    }\n  }\n  if (token && !channel) {\n    return {\n      delivered: false,\n      reason: 'not-configured',\n      detail: 'a Slack bot token is set but no channel is — set the alert channel (e.g. #infra-alerts)',\n    }\n  }\n\n  const fetchImpl = options.fetchImpl ?? fetch\n  const sleep = options.sleepImpl ?? defaultSleep\n  const attempts = Math.max(1, options.attempts ?? DEFAULT_ATTEMPTS)\n  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS\n\n  // A token is never fallen back FROM. If one is configured and dead, that is\n  // the incident, and delivering over a webhook instead would hide exactly the\n  // condition this module exists to surface.\n  const transport: SlackTransport = token\n    ? { kind: 'token', token, channel: channel as string }\n    : { kind: 'webhook', url: webhookUrl as string }\n\n  let lastTransient: SlackAlertFailure = {\n    delivered: false,\n    reason: 'transport',\n    detail: 'Slack was never reached',\n  }\n\n  for (let attempt = 1; attempt <= attempts; attempt += 1) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    let response: Response\n    try {\n      response = await fetchImpl(requestUrl(transport), {\n        method: 'POST',\n        headers: requestHeaders(transport),\n        body: JSON.stringify(requestBody(transport, options.text)),\n        signal: controller.signal,\n      })\n    } catch (error) {\n      lastTransient = {\n        delivered: false,\n        reason: 'transport',\n        detail: `could not reach Slack: ${error instanceof Error ? error.message : String(error)}`,\n      }\n      if (attempt < attempts) await sleep(Math.min(500 * 2 ** (attempt - 1), 8_000))\n      continue\n    } finally {\n      clearTimeout(timer)\n    }\n\n    if (response.status === 429 || response.status >= 500) {\n      lastTransient = {\n        delivered: false,\n        reason: response.status === 429 ? 'rate-limited' : 'transport',\n        detail: `Slack returned ${response.status}`,\n      }\n      if (attempt < attempts) await sleep(retryDelayMs(response, attempt))\n      continue\n    }\n\n    // Everything below is a settled answer. BOTH transports put the verdict in\n    // the BODY under a 200 — the API as `{\"ok\":false,\"error\":…}`, a webhook as\n    // an error token where the literal `ok` should be — so a status check alone\n    // reads a revoked credential as a delivered page. That misreading is why\n    // this module exists.\n    return transport.kind === 'token'\n      ? await settleTokenResponse(response, transport.channel)\n      : await settleWebhookResponse(response)\n  }\n\n  return lastTransient\n}\n\ntype SlackTransport =\n  | { kind: 'token'; token: string; channel: string }\n  | { kind: 'webhook'; url: string }\n\nfunction requestUrl(transport: SlackTransport): string {\n  return transport.kind === 'token' ? `${SLACK_API}/chat.postMessage` : transport.url\n}\n\nfunction requestHeaders(transport: SlackTransport): Record<string, string> {\n  const headers: Record<string, string> = { 'Content-Type': 'application/json; charset=utf-8' }\n  // The token rides a header, never a query string: a URL is logged by proxies\n  // and retained in error messages; a header is not. (A webhook URL IS the\n  // credential and has no such option — one more reason to prefer a token.)\n  if (transport.kind === 'token') headers.Authorization = `Bearer ${transport.token}`\n  return headers\n}\n\nfunction requestBody(transport: SlackTransport, text: string): Record<string, string> {\n  // A webhook carries its own channel, fixed when it was created; naming one\n  // here would be ignored at best and rejected at worst.\n  return transport.kind === 'token' ? { channel: transport.channel, text } : { text }\n}\n\nasync function settleTokenResponse(\n  response: Response,\n  channel: string,\n): Promise<SlackAlertOutcome> {\n  let body: { ok?: boolean; error?: string; channel?: string; ts?: string }\n  try {\n    body = (await response.json()) as typeof body\n  } catch {\n    return {\n      delivered: false,\n      reason: 'api',\n      detail: `Slack returned ${response.status} with an unreadable body`,\n    }\n  }\n  if (body.ok === true) {\n    return { delivered: true, channel: body.channel ?? channel, ts: body.ts ?? '' }\n  }\n  return classifySlackError(body.error ?? `http_${response.status}`, channel)\n}\n\n/**\n * A webhook confirms delivery with a 2xx AND the literal three-byte body `ok`.\n * A revoked one answers `no_service` / `no_team`, sometimes under a 200. Both\n * halves are required: this is the shape `agent-dev-container` proved against a\n * stand-in webhook, where a healthy, a revoked and a deleted webhook produced\n * byte-identical output under a status-only check.\n */\nasync function settleWebhookResponse(response: Response): Promise<SlackAlertOutcome> {\n  const body = (await response.text().catch(() => '')).trim()\n  if (response.ok && body === 'ok') {\n    // A webhook reports neither the channel it posted to nor a message id.\n    return { delivered: true, channel: '(webhook)', ts: '' }\n  }\n  const error = body || `http_${response.status}`\n  const reason: SlackFailureReason = WEBHOOK_CREDENTIAL_ERRORS.has(error)\n    ? 'credential'\n    : WEBHOOK_CHANNEL_ERRORS.has(error)\n      ? 'channel'\n      : 'api'\n  return {\n    delivered: false,\n    reason,\n    detail:\n      reason === 'credential'\n        ? `the Slack webhook is revoked (${error}) — no alert can arrive until a human mints a new one. ` +\n          'Prefer replacing it with a bot token, whose liveness can be checked before an alert needs it.'\n        : reason === 'channel'\n          ? `Slack refused the webhook's channel (${error}) — the channel was archived, or the app lost access.`\n          : `Slack refused the webhook post (${error}).`,\n  }\n}\n\n/** Webhook error tokens that mean the webhook itself is gone. */\nconst WEBHOOK_CREDENTIAL_ERRORS = new Set(['no_service', 'no_team', 'invalid_token'])\n\n/** Webhook error tokens that mean the webhook is valid but its channel is not usable. */\nconst WEBHOOK_CHANNEL_ERRORS = new Set(['channel_not_found', 'channel_is_archived', 'action_prohibited'])\n\n/** Define configuration options for verifying that a Slack bot token is live */\nexport interface SlackCredentialCheckOptions {\n  token: string | undefined\n  /** Per-request deadline. Default 10s. */\n  timeoutMs?: number\n  /** Injection seam for tests; defaults to global `fetch`. */\n  fetchImpl?: typeof fetch\n}\n\n/** What `checkSlackCredential` concluded. `team`/`botId` are present only when live. */\nexport type SlackCredentialVerdict =\n  | { live: true; team: string; botId: string }\n  | { live: false; reason: SlackFailureReason; detail: string }\n\n/**\n * Ask Slack whether the bot token is alive, WITHOUT posting anything.\n *\n * This is the check that was missing. An incoming webhook offers no equivalent\n * — the only way to test one is to post to it — which is how a revoked webhook\n * sat in a repo secret for months looking configured. Wire it into `/preflight`\n * so a dead alerting channel fails a deploy rather than an incident.\n */\nexport async function checkSlackCredential(\n  options: SlackCredentialCheckOptions,\n): Promise<SlackCredentialVerdict> {\n  const token = options.token?.trim()\n  if (!token) {\n    return {\n      live: false,\n      reason: 'not-configured',\n      detail: 'no Slack bot token configured — set SLACK_BOT_TOKEN',\n    }\n  }\n  const fetchImpl = options.fetchImpl ?? fetch\n  const controller = new AbortController()\n  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? DEFAULT_TIMEOUT_MS)\n  try {\n    const response = await fetchImpl(`${SLACK_API}/auth.test`, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${token}` },\n      signal: controller.signal,\n    })\n    const body = (await response.json()) as {\n      ok?: boolean\n      error?: string\n      team?: string\n      bot_id?: string\n    }\n    if (body.ok === true) {\n      return { live: true, team: body.team ?? 'unknown', botId: body.bot_id ?? 'unknown' }\n    }\n    const outcome = classifySlackError(body.error ?? `http_${response.status}`, '(auth.test)')\n    // `classifySlackError` is shaped for a post; auth.test only ever answers\n    // about the credential, so a non-credential code here still means the\n    // token cannot be used.\n    return {\n      live: false,\n      reason: outcome.reason === 'channel' ? 'credential' : outcome.reason,\n      detail: outcome.detail,\n    }\n  } catch (error) {\n    return {\n      live: false,\n      reason: 'transport',\n      detail: `could not reach Slack: ${error instanceof Error ? error.message : String(error)}`,\n    }\n  } finally {\n    clearTimeout(timer)\n  }\n}\n"],"mappings":";AAwDA,IAAM,YAAY;AAClB,IAAM,qBAAqB;AAC3B,IAAM,mBAAmB;AA8FzB,IAAM,oBAAoB,oBAAI,IAAI;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,iBAAiB,oBAAI,IAAI;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,UAAU,QAA4B,OAAe,SAAyB;AACrF,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aACE,iCAAiC,KAAK;AAAA,IAG1C,KAAK;AACH,aACE,wCAAwC,OAAO,KAAK,KAAK,8BACpC,OAAO;AAAA,IAEhC;AACE,aAAO,2BAA2B,KAAK;AAAA,EAC3C;AACF;AAEA,SAAS,mBAAmB,OAAe,SAAoC;AAC7E,QAAM,SAA6B,kBAAkB,IAAI,KAAK,IAC1D,eACA,eAAe,IAAI,KAAK,IACtB,YACA;AACN,SAAO,EAAE,WAAW,OAAO,QAAQ,QAAQ,UAAU,QAAQ,OAAO,OAAO,EAAE;AAC/E;AAGA,SAAS,aAAa,UAAoB,SAAyB;AACjE,QAAM,SAAS,OAAO,SAAS,QAAQ,IAAI,aAAa,CAAC;AACzD,MAAI,OAAO,SAAS,MAAM,KAAK,SAAS,EAAG,QAAO,KAAK,IAAI,SAAS,KAAM,GAAM;AAChF,SAAO,KAAK,IAAI,MAAM,MAAM,UAAU,IAAI,GAAK;AACjD;AAEA,IAAM,eAAe,CAAC,OAA8B,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAUpG,eAAsB,eAAe,SAAwD;AAC3F,QAAM,QAAQ,QAAQ,OAAO,KAAK;AAClC,QAAM,UAAU,QAAQ,SAAS,KAAK;AACtC,QAAM,aAAa,QAAQ,YAAY,KAAK;AAE5C,MAAI,CAAC,SAAS,CAAC,YAAY;AACzB,WAAO;AAAA,MACL,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,QACE;AAAA,IAEJ;AAAA,EACF;AACA,MAAI,SAAS,CAAC,SAAS;AACrB,WAAO;AAAA,MACL,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,QAAQ,QAAQ,aAAa;AACnC,QAAM,WAAW,KAAK,IAAI,GAAG,QAAQ,YAAY,gBAAgB;AACjE,QAAM,YAAY,QAAQ,aAAa;AAKvC,QAAM,YAA4B,QAC9B,EAAE,MAAM,SAAS,OAAO,QAA2B,IACnD,EAAE,MAAM,WAAW,KAAK,WAAqB;AAEjD,MAAI,gBAAmC;AAAA,IACrC,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAEA,WAAS,UAAU,GAAG,WAAW,UAAU,WAAW,GAAG;AACvD,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,UAAU,WAAW,SAAS,GAAG;AAAA,QAChD,QAAQ;AAAA,QACR,SAAS,eAAe,SAAS;AAAA,QACjC,MAAM,KAAK,UAAU,YAAY,WAAW,QAAQ,IAAI,CAAC;AAAA,QACzD,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,sBAAgB;AAAA,QACd,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,QAAQ,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC1F;AACA,UAAI,UAAU,SAAU,OAAM,MAAM,KAAK,IAAI,MAAM,MAAM,UAAU,IAAI,GAAK,CAAC;AAC7E;AAAA,IACF,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAEA,QAAI,SAAS,WAAW,OAAO,SAAS,UAAU,KAAK;AACrD,sBAAgB;AAAA,QACd,WAAW;AAAA,QACX,QAAQ,SAAS,WAAW,MAAM,iBAAiB;AAAA,QACnD,QAAQ,kBAAkB,SAAS,MAAM;AAAA,MAC3C;AACA,UAAI,UAAU,SAAU,OAAM,MAAM,aAAa,UAAU,OAAO,CAAC;AACnE;AAAA,IACF;AAOA,WAAO,UAAU,SAAS,UACtB,MAAM,oBAAoB,UAAU,UAAU,OAAO,IACrD,MAAM,sBAAsB,QAAQ;AAAA,EAC1C;AAEA,SAAO;AACT;AAMA,SAAS,WAAW,WAAmC;AACrD,SAAO,UAAU,SAAS,UAAU,GAAG,SAAS,sBAAsB,UAAU;AAClF;AAEA,SAAS,eAAe,WAAmD;AACzE,QAAM,UAAkC,EAAE,gBAAgB,kCAAkC;AAI5F,MAAI,UAAU,SAAS,QAAS,SAAQ,gBAAgB,UAAU,UAAU,KAAK;AACjF,SAAO;AACT;AAEA,SAAS,YAAY,WAA2B,MAAsC;AAGpF,SAAO,UAAU,SAAS,UAAU,EAAE,SAAS,UAAU,SAAS,KAAK,IAAI,EAAE,KAAK;AACpF;AAEA,eAAe,oBACb,UACA,SAC4B;AAC5B,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,MACL,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,QAAQ,kBAAkB,SAAS,MAAM;AAAA,IAC3C;AAAA,EACF;AACA,MAAI,KAAK,OAAO,MAAM;AACpB,WAAO,EAAE,WAAW,MAAM,SAAS,KAAK,WAAW,SAAS,IAAI,KAAK,MAAM,GAAG;AAAA,EAChF;AACA,SAAO,mBAAmB,KAAK,SAAS,QAAQ,SAAS,MAAM,IAAI,OAAO;AAC5E;AASA,eAAe,sBAAsB,UAAgD;AACnF,QAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE,GAAG,KAAK;AAC1D,MAAI,SAAS,MAAM,SAAS,MAAM;AAEhC,WAAO,EAAE,WAAW,MAAM,SAAS,aAAa,IAAI,GAAG;AAAA,EACzD;AACA,QAAM,QAAQ,QAAQ,QAAQ,SAAS,MAAM;AAC7C,QAAM,SAA6B,0BAA0B,IAAI,KAAK,IAClE,eACA,uBAAuB,IAAI,KAAK,IAC9B,YACA;AACN,SAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA,QACE,WAAW,eACP,iCAAiC,KAAK,8JAEtC,WAAW,YACT,wCAAwC,KAAK,+DAC7C,mCAAmC,KAAK;AAAA,EAClD;AACF;AAGA,IAAM,4BAA4B,oBAAI,IAAI,CAAC,cAAc,WAAW,eAAe,CAAC;AAGpF,IAAM,yBAAyB,oBAAI,IAAI,CAAC,qBAAqB,uBAAuB,mBAAmB,CAAC;AAwBxG,eAAsB,qBACpB,SACiC;AACjC,QAAM,QAAQ,QAAQ,OAAO,KAAK;AAClC,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AACA,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,QAAQ,aAAa,kBAAkB;AAC1F,MAAI;AACF,UAAM,WAAW,MAAM,UAAU,GAAG,SAAS,cAAc;AAAA,MACzD,QAAQ;AAAA,MACR,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC5C,QAAQ,WAAW;AAAA,IACrB,CAAC;AACD,UAAM,OAAQ,MAAM,SAAS,KAAK;AAMlC,QAAI,KAAK,OAAO,MAAM;AACpB,aAAO,EAAE,MAAM,MAAM,MAAM,KAAK,QAAQ,WAAW,OAAO,KAAK,UAAU,UAAU;AAAA,IACrF;AACA,UAAM,UAAU,mBAAmB,KAAK,SAAS,QAAQ,SAAS,MAAM,IAAI,aAAa;AAIzF,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ,QAAQ,WAAW,YAAY,eAAe,QAAQ;AAAA,MAC9D,QAAQ,QAAQ;AAAA,IAClB;AAAA,EACF,SAAS,OAAO;AACd,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC1F;AAAA,EACF,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;","names":[]}

package/dist/{chunk-NC2V63EL.js → chunk-FNM7JYME.js}

@@ -448,8 +448,8 @@ function PagesStrip({
                 },
                 className: [
                   "group relative flex shrink-0 flex-col items-center gap-1 rounded p-1 transition",
-                  isActive ? "ring-2 ring-[var(--brand-primary)]" : "hover:bg-[var(--border-default)]/40",
-                  dragOverIndex === index ? "ring-1 ring-[var(--brand-primary)]/60" : ""
+                  isActive ? "ring-2 ring-[var(--brand-primary)]" : "hover:bg-[color-mix(in_srgb,var(--border-default)_40%,transparent)]",
+                  dragOverIndex === index ? "ring-1 ring-[color-mix(in_srgb,var(--brand-primary)_60%,transparent)]" : ""
                 ].join(" "),
                 children: [
                   /* @__PURE__ */ jsxs3(
@@ -568,7 +568,8 @@ function Rulers({ pageWidth, pageHeight, zoom, scrollLeft, scrollTop, showRulers
         guides,
         onGuidesChange
       }
-    )
+    ),
+    /* @__PURE__ */ jsx6(GuidesCanvasOverlay, { guides, zoom, scrollLeft, scrollTop })
   ] });
 }
 function HorizontalRuler({ pageWidth, zoom, scrollLeft, guides, onGuidesChange }) {
@@ -657,7 +658,23 @@ function HorizontalRuler({ pageWidth, zoom, scrollLeft, guides, onGuidesChange }
             tick.position
           );
         }),
-        pointerX !== null ? /* @__PURE__ */ jsx6("div", { className: "pointer-events-none absolute top-0 bottom-0 w-px bg-[var(--brand-primary)]/60", style: { left: pointerX } }) : null,
+        guides.vertical.map((position, index) => /* @__PURE__ */ jsx6(
+          "div",
+          {
+            "data-guide-marker": "vertical",
+            "aria-hidden": true,
+            className: "pointer-events-none absolute top-0 bottom-0 w-px bg-[var(--brand-primary)]",
+            style: { left: position * zoom - scrollLeft * zoom }
+          },
+          `guide-${index}`
+        )),
+        pointerX !== null ? /* @__PURE__ */ jsx6(
+          "div",
+          {
+            className: "pointer-events-none absolute top-0 bottom-0 w-px bg-[color-mix(in_srgb,var(--brand-primary)_60%,transparent)]",
+            style: { left: pointerX }
+          }
+        ) : null,
         dragGuideX !== null ? /* @__PURE__ */ jsx6(
           "div",
           {
@@ -758,7 +775,23 @@ function VerticalRuler({ pageHeight, zoom, scrollTop, guides, onGuidesChange })
             tick.position
           );
         }),
-        pointerY !== null ? /* @__PURE__ */ jsx6("div", { className: "pointer-events-none absolute left-0 right-0 h-px bg-[var(--brand-primary)]/60", style: { top: pointerY } }) : null,
+        guides.horizontal.map((position, index) => /* @__PURE__ */ jsx6(
+          "div",
+          {
+            "data-guide-marker": "horizontal",
+            "aria-hidden": true,
+            className: "pointer-events-none absolute left-0 right-0 h-px bg-[var(--brand-primary)]",
+            style: { top: position * zoom - scrollTop * zoom }
+          },
+          `guide-${index}`
+        )),
+        pointerY !== null ? /* @__PURE__ */ jsx6(
+          "div",
+          {
+            className: "pointer-events-none absolute left-0 right-0 h-px bg-[color-mix(in_srgb,var(--brand-primary)_60%,transparent)]",
+            style: { top: pointerY }
+          }
+        ) : null,
         dragGuideY !== null ? /* @__PURE__ */ jsx6(
           "div",
           {
@@ -770,6 +803,37 @@ function VerticalRuler({ pageHeight, zoom, scrollTop, guides, onGuidesChange })
     }
   );
 }
+function GuidesCanvasOverlay({ guides, zoom, scrollLeft, scrollTop }) {
+  if (guides.vertical.length === 0 && guides.horizontal.length === 0) return null;
+  return /* @__PURE__ */ jsxs4(
+    "div",
+    {
+      "aria-hidden": true,
+      className: "pointer-events-none absolute right-0 bottom-0 z-10 overflow-hidden",
+      style: { left: RULER_SIZE_PX, top: RULER_SIZE_PX },
+      children: [
+        guides.vertical.map((position, index) => /* @__PURE__ */ jsx6(
+          "div",
+          {
+            "data-guide-line": "vertical",
+            className: "absolute top-0 bottom-0 w-px bg-[var(--brand-primary)]",
+            style: { left: position * zoom - scrollLeft * zoom }
+          },
+          `v-${index}`
+        )),
+        guides.horizontal.map((position, index) => /* @__PURE__ */ jsx6(
+          "div",
+          {
+            "data-guide-line": "horizontal",
+            className: "absolute left-0 right-0 h-px bg-[var(--brand-primary)]",
+            style: { top: position * zoom - scrollTop * zoom }
+          },
+          `h-${index}`
+        ))
+      ]
+    }
+  );
+}
 
 // src/design-canvas-react/components/Toolbar.tsx
 import { useEffect as useEffect2, useRef as useRef3, useState as useState3 } from "react";
@@ -894,7 +958,7 @@ function SelectControl({
               onChange(opt.value);
               setOpen(false);
             },
-            className: `px-3 py-1 text-left text-[12px] hover:bg-[var(--brand-primary)]/10 ${opt.value === value ? "text-[var(--brand-primary)]" : "text-[var(--text-primary)]"}`,
+            className: `px-3 py-1 text-left text-[12px] hover:bg-[color-mix(in_srgb,var(--brand-primary)_10%,transparent)] ${opt.value === value ? "text-[var(--brand-primary)]" : "text-[var(--text-primary)]"}`,
             children: opt.label
           },
           opt.value
@@ -963,7 +1027,7 @@ function FontPicker({
                 setQuery("");
               },
               style: { fontFamily: family },
-              className: `block w-full px-3 py-1 text-left text-[13px] hover:bg-[var(--brand-primary)]/10 ${family === value ? "text-[var(--brand-primary)]" : "text-[var(--text-primary)]"}`,
+              className: `block w-full px-3 py-1 text-left text-[13px] hover:bg-[color-mix(in_srgb,var(--brand-primary)_10%,transparent)] ${family === value ? "text-[var(--brand-primary)]" : "text-[var(--text-primary)]"}`,
               children: family
             },
             family
@@ -973,7 +1037,7 @@ function FontPicker({
     )
   ] });
 }
-function ColorSwatch({ label, value, onCommit, disabled }) {
+function ColorSwatch({ label, value, onCommit, disabled, none = false }) {
   const [open, setOpen] = useState3(false);
   const normalized = value.startsWith("#") ? value : "#ffffff";
   return /* @__PURE__ */ jsxs5("div", { className: "flex flex-col items-center gap-0.5", children: [
@@ -988,10 +1052,12 @@ function ColorSwatch({ label, value, onCommit, disabled }) {
           {
             type: "button",
             disabled,
-            "aria-label": `${label} color`,
+            "aria-label": none ? `${label} color (none)` : `${label} color`,
+            title: none ? "None" : void 0,
             onClick: () => setOpen((v) => !v),
-            className: "h-6 w-10 rounded border border-[var(--border-default)] disabled:cursor-default disabled:opacity-40",
-            style: { backgroundColor: normalized }
+            className: "relative h-6 w-10 overflow-hidden rounded border border-[var(--border-default)] disabled:cursor-default disabled:opacity-40",
+            style: { backgroundColor: none ? "#ffffff" : normalized },
+            children: none ? /* @__PURE__ */ jsx7("svg", { className: "absolute inset-0 h-full w-full", viewBox: "0 0 40 24", preserveAspectRatio: "none", "aria-hidden": true, children: /* @__PURE__ */ jsx7("line", { x1: "1", y1: "23", x2: "39", y2: "1", stroke: "var(--text-danger)", strokeWidth: "1.5" }) }) : null
           }
         ),
         children: /* @__PURE__ */ jsxs5("div", { className: `${POPOVER_PANEL} w-40 gap-2 p-2`, children: [
@@ -1228,7 +1294,7 @@ function SelectionControls({
                     onBindSlot(slotInput.trim() || null);
                     setSlotPopoverOpen(false);
                   },
-                  className: "flex-1 rounded border border-[var(--brand-primary)] px-2 py-0.5 text-[11px] text-[var(--brand-primary)] hover:bg-[var(--brand-primary)]/10",
+                  className: "flex-1 rounded border border-[var(--brand-primary)] px-2 py-0.5 text-[11px] text-[var(--brand-primary)] hover:bg-[color-mix(in_srgb,var(--brand-primary)_10%,transparent)]",
                   children: slotInput.trim() ? "Bind" : "Unbind"
                 }
               ),
@@ -1310,7 +1376,7 @@ function TextControls({ element, canWrite, onPatch }) {
 function ShapeControls({ element, canWrite, onPatch, showCornerRadius }) {
   return /* @__PURE__ */ jsxs5(Fragment4, { children: [
     /* @__PURE__ */ jsx7(ColorSwatch, { label: "Fill", value: element.fill, onCommit: (v) => onPatch({ fill: v }), disabled: !canWrite }),
-    /* @__PURE__ */ jsx7(ColorSwatch, { label: "Stroke", value: element.stroke ?? "#000000", onCommit: (v) => onPatch({ stroke: v }), disabled: !canWrite }),
+    /* @__PURE__ */ jsx7(ColorSwatch, { label: "Stroke", value: element.stroke ?? "#000000", onCommit: (v) => onPatch({ stroke: v }), disabled: !canWrite, none: (element.strokeWidth ?? 0) === 0 }),
     /* @__PURE__ */ jsx7(NumberInput, { label: "Stroke W", value: element.strokeWidth ?? 0, min: 0, onCommit: (v) => onPatch({ strokeWidth: v }), className: "w-14" }),
     showCornerRadius && "cornerRadius" in element ? /* @__PURE__ */ jsx7(NumberInput, { label: "Corner R", value: element.cornerRadius ?? 0, min: 0, onCommit: (v) => onPatch({ cornerRadius: v }), className: "w-14" }) : null
   ] });
@@ -1376,7 +1442,7 @@ function ImageControls({ element, canWrite, onPatch }) {
                   onPatch({ src: swapUrl.trim() });
                   setSwapOpen(false);
                 },
-                className: "flex-1 rounded border border-[var(--brand-primary)] px-2 py-0.5 text-[11px] text-[var(--brand-primary)] hover:bg-[var(--brand-primary)]/10 disabled:cursor-default disabled:opacity-40",
+                className: "flex-1 rounded border border-[var(--brand-primary)] px-2 py-0.5 text-[11px] text-[var(--brand-primary)] hover:bg-[color-mix(in_srgb,var(--brand-primary)_10%,transparent)] disabled:cursor-default disabled:opacity-40",
                 children: "Replace"
               }
             ),
@@ -1432,7 +1498,8 @@ function PagePropsControls({ page, canWrite, onSetPageProps, onSetPageGuides, pa
           const preset = SIZE_PRESETS.find((p) => p.id === id);
           if (preset) onSetPageProps({ width: preset.width, height: preset.height });
         },
-        options: presetOptions
+        options: presetOptions,
+        buttonClassName: "w-44"
       }
     ),
     /* @__PURE__ */ jsxs5("label", { className: "flex flex-col items-center gap-0.5", children: [
@@ -1627,7 +1694,7 @@ function ExportControl({ defaults, onExport, className }) {
             setOpen(false);
           }
         },
-        className: "flex h-8 items-center gap-1.5 rounded-md border border-[var(--border-default)] px-2.5 text-xs font-medium text-[var(--text-primary)] transition-colors hover:border-[var(--brand-primary)]/40",
+        className: "flex h-8 items-center gap-1.5 rounded-md border border-[var(--border-default)] px-2.5 text-xs font-medium text-[var(--text-primary)] transition-colors hover:border-[color-mix(in_srgb,var(--brand-primary)_40%,transparent)]",
         children: [
           /* @__PURE__ */ jsx9(ExportGlyph, { className: "h-3.5 w-3.5" }),
           "Export",
@@ -1681,7 +1748,7 @@ function ExportControl({ defaults, onExport, className }) {
               type: "button",
               "aria-label": "Export image",
               onClick: confirm,
-              className: "rounded border border-[var(--brand-primary)] px-2 py-1 text-[11px] font-medium text-[var(--brand-primary)] transition-colors hover:bg-[var(--brand-primary)]/10",
+              className: "rounded border border-[var(--brand-primary)] px-2 py-1 text-[11px] font-medium text-[var(--brand-primary)] transition-colors hover:bg-[color-mix(in_srgb,var(--brand-primary)_10%,transparent)]",
               children: "Export"
             }
           )
@@ -2062,7 +2129,7 @@ function DesignCanvas({
           /* @__PURE__ */ jsx10("p", { className: "text-xs leading-5 text-[var(--text-secondary)]", children: "The design canvas needs room to work. Open this on a tablet or desktop to edit pages, elements, and export." })
         ] })
       ] }),
-      /* @__PURE__ */ jsxs8("div", { className: "relative hidden min-h-0 flex-1 sm:block", children: [
+      /* @__PURE__ */ jsxs8("div", { className: `relative hidden min-h-0 flex-1 sm:block ${editorState.showRulers ? "pl-[20px] pt-[20px]" : ""}`, children: [
         /* @__PURE__ */ jsx10(
           Rulers,
           {
@@ -2086,8 +2153,8 @@ function DesignCanvas({
               {
                 style: {
                   position: "absolute",
-                  left: editorState.panX,
-                  top: editorState.panY
+                  left: editorState.panX + (editorState.showRulers ? 20 : 0),
+                  top: editorState.panY + (editorState.showRulers ? 20 : 0)
                 },
                 children: /* @__PURE__ */ jsx10(
                   BleedTrimOverlay,
@@ -2192,4 +2259,4 @@ export {
   ExportControl,
   DesignCanvas
 };
-//# sourceMappingURL=chunk-NC2V63EL.js.map
+//# sourceMappingURL=chunk-FNM7JYME.js.map