Part of #280 (Dashboard as a first-class module). Phase 6 of 6 — final phase. Normative spec in #280.
Closes the remaining half of #153 (open panel/dashboard in its own window) via the full-screen viewer route.
Goal
Bookmarkable direct viewing of the current workspace's Dashboard, and one-time IndexedDB token handoff for full-screen preview and temporary external-bundle viewing — on a read-only path that never constructs Workbench or editor modules.
Scope (from #280 "Phase 6: direct and full-screen viewing")
DashboardOpenSource contract: current-workspace (bookmarkable; authenticates, loads the stored workspace, verifies workspace + dashboard IDs, shows not-found rather than silently opening something else) and session-bundle (unguessable one-time token; not bookmarkable).- IndexedDB one-time token transport: write validated bundle + expiry before opening the tab; viewer atomically consumes the record; delete on consumption or expiry; strip the token from the URL via
history.replaceState; sessionStorage alone is explicitly insufficient.
- Lazy-load the selected layout module on the viewer path.
- Read-only path bundles/loads no Workbench/editor construction (verify against the single-artifact build — code-splitting questions go through hard rule 4 if they arise).
Reconciliation note
This replaces the #149 Phase-D1 postMessage credential-handoff design decision for state transport (auth handoff behavior itself is unchanged unless this phase's design says otherwise — the token record carries the dashboard/bundle, not credentials). Update #149's Architecture section when this lands.
Dependencies
Phases 1–5 (viewer session, codecs, repository, preflight).
Tests
Per #280 "Open, trust, import, and remapping" (route/token subset): both IDs validated on the workspace route; token is unguessable, expiring, consumed exactly once, deleted, and removed from the URL; external bundle never auto-executes after file selection or OAuth return.
Acceptance
Part of #280 (Dashboard as a first-class module). Phase 6 of 6 — final phase. Normative spec in #280.
Closes the remaining half of #153 (open panel/dashboard in its own window) via the full-screen viewer route.
Goal
Bookmarkable direct viewing of the current workspace's Dashboard, and one-time IndexedDB token handoff for full-screen preview and temporary external-bundle viewing — on a read-only path that never constructs Workbench or editor modules.
Scope (from #280 "Phase 6: direct and full-screen viewing")
DashboardOpenSourcecontract:current-workspace(bookmarkable; authenticates, loads the stored workspace, verifies workspace + dashboard IDs, shows not-found rather than silently opening something else) andsession-bundle(unguessable one-time token; not bookmarkable).history.replaceState;sessionStoragealone is explicitly insufficient.Reconciliation note
This replaces the #149 Phase-D1
postMessagecredential-handoff design decision for state transport (auth handoff behavior itself is unchanged unless this phase's design says otherwise — the token record carries the dashboard/bundle, not credentials). Update #149's Architecture section when this lands.Dependencies
Phases 1–5 (viewer session, codecs, repository, preflight).
Tests
Per #280 "Open, trust, import, and remapping" (route/token subset): both IDs validated on the workspace route; token is unguessable, expiring, consumed exactly once, deleted, and removed from the URL; external bundle never auto-executes after file selection or OAuth return.
Acceptance