fix(web): reject empty auditor hex payloads (#251)

apps/web/package.json

@@ -8,7 +8,7 @@
     "dev": "vite",
     "build": "vite build",
     "preview": "vite preview",
-    "test": "node --import tsx --test src/demo/trace-health-check.test.ts src/lib/config.test.ts src/lib/chain.test.ts src/dashboard/fixture-health-check.test.ts src/lib/round-status.test.ts src/components/dashboard/RoundStatusCard.test.tsx src/hooks/useDashboardData.test.ts",
+    "test": "node --import tsx --test src/demo/trace-health-check.test.ts src/lib/config.test.ts src/lib/hex.test.ts src/lib/chain.test.ts src/dashboard/fixture-health-check.test.ts src/lib/round-status.test.ts src/components/dashboard/RoundStatusCard.test.tsx src/hooks/useDashboardData.test.ts",
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {

apps/web/src/lib/hex.test.ts

@@ -0,0 +1,14 @@
+// Copyright (c) 2026 Sub Rosa contributors
+import assert from "node:assert/strict";
+import test from "node:test";
+import { hexToBytes } from "./hex";
+for (const value of ["", "  ", "0x", "0X", " 0x ", "a", "0xabc", "xz", "00 gg"]) {
+  test(`rejects invalid hex ${JSON.stringify(value)}`, () => {
+    assert.throws(() => hexToBytes(value), /^Error: invalid hex string$/);
+  });
+}
+for (const value of ["00aBff", "0x00abff", "0X00ABFF", " 00abff "]) {
+  test(`decodes valid hex ${JSON.stringify(value)}`, () => {
+    assert.deepEqual(hexToBytes(value), new Uint8Array([0, 171, 255]));
+  });
+}

apps/web/src/lib/hex.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Sub Rosa contributors
 export function hexToBytes(hex: string): Uint8Array {
   const clean = hex.trim().replace(/^0x/i, "");
-  if (clean.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(clean)) {
+  if (clean.length === 0 || clean.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(clean)) {
     throw new Error("invalid hex string");
   }
   const out = new Uint8Array(clean.length / 2);