@akinon/akitable 1.6.2 → 1.7.0-260914-0

package/dist/cjs/common/navigation.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Navigation helpers behind this package's new-tab support.
+ *
+ * DUPLICATE — an identical copy lives in `@akinon/ui-breadcrumb` as
+ * `src/navigation.ts`. The two are kept apart on purpose: neither package
+ * should depend on the other, and a shared package would have to put them in
+ * its public API. `isSafeHref` is a security check, so any change here — a
+ * newly discovered bypass shape, a scheme added to the allow list — MUST be
+ * applied to the other copy as well.
+ */
+/**
+ * Returns `true` when a mouse event expresses the user's intent to open the
+ * target in a new tab or window: middle click, `Cmd` + click (macOS) / `Ctrl` +
+ * click (Windows, Linux), or `Shift` + click.
+ *
+ * `Alt` + click is deliberately **not** included: it is a download gesture
+ * rather than a new-tab one, and it does nothing at all for in-app routes, so
+ * treating it as browser-handled would swallow the navigation entirely.
+ *
+ * Call sites must return early **without** calling `preventDefault()` when this
+ * returns `true`, so the browser's native anchor behavior takes over. This only
+ * works on elements that render as a real `<a href="...">`.
+ *
+ * The `button` check only matters for a call site that listens to
+ * `mousedown`/`auxclick`: a middle click dispatches `auxclick`, not `click`, so
+ * React's `onClick` never sees it.
+ */
+export declare const isNewTabRequest: (event: Pick<MouseEvent, "button" | "metaKey" | "ctrlKey" | "shiftKey">) => boolean;
+/**
+ * Returns `true` when `href` is safe to render as a real `<a href="...">`
+ * attribute.
+ *
+ * Relative URLs (`/products/1`, `products/1`, `#/products/1`, `?page=2`) and
+ * the `http`, `https`, `mailto` and `tel` schemes are allowed. Any other scheme
+ * — `javascript:` above all — is rejected, since following such a link executes
+ * script in the page's own origin. Note that an internal routing key shaped
+ * like `catalog:detail` parses as the scheme `catalog:` and is rejected as
+ * well.
+ *
+ * This matters because navigation targets are typically derived from server
+ * data: an `href` built from a record field is untrusted input, and a real
+ * anchor is followed natively on middle click, `Cmd`/`Ctrl` + click and through
+ * the right-click context menu, where no click handler runs to intercept it.
+ *
+ * An empty or whitespace-only value is rejected as well: `<a href="">` points at
+ * the current document and reloads the page.
+ *
+ * Protocol-relative URLs (`//evil.com`) are rejected too. They carry no scheme,
+ * so they read as relative, but the browser resolves them against the current
+ * one and navigates off-origin — and no in-app route ever needs that shape.
+ * Absolute `http`/`https` URLs stay allowed on purpose: a cross-origin target
+ * can be legitimate, so the caller owns that decision — including whether it
+ * can carry `rel="noopener"`, which is a per-call-site matter.
+ *
+ * A rejected value is dropped silently: nothing is logged, and the element
+ * renders without an anchor.
+ */
+export declare const isSafeHref: (href: string | undefined | null) => boolean;
+//# sourceMappingURL=navigation.d.ts.map

package/dist/cjs/common/navigation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"navigation.d.ts","sourceRoot":"","sources":["../../../src/common/navigation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAoCH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC,KACrE,OAIa,CAAC;AAEjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OAkB5D,CAAC"}

package/dist/cjs/common/navigation.js

@@ -0,0 +1,112 @@
+"use strict";
+/**
+ * Navigation helpers behind this package's new-tab support.
+ *
+ * DUPLICATE — an identical copy lives in `@akinon/ui-breadcrumb` as
+ * `src/navigation.ts`. The two are kept apart on purpose: neither package
+ * should depend on the other, and a shared package would have to put them in
+ * its public API. `isSafeHref` is a security check, so any change here — a
+ * newly discovered bypass shape, a scheme added to the allow list — MUST be
+ * applied to the other copy as well.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSafeHref = exports.isNewTabRequest = void 0;
+/** Mouse button number for the middle (wheel) button in `MouseEvent.button`. */
+const MIDDLE_MOUSE_BUTTON = 1;
+/**
+ * Control characters (tab and newline included) are stripped by browsers while
+ * parsing a URL, so `java\nscript:alert(1)` is a working `javascript:` URL and
+ * must not slip through the scheme check below.
+ *
+ * Deliberately wider than the browser, which strips tab/CR/LF anywhere but
+ * whitespace only from the ends. Widening can never let an unsupported scheme
+ * through — the stripped characters cannot spell one out — so it errs in the
+ * safe direction. The range covers whitespace as well, so no separate `trim()`
+ * is needed.
+ */
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARACTERS = /[\x00-\x20\x7f]/g;
+/**
+ * Schemes that are safe to put into an `href` attribute. Everything else —
+ * most importantly `javascript:`, but also `data:` and `vbscript:` — can run
+ * script in the page's own origin when the link is followed.
+ */
+const SAFE_SCHEMES = ['http:', 'https:', 'mailto:', 'tel:'];
+/** Matches a leading URL scheme, e.g. `https:` or `javascript:`. */
+const SCHEME_PATTERN = /^([a-z][a-z0-9+.-]*):/;
+/**
+ * Matches the leading slashes of a protocol-relative URL. Backslashes are
+ * folded in because browsers treat `\` as `/` while parsing a URL, which makes
+ * `\\evil.com` and `/\evil.com` protocol-relative just like `//evil.com`.
+ */
+const PROTOCOL_RELATIVE_PATTERN = /^[/\\]{2,}/;
+/**
+ * Returns `true` when a mouse event expresses the user's intent to open the
+ * target in a new tab or window: middle click, `Cmd` + click (macOS) / `Ctrl` +
+ * click (Windows, Linux), or `Shift` + click.
+ *
+ * `Alt` + click is deliberately **not** included: it is a download gesture
+ * rather than a new-tab one, and it does nothing at all for in-app routes, so
+ * treating it as browser-handled would swallow the navigation entirely.
+ *
+ * Call sites must return early **without** calling `preventDefault()` when this
+ * returns `true`, so the browser's native anchor behavior takes over. This only
+ * works on elements that render as a real `<a href="...">`.
+ *
+ * The `button` check only matters for a call site that listens to
+ * `mousedown`/`auxclick`: a middle click dispatches `auxclick`, not `click`, so
+ * React's `onClick` never sees it.
+ */
+const isNewTabRequest = (event) => event.button === MIDDLE_MOUSE_BUTTON ||
+    event.metaKey ||
+    event.ctrlKey ||
+    event.shiftKey;
+exports.isNewTabRequest = isNewTabRequest;
+/**
+ * Returns `true` when `href` is safe to render as a real `<a href="...">`
+ * attribute.
+ *
+ * Relative URLs (`/products/1`, `products/1`, `#/products/1`, `?page=2`) and
+ * the `http`, `https`, `mailto` and `tel` schemes are allowed. Any other scheme
+ * — `javascript:` above all — is rejected, since following such a link executes
+ * script in the page's own origin. Note that an internal routing key shaped
+ * like `catalog:detail` parses as the scheme `catalog:` and is rejected as
+ * well.
+ *
+ * This matters because navigation targets are typically derived from server
+ * data: an `href` built from a record field is untrusted input, and a real
+ * anchor is followed natively on middle click, `Cmd`/`Ctrl` + click and through
+ * the right-click context menu, where no click handler runs to intercept it.
+ *
+ * An empty or whitespace-only value is rejected as well: `<a href="">` points at
+ * the current document and reloads the page.
+ *
+ * Protocol-relative URLs (`//evil.com`) are rejected too. They carry no scheme,
+ * so they read as relative, but the browser resolves them against the current
+ * one and navigates off-origin — and no in-app route ever needs that shape.
+ * Absolute `http`/`https` URLs stay allowed on purpose: a cross-origin target
+ * can be legitimate, so the caller owns that decision — including whether it
+ * can carry `rel="noopener"`, which is a per-call-site matter.
+ *
+ * A rejected value is dropped silently: nothing is logged, and the element
+ * renders without an anchor.
+ */
+const isSafeHref = (href) => {
+    var _a;
+    if (!href)
+        return false;
+    // Normalized the way the browser would parse it, so a value that only looks
+    // safe before the noise is stripped cannot get through.
+    const normalized = href.replace(CONTROL_CHARACTERS, '').toLowerCase();
+    if (!normalized)
+        return false;
+    // Checked before the scheme, since a protocol-relative URL carries none.
+    if (PROTOCOL_RELATIVE_PATTERN.test(normalized))
+        return false;
+    const scheme = (_a = SCHEME_PATTERN.exec(normalized)) === null || _a === void 0 ? void 0 : _a[1];
+    // No scheme at all — a relative URL, resolved against the current document.
+    if (!scheme)
+        return true;
+    return SAFE_SCHEMES.includes(`${scheme}:`);
+};
+exports.isSafeHref = isSafeHref;

package/dist/cjs/components/datatable.css

@@ -167,3 +167,11 @@
   opacity: 1 !important;
   cursor: not-allowed;
 }
+
+/* Declarative action column items (`actionColumn.items`). Keeps the buttons on
+   one line instead of letting them wrap in a narrow action column. */
+.akitable-action-items {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.25rem;
+}

package/dist/cjs/components/datatable.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"datatable.d.ts","sourceRoot":"","sources":["../../../src/components/datatable.tsx"],"names":[],"mappings":"AAAA,OAAO,iBAAiB,CAAC;AAQzB,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,EAIL,sBAAsB,EAIvB,MAAM,UAAU,CAAC;AAIlB,eAAO,MAAM,iBAAiB,GAAI,OAAO,sBAAsB,sBA+S9D,CAAC"}
+{"version":3,"file":"datatable.d.ts","sourceRoot":"","sources":["../../../src/components/datatable.tsx"],"names":[],"mappings":"AAAA,OAAO,iBAAiB,CAAC;AAQzB,OAAO,KAAK,MAAM,OAAO,CAAC;AAK1B,OAAO,EAOL,sBAAsB,EAIvB,MAAM,UAAU,CAAC;AAKlB,eAAO,MAAM,iBAAiB,GAAI,OAAO,sBAAsB,sBA2hB9D,CAAC"}

package/dist/cjs/components/datatable.js

@@ -1,4 +1,15 @@
 "use strict";
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AkitableDataTable = void 0;
 require("./datatable.css");
@@ -10,6 +21,7 @@ const antd_1 = require("antd");
 const clsx_1 = require("clsx");
 const react_1 = require("react");
 const akitable_context_1 = require("../akitable-context");
+const navigation_1 = require("../common/navigation");
 const i18n_1 = require("../i18n");
 const types_1 = require("../types");
 const EditableCell_1 = require("./EditableCell");
@@ -26,12 +38,46 @@ const AkitableDataTable = (props) => {
         if (!editingKey)
             setHasFormErrors(false);
     }, [editingKey]);
+    /** Keys of the misconfiguration reports already made by this instance. */
+    const warnedConfigKeysRef = react_1.default.useRef(new Set());
+    // Developer-facing misconfiguration reports, stripped from production builds
+    // the way antd's own `devUseWarning` is: the messages help nobody in a
+    // shipped app, and the guard lets a bundler drop the whole block.
+    //
+    // Re-checked when the props change rather than only on mount: an
+    // `actionColumn` is commonly built from data (permissions, an async config),
+    // so it can arrive after the first render. Each report is deduplicated per
+    // instance instead, since `actionColumn` is typically an inline object
+    // literal whose identity changes on every render.
     react_1.default.useEffect(() => {
+        var _a;
+        if (process.env.NODE_ENV === 'production')
+            return;
+        const warnOnce = (key, message) => {
+            if (warnedConfigKeysRef.current.has(key))
+                return;
+            warnedConfigKeysRef.current.add(key);
+            console.warn(message);
+        };
         if (onRowEdit && !actionColumn) {
-            console.warn('[Akitable] onRowEdit is provided without actionColumn. ' +
+            warnOnce('onRowEdit-without-actionColumn', '[Akitable] onRowEdit is provided without actionColumn. ' +
                 'Please migrate to the actionColumn prop to customize the action column.');
         }
-    }, []);
+        if ((actionColumn === null || actionColumn === void 0 ? void 0 : actionColumn.render) && (actionColumn === null || actionColumn === void 0 ? void 0 : actionColumn.items)) {
+            warnOnce('render-and-items', '[Akitable] actionColumn.render and actionColumn.items are both provided. ' +
+                'render takes precedence and items is ignored.');
+        }
+        if (actionColumn && !actionColumn.render && !actionColumn.items) {
+            warnOnce('actionColumn-without-actions', '[Akitable] actionColumn is provided without render or items. ' +
+                'The column renders no actions — and it replaces the built-in edit ' +
+                'column, so there is no way to enter edit mode either. Provide one ' +
+                'of them.');
+        }
+        if (!onRowEdit && ((_a = actionColumn === null || actionColumn === void 0 ? void 0 : actionColumn.items) === null || _a === void 0 ? void 0 : _a.some(item => item.startEdit))) {
+            warnOnce('startEdit-without-onRowEdit', '[Akitable] actionColumn.items contains a startEdit item but onRowEdit ' +
+                'is not provided. Saving the edited row would fail.');
+        }
+    }, [actionColumn, onRowEdit]);
     const [isOverflowing, setIsOverflowing] = react_1.default.useState(false);
     const wrapperRef = react_1.default.useRef(null);
     const hasActions = actions && actions.length > 0;
@@ -61,6 +107,15 @@ const AkitableDataTable = (props) => {
             e === null || e === void 0 ? void 0 : e.stopPropagation();
         },
         handleSaveEditingItem: async () => {
+            // Without `onRowEdit` there is nowhere to save to. Keep the row editable
+            // rather than throwing and discarding what was typed, and report the
+            // misconfiguration outside production builds.
+            if (!onRowEdit) {
+                if (process.env.NODE_ENV !== 'production') {
+                    console.error('[Akitable] Cannot save the edited row because onRowEdit is not provided.');
+                }
+                return;
+            }
             try {
                 setIsLoadingSaveButton(true);
                 await onRowEdit(record, form.getFieldsValue());
@@ -73,7 +128,121 @@ const AkitableDataTable = (props) => {
         },
         handleCancelEditingItem: () => setEditingKey(null)
     });
-    const buildActionColumn = (col) => (Object.assign(Object.assign({}, col), { key: '__akitable_action__', render: (record) => col.render(Object.assign({ record, isEditing: checkIsEditingRow(getRowKeyData(record)), isEditLoading: isLoadingSaveButton, hasEditFormError: hasFormErrors }, buildActionHandlers(record))) }));
+    /**
+     * The save/cancel pair shown while a row is being edited. Shared by the
+     * default edit column and the declarative `items` action column so both
+     * render an identical editing state.
+     */
+    const renderEditingActions = ({ handleSaveEditingItem, handleCancelEditingItem }) => (react_1.default.createElement("span", null,
+        react_1.default.createElement(ui_button_1.Button, { size: "small", onClick: handleSaveEditingItem, loading: isLoadingSaveButton, disabled: hasFormErrors, className: (0, clsx_1.default)({
+                'akitable-save-button--has-errors': hasFormErrors
+            }) }, t('save')),
+        react_1.default.createElement(ui_typography_1.Text, Object.assign({ type: "danger", disabled: isLoadingSaveButton, className: "cursor-pointer ml-2" }, (!isLoadingSaveButton && { onClick: handleCancelEditingItem })), t('cancel'))));
+    const resolveActionItemValue = (value, record) => typeof value === 'function'
+        ? value(record)
+        : value;
+    const renderActionItem = (item, index, onNavigate, params) => {
+        const { record } = params;
+        const { key, label, startEdit, href: hrefValue, hidden, disabled: disabledValue, onClick: onItemClick } = item, buttonProps = __rest(item, ["key", "label", "startEdit", "href", "hidden", "disabled", "onClick"]);
+        if (resolveActionItemValue(hidden, record))
+            return null;
+        const resolvedHref = resolveActionItemValue(hrefValue, record);
+        const disabled = resolveActionItemValue(disabledValue, record);
+        // An `href` is usually derived from record data, so it is validated rather
+        // than trusted — see `isSafeHref` for which values are accepted and why
+        // rendering a real anchor makes that necessary.
+        //
+        // A rejected value is dropped silently: it never reaches the anchor, the
+        // item degrades to a plain button and nothing is logged. A builder slip
+        // like `record => record.detailUrl ?? ''` therefore shows up as a button
+        // where a link was expected, not as a console message.
+        const href = (0, navigation_1.isSafeHref)(resolvedHref) ? resolvedHref : undefined;
+        const handleClick = (event) => {
+            // Action buttons live inside a row that may have its own `onRowClick`.
+            // The wrapper in `renderActionItems` stops the same propagation for the
+            // clicks antd swallows before this handler ever runs; this one covers the
+            // ordinary path.
+            event.stopPropagation();
+            if (startEdit) {
+                // A `startEdit` item never becomes an anchor (see the `href` prop
+                // below), so there is no default navigation to prevent here.
+                params.handleStartEdit(event);
+                return;
+            }
+            if (!href) {
+                onItemClick === null || onItemClick === void 0 ? void 0 : onItemClick(record, event);
+                return;
+            }
+            // New tab request (middle click, Cmd/Ctrl/Shift + click) — hand over to
+            // the browser. Never `preventDefault()` here, otherwise the native
+            // anchor behavior is destroyed.
+            if ((0, navigation_1.isNewTabRequest)(event) || event.defaultPrevented)
+                return;
+            // A per-item `onClick` wins over the column level `onNavigate` so a
+            // single item can route itself.
+            const navigate = onItemClick
+                ? () => onItemClick(record, event)
+                : onNavigate
+                    ? () => onNavigate(href, record, event)
+                    : undefined;
+            // With no handler there is nothing to intercept: let the browser follow
+            // the `href` instead of leaving a dead link behind.
+            if (!navigate)
+                return;
+            event.preventDefault();
+            navigate();
+        };
+        return (react_1.default.createElement(ui_button_1.Button, Object.assign({}, buttonProps, { key: key !== null && key !== void 0 ? key : index, 
+            // An `href` makes `@akinon/ui-button` render a real <a href>, which is
+            // what enables the browser's native new-tab gestures.
+            //
+            // Neither a disabled, a loading nor a `startEdit` item may become an
+            // anchor. antd swallows the click handler of a disabled Button, so
+            // `stopPropagation` would never run and the click would bubble up to
+            // `onRowClick`; a real <button disabled> dispatches no click at all.
+            //
+            // A loading Button is swallowed the same way but is *not* marked
+            // disabled in the DOM, so an anchor left in place would take a click
+            // that reaches neither the item nor `preventDefault` — antd calls that
+            // itself — leaving a dead left click whose event still bubbles to
+            // `onRowClick`, while a middle click would keep opening a new tab. That
+            // is exactly the "two gestures, two targets" split this API exists to
+            // avoid. `loading` is read as truthy, so the `{ delay }` form drops the
+            // anchor from the start rather than once the delay elapses.
+            //
+            // And a `startEdit` item is not a navigation target, so an anchor would
+            // be followed by the browser on a middle click or through the context
+            // menu — gestures that dispatch `auxclick` or no event at all, leaving
+            // no handler to stop.
+            href: disabled || startEdit || item.loading ? undefined : href, disabled: disabled, size: "small", onClick: handleClick }), label));
+    };
+    const renderActionItems = (items, onNavigate, params) => {
+        if (params.isEditing)
+            return renderEditingActions(params);
+        return (react_1.default.createElement("span", { className: "akitable-action-items", 
+            // Safety net for the row's own `onRowClick`: antd never calls a
+            // Button's `onClick` while it is loading or disabled, so an item's own
+            // `stopPropagation` cannot be relied on to keep the click from bubbling
+            // up to the row.
+            onClick: event => event.stopPropagation() }, items.map((item, index) => renderActionItem(item, index, onNavigate, params))));
+    };
+    const buildActionColumn = (col) => {
+        // `items`/`onNavigate` are Akinon-only fields; keep them out of the object
+        // that is handed to antd's `Table` as a column definition.
+        const { items, onNavigate, render } = col, columnProps = __rest(col, ["items", "onNavigate", "render"]);
+        return Object.assign(Object.assign({}, columnProps), { key: '__akitable_action__', 
+            // rc-table passes the whole record as the first argument when the column
+            // has no `dataIndex`.
+            render: (record) => {
+                const params = Object.assign({ record, isEditing: checkIsEditingRow(getRowKeyData(record)), isEditLoading: isLoadingSaveButton, hasEditFormError: hasFormErrors }, buildActionHandlers(record));
+                // `render` wins over `items` so existing consumers are untouched.
+                if (render)
+                    return render(params);
+                if (items)
+                    return renderActionItems(items, onNavigate, params);
+                return null;
+            } });
+    };
     const handleFormFieldsChange = (_, allFields) => {
         setHasFormErrors(allFields.some(f => { var _a, _b; return ((_b = (_a = f.errors) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0) > 0; }));
     };
@@ -84,11 +253,10 @@ const AkitableDataTable = (props) => {
         render: (record) => {
             const isRowEditing = checkIsEditingRow(getRowKeyData(record));
             const { handleStartEdit, handleSaveEditingItem, handleCancelEditingItem } = buildActionHandlers(record);
-            return isRowEditing ? (react_1.default.createElement("span", null,
-                react_1.default.createElement(ui_button_1.Button, { size: "small", onClick: handleSaveEditingItem, loading: isLoadingSaveButton, disabled: hasFormErrors, className: (0, clsx_1.default)({
-                        'akitable-save-button--has-errors': hasFormErrors
-                    }) }, t('save')),
-                react_1.default.createElement(ui_typography_1.Text, Object.assign({ type: "danger", disabled: isLoadingSaveButton, className: "cursor-pointer ml-2" }, (!isLoadingSaveButton && { onClick: handleCancelEditingItem })), t('cancel')))) : (react_1.default.createElement(ui_button_1.Button, { type: "primary", size: "small", onClick: handleStartEdit, className: (0, clsx_1.default)({
+            return isRowEditing ? (renderEditingActions({
+                handleSaveEditingItem,
+                handleCancelEditingItem
+            })) : (react_1.default.createElement(ui_button_1.Button, { type: "primary", size: "small", onClick: handleStartEdit, className: (0, clsx_1.default)({
                     'akinon-table-edit-button--disable': isLoadingSaveButton
                 }) }, t('edit')));
         },

package/dist/cjs/components/pagination.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../../../src/components/pagination.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAO1B,eAAO,MAAM,kBAAkB,yBA4C9B,CAAC"}
+{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../../../src/components/pagination.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AA6B1B,eAAO,MAAM,kBAAkB,yBA8C9B,CAAC"}

package/dist/cjs/components/pagination.js

@@ -4,12 +4,25 @@ exports.AkitablePagination = void 0;
 const ui_pagination_1 = require("@akinon/ui-pagination");
 const react_1 = require("react");
 const akitable_context_1 = require("../akitable-context");
+const constants_1 = require("../constants");
 const i18n_1 = require("../i18n");
-const PAGE_SIZE_OPTIONS = [20, 50, 100, 250];
+const resolvePageSizeOptions = (requestedOptions) => [
+    ...new Set((requestedOptions === null || requestedOptions === void 0 ? void 0 : requestedOptions.length)
+        ? requestedOptions
+        : constants_1.AKITABLE_DEFAULT_PAGE_SIZE_OPTIONS)
+];
+const resolvePageSize = (requestedSize, pageSizeOptions) => {
+    const isPositiveInteger = typeof requestedSize === 'number' &&
+        Number.isInteger(requestedSize) &&
+        requestedSize > 0;
+    return isPositiveInteger ? requestedSize : pageSizeOptions[0];
+};
 const AkitablePagination = () => {
     const { isLoading, pagination, onPaginationChanged, paginationShowTotal } = (0, akitable_context_1.useAkitableContext)();
     const { t } = i18n_1.i18n;
     const totalPagination = (pagination === null || pagination === void 0 ? void 0 : pagination.total) || 0;
+    const pageSizeOptions = resolvePageSizeOptions(pagination === null || pagination === void 0 ? void 0 : pagination.pageSizeOptions);
+    const pageSize = resolvePageSize(pagination === null || pagination === void 0 ? void 0 : pagination.size, pageSizeOptions);
     const hasItems = totalPagination > 0;
     const locale = {
         items_per_page: t('itemsPerPage')
@@ -29,6 +42,6 @@ const AkitablePagination = () => {
         return null;
     };
     return (react_1.default.createElement("div", { className: "akitable-pagination" },
-        react_1.default.createElement(ui_pagination_1.Pagination, { disabled: isLoading || !hasItems, current: pagination === null || pagination === void 0 ? void 0 : pagination.page, pageSize: pagination === null || pagination === void 0 ? void 0 : pagination.size, pageSizeOptions: PAGE_SIZE_OPTIONS, total: totalPagination, showTotal: handleShowTotal, showSizeChanger: true, onChange: handleOnChange, locale: locale, theme: "light" })));
+        react_1.default.createElement(ui_pagination_1.Pagination, { disabled: isLoading || !hasItems, current: pagination === null || pagination === void 0 ? void 0 : pagination.page, pageSize: pageSize, pageSizeOptions: pageSizeOptions, total: totalPagination, showTotal: handleShowTotal, showSizeChanger: true, onChange: handleOnChange, locale: locale, theme: "light" })));
 };
 exports.AkitablePagination = AkitablePagination;

package/dist/cjs/constants.d.ts

@@ -0,0 +1,3 @@
+import type { AkitablePageSizes } from './types';
+export declare const AKITABLE_DEFAULT_PAGE_SIZE_OPTIONS: readonly AkitablePageSizes[];
+//# sourceMappingURL=constants.d.ts.map

package/dist/cjs/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD,eAAO,MAAM,kCAAkC,EAAE,SAAS,iBAAiB,EACxC,CAAC"}

package/dist/cjs/constants.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AKITABLE_DEFAULT_PAGE_SIZE_OPTIONS = void 0;
+exports.AKITABLE_DEFAULT_PAGE_SIZE_OPTIONS = Object.freeze([20, 50, 100, 250]);

package/dist/cjs/index.d.ts

@@ -1,3 +1,4 @@
 export * from './akitable';
+export * from './constants';
 export * from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC"}

package/dist/cjs/index.js

@@ -15,4 +15,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./akitable"), exports);
+__exportStar(require("./constants"), exports);
 __exportStar(require("./types"), exports);

package/dist/cjs/types.d.ts

@@ -1,3 +1,4 @@
+import type { IButtonProps } from '@akinon/ui-button';
 import type { InputProps } from '@akinon/ui-input';
 import { FormItemProps, TableColumnType } from 'antd';
 import React, { ReactNode } from 'react';
@@ -30,6 +31,63 @@ export interface AkitableActionColumnRenderParams {
     /** Cancels the current edit and exits edit mode without saving. */
     handleCancelEditingItem: () => void;
 }
+/** A value that is either static or derived from the row it belongs to. */
+export type AkitableActionItemValue<T> = T | ((record: AkitableData) => T);
+/**
+ * A single declarative action rendered in the action column. Use it instead of
+ * a custom `render` when you want navigating actions to open in a new tab on
+ * middle click, `Cmd`/`Ctrl` + click or through the right-click context menu.
+ *
+ * Every `@akinon/ui-button` prop (`icon`, `iconSize`, `type`, `danger`,
+ * `tooltip`, `loading`, …) is accepted and forwarded to the rendered button.
+ * The exceptions are the ones this API redefines below, plus `size`, which the
+ * action column fixes to `small`.
+ */
+export interface AkitableActionItem extends Omit<IButtonProps, 'children' | 'disabled' | 'hidden' | 'href' | 'onClick' | 'size'> {
+    /** Stable key for the item. Falls back to the array index. */
+    key?: string;
+    /** Button label. Omit for icon-only buttons. */
+    label?: React.ReactNode;
+    /**
+     * Navigation target. When provided the item renders as a real `<a href>`, so
+     * middle click, `Cmd`/`Ctrl` + click and the right-click context menu open it
+     * in a new tab through native browser behavior.
+     *
+     * A plain left click is intercepted and delegated to this item's `onClick`
+     * if it has one, otherwise to the column's `onNavigate`. When neither is
+     * defined, the click is left alone and the browser follows the `href` as a
+     * regular link.
+     *
+     * No `target` is set on the anchor — that would make a plain left click open
+     * a new tab as well. The value must be a URL the browser can resolve on its
+     * own: a relative URL (`/products/1`, `products/1`, `#/products/1`, `?page=2`)
+     * or an `http`, `https`, `mailto` or `tel` one. Anything else is rejected —
+     * `javascript:` above all, but also a protocol-relative URL (`//evil.com`),
+     * an empty string, and an internal routing key shaped like `catalog:detail`,
+     * which parses as the scheme `catalog:`.
+     *
+     * A rejected value is dropped silently — nothing is logged and the item
+     * renders as a plain button — so check the values a builder can produce
+     * rather than waiting for a console message. An `href` is ignored altogether
+     * for a `startEdit` item.
+     */
+    href?: AkitableActionItemValue<string>;
+    /**
+     * Click handler. For a non-navigating action (delete, toggles, …) this is the
+     * action itself. For an item that also has an `href` it is the per-item
+     * navigation handler and takes precedence over the column's `onNavigate`.
+     */
+    onClick?: (record: AkitableData, event: React.MouseEvent) => void;
+    /**
+     * Puts the row into edit mode. Shorthand for `handleStartEdit`. Requires the
+     * table's `onRowEdit` to be defined, since that is what saves the row.
+     */
+    startEdit?: boolean;
+    /** Whether the button is disabled. */
+    disabled?: AkitableActionItemValue<boolean>;
+    /** When `true` the item is not rendered for that row. */
+    hidden?: AkitableActionItemValue<boolean>;
+}
 export interface AkitableActionColumn {
     /** Column header content. */
     title?: React.ReactNode;
@@ -41,8 +99,35 @@ export interface AkitableActionColumn {
     className?: string;
     /** Text alignment within the column. */
     align?: 'left' | 'right' | 'center';
-    /** Render function receiving row edit state and handler functions. */
-    render: (params: AkitableActionColumnRenderParams) => React.ReactNode;
+    /**
+     * Render function receiving row edit state and handler functions.
+     *
+     * Takes precedence over `items` when both are provided, so existing usages
+     * keep working unchanged. Note that anything rendered here is opaque to
+     * Akitable: to get new-tab support for navigating actions, either use `items`
+     * or render your own real `<a href>` elements.
+     */
+    render?: (params: AkitableActionColumnRenderParams) => React.ReactNode;
+    /**
+     * Declarative action items. Items with an `href` render as real anchors, so
+     * middle click, `Cmd`/`Ctrl` + click and the right-click context menu open
+     * them in a new tab.
+     *
+     * Ignored when `render` is also provided.
+     */
+    items?: AkitableActionItem[];
+    /**
+     * Called on a plain left click of an item that has an `href`, after
+     * `preventDefault()`. Perform the client-side navigation here (e.g.
+     * react-router's `navigate`). Not called for new-tab requests, nor for an
+     * item that defines its own `onClick`.
+     *
+     * The `href` is not necessarily an in-app route: an absolute `http(s)` URL
+     * and the `mailto:` / `tel:` schemes are accepted as well. Handing such a
+     * value straight to a client-side router would break the navigation, so
+     * check for them here before routing.
+     */
+    onNavigate?: (href: string, record: AkitableData, event: React.MouseEvent) => void;
 }
 export interface AkitableProps {
     /**
@@ -247,7 +332,12 @@ export interface AkitableEmptyStateProps {
      */
     description?: ReactNode;
 }
-export type AkitablePageSizes = 20 | 50 | 100 | 250;
+/**
+ * Number of rows per page. The default options are kept as literals so editors
+ * still suggest them, but any number is accepted so apps can supply their own
+ * `pageSizeOptions`.
+ */
+export type AkitablePageSizes = 20 | 50 | 100 | 250 | (number & NonNullable<unknown>);
 export interface AkitablePaginationProps {
     /**
      * Current page number.
@@ -257,6 +347,12 @@ export interface AkitablePaginationProps {
      * Number of rows per page.
      */
     size: AkitablePageSizes;
+    /**
+     * Page sizes offered by the "items per page" dropdown. Defaults to
+     * `AKITABLE_DEFAULT_PAGE_SIZE_OPTIONS` ([20, 50, 100, 250]) when omitted or
+     * empty, so existing tables keep their current options.
+     */
+    pageSizeOptions?: readonly AkitablePageSizes[];
 }
 export interface CustomEditRenderParams {
     /** The data record for the current row. */