@grapecity-software/dsh-spreadjs-editor 0.2.6 → 0.2.7

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Release Notes / 版本记录
 
+## 0.2.7
+
+### 中文
+
+**隔离授权及初始化失败，保留 DSH 侧栏可用性**
+
+- 隔离 SpreadJS / Designer 初始化与文档渲染错误，失败时显示当前页面来源和授权排查提示，避免异常冒泡并破坏 DSH sidebar。
+- 初始化失败后清理局部 DOM 和已创建实例；销毁时先撤销工作簿与 Driver 租约，分别处理恢复、事件解绑及 SDK 销毁异常。
+- 主题切换触发的工作簿刷新异常交由文档错误页处理，避免中断 DSH 的主题事件。
+- 避免正常关闭时重复销毁 Workbook；Designer 已负责销毁它持有的工作簿。
+- 补充桌面版 `dsh-app://app/` 授权说明、配置位置和测试步骤，修正「留空即能试用」的描述。
+
+**范围说明：** 本版保留 SDK 的授权校验，失败时显示当前文件的提示。用户用主机名 `app` 申请的试用授权已让运行时启动，但 Designer 显示仍异常；本版不宣称解决桌面版完整授权和 Designer 兼容问题。无须配套升级 Driver，继续使用 `0.1.4`。
+
+**验证：** 类型检查、260 项测试（含真实 React 调度下的初始化失败与侧栏隔离）、构建、客户端 / 宿主 smoke 和独立离线包安装校验通过。真实桌面许可证及 Designer 显示仍需后续验证。
+
+### English
+
+**Contain licensing and initialization failures within the editor**
+
+- Contain SpreadJS / Designer initialization and document rendering failures within the editor, with page-origin and licensing guidance.
+- Clean up partially initialized instances and DOM; revoke Workbook access and Driver leases before independently guarded recovery and disposal steps.
+- Contain workbook refresh failures during theme changes without interrupting DSH's theme event.
+- Avoid destroying a Workbook twice on normal close: Designer owns its workbook's disposal.
+- Document desktop licensing for `dsh-app://app/`, profile configuration, regression steps and the limits of keyless evaluation.
+
+**Scope:** SDK license validation remains in place; failures display a document-local message. A trial key issued for hostname `app` let the runtime start in a user test, but Designer still displayed incorrectly. This release does not establish complete desktop licensing or Designer compatibility. Companion Driver `0.1.4` remains suitable.
+
+**Validation:** Typecheck, 260 tests (including real React initialization-failure and sidebar-isolation tests), build, client / host smokes and independent offline package installation passed. Real desktop licensing and Designer rendering still need further validation.
+
 ## 0.2.6
 
 ### 中文

package/README.md

@@ -84,7 +84,7 @@ Editor `0.2.6` 声明支持 DSH `>=0.2.1-rc.3 <0.3.0-0`，需要 Node.js ≥22.1
 | DSH 版本 | 状态 | 说明 |
 | --- | --- | --- |
 | `>=0.2.1-rc.3 <0.3.0-0` | 声明兼容范围 | 覆盖 DSH 0.2.x 从 rc.3 起的版本；rc.3/rc.4/rc.5 UI API 包实现对比无差异 |
-| `0.2.1-rc.4` | 桌面环境验收基线 | 类型检查、240 项单测、构建、两个 smoke 与包安装校验通过；用户已确认 dev 环境运行正常 |
+| `0.2.1-rc.4` | 桌面环境验收基线 | 类型检查、260 项单测、构建、两个 smoke 与包安装校验通过；用户已确认 dev 环境运行正常 |
 
 **版本策略：** `engines.dsh` 与 DSH API peers 使用同一有界范围；范围起点取插件所需 API 的最低版本，上界停在下一条 DSH 次版本线。范围内的 patch 和 RC 不要求每次发布插件；开发依赖固定在最近通过验证的 RC。扩展到新的 DSH 次版本前，先比较 API 并跑安装/运行 smoke，再发布更新后的兼容声明。
 
@@ -156,12 +156,12 @@ DSH 在标签页被切走时会卸载文档主体，平台也没有可供拦下
 
 ### 配置
 
-如已获得许可证，在 web profile 的 `cordis.patch.yml` 中添加以下配置：
+如已获得许可证，在当前 profile 的 `cordis.patch.yml` 中添加以下配置（浏览器为 `web`，桌面版为 `desktop`）：
 
 | Key | 默认值 | 说明 |
 | --- | --- | --- |
-| `licenseKey` | `''` | SpreadJS 部署许可证。留空以带水印的试用模式运行。 |
-| `designerLicenseKey` | `''` | 独立的 SpreadJS Designer 部署许可证。留空保持 Designer 试用状态。 |
+| `licenseKey` | `''` | SpreadJS 试用或部署许可证。无 key 的本地试用限官方支持的 HTTP(S) 回环地址。 |
+| `designerLicenseKey` | `''` | 独立的 SpreadJS Designer 试用或部署许可证。 |
 | `maxSaveBytes` | `67108864` | 单次保存允许的最大字节数；超出直接拒绝，不做截断。 |
 | `trustedHosts` | `[]` | 除本机回环地址外，额外允许调用保存接口的地址（局域网部署时使用）。 |
 
@@ -172,7 +172,9 @@ DSH 在标签页被切走时会卸载文档主体，平台也没有可供拦下
     designerLicenseKey: 'YOUR_DESIGNER_KEY'
 ```
 
-修改后重启 DSH 并刷新网页。
+修改后重启 DSH 并重新打开文件。
+
+桌面版 DSH `0.2.1-rc.5` 的页面地址是 `dsh-app://app/`，后端在本机不代表页面是 localhost，因此不能依赖无 key 的本地试用。请先向葡萄城确认适用于该协议的 SpreadJS / Designer 授权。[桌面授权与故障排查](docs/desktop-licensing.md) 记录了地址来源、配置位置和回归步骤。初始化失败时，本插件显示局部错误页，关闭或切换文档仍可继续使用 DSH。
 
 还有一项**不写在这里**：`bridge` 是「电子表格编辑器」设置页在 Web UI 里写的，代表用户选了哪一个桥。它同样属于本插件的配置，但**不该手写进 patch**——设置页会把写入结果如实报出来（写入被拒或失败时页面会说明），而手写的值不会经过这条检查。既没选过、又在 patch 里留空，含义相同：`bridge: ''` 等于「不使用」。本插件自身的设置页取代了 DSH 从这个 schema 自动生成的那一页，所以不会出现两个入口。
 
@@ -180,7 +182,7 @@ DSH 在标签页被切走时会卸载文档主体，平台也没有可供拦下
 
 | 命令 | 验证内容 |
 | --- | --- |
-| `npm run typecheck`、`npm test` | 类型契约，以及 240 个单元测试（保存路由的每条守卫、文件地址解析与地址构造、另存为的目标校验、默认名与失败文案、保存命令重定向的每条分支、编辑器主题桥的每条分支、查看器名称与二进制后缀声明的边界、未保存改动的缓存规则与脏状态跟踪的边界、打开时「用文件还是用缓存」的每个分支、面板状态胶囊的状态与操作矩阵、文档头部动作的发布/订阅/命令路由、按钮的尺寸字号颜色规格、「只在表格文件上出现」的判定与注册顺序，隐藏 Designer「文件」Tab 那条规则的两处身份与作用域，以及桥选择的方向与「写入被拒也要报出来」、桥字段是否真的声明为 volatile、名册自身的契约（重复 id 拒绝、disposer 语义、只在真的变化时通知）、名册与设置页在有无 settings 服务时的接线，以及设置页每一行确实是照 DSH 自己设置页的行规格画的） |
+| `npm run typecheck`、`npm test` | 类型契约，以及 260 个单元测试（保存路由的每条守卫、文件地址解析与地址构造、另存为的目标校验、默认名与失败文案、保存命令重定向的每条分支、编辑器主题桥的每条分支、查看器名称与二进制后缀声明的边界、未保存改动的缓存规则与脏状态跟踪的边界、打开时「用文件还是用缓存」的每个分支、面板状态胶囊的状态与操作矩阵、文档头部动作的发布/订阅/命令路由、按钮的尺寸字号颜色规格、「只在表格文件上出现」的判定与注册顺序，隐藏 Designer「文件」Tab 那条规则的两处身份与作用域，以及桥选择的方向与「写入被拒也要报出来」、桥字段是否真的声明为 volatile、名册自身的契约（重复 id 拒绝、disposer 语义、只在真的变化时通知）、名册与设置页在有无 settings 服务时的接线，以及设置页每一行确实是照 DSH 自己设置页的行规格画的） |
 | `node scripts/smoke-client.mjs` | 构建后的浏览器半结构：loader 包装、内联的 SpreadJS 与样式、外部依赖只有 react |
 | `node scripts/smoke-node.mjs` | 构建后的宿主半：路由注册、许可证配置，以及保存路径的真实写盘、冲突与越界拒绝 |
 | `npm run probe:live` | **对着正在运行的 DSH** 跑一遍真实保存：真实 `ctx.fs` 的解析、落盘、冲突守卫、工作区越界；并核对进程里装的是不是本构建（插件版本与内置 SpreadJS 版本） |
@@ -189,7 +191,7 @@ DSH 在标签页被切走时会卸载文档主体，平台也没有可供拦下
 
 ### 许可
 
-插件代码免费提供，采用 [MIT 许可证](LICENSE)。内置的 SpreadJS 和 Designer 是葡萄城商业产品，未配置许可证时可按其试用条款体验；插件免费不包含这两个产品的商业授权。
+插件代码免费提供，采用 [MIT 许可证](LICENSE)。内置的 SpreadJS 和 Designer 是葡萄城商业产品，无 key 试用限其官方支持的本地环境；桌面版 `dsh-app://app/` 需确认适用授权。插件免费不包含这两个产品的商业授权。
 
 如用于正式部署或 SaaS 服务，请根据使用场景获取适用的 SpreadJS 和 Designer 授权。
 
@@ -265,7 +267,7 @@ Editor `0.2.6` declares support for DSH `>=0.2.1-rc.3 <0.3.0-0` and requires Nod
 | DSH version | Status | Notes |
 | --- | --- | --- |
 | `>=0.2.1-rc.3 <0.3.0-0` | Declared compatibility range | DSH 0.2.x from rc.3; the rc.3/rc.4/rc.5 UI API package implementations compare without differences |
-| `0.2.1-rc.4` | Desktop validation baseline | Typecheck, 240 unit tests, build, both smokes and package installation checks pass; the user confirmed the development environment works |
+| `0.2.1-rc.4` | Desktop validation baseline | Typecheck, 260 unit tests, build, both smokes and package installation checks pass; the user confirmed the development environment works |
 
 **Version policy:** Keep `engines.dsh` and DSH API peers on the same bounded range, starting at the oldest API version the plugin needs and ending before the next DSH minor line. Patch and RC releases inside that range do not require a plugin release each time; development dependencies stay pinned to the latest validated RC. Before extending support to a new DSH minor, compare the APIs and run install/runtime smokes, then publish the updated compatibility declaration.
 
@@ -337,12 +339,12 @@ The harness unmounts a document body when its tab is hidden, and the platform of
 
 ### Configuration
 
-If you have licenses, add the following to the web profile's `cordis.patch.yml`:
+If you have licenses, add the following to the active profile's `cordis.patch.yml` (`web` for the browser, `desktop` for the desktop app):
 
 | Key | Default | Description |
 | --- | --- | --- |
-| `licenseKey` | `''` | SpreadJS deployment key. Empty runs in evaluation mode with a watermark. |
-| `designerLicenseKey` | `''` | Separate SpreadJS Designer deployment key. Empty keeps Designer in evaluation mode. |
+| `licenseKey` | `''` | SpreadJS trial or deployment key. Keyless local evaluation requires a supported HTTP(S) loopback address. |
+| `designerLicenseKey` | `''` | Separate SpreadJS Designer trial or deployment key. |
 | `maxSaveBytes` | `67108864` | Largest payload one save may carry; a bigger one is refused, never truncated. |
 | `trustedHosts` | `[]` | Extra authorities allowed to call the save endpoint, beyond loopback (for LAN deployments). |
 
@@ -353,7 +355,7 @@ If you have licenses, add the following to the web profile's `cordis.patch.yml`:
     designerLicenseKey: 'YOUR_DESIGNER_KEY'
 ```
 
-Restart DSH and refresh the browser after changing the configuration.
+Restart DSH and reopen the workbook after changing the configuration. DSH Desktop uses `dsh-app://app/`, so keyless localhost evaluation must not be assumed to work there. Confirm appropriate licensing with GrapeCity; see [desktop licensing and troubleshooting](docs/desktop-licensing.md).
 
 One more field is deliberately **not** in that table: `bridge` is written by the **Spreadsheet Editor** page in the Web UI and records which bridge the user chose. It is this plugin's configuration all the same, but it should not be written into the patch by hand — the page reports honestly whether a write was accepted, and a hand-written value never goes through that check. Not having chosen yet and leaving it empty in the patch mean the same thing: `bridge: ''` is "None". This plugin's own page replaces the one DSH would otherwise synthesise from the schema, so there is only ever one entry point.
 
@@ -361,7 +363,7 @@ One more field is deliberately **not** in that table: `bridge` is written by the
 
 | Command | What it proves |
 | --- | --- |
-| `npm run typecheck`, `npm test` | The type contract, and 240 unit tests: every save guard, file-address parsing and address building, the Save As target rules, suggested name and failure wording, every branch of the Save-command redirect, every branch of the editor theme bridge, the viewer-name and binary-suffix edge cases, the unsaved-buffer and dirty-tracking rules, every branch of the file-versus-buffer decision at open, the panel state pill's state/action matrix, the document header actions' publication, subscription, command routing, button spec, "spreadsheets only" rule and registration order, both identities plus the scope of the rule that hides the Designer's File tab, the direction of the bridge choice and that a refused write is reported, that the bridge field really is declared volatile, and the registry's own contract (a duplicate id refused, disposer semantics, notifying only on a real change), the wiring of the roster and the settings page with and without a settings service, and that every row of that page is drawn to the harness's own settings-row spec |
+| `npm run typecheck`, `npm test` | The type contract, and 260 unit tests: every save guard, file-address parsing and address building, the Save As target rules, suggested name and failure wording, every branch of the Save-command redirect, every branch of the editor theme bridge, the viewer-name and binary-suffix edge cases, the unsaved-buffer and dirty-tracking rules, every branch of the file-versus-buffer decision at open, the panel state pill's state/action matrix, the document header actions' publication, subscription, command routing, button spec, "spreadsheets only" rule and registration order, both identities plus the scope of the rule that hides the Designer's File tab, the direction of the bridge choice and that a refused write is reported, that the bridge field really is declared volatile, and the registry's own contract (a duplicate id refused, disposer semantics, notifying only on a real change), the wiring of the roster and the settings page with and without a settings service, and that every row of that page is drawn to the harness's own settings-row spec |
 | `node scripts/smoke-client.mjs` | The built browser half's structure: loader wrapper, inlined SpreadJS and styles, react as the only runtime external |
 | `node scripts/smoke-node.mjs` | The built host half: route registration, license config, and the save path writing real bytes plus refusing conflicts and escapes |
 | `npm run probe:live` | A real save against a **running DSH**: the actual `ctx.fs` resolving, writing, refusing a stale base hash, and refusing a workspace escape — plus a check that the process carries *this* build (plugin and bundled SpreadJS versions) |
@@ -370,6 +372,6 @@ One more field is deliberately **not** in that table: `bridge` is written by the
 
 ### License
 
-The plugin code is free under the [MIT license](LICENSE). Bundled SpreadJS and Designer are GrapeCity commercial products available for evaluation under their trial terms without license keys. The free plugin does not include commercial licenses for these products.
+The plugin code is free under the [MIT license](LICENSE). Bundled SpreadJS and Designer are GrapeCity commercial products. Keyless local evaluation is limited to the environments supported by their trial terms; DSH Desktop's `dsh-app://app/` page requires confirming suitable licensing with GrapeCity. See [desktop licensing and troubleshooting](docs/desktop-licensing.md). The free plugin does not include commercial licenses for these products.
 
 For production or SaaS deployments, obtain SpreadJS and Designer licenses appropriate to your use.

package/cordis.patch.yml

@@ -17,8 +17,8 @@
     name: '@grapecity-software/dsh-spreadjs-editor'
     inject: [webServer]
     config:
-      # Optional: your SpreadJS license key. Empty (default) runs the
-      # evaluation watermark build. Keep it out of the patch if you prefer
-      # to configure it per-deployment.
+      # Your SpreadJS and Designer trial/deployment keys. Keyless evaluation
+      # requires a supported HTTP(S) loopback origin; DSH Desktop uses
+      # dsh-app://app/ instead. See docs/desktop-licensing.md.
       licenseKey: ''
       designerLicenseKey: ''

package/docs/desktop-licensing.md

@@ -0,0 +1,75 @@
+# 桌面版授权与故障排查
+
+## 为什么 localhost 能打开，桌面版却提示没有授权
+
+DSH Desktop `0.2.1-rc.5` 将界面加载到 `dsh-app://app/`。SpreadJS 在这个页面中运行，看到的协议是 `dsh-app:`、主机名是 `app`。DSH 的文件和保存请求虽然被转发到本地 HTTP 后端，页面来源并不会因此变为 localhost。
+
+[SpreadJS 官方试用与许可说明](https://demo.grapecity.com.cn/spreadjs/help/docs/started-guide/trial-and-license) 明确指出：没有试用或生产许可证时，只支持本地计算机环境，并以 `http(s)://localhost` 或 `http(s)://127.0.0.1` 为例。Designer 还列举了 `file:` 等本地地址，但文档并未承诺支持 `dsh-app:`。SpreadJS 和 Designer 需要各自的许可证，并须在创建工作簿和 Designer 之前赋值。
+
+因此，不能将「在本机运行」等同于「符合无 key 的本地试用条件」。本插件免费，不包含 SpreadJS 或 Designer 的商业授权。
+
+## 可行的部署方式
+
+向葡萄城提供以下信息，确认适用于桌面环境的试用或部署许可证：
+
+- SpreadJS 与 Designer 版本：均为 `19.2.1`。
+- 运行环境：Electron 中的 DSH Desktop。
+- 页面地址：`dsh-app://app/`，自定义协议 `dsh-app:`，主机名 `app`。
+- 使用方式：公开分发的插件，在用户自己的 DSH 桌面客户端创建和编辑工作簿。
+
+[官方 Licensing FAQ](https://developer.mescius.com/spreadjs/licensing/) 提供 Named Mobile/Desktop Application License，并明确将 Electron 列为适用的分发场景。需要进一步确认许可证是否支持 `dsh-app:`、如何签发，以及插件分发所需的授权条款。仅凭主机名 `app` 不能断定普通域名许可证可用。配置了非空 key 也不代表授权校验已经通过。
+
+插件已经支持 `licenseKey` 和 `designerLicenseKey`，拿到适用许可证后无需更改 SDK 的授权校验。当前无 key 的本地开发可继续使用 HTTP(S) localhost 的浏览器 dev 环境。
+
+2026-11-05，用户用主机名 `app` 申请试用授权后反馈：运行时能够启动，但 Designer 没有正常显示。这说明主机名授权值得继续验证，还不足以确认桌面端完整可用。Editor `0.2.7` 先修复初始化失败的错误隔离，Designer 的授权和显示问题继续单独调查。
+
+## 配置桌面 profile
+
+默认配置文件为 `%USERPROFILE%\.dsh\profiles\desktop\cordis.patch.yml`。自定义 `DSH_HOME` 时，以实际目录为准。在已有配置中更新 `spreadjs-editor`，不要覆盖其他插件的配置：
+
+```yaml
+- id: spreadjs-editor
+  config:
+    licenseKey: 'YOUR_SPREADJS_KEY'
+    designerLicenseKey: 'YOUR_DESIGNER_KEY'
+```
+
+浏览器 profile 使用 `profiles\web\cordis.patch.yml`；两个 profile 的配置互不替代。修改后重启相应 DSH 实例，再打开工作簿。不要将真实 key 提交到公共仓库。
+
+## 初始化失败时的行为
+
+插件会将创建、授权赋值或 React 文档生命周期中的异常隔离在当前编辑器，显示错误页和页面来源。可以关闭当前文件或切换到其他文档。SDK 清理失败也不会阻止后续清理和 Driver 租约撤销。
+
+文件导入失败仍显示该文件的加载错误，不会写回一个尚未加载成功的工作簿。初始化失败页没有自动重试；确认配置后重新打开文件。错误页不代表所有错误均由授权引起，应结合错误详情判断。
+
+这些保护不承诺能够拦截 SDK 在全局计时器、独立 DOM 事件或模块加载 / 求值时抛出的任意异常，也无法终止第三方 SDK 的同步死循环。
+
+## 回归步骤
+
+1. 在没有许可证的桌面 profile 打开一个 `.xlsx` 或 `.ssjson`。若 SDK 拒绝初始化，应显示局部错误页，页面来源为 `dsh-app://app`。
+2. 关闭该文件，打开文本或图片，再切换聊天。Sidebar 应继续响应；失败的工作簿不得被 Driver 获取或保存。
+3. 切换 DSH 明暗主题，确认失败页仍可显示，其他界面正常。
+4. 在 HTTP(S) localhost dev 环境打开同一工作簿，检查加载、编辑、保存和切换标签后的恢复没有退化。
+5. 获得供应商确认的两份许可证后，在 desktop profile 配置并重启，检查编辑器启动、导入、编辑、保存、Driver 操作及主题切换。
+
+自动测试使用可控 SDK 故障覆盖授权赋值、构造器、实例初始化及清理异常；它们不能替代第 5 步的真实许可证验证。
+
+## 调查依据
+
+2026-11-05 只读检查本机安装的 DSH Desktop `0.2.1-rc.5`：`resources/app.asar` 中的 `lib/main.js` 定义 `SCHEME = 'dsh-app'`，构造并导航到 `applicationUrl = 'dsh-app://app/'`，并注册该协议的静态资源及后端转发处理。后续 DSH 版本应以错误页展示的实际页面来源为准。
+
+- [SpreadJS 官方试用与许可说明](https://demo.grapecity.com.cn/spreadjs/help/docs/started-guide/trial-and-license)
+- [SpreadJS 官方技术支持 FAQ](https://demo.grapecity.com.cn/spreadjs/help/docs/started-guide/techsupport)
+- [SpreadJS v19 licensing](https://developer.mescius.com/spreadjs/docs/getstarted/trialSpreadJS)
+- [Designer Component licensing](https://developer.mescius.com/spreadjs/docs/spreadjs-designer-component/getting-started-designer)
+- [Desktop application licensing FAQ](https://developer.mescius.com/spreadjs/licensing/)
+
+## English
+
+DSH Desktop `0.2.1-rc.5` loads its UI at `dsh-app://app/`. Forwarding API requests to a local HTTP backend does not change the page origin. GrapeCity documents keyless local evaluation for HTTP(S) localhost / loopback addresses, so it must not be assumed to cover this custom protocol.
+
+Ask GrapeCity to confirm licensing for SpreadJS and Designer `19.2.1` in Electron, including the `dsh-app:` protocol, hostname `app`, and distribution through a public plugin. Configure the separate `licenseKey` and `designerLicenseKey` values in the active desktop profile as shown above, then restart DSH. Nonempty keys only mean configured, not validated.
+
+On 2026-11-05, the user reported that a trial key issued for hostname `app` let the runtime start, but Designer did not display correctly. Editor `0.2.7` contains initialization failures; it does not resolve or establish full desktop licensing and Designer compatibility.
+
+Initialization and React lifecycle errors are contained within this document. The failure page shows the page origin; users can close or switch documents. Cleanup attempts recovery, cancels Driver leases and disposes SDK resources independently. Automated fault tests do not establish successful desktop licensing: that still requires a real key and desktop regression checks. Browser development over HTTP(S) localhost remains an alternative for keyless local evaluation under the vendor's terms.

package/lib/client.js

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/lib/client.js
-size: 52052364 bytes
-sha256: ec38a36efd2c2ec37f7e448f66c9cd27801581189bd76bd0614c2b9af467f351
+size: 52058214 bytes
+sha256: 29b3bee17aaa80859288a6a26dfbd53871bd06fd554649e0af67560d0bb85389

package/package.json

@@ -1,122 +1,125 @@
-{
-  "name": "@grapecity-software/dsh-spreadjs-editor",
-  "version": "0.2.6",
-  "description": "DSH sidebar SpreadJS editor with binary save, recovery and a selectable bridge for compatible drivers.",
-  "keywords": [
-    "deepseek-harness",
-    "dsh",
-    "webui",
-    "plugin",
-    "spreadjs",
-    "excel"
-  ],
-  "type": "module",
-  "main": "lib/index.js",
-  "exports": {
-    ".": {
-      "default": "./lib/index.js"
-    },
-    "./client": {
-      "default": "./lib/client.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "lib/*.js",
-    "lib/licenses",
-    "cordis.patch.yml",
-    "README.md",
-    "docs/bridge-contract.md",
-    "CHANGELOG.md",
-    "LICENSE",
-    "THIRD_PARTY_NOTICES.md"
-  ],
-  "scripts": {
-    "build": "node scripts/build.mjs && node scripts/copy-notices.mjs",
-    "grapecity:update": "node scripts/update-grapecity.mjs",
-    "prepack": "npm run build",
-    "prepublishOnly": "npm run typecheck && npm test && npm run build && node scripts/smoke-client.mjs && node scripts/smoke-node.mjs && npm run verify:package",
-    "rebuild": "node scripts/build.mjs",
-    "probe:live": "node scripts/probe-live-save.mjs",
-    "release": "node scripts/release.mjs",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit",
-    "verify:package": "node scripts/verify-package.mjs"
-  },
-  "engines": {
-    "node": ">=22.19.0",
-    "dsh": ">=0.2.1-rc.3 <0.3.0-0"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/GrapeCityXA/dsh-plugin-spreadjs-editor.git"
-  },
-  "dsh": {
-    "engines": {
-      "dsh": ">=0.2.1-rc.3 <0.3.0-0"
-    },
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "platform": "web",
-      "inject": [
-        "@deepseek-ai/dsh-client-ui-theme",
-        "@deepseek-ai/dsh-client-ui-slots",
-        "@deepseek-ai/dsh-client-ui-sidebar-right",
-        "@deepseek-ai/dsh-client-ui-sidebar-documentpreview"
-      ]
-    }
-  },
-  "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5",
-    "@deepseek-ai/dsh-client-ui-renderer": ">=0.2.1-rc.3 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-sidebar-documentpreview": ">=0.2.1-rc.3 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-slots": ">=0.2.1-rc.3 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-theme": ">=0.2.1-rc.3 <0.3.0-0",
-    "@deepseek-ai/schemastery": "~3.18.5",
-    "react": "^18.0.0"
-  },
-  "devDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-client-ui-sidebar-documentpreview": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-client-ui-sidebar-right": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-client-ui-theme": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.4",
-    "@deepseek-ai/schemastery": "~3.18.5",
-    "@grapecity-software/spread-excelio": "19.2.1",
-    "@grapecity-software/spread-sheets": "19.2.1",
-    "@grapecity-software/spread-sheets-barcode": "19.2.1",
-    "@grapecity-software/spread-sheets-charts": "19.2.1",
-    "@grapecity-software/spread-sheets-datacharts-addon": "19.2.1",
-    "@grapecity-software/spread-sheets-designer": "19.2.1",
-    "@grapecity-software/spread-sheets-designer-resources-cn": "19.2.1",
-    "@grapecity-software/spread-sheets-formula-panel": "19.2.1",
-    "@grapecity-software/spread-sheets-ganttsheet": "19.2.1",
-    "@grapecity-software/spread-sheets-io": "19.2.1",
-    "@grapecity-software/spread-sheets-languagepackages": "19.2.1",
-    "@grapecity-software/spread-sheets-pdf": "19.2.1",
-    "@grapecity-software/spread-sheets-pivot-addon": "19.2.1",
-    "@grapecity-software/spread-sheets-print": "19.2.1",
-    "@grapecity-software/spread-sheets-reportsheet-addon": "19.2.1",
-    "@grapecity-software/spread-sheets-resources-zh": "19.2.1",
-    "@grapecity-software/spread-sheets-shapes": "19.2.1",
-    "@grapecity-software/spread-sheets-slicers": "19.2.1",
-    "@grapecity-software/spread-sheets-sparklines": "19.2.1",
-    "@grapecity-software/spread-sheets-tablesheet": "19.2.1",
-    "@types/node": "^22.0.0",
-    "@types/react": "^18.3.0",
-    "react": "^18.2.0",
-    "tsdown": "^0.22.0",
-    "typescript": "^5.9.0",
-    "unrun": "^0.3.1",
-    "vitest": "^3.0.0"
-  },
-  "license": "MIT"
-}
+{
+  "name": "@grapecity-software/dsh-spreadjs-editor",
+  "version": "0.2.7",
+  "description": "DSH sidebar SpreadJS editor with binary save, recovery and a selectable bridge for compatible drivers.",
+  "keywords": [
+    "deepseek-harness",
+    "dsh",
+    "webui",
+    "plugin",
+    "spreadjs",
+    "excel"
+  ],
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": {
+      "default": "./lib/index.js"
+    },
+    "./client": {
+      "default": "./lib/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/*.js",
+    "lib/licenses",
+    "cordis.patch.yml",
+    "README.md",
+    "docs/bridge-contract.md",
+    "docs/desktop-licensing.md",
+    "CHANGELOG.md",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md"
+  ],
+  "scripts": {
+    "build": "node scripts/build.mjs && node scripts/copy-notices.mjs",
+    "grapecity:update": "node scripts/update-grapecity.mjs",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm run typecheck && npm test && npm run build && node scripts/smoke-client.mjs && node scripts/smoke-node.mjs && npm run verify:package",
+    "rebuild": "node scripts/build.mjs",
+    "probe:live": "node scripts/probe-live-save.mjs",
+    "release": "node scripts/release.mjs",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "verify:package": "node scripts/verify-package.mjs"
+  },
+  "engines": {
+    "node": ">=22.19.0",
+    "dsh": ">=0.2.1-rc.3 <0.3.0-0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/GrapeCityXA/dsh-plugin-spreadjs-editor.git"
+  },
+  "dsh": {
+    "engines": {
+      "dsh": ">=0.2.1-rc.3 <0.3.0-0"
+    },
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-theme",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-ui-sidebar-right",
+        "@deepseek-ai/dsh-client-ui-sidebar-documentpreview"
+      ]
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "~4.0.5",
+    "@deepseek-ai/dsh-client-ui-renderer": ">=0.2.1-rc.3 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-sidebar-documentpreview": ">=0.2.1-rc.3 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-slots": ">=0.2.1-rc.3 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-theme": ">=0.2.1-rc.3 <0.3.0-0",
+    "@deepseek-ai/schemastery": "~3.18.5",
+    "react": "^18.0.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "~4.0.5",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-client-ui-sidebar-documentpreview": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-client-ui-sidebar-right": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-client-ui-theme": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.4",
+    "@deepseek-ai/schemastery": "~3.18.5",
+    "@grapecity-software/spread-excelio": "19.2.1",
+    "@grapecity-software/spread-sheets": "19.2.1",
+    "@grapecity-software/spread-sheets-barcode": "19.2.1",
+    "@grapecity-software/spread-sheets-charts": "19.2.1",
+    "@grapecity-software/spread-sheets-datacharts-addon": "19.2.1",
+    "@grapecity-software/spread-sheets-designer": "19.2.1",
+    "@grapecity-software/spread-sheets-designer-resources-cn": "19.2.1",
+    "@grapecity-software/spread-sheets-formula-panel": "19.2.1",
+    "@grapecity-software/spread-sheets-ganttsheet": "19.2.1",
+    "@grapecity-software/spread-sheets-io": "19.2.1",
+    "@grapecity-software/spread-sheets-languagepackages": "19.2.1",
+    "@grapecity-software/spread-sheets-pdf": "19.2.1",
+    "@grapecity-software/spread-sheets-pivot-addon": "19.2.1",
+    "@grapecity-software/spread-sheets-print": "19.2.1",
+    "@grapecity-software/spread-sheets-reportsheet-addon": "19.2.1",
+    "@grapecity-software/spread-sheets-resources-zh": "19.2.1",
+    "@grapecity-software/spread-sheets-shapes": "19.2.1",
+    "@grapecity-software/spread-sheets-slicers": "19.2.1",
+    "@grapecity-software/spread-sheets-sparklines": "19.2.1",
+    "@grapecity-software/spread-sheets-tablesheet": "19.2.1",
+    "@types/node": "^22.0.0",
+    "@types/react": "^18.3.0",
+    "@types/react-test-renderer": "18.3.1",
+    "react": "^18.2.0",
+    "react-test-renderer": "18.3.1",
+    "tsdown": "^0.22.0",
+    "typescript": "^5.9.0",
+    "unrun": "^0.3.1",
+    "vitest": "^3.0.0"
+  },
+  "license": "MIT"
+}