@happyvertical/smrt-svelte 0.55.7 → 0.55.9

package/dist/components/overview/format.js

@@ -0,0 +1,45 @@
+/**
+ * Number formatting for overview widgets (#3727). Deterministic for a given
+ * locale so a server render and the client hydrate to the same text. Money is
+ * integer minor units end to end (never a decimal in data).
+ */
+import { currencyMinorDigits } from '../screens/values.js';
+const EN_DASH = '–';
+function safeLocale(locale) {
+    try {
+        return Intl.getCanonicalLocales(locale)[0] ?? 'en';
+    }
+    catch {
+        return 'en';
+    }
+}
+/**
+ * Format a metric value. `money` takes integer minor units, `percent` takes a
+ * fraction (0.25 is 25%). Non-finite input renders as an en dash.
+ */
+export function formatWidgetValue(value, { format = 'integer', currency = 'USD', locale }) {
+    if (typeof value !== 'number' || !Number.isFinite(value))
+        return EN_DASH;
+    const tag = safeLocale(locale);
+    switch (format) {
+        case 'money': {
+            const code = /^[A-Za-z]{3}$/.test(currency)
+                ? currency.toUpperCase()
+                : 'USD';
+            const digits = currencyMinorDigits(code);
+            return new Intl.NumberFormat(tag, {
+                style: 'currency',
+                currency: code,
+            }).format(value / 10 ** digits);
+        }
+        case 'percent':
+            return new Intl.NumberFormat(tag, {
+                style: 'percent',
+                maximumFractionDigits: 1,
+            }).format(value);
+        case 'decimal':
+            return new Intl.NumberFormat(tag, { maximumFractionDigits: 2 }).format(value);
+        default:
+            return new Intl.NumberFormat(tag, { maximumFractionDigits: 0 }).format(value);
+    }
+}

package/dist/components/overview/grid-types.d.ts

@@ -0,0 +1,52 @@
+import type { Component } from 'svelte';
+import type { OverviewController } from './controller.svelte.js';
+import type { OverviewOptions, RegisteredWidget, WidgetComponentProps } from './types.js';
+/** A model the option editor offers for `model` fields. */
+export interface OverviewModelChoice {
+    value: string;
+    label: string;
+}
+/** Props of `OverviewGrid`. */
+export interface OverviewGridProps {
+    /** The overview's state, from `createOverview`. */
+    controller: OverviewController;
+    /**
+     * Resolved widget components (see `resolveWidgetComponents`). A type with
+     * no entry falls back to the registered `component`, else renders as
+     * unavailable.
+     */
+    components?: ReadonlyMap<string, Component<WidgetComponentProps>>;
+    /**
+     * Edit mode. Omit to follow the shell's layout editor (the pencil), so a
+     * grid inside `AppShell` edits with the rest of the page.
+     */
+    editing?: boolean;
+    /** Accessible name of the grid. */
+    label?: string;
+    /** Heading level of widget titles (default 2). */
+    headingLevel?: 2 | 3 | 4;
+    /** Models offered by `model` option fields (else a text box). */
+    models?: readonly OverviewModelChoice[];
+    /** Host renderer for icon names that are not built in. */
+    iconComponent?: Component<{
+        name: string;
+        size?: number;
+    }>;
+}
+/** An option-level problem shown next to its field. */
+export interface OverviewFormIssue {
+    key: string;
+    code: string;
+}
+/** Props of `WidgetOptionsForm`. */
+export interface WidgetOptionsFormProps {
+    /** The widget type being configured. */
+    definition: RegisteredWidget;
+    /** Current options (an existing widget) or starting values. */
+    initial: OverviewOptions;
+    models?: readonly OverviewModelChoice[];
+    /** Saves; returns issues to show, or `null` when it worked. */
+    onsave: (options: OverviewOptions) => OverviewFormIssue[] | null;
+    oncancel: () => void;
+}
+//# sourceMappingURL=grid-types.d.ts.map

package/dist/components/overview/grid-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grid-types.d.ts","sourceRoot":"","sources":["../../../src/components/overview/grid-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,+BAA+B;AAC/B,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,UAAU,EAAE,kBAAkB,CAAC;IAC/B;;;;OAIG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAClE;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,iEAAiE;IACjE,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxC,0DAA0D;IAC1D,aAAa,CAAC,EAAE,SAAS,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5D;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,sBAAsB;IACrC,wCAAwC;IACxC,UAAU,EAAE,gBAAgB,CAAC;IAC7B,+DAA+D;IAC/D,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxC,+DAA+D;IAC/D,MAAM,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,iBAAiB,EAAE,GAAG,IAAI,CAAC;IACjE,QAAQ,EAAE,MAAM,IAAI,CAAC;CACtB"}

package/dist/components/overview/grid-types.js

@@ -0,0 +1 @@
+export {};

package/dist/components/overview/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @happyvertical/smrt-svelte/overview
+ *
+ * Customizable overview surfaces (#3727): a flow grid of registered widgets
+ * with versioned option schemas, edited in place with the shell's layout
+ * editor. The Svelte-free model, registry and server load contract are also
+ * published on `@happyvertical/smrt-svelte/overview/server`.
+ */
+export { createOverview, OverviewController, type OverviewControllerOptions, type OverviewOpResult, type OverviewWidgetEntry, } from './controller.svelte.js';
+export { type FormatWidgetValueOptions, formatWidgetValue, type WidgetValueFormat, } from './format.js';
+export type { OverviewFormIssue, OverviewGridProps, OverviewModelChoice, WidgetOptionsFormProps, } from './grid-types.js';
+export { type BlockNode, type InlineNode, parseMarkdown, safeHref, } from './markdown.js';
+export { default as OverviewGrid } from './OverviewGrid.svelte';
+export { spanFromKey, spanFromPointer } from './resize.js';
+export * from './server.js';
+export { default as WidgetOptionsForm } from './WidgetOptionsForm.svelte';
+export { default as ChartWidget } from './widgets/ChartWidget.svelte';
+export { type CoreWidgetLoaders, createChartWidget, createMetricWidget, createNoteWidget, createRecordListWidget, createShortcutsWidget, registerCoreWidgets, } from './widgets/core.js';
+export { type ChartWidgetData, type MetricWidgetData, type RecordListWidgetData, type ShortcutNavSection, type ShortcutsWidgetData, shortcutsFromNav, } from './widgets/data.js';
+export { default as MetricWidget } from './widgets/MetricWidget.svelte';
+export { default as NoteWidget } from './widgets/NoteWidget.svelte';
+export { default as RecordListWidget } from './widgets/RecordListWidget.svelte';
+export { default as ShortcutsWidget } from './widgets/ShortcutsWidget.svelte';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/overview/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/overview/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,wBAAwB,EAC7B,iBAAiB,EACjB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,SAAS,EACd,KAAK,UAAU,EACf,aAAa,EACb,QAAQ,GACT,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EACL,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/components/overview/index.js

@@ -0,0 +1,22 @@
+/**
+ * @happyvertical/smrt-svelte/overview
+ *
+ * Customizable overview surfaces (#3727): a flow grid of registered widgets
+ * with versioned option schemas, edited in place with the shell's layout
+ * editor. The Svelte-free model, registry and server load contract are also
+ * published on `@happyvertical/smrt-svelte/overview/server`.
+ */
+export { createOverview, OverviewController, } from './controller.svelte.js';
+export { formatWidgetValue, } from './format.js';
+export { parseMarkdown, safeHref, } from './markdown.js';
+export { default as OverviewGrid } from './OverviewGrid.svelte';
+export { spanFromKey, spanFromPointer } from './resize.js';
+export * from './server.js';
+export { default as WidgetOptionsForm } from './WidgetOptionsForm.svelte';
+export { default as ChartWidget } from './widgets/ChartWidget.svelte';
+export { createChartWidget, createMetricWidget, createNoteWidget, createRecordListWidget, createShortcutsWidget, registerCoreWidgets, } from './widgets/core.js';
+export { shortcutsFromNav, } from './widgets/data.js';
+export { default as MetricWidget } from './widgets/MetricWidget.svelte';
+export { default as NoteWidget } from './widgets/NoteWidget.svelte';
+export { default as RecordListWidget } from './widgets/RecordListWidget.svelte';
+export { default as ShortcutsWidget } from './widgets/ShortcutsWidget.svelte';

package/dist/components/overview/load.d.ts

@@ -0,0 +1,30 @@
+import type { WidgetRegistry } from './registry.js';
+import type { LoadedOverview, OverviewDefinition, OverviewDocument } from './types.js';
+export interface LoadOverviewOptions {
+    /** Per-widget time budget in milliseconds (default 8000). */
+    timeoutMs?: number;
+    /** Largest serialized `data` a widget may return (default 262144 chars). */
+    maxDataLength?: number;
+    /**
+     * Receives the real error of a failed load for server logs. The client only
+     * ever gets a generic code.
+     */
+    onError?: (widget: {
+        id: string;
+        type: string;
+    }, error: unknown) => void;
+}
+/** The request-scoped context a page passes to {@link loadOverview}. */
+export interface WidgetLoadInput {
+    signal?: AbortSignal;
+    locale?: string;
+    [capability: string]: unknown;
+}
+/**
+ * Sanitize `document` against the registry and the page's confined set, then
+ * run each widget's `load` in parallel. A widget that fails, times out or
+ * returns non-serializable data renders as an error tile; it never fails the
+ * page. Widgets without a `load` are `ready` with no data.
+ */
+export declare function loadOverview(document: OverviewDocument, definition: OverviewDefinition, registry: WidgetRegistry, ctx: WidgetLoadInput, options?: LoadOverviewOptions): Promise<LoadedOverview>;
+//# sourceMappingURL=load.d.ts.map

package/dist/components/overview/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../../src/components/overview/load.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EACV,cAAc,EAGd,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,mBAAmB;IAClC,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CAC1E;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/B;AA0CD;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,cAAc,EACxB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,cAAc,CAAC,CAkCzB"}

package/dist/components/overview/load.js

@@ -0,0 +1,92 @@
+/**
+ * The server load contract (#3727): run every widget's `load(options, ctx)`
+ * inside a page's server load, with the request's context, and hand the
+ * client a serializable {@link LoadedOverview} to render without any
+ * client-only fetching.
+ *
+ * ```ts
+ * // +page.server.ts
+ * export const load = async (event) => {
+ *   const resolved = resolveOverview(definition, await storedOverride(event), registry);
+ *   return { overview: await loadOverview(resolved.document, definition, registry, ctx(event)) };
+ * };
+ * ```
+ *
+ * Svelte-free. The context carries the user's permissions and tenant
+ * filters; this module never widens it.
+ */
+import { sanitizeOverview } from './model.js';
+const DEFAULT_TIMEOUT_MS = 8000;
+const DEFAULT_MAX_DATA_LENGTH = 262_144;
+class LoadTimeout extends Error {
+}
+function runWithTimeout(run, timeoutMs, parent) {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    parent?.addEventListener('abort', abort, { once: true });
+    if (parent?.aborted)
+        controller.abort();
+    let timer;
+    const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            reject(new LoadTimeout('widget load timed out'));
+        }, timeoutMs);
+    });
+    return Promise.race([
+        Promise.resolve().then(() => run(controller.signal)),
+        timeout,
+    ]).finally(() => {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        parent?.removeEventListener('abort', abort);
+    });
+}
+function serializable(data, maxLength) {
+    if (data === undefined)
+        return true;
+    try {
+        const json = JSON.stringify(data);
+        return json !== undefined && json.length <= maxLength;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Sanitize `document` against the registry and the page's confined set, then
+ * run each widget's `load` in parallel. A widget that fails, times out or
+ * returns non-serializable data renders as an error tile; it never fails the
+ * page. Widgets without a `load` are `ready` with no data.
+ */
+export async function loadOverview(document, definition, registry, ctx, options = {}) {
+    const sanitized = sanitizeOverview(document, { registry, definition });
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxLength = options.maxDataLength ?? DEFAULT_MAX_DATA_LENGTH;
+    const widgets = await Promise.all(sanitized.document.widgets.map(async (widget) => {
+        const def = registry.get(widget.type);
+        const base = { ...widget, status: 'ready' };
+        if (!def?.load)
+            return base;
+        const fail = (code) => ({
+            ...widget,
+            status: 'error',
+            error: { code },
+        });
+        try {
+            const data = await runWithTimeout((signal) => def.load?.(widget.options, {
+                ...ctx,
+                overviewId: definition.id,
+                signal,
+            }), timeoutMs, ctx.signal);
+            if (!serializable(data, maxLength))
+                return fail('invalid_data');
+            return data === undefined ? base : { ...base, data };
+        }
+        catch (error) {
+            options.onError?.({ id: widget.id, type: widget.type }, error);
+            return fail(error instanceof LoadTimeout ? 'timeout' : 'load_failed');
+        }
+    }));
+    return { overviewId: definition.id, widgets, issues: sanitized.issues };
+}

package/dist/components/overview/markdown.d.ts

@@ -0,0 +1,53 @@
+/**
+ * A small, safe Markdown subset for the note widget (#3727).
+ *
+ * It parses to a node tree that components render as Svelte elements. There
+ * is no HTML output and no `{@html}`: raw HTML in the source is plain text,
+ * and links pass {@link safeHref}, so a stored note cannot inject markup or a
+ * `javascript:` URL by construction.
+ *
+ * Supported: `#`-`###` headings, paragraphs, `-`/`*` and `1.` lists,
+ * `>` quotes, fenced code, and inline **bold**, *italic*, `code`, and
+ * [links](https://example.com). Anything else is literal text.
+ */
+export type InlineNode = {
+    type: 'text';
+    text: string;
+} | {
+    type: 'code';
+    text: string;
+} | {
+    type: 'strong' | 'em';
+    children: InlineNode[];
+} | {
+    type: 'link';
+    href: string;
+    children: InlineNode[];
+};
+export type BlockNode = {
+    type: 'heading';
+    level: 1 | 2 | 3;
+    children: InlineNode[];
+} | {
+    type: 'paragraph';
+    children: InlineNode[];
+} | {
+    type: 'quote';
+    children: InlineNode[];
+} | {
+    type: 'list';
+    ordered: boolean;
+    items: InlineNode[][];
+} | {
+    type: 'code';
+    text: string;
+};
+/**
+ * The URL when it is safe to link: `http(s):`, `mailto:`, a same-site path
+ * (`/x`, not `//host`), or a fragment. Everything else (`javascript:`,
+ * `data:`, control characters, whitespace, quotes) is `null`.
+ */
+export declare function safeHref(raw: string): string | null;
+/** Parse a note into blocks. Total; capped in size and nesting. */
+export declare function parseMarkdown(source: string): BlockNode[];
+//# sourceMappingURL=markdown.d.ts.map

package/dist/components/overview/markdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../../src/components/overview/markdown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC;AAE3D,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAMnC;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBnD;AA8FD,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,CAuEzD"}

package/dist/components/overview/markdown.js

@@ -0,0 +1,203 @@
+/**
+ * A small, safe Markdown subset for the note widget (#3727).
+ *
+ * It parses to a node tree that components render as Svelte elements. There
+ * is no HTML output and no `{@html}`: raw HTML in the source is plain text,
+ * and links pass {@link safeHref}, so a stored note cannot inject markup or a
+ * `javascript:` URL by construction.
+ *
+ * Supported: `#`-`###` headings, paragraphs, `-`/`*` and `1.` lists,
+ * `>` quotes, fenced code, and inline **bold**, *italic*, `code`, and
+ * [links](https://example.com). Anything else is literal text.
+ */
+const MAX_BLOCKS = 200;
+const MAX_INLINE_DEPTH = 4;
+const MAX_SOURCE = 20_000;
+/**
+ * The URL when it is safe to link: `http(s):`, `mailto:`, a same-site path
+ * (`/x`, not `//host`), or a fragment. Everything else (`javascript:`,
+ * `data:`, control characters, whitespace, quotes) is `null`.
+ */
+export function safeHref(raw) {
+    const url = raw.trim();
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: rejecting control characters is the point
+    if (!url || url.length > 2048 || /[\u0000-\u001f\u007f\s<>"'`\\]/.test(url)) {
+        return null;
+    }
+    if (/^https?:\/\//i.test(url)) {
+        try {
+            new URL(url);
+            return url;
+        }
+        catch {
+            return null;
+        }
+    }
+    if (/^mailto:[^\s?]+(\?.*)?$/i.test(url))
+        return url;
+    if (url.startsWith('#'))
+        return url;
+    if (url.startsWith('/') && !url.startsWith('//'))
+        return url;
+    return null;
+}
+const isWordChar = (ch) => ch !== undefined && /[A-Za-z0-9]/.test(ch);
+function parseInline(src, depth) {
+    const out = [];
+    let text = '';
+    const flush = () => {
+        if (text)
+            out.push({ type: 'text', text });
+        text = '';
+    };
+    let i = 0;
+    while (i < src.length) {
+        const ch = src[i];
+        if (ch === '\\' &&
+            i + 1 < src.length &&
+            /[\\`*_[\]()#>-]/.test(src[i + 1])) {
+            text += src[i + 1];
+            i += 2;
+            continue;
+        }
+        if (ch === '`') {
+            const end = src.indexOf('`', i + 1);
+            if (end > i + 1) {
+                flush();
+                out.push({ type: 'code', text: src.slice(i + 1, end) });
+                i = end + 1;
+                continue;
+            }
+        }
+        if (depth < MAX_INLINE_DEPTH && src.startsWith('**', i)) {
+            const end = src.indexOf('**', i + 2);
+            if (end > i + 2) {
+                flush();
+                out.push({
+                    type: 'strong',
+                    children: parseInline(src.slice(i + 2, end), depth + 1),
+                });
+                i = end + 2;
+                continue;
+            }
+        }
+        if (depth < MAX_INLINE_DEPTH &&
+            (ch === '*' || ch === '_') &&
+            src[i + 1] !== ' ' &&
+            !(ch === '_' && isWordChar(src[i - 1]))) {
+            const end = src.indexOf(ch, i + 1);
+            if (end > i + 1 &&
+                src[end - 1] !== ' ' &&
+                !(ch === '_' && isWordChar(src[end + 1]))) {
+                flush();
+                out.push({
+                    type: 'em',
+                    children: parseInline(src.slice(i + 1, end), depth + 1),
+                });
+                i = end + 1;
+                continue;
+            }
+        }
+        if (ch === '[' && depth < MAX_INLINE_DEPTH) {
+            const close = src.indexOf('](', i + 1);
+            const endParen = close > 0 ? src.indexOf(')', close + 2) : -1;
+            if (close > 0 && endParen > 0) {
+                const label = src.slice(i + 1, close);
+                const href = safeHref(src.slice(close + 2, endParen));
+                flush();
+                if (href) {
+                    out.push({
+                        type: 'link',
+                        href,
+                        children: parseInline(label, depth + 1),
+                    });
+                }
+                else {
+                    // An unsafe target keeps the label as plain text.
+                    out.push(...parseInline(label, depth + 1));
+                }
+                i = endParen + 1;
+                continue;
+            }
+        }
+        text += ch;
+        i += 1;
+    }
+    flush();
+    return out;
+}
+/** Parse a note into blocks. Total; capped in size and nesting. */
+export function parseMarkdown(source) {
+    const lines = source.slice(0, MAX_SOURCE).replace(/\r\n?/g, '\n').split('\n');
+    const blocks = [];
+    let paragraph = [];
+    let list = null;
+    const closeParagraph = () => {
+        if (paragraph.length) {
+            blocks.push({
+                type: 'paragraph',
+                children: parseInline(paragraph.join(' '), 0),
+            });
+        }
+        paragraph = [];
+    };
+    const closeList = () => {
+        if (list)
+            blocks.push({ type: 'list', ...list });
+        list = null;
+    };
+    for (let i = 0; i < lines.length && blocks.length < MAX_BLOCKS; i += 1) {
+        const line = lines[i];
+        if (/^\s*```/.test(line)) {
+            closeParagraph();
+            closeList();
+            const body = [];
+            i += 1;
+            while (i < lines.length && !/^\s*```/.test(lines[i])) {
+                body.push(lines[i]);
+                i += 1;
+            }
+            blocks.push({ type: 'code', text: body.join('\n') });
+            continue;
+        }
+        if (line.trim() === '') {
+            closeParagraph();
+            closeList();
+            continue;
+        }
+        const heading = /^(#{1,3})\s+(.*\S)\s*$/.exec(line);
+        if (heading) {
+            closeParagraph();
+            closeList();
+            blocks.push({
+                type: 'heading',
+                level: heading[1].length,
+                children: parseInline(heading[2], 0),
+            });
+            continue;
+        }
+        const bullet = /^\s*[-*]\s+(.*\S)\s*$/.exec(line);
+        const numbered = /^\s*\d+[.)]\s+(.*\S)\s*$/.exec(line);
+        if (bullet || numbered) {
+            closeParagraph();
+            const ordered = numbered !== null;
+            if (list && list.ordered !== ordered)
+                closeList();
+            list ??= { ordered, items: [] };
+            list.items.push(parseInline((bullet ?? numbered)?.[1] ?? '', 0));
+            continue;
+        }
+        const quote = /^\s*>\s?(.*)$/.exec(line);
+        if (quote) {
+            closeParagraph();
+            closeList();
+            blocks.push({ type: 'quote', children: parseInline(quote[1], 0) });
+            continue;
+        }
+        closeList();
+        paragraph.push(line.trim());
+    }
+    closeParagraph();
+    closeList();
+    return blocks.slice(0, MAX_BLOCKS);
+}

package/dist/components/overview/model.d.ts

@@ -0,0 +1,100 @@
+/**
+ * The pure overview data model (#3727): parse untrusted JSON, merge a stored
+ * override onto the page defaults, derive the sparse override back from an
+ * edited document, and sanitize a document against the widget registry.
+ *
+ * Everything here is total and never throws on bad input: unknown, invalid
+ * or disallowed widgets are dropped and reported as {@link OverviewIssue}s,
+ * never executed. Svelte-free; runs on the server on save and on load.
+ */
+import type { WidgetRegistry } from './registry.js';
+import { type OverviewDefinition, type OverviewDocument, type OverviewIssue, type OverviewOverride } from './types.js';
+/** Parse untrusted JSON into a document. Malformed widgets are dropped. */
+export declare function parseOverviewDocument(input: unknown): {
+    document: OverviewDocument;
+    issues: OverviewIssue[];
+};
+/**
+ * Parse an untrusted stored override. Never throws; an unknown version, or
+ * anything that is not an object, yields `null` (no override).
+ */
+export declare function parseOverviewOverride(input: unknown): {
+    override: OverviewOverride | null;
+    issues: OverviewIssue[];
+};
+/** True when an override changes nothing. */
+export declare function isEmptyOverride(override: OverviewOverride | null): boolean;
+/**
+ * Merge an override onto a base document. Total: ids the base no longer has
+ * are ignored, added widgets whose id collides with the base are skipped, and
+ * widgets the order does not list keep their slots (listed ids permute among
+ * the slots they occupy), so a default shipped later still appears.
+ */
+export declare function applyOverviewOverride(base: OverviewDocument, override: OverviewOverride | null): OverviewDocument;
+/**
+ * The sparse override that turns `base` into `next` (the inverse of
+ * {@link applyOverviewOverride}); `null` when they are the same. Both
+ * documents should already be sanitized so versions compare like for like.
+ */
+export declare function diffOverview(base: OverviewDocument, next: OverviewDocument): OverviewOverride | null;
+/**
+ * The next unused widget id (`w1`, `w2`, ...) given every reserved id.
+ *
+ * Total for any reserved ids, including hostile stored ones such as
+ * `w9007199254740992`: only numeric suffixes that are safe integers below
+ * `Number.MAX_SAFE_INTEGER` raise the starting point (beyond it `n + 1` stops
+ * changing the number, which would loop forever), and when the high end is
+ * exhausted the scan restarts at `w1`. The reserved set is finite, so a free
+ * id is found within `size + 1` steps of the restart.
+ */
+export declare function nextWidgetId(reserved: Iterable<string>): string;
+export interface SanitizeOptions {
+    registry: WidgetRegistry;
+    definition: Pick<OverviewDefinition, 'id' | 'allowed' | 'models' | 'maxWidgets'>;
+}
+/**
+ * Sanitize a document against the registry and the page's confined set:
+ * drops (and reports) unknown types, types the page does not allow or the
+ * widget refuses (`allowedIn`), future versions, failed migrations, invalid
+ * options, duplicate ids and widgets over the cap; migrates older option
+ * versions; clamps spans to the widget's range. Idempotent. Nothing here
+ * calls a widget's `load`.
+ */
+export declare function sanitizeOverview(document: OverviewDocument, { registry, definition }: SanitizeOptions): {
+    document: OverviewDocument;
+    issues: OverviewIssue[];
+};
+export interface ResolvedOverview {
+    /** The sanitized defaults (the base an override applies to). */
+    base: OverviewDocument;
+    /** The sanitized document to render. */
+    document: OverviewDocument;
+    /** The parsed, well-formed override that was applied (or `null`). */
+    override: OverviewOverride | null;
+    /** Everything dropped or reported along the way. */
+    issues: OverviewIssue[];
+    /** The subset caused by the override (not by the page's own defaults). */
+    overrideIssues: OverviewIssue[];
+}
+/**
+ * Resolve an overview: sanitize the page defaults, parse the stored override
+ * (untrusted JSON), merge, and sanitize the result. This is the one call a
+ * page's server load makes before loading widget data.
+ */
+export declare function resolveOverview(definition: OverviewDefinition, override: unknown, registry: WidgetRegistry): ResolvedOverview;
+export type OverviewOverrideCheck = {
+    ok: true;
+    override: OverviewOverride | null;
+} | {
+    ok: false;
+    issues: OverviewIssue[];
+};
+/**
+ * Validate an override a client wants to save. Strict where load is lenient:
+ * any issue rejects the save. On success the returned override is canonical
+ * (re-derived from the sanitized result), so persist that, not the input.
+ */
+export declare function checkOverviewOverride(definition: OverviewDefinition, input: unknown, registry: WidgetRegistry): OverviewOverrideCheck;
+/** Validate and freeze a page's overview declaration. */
+export declare function defineOverview(definition: OverviewDefinition): OverviewDefinition;
+//# sourceMappingURL=model.d.ts.map

package/dist/components/overview/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/components/overview/model.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAML,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAElB,KAAK,gBAAgB,EAGtB,MAAM,YAAY,CAAC;AAmFpB,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG;IACrD,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB,CAiCA;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG;IACrD,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB,CA2DA;AAED,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAQ1E;AAaD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,gBAAgB,EACtB,QAAQ,EAAE,gBAAgB,GAAG,IAAI,GAChC,gBAAgB,CAsClB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,gBAAgB,GACrB,gBAAgB,GAAG,IAAI,CAiCzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAgB/D;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,IAAI,CACd,kBAAkB,EAClB,IAAI,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,CAC3C,CAAC;CACH;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,eAAe,GACxC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,aAAa,EAAE,CAAA;CAAE,CA6FzD;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,IAAI,EAAE,gBAAgB,CAAC;IACvB,wCAAwC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,qEAAqE;IACrE,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,oDAAoD;IACpD,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,0EAA0E;IAC1E,cAAc,EAAE,aAAa,EAAE,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,cAAc,GACvB,gBAAgB,CAkBlB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,EAAE,CAAA;CAAE,CAAC;AAE3C;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,kBAAkB,EAC9B,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,cAAc,GACvB,qBAAqB,CAMvB;AAED,yDAAyD;AACzD,wBAAgB,cAAc,CAC5B,UAAU,EAAE,kBAAkB,GAC7B,kBAAkB,CAiBpB"}