@portnet/ui 6.0.2 → 6.0.3

package/dist/v2/utils/fileValidation.d.ts

@@ -0,0 +1,116 @@
+/**
+ * fileValidation — is this file allowed to be uploaded?
+ *
+ *   const POLICY = { extensions: ["pdf", "png", "jpg", "jpeg", "doc", "docx"] };
+ *
+ *   const rejection = getFileRejection(file, POLICY);
+ *   if (rejection) toast(rejection.message, "error");
+ *
+ *   <Dropzone accept={toAcceptAttribute(POLICY.extensions)} … />
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHY THIS BELONGS IN THE LIBRARY (capability gap G-52)
+ *
+ * `Dropzone` takes an `accept` attribute and reports `DropzoneRejection`, but it
+ * validates nothing: the browser's `accept` is a FILE-PICKER FILTER, not a
+ * control. It is trivially bypassed — drag and drop ignores it, and so does
+ * "All files" in the picker on most platforms. So the library asked every host
+ * to decide, itself, whether a dropped file is acceptable, and every host wrote:
+ *
+ *   - an extension allow-list (business policy — rightly theirs), AND
+ *   - a deny-list of executables and scripts, AND
+ *   - an extension↔MIME cross-check with its browser tolerances.
+ *
+ * The last two are NOT business policy. They are one security decision, and a
+ * security decision copied into every module is a security decision that WILL
+ * drift: the day a file type has to be added to the deny-list, nobody can say
+ * which of the fifteen GU modules received it. Worse, divergence here is
+ * SILENT — a module missing an entry looks exactly like a module that has it,
+ * until something gets uploaded.
+ *
+ * So the split this file draws: the HOST owns which extensions its business
+ * accepts; the LIBRARY owns the executable deny-list and the MIME cross-check.
+ *
+ * Raised from `autorisation-admis-pour-conforme-fe` (Area 5), which carried a
+ * 21-entry executable deny-list and a six-extension MIME table locally.
+ *
+ * NOT A SUBSTITUTE FOR SERVER-SIDE VALIDATION, and this must stay written down:
+ * everything here runs in a browser the user controls. Its purpose is to give a
+ * CLEAR, IMMEDIATE reason (R-4.1, R-4.4) instead of a server rejection after a
+ * full upload. The back-end remains the authority.
+ * ─────────────────────────────────────────────────────────────────────────────
+ */
+/** Why a file was refused. `reason` is for branching and logs, not for display. */
+export type FileRejectionReason = "executable" | "extension" | "mime";
+export interface FileRejection {
+    reason: FileRejectionReason;
+    /** Ready to render (French, Charter §09.3 — what, and what is accepted). */
+    message: string;
+}
+export interface FileAcceptPolicy {
+    /**
+     * Extensions the HOST's business accepts, without a leading dot,
+     * case-insensitive. This is the only part of the decision that belongs to the
+     * host — an empty list accepts nothing, which is a programming error rather
+     * than a policy, so it is treated as "refuse everything" and not as "allow".
+     */
+    extensions: readonly string[];
+    /** Overrides for the default messages. Keep them in French, verb + object. */
+    labels?: {
+        executable?: string | undefined;
+        type?: string | undefined;
+    } | undefined;
+}
+/**
+ * Human list of the accepted types — "PDF, PNG, JPG, JPEG, DOC, DOCX."
+ *
+ * Order is the host's: the list is read by a person, and a host lists its most
+ * common format first for a reason. Sorting it here would silently reorder
+ * copy the host wrote deliberately.
+ */
+export declare function describeAcceptedTypes(extensions: readonly string[]): string;
+/**
+ * The `accept` attribute for an input or `Dropzone` — ".pdf,.png,.jpg".
+ *
+ * A picker filter, never a control: see the note on server-side validation in
+ * the file header.
+ */
+export declare function toAcceptAttribute(extensions: readonly string[]): string;
+/**
+ * Is this an executable, a script or an installer?
+ *
+ * Exported on its own because a host may want to refuse those EARLIER than its
+ * own policy check — on a bulk drop, for instance, where one dangerous file
+ * should stop the whole batch rather than be listed among type mismatches.
+ *
+ * Permissive parameter type on purpose: callers routinely pass an item pulled
+ * out of a `FileList` without having checked it.
+ */
+export declare function isForbiddenExecutable(file?: File | null | undefined): boolean;
+/** Does the file satisfy `policy` (and the library's own deny-list)? */
+export declare function isAcceptedFile(file: File | null | undefined, policy: FileAcceptPolicy): boolean;
+/**
+ * Why this file cannot be uploaded, or `null` when it can.
+ *
+ * Order of checks is load-bearing:
+ *   1. executable / script / installer — named as such;
+ *   2. extension against the host's allow-list;
+ *   3. reported MIME type against the extension.
+ *
+ * MIME RULES, both deliberate: an EMPTY type is accepted (some browsers report
+ * none, and the extension has just been checked), and `application/octet-stream`
+ * is accepted for the extensions listed in `UNRELIABLE_MIME_EXTENSIONS`. An
+ * extension with no entry in the MIME table is accepted on its extension alone
+ * — the table is a cross-check, not a second allow-list, and a host adding a
+ * format to its policy must not have it refused by a table it cannot see.
+ */
+export declare function getFileRejection(file: File | null | undefined, policy: FileAcceptPolicy): FileRejection | null;
+declare const fileValidationApi: {
+    isForbiddenExecutable: typeof isForbiddenExecutable;
+    isAcceptedFile: typeof isAcceptedFile;
+    getFileRejection: typeof getFileRejection;
+    describeAcceptedTypes: typeof describeAcceptedTypes;
+    toAcceptAttribute: typeof toAcceptAttribute;
+};
+export default fileValidationApi;
+//# sourceMappingURL=fileValidation.d.ts.map

package/dist/v2/utils/fileValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileValidation.d.ts","sourceRoot":"","sources":["../../../src/lib/v2/utils/fileValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAwEH,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,CAAC;AAEtE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,8EAA8E;IAC9E,MAAM,CAAC,EACH;QACE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAChC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC3B,GACD,SAAS,CAAC;CACf;AAeD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,MAAM,CAER;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAG7E;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAC5B,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,EAC7B,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAET;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,EAC7B,MAAM,EAAE,gBAAgB,GACvB,aAAa,GAAG,IAAI,CA8BtB;AAED,QAAA,MAAM,iBAAiB;;;;;;CAMtB,CAAC;AACF,eAAe,iBAAiB,CAAC"}

package/dist/v2/utils/fileValidation.js

@@ -0,0 +1,220 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = void 0;
+exports.describeAcceptedTypes = describeAcceptedTypes;
+exports.getFileRejection = getFileRejection;
+exports.isAcceptedFile = isAcceptedFile;
+exports.isForbiddenExecutable = isForbiddenExecutable;
+exports.toAcceptAttribute = toAcceptAttribute;
+/**
+ * fileValidation — is this file allowed to be uploaded?
+ *
+ *   const POLICY = { extensions: ["pdf", "png", "jpg", "jpeg", "doc", "docx"] };
+ *
+ *   const rejection = getFileRejection(file, POLICY);
+ *   if (rejection) toast(rejection.message, "error");
+ *
+ *   <Dropzone accept={toAcceptAttribute(POLICY.extensions)} … />
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHY THIS BELONGS IN THE LIBRARY (capability gap G-52)
+ *
+ * `Dropzone` takes an `accept` attribute and reports `DropzoneRejection`, but it
+ * validates nothing: the browser's `accept` is a FILE-PICKER FILTER, not a
+ * control. It is trivially bypassed — drag and drop ignores it, and so does
+ * "All files" in the picker on most platforms. So the library asked every host
+ * to decide, itself, whether a dropped file is acceptable, and every host wrote:
+ *
+ *   - an extension allow-list (business policy — rightly theirs), AND
+ *   - a deny-list of executables and scripts, AND
+ *   - an extension↔MIME cross-check with its browser tolerances.
+ *
+ * The last two are NOT business policy. They are one security decision, and a
+ * security decision copied into every module is a security decision that WILL
+ * drift: the day a file type has to be added to the deny-list, nobody can say
+ * which of the fifteen GU modules received it. Worse, divergence here is
+ * SILENT — a module missing an entry looks exactly like a module that has it,
+ * until something gets uploaded.
+ *
+ * So the split this file draws: the HOST owns which extensions its business
+ * accepts; the LIBRARY owns the executable deny-list and the MIME cross-check.
+ *
+ * Raised from `autorisation-admis-pour-conforme-fe` (Area 5), which carried a
+ * 21-entry executable deny-list and a six-extension MIME table locally.
+ *
+ * NOT A SUBSTITUTE FOR SERVER-SIDE VALIDATION, and this must stay written down:
+ * everything here runs in a browser the user controls. Its purpose is to give a
+ * CLEAR, IMMEDIATE reason (R-4.1, R-4.4) instead of a server rejection after a
+ * full upload. The back-end remains the authority.
+ * ─────────────────────────────────────────────────────────────────────────────
+ */
+
+/**
+ * Executables, scripts and installers — refused whatever the host's policy says.
+ *
+ * Checked FIRST, and the order carries meaning: a `.exe` gets a message naming
+ * it as a dangerous file, not a vague "unsupported type", because those are not
+ * the same information for the person at the screen.
+ *
+ * Windows-centric because GU workstations are: PE binaries, the cmd/PowerShell
+ * script families, installer packages, and the HTML-application and
+ * control-panel shims that are executable despite innocuous extensions.
+ */
+const EXECUTABLE_EXTENSIONS = new Set(["exe", "dll", "bat", "cmd", "com", "pif", "scr", "msi", "msu", "msp", "vbs", "vbe", "jse", "wsf", "wsh", "ps1", "psm1", "psc1", "cpl", "msc", "hta"]);
+
+/**
+ * Accepted MIME types per extension.
+ *
+ * DELIBERATELY NOT `getMimeType` from ./fileDownload, though both map
+ * extensions to MIME types. That one answers "what type should I stamp on this
+ * Blob" — ONE canonical value. This one answers "what types may a browser
+ * plausibly report for this extension" — a SET, including variants no canonical
+ * table would contain (`image/jpg` is not a registered type, and browsers send
+ * it anyway). Collapsing the two would reject valid files.
+ */
+const MIME_BY_EXTENSION = Object.freeze({
+  pdf: ["application/pdf"],
+  png: ["image/png"],
+  jpg: ["image/jpeg", "image/jpg"],
+  jpeg: ["image/jpeg", "image/jpg"],
+  gif: ["image/gif"],
+  webp: ["image/webp"],
+  tif: ["image/tiff"],
+  tiff: ["image/tiff"],
+  txt: ["text/plain"],
+  csv: ["text/csv", "application/csv", "text/plain"],
+  doc: ["application/msword"],
+  docx: ["application/vnd.openxmlformats-officedocument.wordprocessingml.document"],
+  xls: ["application/vnd.ms-excel"],
+  xlsx: ["application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"],
+  ppt: ["application/vnd.ms-powerpoint"],
+  pptx: ["application/vnd.openxmlformats-officedocument.presentationml.presentation"]
+});
+
+/**
+ * Extensions whose reported MIME type cannot be trusted, so
+ * `application/octet-stream` is tolerated for them.
+ *
+ * WITHOUT THIS TOLERANCE A LEGITIMATE `.docx` IS REFUSED on some machines —
+ * Office documents are frequently reported as `application/octet-stream`
+ * depending on browser and OS, and the refusal would be INTERMITTENT, which is
+ * the hardest kind to diagnose from a support ticket. The extension has already
+ * been checked against the host's allow-list at that point, so the tolerance
+ * does not widen what is accepted, only what is believed.
+ */
+const UNRELIABLE_MIME_EXTENSIONS = new Set(["doc", "docx", "xls", "xlsx", "ppt", "pptx", "csv"]);
+
+/** Why a file was refused. `reason` is for branching and logs, not for display. */
+
+const DEFAULT_EXECUTABLE_MESSAGE = "Les fichiers exécutables, scripts et installeurs ne sont pas autorisés.";
+
+/** Lowercased extension of a file name, or `""` when there is none. */
+const extensionOf = fileName => {
+  if (!fileName) return "";
+  const parts = fileName.split(".");
+  /* A name with no dot has no extension: "rapport" must not be read as having
+     extension "rapport", which a bare `pop()` would do. */
+  if (parts.length < 2) return "";
+  return (parts[parts.length - 1] ?? "").toLowerCase();
+};
+
+/**
+ * Human list of the accepted types — "PDF, PNG, JPG, JPEG, DOC, DOCX."
+ *
+ * Order is the host's: the list is read by a person, and a host lists its most
+ * common format first for a reason. Sorting it here would silently reorder
+ * copy the host wrote deliberately.
+ */
+function describeAcceptedTypes(extensions) {
+  return `${extensions.map(ext => ext.toUpperCase()).join(", ")}.`;
+}
+
+/**
+ * The `accept` attribute for an input or `Dropzone` — ".pdf,.png,.jpg".
+ *
+ * A picker filter, never a control: see the note on server-side validation in
+ * the file header.
+ */
+function toAcceptAttribute(extensions) {
+  return extensions.map(ext => `.${ext.toLowerCase()}`).join(",");
+}
+
+/**
+ * Is this an executable, a script or an installer?
+ *
+ * Exported on its own because a host may want to refuse those EARLIER than its
+ * own policy check — on a bulk drop, for instance, where one dangerous file
+ * should stop the whole batch rather than be listed among type mismatches.
+ *
+ * Permissive parameter type on purpose: callers routinely pass an item pulled
+ * out of a `FileList` without having checked it.
+ */
+function isForbiddenExecutable(file) {
+  const ext = extensionOf(file?.name);
+  return ext !== "" && EXECUTABLE_EXTENSIONS.has(ext);
+}
+
+/** Does the file satisfy `policy` (and the library's own deny-list)? */
+function isAcceptedFile(file, policy) {
+  return getFileRejection(file, policy) === null;
+}
+
+/**
+ * Why this file cannot be uploaded, or `null` when it can.
+ *
+ * Order of checks is load-bearing:
+ *   1. executable / script / installer — named as such;
+ *   2. extension against the host's allow-list;
+ *   3. reported MIME type against the extension.
+ *
+ * MIME RULES, both deliberate: an EMPTY type is accepted (some browsers report
+ * none, and the extension has just been checked), and `application/octet-stream`
+ * is accepted for the extensions listed in `UNRELIABLE_MIME_EXTENSIONS`. An
+ * extension with no entry in the MIME table is accepted on its extension alone
+ * — the table is a cross-check, not a second allow-list, and a host adding a
+ * format to its policy must not have it refused by a table it cannot see.
+ */
+function getFileRejection(file, policy) {
+  const executableMessage = policy.labels?.executable ?? DEFAULT_EXECUTABLE_MESSAGE;
+  const typeMessage = policy.labels?.type ?? `Types autorisés : ${describeAcceptedTypes(policy.extensions)}`;
+  if (isForbiddenExecutable(file)) {
+    return {
+      reason: "executable",
+      message: executableMessage
+    };
+  }
+  const ext = extensionOf(file?.name);
+  if (ext === "") return {
+    reason: "extension",
+    message: typeMessage
+  };
+  const accepted = policy.extensions.some(allowed => allowed.toLowerCase() === ext);
+  if (!accepted) return {
+    reason: "extension",
+    message: typeMessage
+  };
+  const mime = (file?.type ?? "").trim().toLowerCase();
+  if (mime === "") return null;
+  if (mime === "application/octet-stream" && UNRELIABLE_MIME_EXTENSIONS.has(ext)) {
+    return null;
+  }
+  const expected = MIME_BY_EXTENSION[ext];
+  if (expected === undefined) return null;
+  if (expected.includes(mime)) return null;
+  return {
+    reason: "mime",
+    message: typeMessage
+  };
+}
+const fileValidationApi = {
+  isForbiddenExecutable,
+  isAcceptedFile,
+  getFileRejection,
+  describeAcceptedTypes,
+  toAcceptAttribute
+};
+var _default = exports.default = fileValidationApi;
+//# sourceMappingURL=fileValidation.js.map

package/dist/v2/utils/fileValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileValidation.js","names":["EXECUTABLE_EXTENSIONS","Set","MIME_BY_EXTENSION","Object","freeze","pdf","png","jpg","jpeg","gif","webp","tif","tiff","txt","csv","doc","docx","xls","xlsx","ppt","pptx","UNRELIABLE_MIME_EXTENSIONS","DEFAULT_EXECUTABLE_MESSAGE","extensionOf","fileName","parts","split","length","toLowerCase","describeAcceptedTypes","extensions","map","ext","toUpperCase","join","toAcceptAttribute","isForbiddenExecutable","file","name","has","isAcceptedFile","policy","getFileRejection","executableMessage","labels","executable","typeMessage","type","reason","message","accepted","some","allowed","mime","trim","expected","undefined","includes","fileValidationApi","_default","exports","default"],"sources":["../../../src/lib/v2/utils/fileValidation.ts"],"sourcesContent":["/**\r\n * fileValidation — is this file allowed to be uploaded?\r\n *\r\n *   const POLICY = { extensions: [\"pdf\", \"png\", \"jpg\", \"jpeg\", \"doc\", \"docx\"] };\r\n *\r\n *   const rejection = getFileRejection(file, POLICY);\r\n *   if (rejection) toast(rejection.message, \"error\");\r\n *\r\n *   <Dropzone accept={toAcceptAttribute(POLICY.extensions)} … />\r\n *\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n * WHY THIS BELONGS IN THE LIBRARY (capability gap G-52)\r\n *\r\n * `Dropzone` takes an `accept` attribute and reports `DropzoneRejection`, but it\r\n * validates nothing: the browser's `accept` is a FILE-PICKER FILTER, not a\r\n * control. It is trivially bypassed — drag and drop ignores it, and so does\r\n * \"All files\" in the picker on most platforms. So the library asked every host\r\n * to decide, itself, whether a dropped file is acceptable, and every host wrote:\r\n *\r\n *   - an extension allow-list (business policy — rightly theirs), AND\r\n *   - a deny-list of executables and scripts, AND\r\n *   - an extension↔MIME cross-check with its browser tolerances.\r\n *\r\n * The last two are NOT business policy. They are one security decision, and a\r\n * security decision copied into every module is a security decision that WILL\r\n * drift: the day a file type has to be added to the deny-list, nobody can say\r\n * which of the fifteen GU modules received it. Worse, divergence here is\r\n * SILENT — a module missing an entry looks exactly like a module that has it,\r\n * until something gets uploaded.\r\n *\r\n * So the split this file draws: the HOST owns which extensions its business\r\n * accepts; the LIBRARY owns the executable deny-list and the MIME cross-check.\r\n *\r\n * Raised from `autorisation-admis-pour-conforme-fe` (Area 5), which carried a\r\n * 21-entry executable deny-list and a six-extension MIME table locally.\r\n *\r\n * NOT A SUBSTITUTE FOR SERVER-SIDE VALIDATION, and this must stay written down:\r\n * everything here runs in a browser the user controls. Its purpose is to give a\r\n * CLEAR, IMMEDIATE reason (R-4.1, R-4.4) instead of a server rejection after a\r\n * full upload. The back-end remains the authority.\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n */\r\n\r\n/**\r\n * Executables, scripts and installers — refused whatever the host's policy says.\r\n *\r\n * Checked FIRST, and the order carries meaning: a `.exe` gets a message naming\r\n * it as a dangerous file, not a vague \"unsupported type\", because those are not\r\n * the same information for the person at the screen.\r\n *\r\n * Windows-centric because GU workstations are: PE binaries, the cmd/PowerShell\r\n * script families, installer packages, and the HTML-application and\r\n * control-panel shims that are executable despite innocuous extensions.\r\n */\r\nconst EXECUTABLE_EXTENSIONS: ReadonlySet<string> = new Set([\r\n  \"exe\", \"dll\", \"bat\", \"cmd\", \"com\", \"pif\", \"scr\",\r\n  \"msi\", \"msu\", \"msp\",\r\n  \"vbs\", \"vbe\", \"jse\", \"wsf\", \"wsh\",\r\n  \"ps1\", \"psm1\", \"psc1\",\r\n  \"cpl\", \"msc\", \"hta\",\r\n]);\r\n\r\n/**\r\n * Accepted MIME types per extension.\r\n *\r\n * DELIBERATELY NOT `getMimeType` from ./fileDownload, though both map\r\n * extensions to MIME types. That one answers \"what type should I stamp on this\r\n * Blob\" — ONE canonical value. This one answers \"what types may a browser\r\n * plausibly report for this extension\" — a SET, including variants no canonical\r\n * table would contain (`image/jpg` is not a registered type, and browsers send\r\n * it anyway). Collapsing the two would reject valid files.\r\n */\r\nconst MIME_BY_EXTENSION: Readonly<Record<string, readonly string[]>> =\r\n  Object.freeze({\r\n    pdf: [\"application/pdf\"],\r\n    png: [\"image/png\"],\r\n    jpg: [\"image/jpeg\", \"image/jpg\"],\r\n    jpeg: [\"image/jpeg\", \"image/jpg\"],\r\n    gif: [\"image/gif\"],\r\n    webp: [\"image/webp\"],\r\n    tif: [\"image/tiff\"],\r\n    tiff: [\"image/tiff\"],\r\n    txt: [\"text/plain\"],\r\n    csv: [\"text/csv\", \"application/csv\", \"text/plain\"],\r\n    doc: [\"application/msword\"],\r\n    docx: [\r\n      \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\r\n    ],\r\n    xls: [\"application/vnd.ms-excel\"],\r\n    xlsx: [\r\n      \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\r\n    ],\r\n    ppt: [\"application/vnd.ms-powerpoint\"],\r\n    pptx: [\r\n      \"application/vnd.openxmlformats-officedocument.presentationml.presentation\",\r\n    ],\r\n  });\r\n\r\n/**\r\n * Extensions whose reported MIME type cannot be trusted, so\r\n * `application/octet-stream` is tolerated for them.\r\n *\r\n * WITHOUT THIS TOLERANCE A LEGITIMATE `.docx` IS REFUSED on some machines —\r\n * Office documents are frequently reported as `application/octet-stream`\r\n * depending on browser and OS, and the refusal would be INTERMITTENT, which is\r\n * the hardest kind to diagnose from a support ticket. The extension has already\r\n * been checked against the host's allow-list at that point, so the tolerance\r\n * does not widen what is accepted, only what is believed.\r\n */\r\nconst UNRELIABLE_MIME_EXTENSIONS: ReadonlySet<string> = new Set([\r\n  \"doc\", \"docx\", \"xls\", \"xlsx\", \"ppt\", \"pptx\", \"csv\",\r\n]);\r\n\r\n/** Why a file was refused. `reason` is for branching and logs, not for display. */\r\nexport type FileRejectionReason = \"executable\" | \"extension\" | \"mime\";\r\n\r\nexport interface FileRejection {\r\n  reason: FileRejectionReason;\r\n  /** Ready to render (French, Charter §09.3 — what, and what is accepted). */\r\n  message: string;\r\n}\r\n\r\nexport interface FileAcceptPolicy {\r\n  /**\r\n   * Extensions the HOST's business accepts, without a leading dot,\r\n   * case-insensitive. This is the only part of the decision that belongs to the\r\n   * host — an empty list accepts nothing, which is a programming error rather\r\n   * than a policy, so it is treated as \"refuse everything\" and not as \"allow\".\r\n   */\r\n  extensions: readonly string[];\r\n  /** Overrides for the default messages. Keep them in French, verb + object. */\r\n  labels?:\r\n    | {\r\n        executable?: string | undefined;\r\n        type?: string | undefined;\r\n      }\r\n    | undefined;\r\n}\r\n\r\nconst DEFAULT_EXECUTABLE_MESSAGE =\r\n  \"Les fichiers exécutables, scripts et installeurs ne sont pas autorisés.\";\r\n\r\n/** Lowercased extension of a file name, or `\"\"` when there is none. */\r\nconst extensionOf = (fileName: string | undefined): string => {\r\n  if (!fileName) return \"\";\r\n  const parts = fileName.split(\".\");\r\n  /* A name with no dot has no extension: \"rapport\" must not be read as having\r\n     extension \"rapport\", which a bare `pop()` would do. */\r\n  if (parts.length < 2) return \"\";\r\n  return (parts[parts.length - 1] ?? \"\").toLowerCase();\r\n};\r\n\r\n/**\r\n * Human list of the accepted types — \"PDF, PNG, JPG, JPEG, DOC, DOCX.\"\r\n *\r\n * Order is the host's: the list is read by a person, and a host lists its most\r\n * common format first for a reason. Sorting it here would silently reorder\r\n * copy the host wrote deliberately.\r\n */\r\nexport function describeAcceptedTypes(\r\n  extensions: readonly string[]\r\n): string {\r\n  return `${extensions.map((ext) => ext.toUpperCase()).join(\", \")}.`;\r\n}\r\n\r\n/**\r\n * The `accept` attribute for an input or `Dropzone` — \".pdf,.png,.jpg\".\r\n *\r\n * A picker filter, never a control: see the note on server-side validation in\r\n * the file header.\r\n */\r\nexport function toAcceptAttribute(extensions: readonly string[]): string {\r\n  return extensions.map((ext) => `.${ext.toLowerCase()}`).join(\",\");\r\n}\r\n\r\n/**\r\n * Is this an executable, a script or an installer?\r\n *\r\n * Exported on its own because a host may want to refuse those EARLIER than its\r\n * own policy check — on a bulk drop, for instance, where one dangerous file\r\n * should stop the whole batch rather than be listed among type mismatches.\r\n *\r\n * Permissive parameter type on purpose: callers routinely pass an item pulled\r\n * out of a `FileList` without having checked it.\r\n */\r\nexport function isForbiddenExecutable(file?: File | null | undefined): boolean {\r\n  const ext = extensionOf(file?.name);\r\n  return ext !== \"\" && EXECUTABLE_EXTENSIONS.has(ext);\r\n}\r\n\r\n/** Does the file satisfy `policy` (and the library's own deny-list)? */\r\nexport function isAcceptedFile(\r\n  file: File | null | undefined,\r\n  policy: FileAcceptPolicy\r\n): boolean {\r\n  return getFileRejection(file, policy) === null;\r\n}\r\n\r\n/**\r\n * Why this file cannot be uploaded, or `null` when it can.\r\n *\r\n * Order of checks is load-bearing:\r\n *   1. executable / script / installer — named as such;\r\n *   2. extension against the host's allow-list;\r\n *   3. reported MIME type against the extension.\r\n *\r\n * MIME RULES, both deliberate: an EMPTY type is accepted (some browsers report\r\n * none, and the extension has just been checked), and `application/octet-stream`\r\n * is accepted for the extensions listed in `UNRELIABLE_MIME_EXTENSIONS`. An\r\n * extension with no entry in the MIME table is accepted on its extension alone\r\n * — the table is a cross-check, not a second allow-list, and a host adding a\r\n * format to its policy must not have it refused by a table it cannot see.\r\n */\r\nexport function getFileRejection(\r\n  file: File | null | undefined,\r\n  policy: FileAcceptPolicy\r\n): FileRejection | null {\r\n  const executableMessage =\r\n    policy.labels?.executable ?? DEFAULT_EXECUTABLE_MESSAGE;\r\n  const typeMessage =\r\n    policy.labels?.type ??\r\n    `Types autorisés : ${describeAcceptedTypes(policy.extensions)}`;\r\n\r\n  if (isForbiddenExecutable(file)) {\r\n    return { reason: \"executable\", message: executableMessage };\r\n  }\r\n\r\n  const ext = extensionOf(file?.name);\r\n  if (ext === \"\") return { reason: \"extension\", message: typeMessage };\r\n\r\n  const accepted = policy.extensions.some(\r\n    (allowed) => allowed.toLowerCase() === ext\r\n  );\r\n  if (!accepted) return { reason: \"extension\", message: typeMessage };\r\n\r\n  const mime = (file?.type ?? \"\").trim().toLowerCase();\r\n  if (mime === \"\") return null;\r\n  if (mime === \"application/octet-stream\" && UNRELIABLE_MIME_EXTENSIONS.has(ext)) {\r\n    return null;\r\n  }\r\n\r\n  const expected = MIME_BY_EXTENSION[ext];\r\n  if (expected === undefined) return null;\r\n  if (expected.includes(mime)) return null;\r\n\r\n  return { reason: \"mime\", message: typeMessage };\r\n}\r\n\r\nconst fileValidationApi = {\r\n  isForbiddenExecutable,\r\n  isAcceptedFile,\r\n  getFileRejection,\r\n  describeAcceptedTypes,\r\n  toAcceptAttribute,\r\n};\r\nexport default fileValidationApi;\r\n"],"mappings":";;;;;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMA,qBAA0C,GAAG,IAAIC,GAAG,CAAC,CACzD,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAC/C,KAAK,EAAE,KAAK,EAAE,KAAK,EACnB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EACjC,KAAK,EAAE,MAAM,EAAE,MAAM,EACrB,KAAK,EAAE,KAAK,EAAE,KAAK,CACpB,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,iBAA8D,GAClEC,MAAM,CAACC,MAAM,CAAC;EACZC,GAAG,EAAE,CAAC,iBAAiB,CAAC;EACxBC,GAAG,EAAE,CAAC,WAAW,CAAC;EAClBC,GAAG,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;EAChCC,IAAI,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;EACjCC,GAAG,EAAE,CAAC,WAAW,CAAC;EAClBC,IAAI,EAAE,CAAC,YAAY,CAAC;EACpBC,GAAG,EAAE,CAAC,YAAY,CAAC;EACnBC,IAAI,EAAE,CAAC,YAAY,CAAC;EACpBC,GAAG,EAAE,CAAC,YAAY,CAAC;EACnBC,GAAG,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,YAAY,CAAC;EAClDC,GAAG,EAAE,CAAC,oBAAoB,CAAC;EAC3BC,IAAI,EAAE,CACJ,yEAAyE,CAC1E;EACDC,GAAG,EAAE,CAAC,0BAA0B,CAAC;EACjCC,IAAI,EAAE,CACJ,mEAAmE,CACpE;EACDC,GAAG,EAAE,CAAC,+BAA+B,CAAC;EACtCC,IAAI,EAAE,CACJ,2EAA2E;AAE/E,CAAC,CAAC;;AAEJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,0BAA+C,GAAG,IAAIpB,GAAG,CAAC,CAC9D,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CACnD,CAAC;;AAEF;;AA0BA,MAAMqB,0BAA0B,GAC9B,yEAAyE;;AAE3E;AACA,MAAMC,WAAW,GAAIC,QAA4B,IAAa;EAC5D,IAAI,CAACA,QAAQ,EAAE,OAAO,EAAE;EACxB,MAAMC,KAAK,GAAGD,QAAQ,CAACE,KAAK,CAAC,GAAG,CAAC;EACjC;AACF;EACE,IAAID,KAAK,CAACE,MAAM,GAAG,CAAC,EAAE,OAAO,EAAE;EAC/B,OAAO,CAACF,KAAK,CAACA,KAAK,CAACE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,EAAEC,WAAW,CAAC,CAAC;AACtD,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,qBAAqBA,CACnCC,UAA6B,EACrB;EACR,OAAO,GAAGA,UAAU,CAACC,GAAG,CAAEC,GAAG,IAAKA,GAAG,CAACC,WAAW,CAAC,CAAC,CAAC,CAACC,IAAI,CAAC,IAAI,CAAC,GAAG;AACpE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,iBAAiBA,CAACL,UAA6B,EAAU;EACvE,OAAOA,UAAU,CAACC,GAAG,CAAEC,GAAG,IAAK,IAAIA,GAAG,CAACJ,WAAW,CAAC,CAAC,EAAE,CAAC,CAACM,IAAI,CAAC,GAAG,CAAC;AACnE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,qBAAqBA,CAACC,IAA8B,EAAW;EAC7E,MAAML,GAAG,GAAGT,WAAW,CAACc,IAAI,EAAEC,IAAI,CAAC;EACnC,OAAON,GAAG,KAAK,EAAE,IAAIhC,qBAAqB,CAACuC,GAAG,CAACP,GAAG,CAAC;AACrD;;AAEA;AACO,SAASQ,cAAcA,CAC5BH,IAA6B,EAC7BI,MAAwB,EACf;EACT,OAAOC,gBAAgB,CAACL,IAAI,EAAEI,MAAM,CAAC,KAAK,IAAI;AAChD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,gBAAgBA,CAC9BL,IAA6B,EAC7BI,MAAwB,EACF;EACtB,MAAME,iBAAiB,GACrBF,MAAM,CAACG,MAAM,EAAEC,UAAU,IAAIvB,0BAA0B;EACzD,MAAMwB,WAAW,GACfL,MAAM,CAACG,MAAM,EAAEG,IAAI,IACnB,qBAAqBlB,qBAAqB,CAACY,MAAM,CAACX,UAAU,CAAC,EAAE;EAEjE,IAAIM,qBAAqB,CAACC,IAAI,CAAC,EAAE;IAC/B,OAAO;MAAEW,MAAM,EAAE,YAAY;MAAEC,OAAO,EAAEN;IAAkB,CAAC;EAC7D;EAEA,MAAMX,GAAG,GAAGT,WAAW,CAACc,IAAI,EAAEC,IAAI,CAAC;EACnC,IAAIN,GAAG,KAAK,EAAE,EAAE,OAAO;IAAEgB,MAAM,EAAE,WAAW;IAAEC,OAAO,EAAEH;EAAY,CAAC;EAEpE,MAAMI,QAAQ,GAAGT,MAAM,CAACX,UAAU,CAACqB,IAAI,CACpCC,OAAO,IAAKA,OAAO,CAACxB,WAAW,CAAC,CAAC,KAAKI,GACzC,CAAC;EACD,IAAI,CAACkB,QAAQ,EAAE,OAAO;IAAEF,MAAM,EAAE,WAAW;IAAEC,OAAO,EAAEH;EAAY,CAAC;EAEnE,MAAMO,IAAI,GAAG,CAAChB,IAAI,EAAEU,IAAI,IAAI,EAAE,EAAEO,IAAI,CAAC,CAAC,CAAC1B,WAAW,CAAC,CAAC;EACpD,IAAIyB,IAAI,KAAK,EAAE,EAAE,OAAO,IAAI;EAC5B,IAAIA,IAAI,KAAK,0BAA0B,IAAIhC,0BAA0B,CAACkB,GAAG,CAACP,GAAG,CAAC,EAAE;IAC9E,OAAO,IAAI;EACb;EAEA,MAAMuB,QAAQ,GAAGrD,iBAAiB,CAAC8B,GAAG,CAAC;EACvC,IAAIuB,QAAQ,KAAKC,SAAS,EAAE,OAAO,IAAI;EACvC,IAAID,QAAQ,CAACE,QAAQ,CAACJ,IAAI,CAAC,EAAE,OAAO,IAAI;EAExC,OAAO;IAAEL,MAAM,EAAE,MAAM;IAAEC,OAAO,EAAEH;EAAY,CAAC;AACjD;AAEA,MAAMY,iBAAiB,GAAG;EACxBtB,qBAAqB;EACrBI,cAAc;EACdE,gBAAgB;EAChBb,qBAAqB;EACrBM;AACF,CAAC;AAAC,IAAAwB,QAAA,GAAAC,OAAA,CAAAC,OAAA,GACaH,iBAAiB","ignoreList":[]}

package/dist/v2/utils/fmtDate.d.ts

@@ -0,0 +1,103 @@
+/**
+ * fmtDate / fmtDateTime — render a date for DISPLAY.
+ *
+ *   fmtDate("2026-03-05T14:30:00Z")        → "05/03/2026"
+ *   fmtDateTime("2026-03-05T14:30:00Z")    → "05/03/2026 15:30"   (local time)
+ *   fmtDate(undefined)                     → "—"
+ *   fmtDate("pas une date")                → "—"
+ *   fmtDate(d, { absent: "" })             → "" when there is no date
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHY THIS BELONGS IN THE LIBRARY (capability gap G-51)
+ *
+ * The library already owns the money side of the same job — `fmtMoney`, same
+ * folder, same "—" for an absent value, for the same reason: a table cell must
+ * never read "NaN". It owned nothing for dates, which every GU screen renders
+ * far more often than amounts. So every module wrote its own, and the copies
+ * shared one defect:
+ *
+ *     const fullformatDate = (stringDate) => {
+ *       const date = new Date(stringDate);
+ *       const day = formatIntoTwoDigits(date.getDate());
+ *       …
+ *
+ * `new Date(undefined)` is an INVALID DATE whose every accessor returns `NaN`,
+ * so the helper rendered, literally:
+ *
+ *     NaN/NaN/NaN NaN:NaN
+ *
+ * on any optional field — an update date, a visit date, a closure date — which
+ * is most of them. In `autorisation-admis-pour-conforme-fe` the guard had been
+ * added at CALL SITES one lot after another (lots 4 to 7) before being pulled
+ * into the module's own helper: treating the symptom eight times, because the
+ * one place where it cannot be forgotten is the formatter itself. That is the
+ * argument for owning it here rather than in each module.
+ *
+ * Two smaller things the same copies carried, fixed here by construction: a
+ * two-digit helper that returned `"08"` (string) or `12` (number) depending on
+ * the value, and an absent date rendered as an EMPTY string — indistinguishable
+ * from a cell that failed to render, where "—" says "we looked, there is
+ * nothing".
+ *
+ * WHY NO `moment`, THOUGH THE PACKAGE ALREADY DEPENDS ON IT
+ *
+ * `moment` is here for the pickers, and specifically for STRICT parsing against
+ * an explicit format (`patterns/_pickerSerialisation`) — reading
+ * `"31-12-2026"` back without guessing. That is the right use of it.
+ *
+ * Rendering an already-parsed instant as two numbers and a year is not. This
+ * folder is dependency-free on purpose (see `fileDownload`), and
+ * `moment(someString)` with no format falls back to `new Date` WHILE EMITTING A
+ * CONSOLE DEPRECATION WARNING — noise a display helper called once per table
+ * cell must not produce. Native padding has neither cost.
+ *
+ * TIME ZONE, STATED RATHER THAN IMPLIED. The output is in the VIEWER'S local
+ * zone (`getDate`, `getHours`…), which is what the module helpers this replaces
+ * did, and what a user expects of "date de dépôt". An instant sent as
+ * `…T23:30:00Z` therefore reads as the next day in Casablanca. If a screen ever
+ * needs the server's calendar day regardless of the reader, that is a DIFFERENT
+ * function and must be argued for on its own — silently switching this one to
+ * UTC would move dates by a day across the whole platform.
+ * ─────────────────────────────────────────────────────────────────────────────
+ */
+/** What a formatter accepts: an API string, an epoch, or a `Date`. */
+export type FmtDateInput = string | number | Date | null | undefined;
+export type FmtDateOptions = {
+    /**
+     * Rendered when there is no usable date. Defaults to the em dash used as the
+     * platform's absence mark in tables and detail sheets.
+     *
+     * Pass `""` where an empty cell is the deliberate choice — a DataGrid column
+     * that must stay visually quiet, or a value on its way into a search payload,
+     * since an em dash travelling to a back-end as a criterion is worse than
+     * nothing. Both cases exist in the module this was raised from.
+     *
+     * NO `separator` OPTION, and that is a correction rather than an omission.
+     * The first draft had one, justified by a module helper documented as feeding
+     * search criteria "d'où le séparateur paramétrable". A grep of the module
+     * showed that helper has ZERO importers: the justification was dead code, so
+     * the knob was speculative surface on a certified API (§2.8 — minimum API
+     * surface). The emitted format is the charter's `DD/MM/YYYY`; a host needing
+     * another separator should say why here.
+     */
+    absent?: string | undefined;
+};
+/**
+ * Day, month and year — `DD/MM/YYYY`.
+ *
+ * @param value - API string, epoch, or `Date`. Absent or unparseable → `absent`.
+ */
+export declare function fmtDate(value: FmtDateInput, opts?: FmtDateOptions): string;
+/**
+ * Day, month, year, then hours and minutes — `DD/MM/YYYY HH:mm`.
+ *
+ * Seconds are deliberately absent: no GU screen displays them, and a second
+ * shown is a second a reader tries to interpret.
+ */
+export declare function fmtDateTime(value: FmtDateInput, opts?: FmtDateOptions): string;
+declare const fmtDateApi: {
+    fmtDate: typeof fmtDate;
+    fmtDateTime: typeof fmtDateTime;
+};
+export default fmtDateApi;
+//# sourceMappingURL=fmtDate.d.ts.map

package/dist/v2/utils/fmtDate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fmtDate.d.ts","sourceRoot":"","sources":["../../../src/lib/v2/utils/fmtDate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,sEAAsE;AACtE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;AAErE,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,CAAC;AAqBF;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,GAAE,cAAmB,GAAG,MAAM,CAO9E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,YAAY,EACnB,IAAI,GAAE,cAAmB,GACxB,MAAM,CAOR;AAED,QAAA,MAAM,UAAU;;;CAA2B,CAAC;AAC5C,eAAe,UAAU,CAAC"}

package/dist/v2/utils/fmtDate.js

@@ -0,0 +1,119 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = void 0;
+exports.fmtDate = fmtDate;
+exports.fmtDateTime = fmtDateTime;
+/**
+ * fmtDate / fmtDateTime — render a date for DISPLAY.
+ *
+ *   fmtDate("2026-03-05T14:30:00Z")        → "05/03/2026"
+ *   fmtDateTime("2026-03-05T14:30:00Z")    → "05/03/2026 15:30"   (local time)
+ *   fmtDate(undefined)                     → "—"
+ *   fmtDate("pas une date")                → "—"
+ *   fmtDate(d, { absent: "" })             → "" when there is no date
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHY THIS BELONGS IN THE LIBRARY (capability gap G-51)
+ *
+ * The library already owns the money side of the same job — `fmtMoney`, same
+ * folder, same "—" for an absent value, for the same reason: a table cell must
+ * never read "NaN". It owned nothing for dates, which every GU screen renders
+ * far more often than amounts. So every module wrote its own, and the copies
+ * shared one defect:
+ *
+ *     const fullformatDate = (stringDate) => {
+ *       const date = new Date(stringDate);
+ *       const day = formatIntoTwoDigits(date.getDate());
+ *       …
+ *
+ * `new Date(undefined)` is an INVALID DATE whose every accessor returns `NaN`,
+ * so the helper rendered, literally:
+ *
+ *     NaN/NaN/NaN NaN:NaN
+ *
+ * on any optional field — an update date, a visit date, a closure date — which
+ * is most of them. In `autorisation-admis-pour-conforme-fe` the guard had been
+ * added at CALL SITES one lot after another (lots 4 to 7) before being pulled
+ * into the module's own helper: treating the symptom eight times, because the
+ * one place where it cannot be forgotten is the formatter itself. That is the
+ * argument for owning it here rather than in each module.
+ *
+ * Two smaller things the same copies carried, fixed here by construction: a
+ * two-digit helper that returned `"08"` (string) or `12` (number) depending on
+ * the value, and an absent date rendered as an EMPTY string — indistinguishable
+ * from a cell that failed to render, where "—" says "we looked, there is
+ * nothing".
+ *
+ * WHY NO `moment`, THOUGH THE PACKAGE ALREADY DEPENDS ON IT
+ *
+ * `moment` is here for the pickers, and specifically for STRICT parsing against
+ * an explicit format (`patterns/_pickerSerialisation`) — reading
+ * `"31-12-2026"` back without guessing. That is the right use of it.
+ *
+ * Rendering an already-parsed instant as two numbers and a year is not. This
+ * folder is dependency-free on purpose (see `fileDownload`), and
+ * `moment(someString)` with no format falls back to `new Date` WHILE EMITTING A
+ * CONSOLE DEPRECATION WARNING — noise a display helper called once per table
+ * cell must not produce. Native padding has neither cost.
+ *
+ * TIME ZONE, STATED RATHER THAN IMPLIED. The output is in the VIEWER'S local
+ * zone (`getDate`, `getHours`…), which is what the module helpers this replaces
+ * did, and what a user expects of "date de dépôt". An instant sent as
+ * `…T23:30:00Z` therefore reads as the next day in Casablanca. If a screen ever
+ * needs the server's calendar day regardless of the reader, that is a DIFFERENT
+ * function and must be argued for on its own — silently switching this one to
+ * UTC would move dates by a day across the whole platform.
+ * ─────────────────────────────────────────────────────────────────────────────
+ */
+
+/** What a formatter accepts: an API string, an epoch, or a `Date`. */
+
+/** The platform's absence mark — same value `fmtMoney` returns. */
+const ABSENT = "—";
+const pad2 = value => String(value).padStart(2, "0");
+
+/**
+ * Parse an input into a USABLE `Date`, or `null`.
+ *
+ * `null` for every unusable case — absent, empty string, unparseable, or an
+ * Invalid Date — so no caller can accidentally format `NaN`. The empty-string
+ * check is explicit because `new Date("")` is Invalid while `new Date(0)` is a
+ * legitimate instant (1970), and a falsy test would conflate them.
+ */
+const toUsableDate = value => {
+  if (value === null || value === undefined || value === "") return null;
+  const date = value instanceof Date ? value : new Date(value);
+  return Number.isNaN(date.getTime()) ? null : date;
+};
+
+/**
+ * Day, month and year — `DD/MM/YYYY`.
+ *
+ * @param value - API string, epoch, or `Date`. Absent or unparseable → `absent`.
+ */
+function fmtDate(value, opts = {}) {
+  const date = toUsableDate(value);
+  if (date === null) return opts.absent ?? ABSENT;
+  return `${pad2(date.getDate())}/${pad2(date.getMonth() + 1)}/${date.getFullYear()}`;
+}
+
+/**
+ * Day, month, year, then hours and minutes — `DD/MM/YYYY HH:mm`.
+ *
+ * Seconds are deliberately absent: no GU screen displays them, and a second
+ * shown is a second a reader tries to interpret.
+ */
+function fmtDateTime(value, opts = {}) {
+  const date = toUsableDate(value);
+  if (date === null) return opts.absent ?? ABSENT;
+  return `${fmtDate(date, opts)} ${pad2(date.getHours())}:${pad2(date.getMinutes())}`;
+}
+const fmtDateApi = {
+  fmtDate,
+  fmtDateTime
+};
+var _default = exports.default = fmtDateApi;
+//# sourceMappingURL=fmtDate.js.map

package/dist/v2/utils/fmtDate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fmtDate.js","names":["ABSENT","pad2","value","String","padStart","toUsableDate","undefined","date","Date","Number","isNaN","getTime","fmtDate","opts","absent","getDate","getMonth","getFullYear","fmtDateTime","getHours","getMinutes","fmtDateApi","_default","exports","default"],"sources":["../../../src/lib/v2/utils/fmtDate.ts"],"sourcesContent":["/**\r\n * fmtDate / fmtDateTime — render a date for DISPLAY.\r\n *\r\n *   fmtDate(\"2026-03-05T14:30:00Z\")        → \"05/03/2026\"\r\n *   fmtDateTime(\"2026-03-05T14:30:00Z\")    → \"05/03/2026 15:30\"   (local time)\r\n *   fmtDate(undefined)                     → \"—\"\r\n *   fmtDate(\"pas une date\")                → \"—\"\r\n *   fmtDate(d, { absent: \"\" })             → \"\" when there is no date\r\n *\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n * WHY THIS BELONGS IN THE LIBRARY (capability gap G-51)\r\n *\r\n * The library already owns the money side of the same job — `fmtMoney`, same\r\n * folder, same \"—\" for an absent value, for the same reason: a table cell must\r\n * never read \"NaN\". It owned nothing for dates, which every GU screen renders\r\n * far more often than amounts. So every module wrote its own, and the copies\r\n * shared one defect:\r\n *\r\n *     const fullformatDate = (stringDate) => {\r\n *       const date = new Date(stringDate);\r\n *       const day = formatIntoTwoDigits(date.getDate());\r\n *       …\r\n *\r\n * `new Date(undefined)` is an INVALID DATE whose every accessor returns `NaN`,\r\n * so the helper rendered, literally:\r\n *\r\n *     NaN/NaN/NaN NaN:NaN\r\n *\r\n * on any optional field — an update date, a visit date, a closure date — which\r\n * is most of them. In `autorisation-admis-pour-conforme-fe` the guard had been\r\n * added at CALL SITES one lot after another (lots 4 to 7) before being pulled\r\n * into the module's own helper: treating the symptom eight times, because the\r\n * one place where it cannot be forgotten is the formatter itself. That is the\r\n * argument for owning it here rather than in each module.\r\n *\r\n * Two smaller things the same copies carried, fixed here by construction: a\r\n * two-digit helper that returned `\"08\"` (string) or `12` (number) depending on\r\n * the value, and an absent date rendered as an EMPTY string — indistinguishable\r\n * from a cell that failed to render, where \"—\" says \"we looked, there is\r\n * nothing\".\r\n *\r\n * WHY NO `moment`, THOUGH THE PACKAGE ALREADY DEPENDS ON IT\r\n *\r\n * `moment` is here for the pickers, and specifically for STRICT parsing against\r\n * an explicit format (`patterns/_pickerSerialisation`) — reading\r\n * `\"31-12-2026\"` back without guessing. That is the right use of it.\r\n *\r\n * Rendering an already-parsed instant as two numbers and a year is not. This\r\n * folder is dependency-free on purpose (see `fileDownload`), and\r\n * `moment(someString)` with no format falls back to `new Date` WHILE EMITTING A\r\n * CONSOLE DEPRECATION WARNING — noise a display helper called once per table\r\n * cell must not produce. Native padding has neither cost.\r\n *\r\n * TIME ZONE, STATED RATHER THAN IMPLIED. The output is in the VIEWER'S local\r\n * zone (`getDate`, `getHours`…), which is what the module helpers this replaces\r\n * did, and what a user expects of \"date de dépôt\". An instant sent as\r\n * `…T23:30:00Z` therefore reads as the next day in Casablanca. If a screen ever\r\n * needs the server's calendar day regardless of the reader, that is a DIFFERENT\r\n * function and must be argued for on its own — silently switching this one to\r\n * UTC would move dates by a day across the whole platform.\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n */\r\n\r\n/** What a formatter accepts: an API string, an epoch, or a `Date`. */\r\nexport type FmtDateInput = string | number | Date | null | undefined;\r\n\r\nexport type FmtDateOptions = {\r\n  /**\r\n   * Rendered when there is no usable date. Defaults to the em dash used as the\r\n   * platform's absence mark in tables and detail sheets.\r\n   *\r\n   * Pass `\"\"` where an empty cell is the deliberate choice — a DataGrid column\r\n   * that must stay visually quiet, or a value on its way into a search payload,\r\n   * since an em dash travelling to a back-end as a criterion is worse than\r\n   * nothing. Both cases exist in the module this was raised from.\r\n   *\r\n   * NO `separator` OPTION, and that is a correction rather than an omission.\r\n   * The first draft had one, justified by a module helper documented as feeding\r\n   * search criteria \"d'où le séparateur paramétrable\". A grep of the module\r\n   * showed that helper has ZERO importers: the justification was dead code, so\r\n   * the knob was speculative surface on a certified API (§2.8 — minimum API\r\n   * surface). The emitted format is the charter's `DD/MM/YYYY`; a host needing\r\n   * another separator should say why here.\r\n   */\r\n  absent?: string | undefined;\r\n};\r\n\r\n/** The platform's absence mark — same value `fmtMoney` returns. */\r\nconst ABSENT = \"—\";\r\n\r\nconst pad2 = (value: number): string => String(value).padStart(2, \"0\");\r\n\r\n/**\r\n * Parse an input into a USABLE `Date`, or `null`.\r\n *\r\n * `null` for every unusable case — absent, empty string, unparseable, or an\r\n * Invalid Date — so no caller can accidentally format `NaN`. The empty-string\r\n * check is explicit because `new Date(\"\")` is Invalid while `new Date(0)` is a\r\n * legitimate instant (1970), and a falsy test would conflate them.\r\n */\r\nconst toUsableDate = (value: FmtDateInput): Date | null => {\r\n  if (value === null || value === undefined || value === \"\") return null;\r\n  const date = value instanceof Date ? value : new Date(value);\r\n  return Number.isNaN(date.getTime()) ? null : date;\r\n};\r\n\r\n/**\r\n * Day, month and year — `DD/MM/YYYY`.\r\n *\r\n * @param value - API string, epoch, or `Date`. Absent or unparseable → `absent`.\r\n */\r\nexport function fmtDate(value: FmtDateInput, opts: FmtDateOptions = {}): string {\r\n  const date = toUsableDate(value);\r\n  if (date === null) return opts.absent ?? ABSENT;\r\n\r\n  return `${pad2(date.getDate())}/${pad2(\r\n    date.getMonth() + 1\r\n  )}/${date.getFullYear()}`;\r\n}\r\n\r\n/**\r\n * Day, month, year, then hours and minutes — `DD/MM/YYYY HH:mm`.\r\n *\r\n * Seconds are deliberately absent: no GU screen displays them, and a second\r\n * shown is a second a reader tries to interpret.\r\n */\r\nexport function fmtDateTime(\r\n  value: FmtDateInput,\r\n  opts: FmtDateOptions = {}\r\n): string {\r\n  const date = toUsableDate(value);\r\n  if (date === null) return opts.absent ?? ABSENT;\r\n\r\n  return `${fmtDate(date, opts)} ${pad2(date.getHours())}:${pad2(\r\n    date.getMinutes()\r\n  )}`;\r\n}\r\n\r\nconst fmtDateApi = { fmtDate, fmtDateTime };\r\nexport default fmtDateApi;\r\n"],"mappings":";;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;;AAwBA;AACA,MAAMA,MAAM,GAAG,GAAG;AAElB,MAAMC,IAAI,GAAIC,KAAa,IAAaC,MAAM,CAACD,KAAK,CAAC,CAACE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC;;AAEtE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,YAAY,GAAIH,KAAmB,IAAkB;EACzD,IAAIA,KAAK,KAAK,IAAI,IAAIA,KAAK,KAAKI,SAAS,IAAIJ,KAAK,KAAK,EAAE,EAAE,OAAO,IAAI;EACtE,MAAMK,IAAI,GAAGL,KAAK,YAAYM,IAAI,GAAGN,KAAK,GAAG,IAAIM,IAAI,CAACN,KAAK,CAAC;EAC5D,OAAOO,MAAM,CAACC,KAAK,CAACH,IAAI,CAACI,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,GAAGJ,IAAI;AACnD,CAAC;;AAED;AACA;AACA;AACA;AACA;AACO,SAASK,OAAOA,CAACV,KAAmB,EAAEW,IAAoB,GAAG,CAAC,CAAC,EAAU;EAC9E,MAAMN,IAAI,GAAGF,YAAY,CAACH,KAAK,CAAC;EAChC,IAAIK,IAAI,KAAK,IAAI,EAAE,OAAOM,IAAI,CAACC,MAAM,IAAId,MAAM;EAE/C,OAAO,GAAGC,IAAI,CAACM,IAAI,CAACQ,OAAO,CAAC,CAAC,CAAC,IAAId,IAAI,CACpCM,IAAI,CAACS,QAAQ,CAAC,CAAC,GAAG,CACpB,CAAC,IAAIT,IAAI,CAACU,WAAW,CAAC,CAAC,EAAE;AAC3B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,WAAWA,CACzBhB,KAAmB,EACnBW,IAAoB,GAAG,CAAC,CAAC,EACjB;EACR,MAAMN,IAAI,GAAGF,YAAY,CAACH,KAAK,CAAC;EAChC,IAAIK,IAAI,KAAK,IAAI,EAAE,OAAOM,IAAI,CAACC,MAAM,IAAId,MAAM;EAE/C,OAAO,GAAGY,OAAO,CAACL,IAAI,EAAEM,IAAI,CAAC,IAAIZ,IAAI,CAACM,IAAI,CAACY,QAAQ,CAAC,CAAC,CAAC,IAAIlB,IAAI,CAC5DM,IAAI,CAACa,UAAU,CAAC,CAClB,CAAC,EAAE;AACL;AAEA,MAAMC,UAAU,GAAG;EAAET,OAAO;EAAEM;AAAY,CAAC;AAAC,IAAAI,QAAA,GAAAC,OAAA,CAAAC,OAAA,GAC7BH,UAAU","ignoreList":[]}

package/dist/v2/utils/fmtMoney.d.ts

@@ -19,9 +19,9 @@
  *   fmtMoney(null) / fmtMoney("abc") / fmtMoney(Infinity) → "—"
  */
 type FmtMoneyOptions = {
-    locale?: string;
-    minimumFractionDigits?: number;
-    maximumFractionDigits?: number;
+    locale?: string | undefined;
+    minimumFractionDigits?: number | undefined;
+    maximumFractionDigits?: number | undefined;
 };
 export default function fmtMoney(n: number | string | null | undefined, currency?: string, opts?: FmtMoneyOptions): string;
 export {};

package/dist/v2/utils/fmtMoney.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fmtMoney.d.ts","sourceRoot":"","sources":["../../../src/lib/v2/utils/fmtMoney.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,eAAe,GAAG;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AA+BF,MAAM,CAAC,OAAO,UAAU,QAAQ,CAC9B,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,QAAQ,GAAE,MAAW,EACrB,IAAI,GAAE,eAAoB,GACzB,MAAM,CAgCR"}
+{"version":3,"file":"fmtMoney.d.ts","sourceRoot":"","sources":["../../../src/lib/v2/utils/fmtMoney.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,eAAe,GAAG;IACrB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C,CAAC;AA+BF,MAAM,CAAC,OAAO,UAAU,QAAQ,CAC9B,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,QAAQ,GAAE,MAAW,EACrB,IAAI,GAAE,eAAoB,GACzB,MAAM,CAgCR"}