@svadmin/lite 0.3.6 → 0.3.10

package/dist/schema-generator.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @svadmin/lite — Schema Generator
+ *
+ * Auto-generates Zod schemas from @svadmin/core FieldDefinitions.
+ * Used with sveltekit-superforms for server-side form validation.
+ */
+import { z } from 'zod';
+import type { FieldDefinition, ResourceDefinition } from '@svadmin/core';
+/**
+ * Generate a Zod object schema from a ResourceDefinition's fields.
+ * Only includes fields that are relevant for form rendering.
+ *
+ * @param mode - 'create' | 'edit' to filter fields by showInCreate / showInEdit
+ */
+export declare function fieldsToZodSchema(fields: FieldDefinition[], mode?: 'create' | 'edit'): z.ZodObject<Record<string, z.ZodTypeAny>>;
+/**
+ * Generate a Zod schema from a ResourceDefinition.
+ * Convenience wrapper around fieldsToZodSchema.
+ */
+export declare function resourceToZodSchema(resource: ResourceDefinition, mode?: 'create' | 'edit'): z.ZodObject<Record<string, z.ZodTypeAny>>;
+/**
+ * Determine a conservative HTML input type for server-rendered forms.
+ * Text fallbacks avoid inconsistent native validation and date widgets.
+ */
+export declare function fieldToInputType(field: FieldDefinition): string;
+/**
+ * Generate an input placeholder with a portable format hint.
+ */
+export declare function fieldToPlaceholder(field: FieldDefinition): string;

package/dist/schema-generator.js

@@ -0,0 +1,226 @@
+/**
+ * @svadmin/lite — Schema Generator
+ *
+ * Auto-generates Zod schemas from @svadmin/core FieldDefinitions.
+ * Used with sveltekit-superforms for server-side form validation.
+ */
+import { z } from 'zod';
+function isNativeFile(value) {
+    return typeof File !== 'undefined' && value instanceof File;
+}
+function isNonEmptyNativeFile(value) {
+    return isNativeFile(value) && value.size > 0 && value.name !== '';
+}
+function hasRequiredValue(value) {
+    if (value === undefined || value === null)
+        return false;
+    if (typeof value === 'string')
+        return value.trim().length > 0;
+    if (Array.isArray(value))
+        return value.length > 0;
+    if (isNativeFile(value))
+        return isNonEmptyNativeFile(value);
+    return true;
+}
+function numberFieldToZod(field) {
+    const numberSchema = z.coerce.number({ message: `${field.label} must be a number` });
+    const targetSchema = field.required ? numberSchema : numberSchema.optional();
+    return z.preprocess((value) => {
+        if (value === undefined || value === null)
+            return undefined;
+        if (typeof value === 'string' && value.trim() === '')
+            return undefined;
+        return value;
+    }, targetSchema);
+}
+function singleFileFieldToZod(field, options) {
+    const fileSchema = z.custom(isNonEmptyNativeFile, {
+        message: `${field.label} must be a non-empty file`,
+    });
+    const referenceSchema = z.string().trim().min(1, `${field.label} must reference an existing file`);
+    const uploadSchema = options.allowReference ? z.union([fileSchema, referenceSchema]) : fileSchema;
+    const targetSchema = options.required ? uploadSchema : uploadSchema.optional();
+    return z.preprocess((value) => {
+        if (value === undefined || value === null || value === '')
+            return undefined;
+        if (isNativeFile(value) && !isNonEmptyNativeFile(value))
+            return undefined;
+        return value;
+    }, targetSchema);
+}
+function multipleFilesFieldToZod(field, options) {
+    const fileSchema = z.custom(isNonEmptyNativeFile, {
+        message: `${field.label} contains an empty or invalid file`,
+    });
+    const filesSchema = z.array(fileSchema).min(1, `${field.label} must contain at least one file`);
+    const referencesSchema = z.array(z.string().trim().min(1, `${field.label} contains an empty file reference`)).min(1, `${field.label} must contain at least one file`);
+    const uploadSchema = options.allowReference ? z.union([filesSchema, referencesSchema]) : filesSchema;
+    const targetSchema = options.required ? uploadSchema : uploadSchema.optional();
+    return z.preprocess((value) => {
+        if (value === undefined || value === null || value === '')
+            return undefined;
+        if (!Array.isArray(value))
+            return value;
+        const invalidEntries = value.filter((entry) => !isNativeFile(entry) && typeof entry !== 'string');
+        if (invalidEntries.length > 0)
+            return value;
+        const uploadedFiles = value.filter(isNonEmptyNativeFile);
+        if (uploadedFiles.length > 0)
+            return uploadedFiles;
+        const references = value.filter((entry) => typeof entry === 'string' && entry.trim().length > 0);
+        return references.length > 0 ? references : undefined;
+    }, targetSchema);
+}
+/**
+ * Convert a single FieldDefinition to its corresponding Zod type.
+ */
+function fieldToZod(field, mode, withinArray = false) {
+    let schema;
+    switch (field.type) {
+        case 'number':
+            return numberFieldToZod(field);
+        case 'boolean':
+            schema = z.coerce.boolean();
+            break;
+        case 'email':
+            schema = z.string().email(`${field.label} must be a valid email`);
+            break;
+        case 'url':
+            schema = z.string().url(`${field.label} must be a valid URL`);
+            break;
+        case 'date':
+            schema = z.string().refine((v) => !v || !isNaN(Date.parse(v)), { message: `${field.label} must be a valid date` });
+            break;
+        case 'select':
+            if (field.options?.length) {
+                schema = z.enum(field.options.map((o) => String(o.value)), { message: `${field.label} must be one of the options` });
+            }
+            else {
+                schema = z.string();
+            }
+            break;
+        case 'multiselect':
+            schema = z.array(z.string()).default([]);
+            break;
+        case 'array': {
+            const shape = {};
+            for (const subField of field.subFields ?? []) {
+                shape[subField.key] = fieldToZod(subField, mode, true);
+            }
+            const arraySchema = z.array(z.object(shape));
+            return field.required
+                ? arraySchema.min(1, `${field.label} must contain at least one item`)
+                : arraySchema.optional().or(z.literal(''));
+        }
+        case 'tags':
+            schema = z.union([
+                z.array(z.string()),
+                z.string().transform((value) => value ? value.split(',').map((tag) => tag.trim()).filter(Boolean) : []),
+            ]);
+            break;
+        case 'textarea':
+        case 'richtext':
+            schema = z.string().max(50000, `${field.label} is too long`);
+            break;
+        case 'json':
+            schema = z.unknown().transform((value, context) => {
+                if (typeof value !== 'string')
+                    return value;
+                try {
+                    return JSON.parse(value);
+                }
+                catch {
+                    context.addIssue({ code: 'custom', message: `${field.label} must be valid JSON` });
+                    return z.NEVER;
+                }
+            });
+            break;
+        case 'phone':
+            schema = z.string().regex(/^[+\d\s()-]*$/, `${field.label} must be a valid phone number`);
+            break;
+        case 'file':
+        case 'image':
+            return singleFileFieldToZod(field, {
+                required: field.required === true && (mode === 'create' || withinArray),
+                allowReference: mode === 'edit' && withinArray,
+            });
+        case 'images':
+            return multipleFilesFieldToZod(field, {
+                required: field.required === true && (mode === 'create' || withinArray),
+                allowReference: mode === 'edit' && withinArray,
+            });
+        default:
+            schema = z.string();
+    }
+    // Enforce meaningful values for required fields, including nested array rows.
+    if (field.required) {
+        schema = schema.refine(hasRequiredValue, { message: `${field.label} is required` });
+    }
+    else {
+        schema = schema.optional().or(z.literal(''));
+    }
+    return schema;
+}
+/**
+ * Generate a Zod object schema from a ResourceDefinition's fields.
+ * Only includes fields that are relevant for form rendering.
+ *
+ * @param mode - 'create' | 'edit' to filter fields by showInCreate / showInEdit
+ */
+export function fieldsToZodSchema(fields, mode = 'create') {
+    const shape = {};
+    for (const field of fields) {
+        // Skip fields not shown in forms
+        if (field.showInForm === false)
+            continue;
+        if (mode === 'create' && field.showInCreate === false)
+            continue;
+        if (mode === 'edit' && field.showInEdit === false)
+            continue;
+        shape[field.key] = fieldToZod(field, mode);
+    }
+    return z.object(shape);
+}
+/**
+ * Generate a Zod schema from a ResourceDefinition.
+ * Convenience wrapper around fieldsToZodSchema.
+ */
+export function resourceToZodSchema(resource, mode = 'create') {
+    return fieldsToZodSchema(resource.fields, mode);
+}
+/**
+ * Determine a conservative HTML input type for server-rendered forms.
+ * Text fallbacks avoid inconsistent native validation and date widgets.
+ */
+export function fieldToInputType(field) {
+    switch (field.type) {
+        case 'number': return 'text';
+        case 'email': return 'text';
+        case 'url': return 'text';
+        case 'phone': return 'tel';
+        case 'boolean': return 'checkbox';
+        case 'date': return 'text';
+        case 'textarea':
+        case 'richtext': return 'textarea';
+        case 'select':
+        case 'multiselect': return 'select';
+        case 'array': return 'text';
+        case 'image':
+        case 'images':
+        case 'file': return 'file';
+        default: return 'text';
+    }
+}
+/**
+ * Generate an input placeholder with a portable format hint.
+ */
+export function fieldToPlaceholder(field) {
+    switch (field.type) {
+        case 'date': return 'YYYY-MM-DD';
+        case 'email': return 'user@example.com';
+        case 'url': return 'https://example.com';
+        case 'phone': return '+1 (555) 000-0000';
+        case 'number': return '0';
+        default: return '';
+    }
+}

package/dist/security.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Convert untrusted display values to text. Callers must render the result with
+ * normal Svelte interpolation so the framework escapes markup characters.
+ */
+export declare function toSafeText(value: unknown, fallback?: string): string;
+/**
+ * Convert an untrusted value into a navigation-safe href.
+ *
+ * Relative references are preserved. Absolute references are limited to
+ * http(s), mailto, tel, and browser-created http(s) blob URLs. Any control or
+ * invisible character fails closed before scheme parsing so browsers cannot
+ * normalize an executable protocol after validation.
+ */
+export declare function toSafeHref(value: unknown): string | undefined;

package/dist/security.js

@@ -0,0 +1,59 @@
+/**
+ * Convert untrusted display values to text. Callers must render the result with
+ * normal Svelte interpolation so the framework escapes markup characters.
+ */
+export function toSafeText(value, fallback = '') {
+    return value === null || value === undefined ? fallback : String(value);
+}
+const URI_SCHEME = /^([a-z][a-z\d+.-]*):/iu;
+const SAFE_HREF_SCHEMES = new Set(['http', 'https', 'mailto', 'tel']);
+function hasUnsafeHrefCharacters(value) {
+    for (const character of value) {
+        const codePoint = character.codePointAt(0) ?? 0;
+        if (codePoint <= 0x1f
+            || (codePoint >= 0x7f && codePoint <= 0x9f)
+            || (codePoint >= 0x200b && codePoint <= 0x200f)
+            || (codePoint >= 0x2028 && codePoint <= 0x202e)
+            || codePoint === 0x2060
+            || codePoint === 0xfeff) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Convert an untrusted value into a navigation-safe href.
+ *
+ * Relative references are preserved. Absolute references are limited to
+ * http(s), mailto, tel, and browser-created http(s) blob URLs. Any control or
+ * invisible character fails closed before scheme parsing so browsers cannot
+ * normalize an executable protocol after validation.
+ */
+export function toSafeHref(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    const href = String(value).trim();
+    if (!href || hasUnsafeHrefCharacters(href))
+        return undefined;
+    const scheme = URI_SCHEME.exec(href)?.[1]?.toLowerCase();
+    if (!scheme)
+        return href;
+    if (scheme === 'blob') {
+        try {
+            const blobUrl = new URL(href);
+            const innerProtocol = new URL(blobUrl.pathname).protocol;
+            return innerProtocol === 'http:' || innerProtocol === 'https:' ? href : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (!SAFE_HREF_SCHEMES.has(scheme))
+        return undefined;
+    try {
+        return new URL(href).protocol === `${scheme}:` ? href : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/server-adapter.d.ts

@@ -0,0 +1,111 @@
+/**
+ * @svadmin/lite — Server Adapter
+ *
+ * Bridges @svadmin/core DataProvider into SvelteKit server loaders and form actions.
+ * All data fetching happens on the server; optional client-side enhancement is
+ * limited to interaction affordances such as dynamic array rows.
+ */
+import type { DataProvider, AuthProvider, ResourceDefinition } from '@svadmin/core';
+import { type RequestEvent } from '@sveltejs/kit';
+export interface ListLoaderResult {
+    records: Record<string, unknown>[];
+    total: number;
+    page: number;
+    pageSize: number;
+    totalPages: number;
+    sort?: string;
+    order?: 'asc' | 'desc';
+    search?: string;
+    resource: ResourceDefinition;
+}
+/**
+ * Creates a SvelteKit `load` function that fetches a resource list
+ * via the DataProvider. All state is driven by URL search params.
+ */
+export declare function createListLoader(dp: DataProvider, resource: ResourceDefinition): ({ url }: {
+    url: URL;
+}) => Promise<ListLoaderResult>;
+export declare function createDetailLoader(dp: DataProvider, resource: ResourceDefinition): ({ params }: {
+    params: {
+        id: string;
+    };
+}) => Promise<{
+    record: Record<string, unknown>;
+    resource: ResourceDefinition;
+}>;
+/**
+ * Creates SvelteKit form actions for create / update / delete.
+ * Works with standard `<form method="POST">` submissions — no JS needed.
+ */
+export declare function createCrudActions(dp: DataProvider, resource: ResourceDefinition): {
+    create: ({ request }: RequestEvent) => Promise<{
+        success: false;
+        error: string;
+        values: Record<string, unknown>;
+        errors: Record<string, string[]>;
+    } | {
+        success: boolean;
+        id: unknown;
+        error?: undefined;
+        values?: undefined;
+    } | {
+        success: boolean;
+        error: string;
+        values: Record<string, unknown>;
+        id?: undefined;
+    }>;
+    update: ({ request }: RequestEvent) => Promise<{
+        success: false;
+        error: string;
+        values: Record<string, unknown>;
+        errors: Record<string, string[]>;
+    } | {
+        success: boolean;
+        error?: undefined;
+        values?: undefined;
+    } | {
+        success: boolean;
+        error: string;
+        values: Record<string, unknown>;
+    }>;
+    delete: ({ request }: RequestEvent) => Promise<{
+        success: boolean;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: string;
+    }>;
+};
+/**
+ * Creates a SvelteKit server hook that checks auth via AuthProvider
+ * and redirects unauthenticated users to a login page.
+ */
+export declare function createAuthGuard(authProvider: AuthProvider, loginPath?: string): ({ event, resolve }: {
+    event: RequestEvent;
+    resolve: (event: RequestEvent) => Promise<Response>;
+}) => Promise<Response>;
+/**
+ * Creates login/logout form actions using AuthProvider.
+ */
+export declare function createAuthActions(authProvider: AuthProvider): {
+    login: ({ request, cookies }: RequestEvent) => Promise<{
+        success: boolean;
+        error: string;
+    }>;
+    logout: ({ cookies }: RequestEvent) => Promise<{
+        success: boolean;
+    }>;
+};
+/**
+ * Detects IE11 user agents for applications that maintain a dedicated fallback.
+ * This helper does not imply that Svelte 5 or the consuming app supports IE11.
+ */
+export declare function isLegacyBrowser(userAgent: string): boolean;
+/**
+ * Creates an opt-in SvelteKit hook that redirects detected IE11 user agents.
+ * Consumers remain responsible for their own transpilation and browser support.
+ */
+export declare function createLegacyRedirectHook(litePrefix?: string): ({ event, resolve }: {
+    event: RequestEvent;
+    resolve: (event: RequestEvent) => Promise<Response>;
+}) => Promise<Response>;