@svadmin/ui 0.72.0 → 0.73.0

package/dist/components/enterprise/recursive-schema-form.d.ts

@@ -0,0 +1,30 @@
+import { type SchemaFormModel, type SchemaFormIssue } from './json-schema-form.js';
+type Node = {
+    kind: 'object';
+    properties: Record<string, Node>;
+    required: Set<string>;
+    additional: boolean;
+    nullable: boolean;
+} | {
+    kind: 'array';
+    item: Node;
+    min: number | undefined;
+    max: number | undefined;
+    nullable: boolean;
+} | {
+    kind: 'scalar';
+    model: SchemaFormModel;
+};
+export interface RecursiveSchemaFormModel {
+    node: Node | undefined;
+    issues: SchemaFormIssue[];
+}
+export declare const schemaFormPointer: (path: readonly string[]) => string;
+/** Compile bounded objects/arrays, delegating scalar assertions to the reviewed leaf validator.
+ * Unsupported assertions fail closed; this is deliberately not a complete JSON Schema engine.
+ * TypeBox's symbol annotations are not JSON assertion keywords and are not executed.
+ */
+export declare function readRecursiveSchemaForm(schema: unknown): RecursiveSchemaFormModel;
+/** Validate a detached JSON payload without defaults, coercion, cleaning or partial acceptance. */
+export declare function validateRecursiveSchemaForm(model: RecursiveSchemaFormModel, value: unknown): SchemaFormIssue[];
+export {};

package/dist/components/enterprise/recursive-schema-form.js

@@ -0,0 +1,196 @@
+import { readSchemaForm, validateSchemaForm } from './json-schema-form.js';
+import { SCHEMA_FORM_LIMITS, schemaFormSnapshot } from '../json-schema-form-state.js';
+const annotationKeys = ['$schema', '$id', '$comment', 'title', 'description', 'type', 'default', 'readOnly', 'writeOnly', 'deprecated', 'examples'];
+const objectKeys = new Set([...annotationKeys, 'properties', 'required', 'additionalProperties']);
+const arrayKeys = new Set([...annotationKeys, 'items', 'minItems', 'maxItems']);
+const unsafe = new Set(['__proto__', 'prototype', 'constructor']);
+export const schemaFormPointer = (path) => path.map(key => '/' + key.replaceAll('~', '~0').replaceAll('/', '~1')).join('');
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+}
+function dataRecord(value) {
+    return record(value) && Object.keys(value).every(key => {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        return descriptor !== undefined && 'value' in descriptor;
+    });
+}
+/** Compile bounded objects/arrays, delegating scalar assertions to the reviewed leaf validator.
+ * Unsupported assertions fail closed; this is deliberately not a complete JSON Schema engine.
+ * TypeBox's symbol annotations are not JSON assertion keywords and are not executed.
+ */
+export function readRecursiveSchemaForm(schema) {
+    const issues = [];
+    const active = new Set();
+    let visited = 0;
+    const issue = (path, code) => {
+        if (issues.length < 128)
+            issues.push({ path, code });
+    };
+    function read(raw, path, depth, root = false) {
+        if (++visited > SCHEMA_FORM_LIMITS.nodes || depth > SCHEMA_FORM_LIMITS.depth || !dataRecord(raw) || active.has(raw)) {
+            issue(path, 'invalid-schema');
+            return;
+        }
+        active.add(raw);
+        try {
+            let type = raw['type'];
+            let nullable = false;
+            if (Array.isArray(type)) {
+                const concrete = type.filter(value => value !== 'null');
+                if (type.length !== 2 || concrete.length !== 1 || !type.includes('null')) {
+                    issue(path, 'unsupported-schema');
+                    return;
+                }
+                nullable = true;
+                type = concrete[0];
+            }
+            if (type === undefined && (root || Object.hasOwn(raw, 'properties')))
+                type = 'object';
+            if (root && type !== 'object') {
+                issue(path, 'unsupported-schema');
+                return;
+            }
+            for (const key of ['readOnly', 'writeOnly', 'deprecated']) {
+                if (raw[key] !== undefined && typeof raw[key] !== 'boolean')
+                    issue(path + '/' + key, 'invalid-schema');
+            }
+            if (Object.hasOwn(raw, 'default')) {
+                try {
+                    schemaFormSnapshot({ value: raw['default'] });
+                }
+                catch {
+                    issue(path + '/default', 'invalid-schema');
+                }
+            }
+            if (type !== 'object' && type !== 'array') {
+                const model = readSchemaForm({ type: 'object', properties: { value: raw } });
+                for (const failure of model.issues)
+                    issue(path + failure.path.replace(/^\/value(?=\/|$)/u, ''), failure.code);
+                return { kind: 'scalar', model };
+            }
+            const allowed = type === 'object' ? objectKeys : arrayKeys;
+            for (const key of Object.keys(raw))
+                if (!allowed.has(key))
+                    issue(path + '/' + key, 'unsupported-schema');
+            if (type === 'object') {
+                const properties = raw['properties'] ?? {};
+                if (!dataRecord(properties) || Object.keys(properties).length > 256 || raw['properties'] === null) {
+                    issue(path + '/properties', 'invalid-schema');
+                    return;
+                }
+                const keys = raw['required'] ?? [];
+                if (!Array.isArray(keys) || keys.length > 256 || raw['required'] === null
+                    || new Set(keys).size !== keys.length || keys.some(key => typeof key !== 'string' || !Object.hasOwn(properties, key))) {
+                    issue(path + '/required', 'invalid-schema');
+                    return;
+                }
+                if (raw['additionalProperties'] !== undefined && typeof raw['additionalProperties'] !== 'boolean') {
+                    issue(path + '/additionalProperties', 'unsupported-schema');
+                }
+                const result = Object.create(null);
+                for (const [key, child] of Object.entries(properties)) {
+                    const childPath = path + schemaFormPointer([key]);
+                    if (unsafe.has(key)) {
+                        issue(childPath, 'invalid-schema');
+                        continue;
+                    }
+                    const node = read(child, childPath, depth + 1);
+                    if (node)
+                        result[key] = node;
+                }
+                return { kind: 'object', properties: result, required: new Set(keys), additional: raw['additionalProperties'] !== false, nullable };
+            }
+            const item = read(raw['items'], path + '/items', depth + 1);
+            const definition = raw;
+            function bound(key) {
+                const value = definition[key];
+                if (value === undefined)
+                    return;
+                if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0) {
+                    issue(path + '/' + key, 'invalid-schema');
+                    return;
+                }
+                return value;
+            }
+            const min = bound('minItems'), max = bound('maxItems');
+            if (min !== undefined && max !== undefined && min > max)
+                issue(path, 'invalid-schema');
+            return item ? { kind: 'array', item, min, max, nullable } : undefined;
+        }
+        finally {
+            active.delete(raw);
+        }
+    }
+    let node;
+    try {
+        node = read(schema, '', 0, true);
+    }
+    catch {
+        issue('', 'invalid-schema');
+    }
+    return { node, issues };
+}
+/** Validate a detached JSON payload without defaults, coercion, cleaning or partial acceptance. */
+export function validateRecursiveSchemaForm(model, value) {
+    if (model.issues.length || !model.node)
+        return model.issues.length ? [...model.issues] : [{ path: '', code: 'invalid-schema' }];
+    const issues = [];
+    const issue = (path, code) => {
+        if (issues.length < 128)
+            issues.push({ path, code });
+    };
+    let payload;
+    try {
+        payload = schemaFormSnapshot(value);
+    }
+    catch {
+        return [{ path: '', code: 'invalid-value' }];
+    }
+    let visited = 0;
+    function visit(node, current, path, required, depth) {
+        if (++visited > SCHEMA_FORM_LIMITS.nodes || depth > SCHEMA_FORM_LIMITS.depth) {
+            issue(path, 'invalid-value');
+            return;
+        }
+        if (current === undefined) {
+            if (required)
+                issue(path, 'required');
+            return;
+        }
+        if (node.kind === 'scalar') {
+            for (const failure of validateSchemaForm(node.model, { value: current }))
+                issue(path + failure.path.replace(/^\/value(?=\/|$)/u, ''), failure.code);
+            return;
+        }
+        if (current === null && node.nullable)
+            return;
+        if (node.kind === 'object') {
+            if (!record(current)) {
+                issue(path, 'type');
+                return;
+            }
+            for (const [key, child] of Object.entries(node.properties)) {
+                visit(child, Object.hasOwn(current, key) ? current[key] : undefined, path + schemaFormPointer([key]), node.required.has(key), depth + 1);
+            }
+            if (!node.additional)
+                for (const key of Object.keys(current)) {
+                    if (!Object.hasOwn(node.properties, key))
+                        issue(path + schemaFormPointer([key]), 'additionalProperties');
+                }
+            return;
+        }
+        if (!Array.isArray(current)) {
+            issue(path, 'type');
+            return;
+        }
+        if (node.min !== undefined && current.length < node.min)
+            issue(path, 'minItems');
+        if (node.max !== undefined && current.length > node.max)
+            issue(path, 'maxItems');
+        for (const [index, item] of current.entries())
+            visit(node.item, item, path + '/' + index, true, depth + 1);
+    }
+    visit(model.node, payload, '', true, 0);
+    return issues;
+}

package/dist/components/enterprise/spreadsheet-formula.d.ts

@@ -0,0 +1,12 @@
+/** 有界、无动态代码执行的轻量公式解析器；不是完整 Excel 公式引擎。 */
+export declare const FORMULA_LIMITS: Readonly<{
+    length: 2048;
+    tokens: 1024;
+    depth: 64;
+    work: 10000;
+    range: 10000;
+}>;
+export type FormulaErrorCode = '#VALUE!' | '#REF!' | '#NAME?' | '#DIV/0!' | '#NUM!' | '#CYCLE!' | '#LIMIT!';
+export declare function evaluateFormula(raw: string, cells: Readonly<Record<string, string>>): number | string;
+/** 文本导出不能把危险前缀当成外部电子表格公式；调用者仍需完成 CSV 引号转义。 */
+export declare function safeSpreadsheetCsvText(value: string): string;

package/dist/components/enterprise/spreadsheet-formula.js

@@ -0,0 +1,245 @@
+/** 有界、无动态代码执行的轻量公式解析器；不是完整 Excel 公式引擎。 */
+export const FORMULA_LIMITS = Object.freeze({ length: 2048, tokens: 1024, depth: 64, work: 10000, range: 10000 });
+class FormulaError extends Error {
+    code;
+    constructor(code) { super(code); this.code = code; }
+}
+function fail(code) { throw new FormulaError(code); }
+function finite(value) { return Number.isFinite(value) ? value : fail('#NUM!'); }
+function numeric(value) {
+    if (value === null)
+        return 0;
+    return typeof value === 'number' ? value : fail('#VALUE!');
+}
+const decimal = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i;
+function address(key) {
+    const match = /^\$?([A-Z]+)\$?(\d+)$/i.exec(key);
+    if (!match?.[1] || !match[2])
+        return fail('#REF!');
+    let column = 0;
+    for (const char of match[1].toUpperCase()) {
+        column = column * 26 + char.charCodeAt(0) - 64;
+        if (column > 16384)
+            return fail('#REF!');
+    }
+    const row = Number(match[2]);
+    if (row < 1 || row > 1048576 || !Number.isSafeInteger(row))
+        return fail('#REF!');
+    return { column, row };
+}
+function columnName(column) {
+    let name = '';
+    while (column > 0) {
+        column--;
+        name = String.fromCharCode(65 + column % 26) + name;
+        column = Math.floor(column / 26);
+    }
+    return name;
+}
+class Evaluation {
+    work = 0;
+    depth = 0;
+    active = new Set();
+    cache = new Map();
+    cells;
+    constructor(cells) { this.cells = cells; }
+    tick() { if (++this.work > FORMULA_LIMITS.work)
+        fail('#LIMIT!'); }
+    bounded(fn) {
+        if (++this.depth > FORMULA_LIMITS.depth) {
+            this.depth--;
+            return fail('#LIMIT!');
+        }
+        try {
+            return fn();
+        }
+        finally {
+            this.depth--;
+        }
+    }
+    cell(key) {
+        this.tick();
+        const parsed = address(key);
+        const normalized = `${columnName(parsed.column)}${parsed.row}`;
+        if (this.active.has(normalized))
+            return fail('#CYCLE!');
+        if (this.cache.has(normalized))
+            return this.cache.get(normalized) ?? null;
+        const raw = Object.hasOwn(this.cells, normalized) ? this.cells[normalized] : '';
+        if (typeof raw !== 'string')
+            return fail('#VALUE!');
+        this.active.add(normalized);
+        try {
+            const trimmed = raw.trim();
+            const value = raw.startsWith('=')
+                ? new Parser(raw.slice(1), this).parse()
+                : trimmed === '' ? null : decimal.test(trimmed) ? finite(Number(trimmed)) : raw;
+            this.cache.set(normalized, value);
+            return value;
+        }
+        finally {
+            this.active.delete(normalized);
+        }
+    }
+    range(start, end) {
+        const a = address(start);
+        const b = address(end);
+        const left = Math.min(a.column, b.column), right = Math.max(a.column, b.column);
+        const top = Math.min(a.row, b.row), bottom = Math.max(a.row, b.row);
+        if ((right - left + 1) * (bottom - top + 1) > FORMULA_LIMITS.range)
+            return fail('#LIMIT!');
+        const values = [];
+        for (let row = top; row <= bottom; row++) {
+            for (let column = left; column <= right; column++)
+                values.push(this.cell(`${columnName(column)}${row}`));
+        }
+        return values;
+    }
+}
+class Parser {
+    tokens = [];
+    position = 0;
+    context;
+    constructor(source, context) {
+        this.context = context;
+        if (source.length + 1 > FORMULA_LIMITS.length)
+            fail('#LIMIT!');
+        let rest = source;
+        while (rest.length) {
+            rest = rest.trimStart();
+            if (!rest)
+                break;
+            context.tick();
+            if (this.tokens.length >= FORMULA_LIMITS.tokens)
+                fail('#LIMIT!');
+            const number = /^(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?/i.exec(rest)?.[0];
+            const cell = /^\$?[A-Z]+\$?\d+/i.exec(rest)?.[0];
+            const name = /^[A-Z_][A-Z_0-9]*/i.exec(rest)?.[0];
+            let token;
+            if (number)
+                token = { kind: 'number', text: number };
+            else if (cell)
+                token = { kind: 'cell', text: cell.toUpperCase() };
+            else if (name)
+                token = { kind: 'name', text: name.toUpperCase() };
+            else if (/^[+\-*/(),:]/.test(rest))
+                token = { kind: 'symbol', text: rest[0] ?? '' };
+            else
+                return fail('#VALUE!');
+            this.tokens.push(token);
+            rest = rest.slice(token.text.length);
+        }
+        this.tokens.push({ kind: 'end', text: '' });
+    }
+    peek() { return this.tokens[this.position] ?? { kind: 'end', text: '' }; }
+    take() { this.context.tick(); const token = this.peek(); this.position++; return token; }
+    expect(text) { if (this.take().text !== text)
+        fail('#VALUE!'); }
+    parse() {
+        return this.context.bounded(() => {
+            const result = this.expression();
+            if (this.peek().kind !== 'end')
+                return fail('#VALUE!');
+            return result;
+        });
+    }
+    expression() {
+        let value = this.product();
+        while (this.peek().text === '+' || this.peek().text === '-') {
+            const op = this.take().text;
+            const right = numeric(this.product()), left = numeric(value);
+            value = finite(op === '+' ? left + right : left - right);
+        }
+        return value;
+    }
+    product() {
+        let value = this.unary();
+        while (this.peek().text === '*' || this.peek().text === '/') {
+            const op = this.take().text;
+            const right = numeric(this.unary()), left = numeric(value);
+            if (op === '/' && right === 0)
+                return fail('#DIV/0!');
+            value = finite(op === '*' ? left * right : left / right);
+        }
+        return value;
+    }
+    unary() {
+        if (this.peek().text === '+' || this.peek().text === '-') {
+            const negative = this.take().text === '-';
+            return this.context.bounded(() => finite(numeric(this.unary()) * (negative ? -1 : 1)));
+        }
+        return this.primary();
+    }
+    primary() {
+        const token = this.take();
+        if (token.kind === 'number')
+            return finite(Number(token.text));
+        if (token.kind === 'cell')
+            return this.context.cell(token.text);
+        if (token.text === '(')
+            return this.context.bounded(() => {
+                const value = this.expression();
+                this.expect(')');
+                return value;
+            });
+        if (token.kind === 'name')
+            return this.context.bounded(() => this.aggregate(token.text));
+        return fail('#VALUE!');
+    }
+    aggregate(name) {
+        if (!['SUM', 'AVG', 'AVERAGE', 'COUNT', 'MIN', 'MAX'].includes(name))
+            return fail('#NAME?');
+        this.expect('(');
+        const values = [];
+        if (this.peek().text !== ')') {
+            while (true) {
+                if (this.peek().kind === 'cell' && this.tokens[this.position + 1]?.text === ':') {
+                    const start = this.take().text;
+                    this.expect(':');
+                    const end = this.take();
+                    if (end.kind !== 'cell')
+                        return fail('#REF!');
+                    for (const value of this.context.range(start, end.text))
+                        if (typeof value === 'number')
+                            values.push(value);
+                }
+                else {
+                    const value = this.expression();
+                    if (typeof value === 'number')
+                        values.push(value);
+                }
+                if (this.peek().text !== ',')
+                    break;
+                this.take();
+            }
+        }
+        this.expect(')');
+        if (name === 'COUNT')
+            return values.length;
+        if (name === 'MIN' || name === 'MAX') {
+            if (!values.length)
+                return 0;
+            return values.reduce((a, b) => name === 'MIN' ? Math.min(a, b) : Math.max(a, b));
+        }
+        const sum = finite(values.reduce((a, b) => finite(a + b), 0));
+        if (name === 'SUM')
+            return sum;
+        return values.length ? finite(sum / values.length) : fail('#DIV/0!');
+    }
+}
+export function evaluateFormula(raw, cells) {
+    if (!raw.startsWith('='))
+        return raw;
+    try {
+        return new Parser(raw.slice(1), new Evaluation(cells)).parse() ?? 0;
+    }
+    catch (error) {
+        if (error instanceof FormulaError)
+            return error.code;
+        throw error;
+    }
+}
+/** 文本导出不能把危险前缀当成外部电子表格公式；调用者仍需完成 CSV 引号转义。 */
+export function safeSpreadsheetCsvText(value) {
+    return /^[\s\uFEFF]*[=+\-@]/u.test(value) || /^[\t\r\n]/.test(value) ? `'${value}` : value;
+}

package/dist/components/fieldComponentMap.js

@@ -70,6 +70,11 @@ export const builtinDisplayComponents = Object.freeze({
     images: validatedDisplay(props(nullable(Type.Array(Type.String()))), ImagesField),
     tags: validatedDisplay(props(nullable(Type.Union([Type.String(), Type.Array(Type.String())]))), TagField),
     date: validatedDisplay(props(date), DateField),
+    datetime: validatedDisplay(Type.Object({
+        value: date, format: Type.Literal('datetime'),
+    }, { additionalProperties: false }), DateField, input => ({ value: input.value, format: 'datetime' })),
+    // 原生 time 值没有日期或时区，不能交给 Date 解析。
+    time: textDisplay,
     daterange: validatedDisplay(props(nullable(Type.Union([
         Type.Tuple([date, date]),
         Type.Object({ start: dateProperty, end: dateProperty, from: dateProperty, to: dateProperty }, { additionalProperties: false }),

package/dist/components/fields/DateField.svelte

@@ -3,6 +3,7 @@
 </script>
 
 <script lang="ts">
+  import { dateFieldValue } from './date-field-value.js';
   import { cn } from '../../utils.js';
 
   interface Props {
@@ -45,7 +46,7 @@
 
   const formatted = $derived.by(() => {
     if (value == null || value === '') return nullLabel;
-    const d = value instanceof Date ? value : new Date(value);
+    const d = dateFieldValue(value, format === 'time');
     if (isNaN(d.getTime())) return nullLabel;
 
     if (format === 'iso') return d.toISOString();
@@ -68,8 +69,8 @@
 
   const fullIsoTitle = $derived.by(() => {
     if (value == null || value === '') return undefined;
-    const d = value instanceof Date ? value : new Date(value);
-    return isNaN(d.getTime()) ? undefined : d.toISOString();
+    const d = dateFieldValue(value, format === 'time');
+    return isNaN(d.getTime()) ? undefined : format === 'time' && typeof value === 'string' && /^\d{2}:/u.test(value) ? value : d.toISOString();
   });
 </script>
 

package/dist/components/fields/date-field-value.d.ts

@@ -0,0 +1,2 @@
+/** 原生 time 输入没有日期/时区；使用本地锚点格式化，不能按 ISO 时间戳解析。 */
+export declare function dateFieldValue(value: string | number | Date, timeOnly: boolean): Date;

package/dist/components/fields/date-field-value.js

@@ -0,0 +1,13 @@
+/** 原生 time 输入没有日期/时区；使用本地锚点格式化，不能按 ISO 时间戳解析。 */
+export function dateFieldValue(value, timeOnly) {
+    if (timeOnly && typeof value === 'string') {
+        const match = /^(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,3}))?)?$/u.exec(value);
+        if (match) {
+            const hour = Number(match[1]), minute = Number(match[2]), second = Number(match[3] ?? 0);
+            if (hour > 23 || minute > 59 || second > 59)
+                return new Date(NaN);
+            return new Date(1970, 0, 1, hour, minute, second, Number((match[4] ?? '').padEnd(3, '0')));
+        }
+    }
+    return value instanceof Date ? value : new Date(value);
+}

package/dist/components/json-schema-form-state.d.ts

@@ -0,0 +1,37 @@
+/** 嵌套表单的草稿与传输语义；不是替代服务端的 JSON Schema 校验器。 */
+export interface JsonSchemaFormSchema {
+    type?: string | string[];
+    const?: string | number | boolean | null;
+    readOnly?: boolean;
+    minimum?: number;
+    maximum?: number;
+    exclusiveMinimum?: number;
+    exclusiveMaximum?: number;
+    multipleOf?: number;
+    minLength?: number;
+    maxLength?: number;
+    minItems?: number;
+    maxItems?: number;
+    additionalProperties?: boolean;
+    title?: string;
+    description?: string;
+    properties?: Record<string, JsonSchemaFormSchema>;
+    items?: JsonSchemaFormSchema;
+    enum?: Array<string | number | boolean | null>;
+    default?: unknown;
+    required?: string[];
+}
+export declare const SCHEMA_FORM_LIMITS: Readonly<{
+    depth: 32;
+    nodes: 10000;
+    characters: 1048576;
+}>;
+/** Svelte 代理也通过普通数据属性读取；回调永远收不到活跃草稿的引用。 */
+export declare function schemaFormSnapshot(value: unknown): Record<string, unknown>;
+/** 默认值只填“缺失的键”；显式 undefined/null/false/0/空串都表示调用方的决定。 */
+export declare function initializeSchemaForm(schema: JsonSchemaFormSchema, value: Record<string, unknown>): Record<string, unknown>;
+export declare function schemaFormArrayItem(schema: JsonSchemaFormSchema): unknown;
+export declare function writeSchemaFormPath(value: Record<string, unknown>, path: readonly string[], nextValue: unknown): Record<string, unknown>;
+/** option.value 是索引，不是 String(value)：1 与 "1"、null 与 "null" 必须可区分。 */
+export declare function schemaFormEnumIndex(choices: readonly unknown[], value: unknown): string;
+export declare function schemaFormEnumValue(choices: readonly unknown[], index: string): unknown;