@svgrid/enterprise 2.4.0 → 2.5.0

package/dist/node/studio.js

@@ -1,3 +1,4 @@
+import "@svgrid/grid/filtering";
 import { defaultThemePreset, getThemePreset, resolveThemeTokens as resolveThemeTokens$1, themePresets } from "@svgrid/grid/themes";
 //#region src/schema.ts
 /** `first_name` / `firstName` / `first-name` -> `First Name`. */
@@ -128,7 +129,8 @@ function schemaToFormFields(schema) {
 			placeholder: f.input?.placeholder,
 			help: f.input?.help,
 			span: f.input?.span ?? (f.type === "json" ? 2 : 1),
-			computed: f.computed
+			computed: f.computed,
+			when: f.when
 		};
 	});
 }
@@ -1119,7 +1121,7 @@ function introspectOpenApi(specText) {
 }
 //#endregion
 //#region src/studio/introspect-db.ts
-function truthy(v) {
+function truthy$1(v) {
 	return v === 1 || v === "1" || v === true;
 }
 function identQuote(name) {
@@ -1154,7 +1156,7 @@ function fieldFrom(name, rawType, pk, notNull) {
 }
 /** Map catalog rows (aliased name/type/nullable/pk) from information_schema dialects. */
 function infoSchemaFields(rows) {
-	return rows.map((r) => fieldFrom(String(r.name), String(r.type ?? ""), truthy(r.pk), !truthy(r.nullable)));
+	return rows.map((r) => fieldFrom(String(r.name), String(r.type ?? ""), truthy$1(r.pk), !truthy$1(r.nullable)));
 }
 /** Map SQLite `PRAGMA table_info` rows (name/type/notnull/pk-as-index). */
 function sqliteFields(rows) {
@@ -1920,6 +1922,145 @@ function scaffoldApp(schemas, options = {}) {
 	return { files };
 }
 //#endregion
+//#region src/expressions/expression-columns.ts
+var TEXT = ["text"];
+var NUM = ["number"];
+var DATES = ["date", "datetime"];
+var ALL = [
+	"text",
+	"number",
+	"date",
+	"datetime",
+	"boolean"
+];
+/** The full operator catalogue, ordered as the editor should present it. */
+var OPERATORS = [
+	{
+		value: "equals",
+		label: "Equals",
+		types: ALL
+	},
+	{
+		value: "notEquals",
+		label: "Not equals",
+		types: ALL
+	},
+	{
+		value: "contains",
+		label: "Contains",
+		types: TEXT
+	},
+	{
+		value: "notContains",
+		label: "Not contains",
+		types: TEXT
+	},
+	{
+		value: "startsWith",
+		label: "Starts with",
+		types: TEXT
+	},
+	{
+		value: "endsWith",
+		label: "Ends with",
+		types: TEXT
+	},
+	{
+		value: "regex",
+		label: "Matches regex",
+		types: TEXT
+	},
+	{
+		value: "greaterThan",
+		label: "Greater than",
+		types: [...NUM, ...DATES]
+	},
+	{
+		value: "lessThan",
+		label: "Less than",
+		types: [...NUM, ...DATES]
+	},
+	{
+		value: "between",
+		label: "Between",
+		types: [...NUM, ...DATES],
+		range: true
+	},
+	{
+		value: "in",
+		label: "In",
+		types: ["text", "number"],
+		set: true
+	},
+	{
+		value: "notIn",
+		label: "Not in",
+		types: ["text", "number"],
+		set: true
+	},
+	{
+		value: "isBlank",
+		label: "Is blank",
+		types: ALL,
+		valueless: true
+	},
+	{
+		value: "isNotBlank",
+		label: "Is not blank",
+		types: ALL,
+		valueless: true
+	}
+];
+new Map(OPERATORS.map((op) => [op.value, op]));
+//#endregion
+//#region src/expressions/parse.ts
+/** Every column id referenced anywhere in a predicate (deduped, in order). */
+function collectColumnRefs(expr) {
+	const out = /* @__PURE__ */ new Set();
+	walkPredicate(expr, out);
+	return [...out];
+}
+function walkPredicate(expr, out) {
+	switch (expr.kind) {
+		case "and":
+		case "or":
+			expr.parts.forEach((p) => walkPredicate(p, out));
+			return;
+		case "not":
+			walkPredicate(expr.expr, out);
+			return;
+		case "cmp":
+			out.add(expr.column);
+			return;
+		case "scalarCmp":
+			walkScalar(expr.left, out);
+			walkScalar(expr.right, out);
+			return;
+		case "const": return;
+	}
+}
+function walkScalar(expr, out) {
+	switch (expr.kind) {
+		case "col":
+			out.add(expr.id);
+			return;
+		case "agg":
+			out.add(expr.column);
+			return;
+		case "neg":
+			walkScalar(expr.expr, out);
+			return;
+		case "bin":
+			walkScalar(expr.left, out);
+			walkScalar(expr.right, out);
+			return;
+		case "func":
+			expr.args.forEach((a) => walkScalar(a, out));
+			return;
+		case "lit": return;
+	}
+}
+//#endregion
 //#region src/studio/ui-components.generated.ts
 var GENERATED_UI_SURFACE = {
 	"SvButton": {
@@ -11402,11 +11543,15 @@ var SSR_READ_KINDS = /* @__PURE__ */ new Set([
 *  null when it must stay SPA. */
 function ssrScreenShape(project, screen) {
 	if (!screen.entity || screen.code) return null;
-	const kind = project.dataSources?.[screen.entity]?.kind ?? project.dataSource;
-	if (kind !== "memory" && kind !== "sql") return null;
+	const source = project.dataSources?.[screen.entity];
+	const kind = source?.kind ?? project.dataSource;
+	if (kind === "rest") {
+		if (!(source?.kind === "rest" && /^https?:\/\//i.test(source.baseUrl ?? ""))) return null;
+	} else if (kind !== "memory" && kind !== "sql") return null;
 	const blocks = screen.blocks ?? [];
-	if (blocks.length === 1 && blocks[0].config.kind === "grid") {
-		const g = blocks[0].config;
+	const grids = blocks.filter((b) => b.config.kind === "grid");
+	if (grids.length === 1 && blocks.every((b) => b.config.kind === "grid" || b.config.kind === "filter")) {
+		const g = grids[0].config;
 		if (g.treeData || g.scheduler) return null;
 		return "grid";
 	}
@@ -11431,6 +11576,34 @@ function setScreenRenderMode(project, screenId, mode) {
 function isSsrScreen(project, screen) {
 	return screenRenderMode(project, screen) === "ssr" && ssrEligible(project, screen);
 }
+/**
+* Turn server rendering on for every screen that can support it, for entities
+* backed by a real database. Applied when a project is first generated, so a new
+* app reads as idiomatic SvelteKit (a `load` and form `actions`) rather than a
+* client SPA. Screens that already state a mode are left alone, so this never
+* overrides a choice somebody made.
+*
+* Deliberately limited to sources that hold one copy of the data. In-memory and
+* PGlite sources are module singletons, so an SSR screen would read and write the
+* *server's* copy of the rows while the app's remaining SPA screens read the
+* browser's - create a row on one and the other never sees it. SQL and REST have
+* no such split: every path goes to the same database or the same remote API.
+*/
+var SSR_DEFAULT_KINDS = /* @__PURE__ */ new Set(["sql", "rest"]);
+function withSsrDefaults(project) {
+	return {
+		...project,
+		screens: project.screens.map((screen) => {
+			if (screen.renderMode || !screen.entity) return screen;
+			const kind = project.dataSources?.[screen.entity]?.kind ?? project.dataSource;
+			if (!SSR_DEFAULT_KINDS.has(kind)) return screen;
+			return ssrEligible(project, screen) ? {
+				...screen,
+				renderMode: "ssr"
+			} : screen;
+		})
+	};
+}
 /** The triggers configured for an entity (or an empty object). */
 function triggersOf(project, entity) {
 	return project.triggers?.[entity] ?? {};
@@ -13333,6 +13506,19 @@ function validateProject(project) {
 		level: "warning",
 		message: "No screens yet."
 	});
+	for (const entity of project.entities) {
+		const names = new Set(entity.fields.map((f) => f.field));
+		for (const field of entity.fields) {
+			if (!field.when) continue;
+			for (const [flag, expr] of Object.entries(field.when)) {
+				if (!expr) continue;
+				for (const ref of collectColumnRefs(expr)) if (!names.has(ref)) issues.push({
+					level: "error",
+					message: `"${entity.name}.${field.field}" has a ${flag} condition on "${ref}", which is not a field on ${entity.name}.`
+				});
+			}
+		}
+	}
 	const routes = /* @__PURE__ */ new Set();
 	for (const s of project.screens) {
 		if (s.entity !== void 0 && !entityOf(project, s.entity)) issues.push({
@@ -13854,7 +14040,7 @@ function namesFor(schema) {
 /** Lookup variable name for a relation field, e.g. `postAuthorIdLookup`. */
 var lookupVar = (schema, field) => `${camel(schema.name)}${pascal(field)}Lookup`;
 function rowType(schema, derived) {
-	const optional = (f) => derived.has(f.field) || !!f.formula || !!f.computed;
+	const optional = (f) => derived.has(f.field) || !!f.formula || !!f.computed || !!f.when?.visible;
 	const lines = schema.fields.map((f) => `  ${f.field}${optional(f) ? "?" : ""}: ${tsType(f)}`);
 	return `export type ${pascal(schema.name)} = {\n${lines.join("\n")}\n}`;
 }
@@ -14925,6 +15111,27 @@ function themeStyleString(theme) {
 	return `${Object.entries(tokens).map(([k, v]) => `${k}: ${v}`).join("; ")}; color-scheme: ${isDarkTheme(theme) ? "dark" : "light"}; font-family: ${tokens["--sg-font"]}`;
 }
 //#endregion
+//#region src/edit-panel.ts
+/** True when any field's behaviour depends on the values (i.e. has a `when`). */
+function hasFieldConditions(schema) {
+	return schema.fields.some((f) => !!f.when && (!!f.when.visible || !!f.when.disabled || !!f.when.required));
+}
+//#endregion
+//#region src/version.ts
+/**
+* The version of this package, as a value the pure (browser-safe) generator can
+* read - it cannot open `package.json` at runtime.
+*
+* Generated apps depend on `^SVGRID_VERSION` rather than `latest`, so an app
+* always installs a runtime at least as new as the generator that wrote it.
+* `latest` made that a coin toss: an app scaffolded today and the same app
+* scaffolded tomorrow could resolve different runtimes, and an unrelated publish
+* could break an app nobody had touched.
+*
+* `version.test.ts` asserts this matches `package.json`, so the two cannot drift.
+*/
+var SVGRID_VERSION = "2.4.0";
+//#endregion
 //#region src/studio/emit-project.ts
 var has = (blocks, kind) => blocks.some((b) => b.config.kind === kind);
 /** Per-Tabs-block active-tab state var + a stable tab id. */
@@ -16828,9 +17035,6 @@ function screenChildEntities(blocks, resolve) {
 	}
 	return [...out.values()];
 }
-/** `+page.server.ts` for a read-only SSR screen (data-viz / detail / master-
-*  detail): a `load` that returns the full dataset (+ each child collection) -
-*  the page renders real SSR HTML from `data.*`. No actions (read-only). */
 function ssrReadServerFile(schema, screen, sourceKind, accessEnabled, screenIds, resolve) {
 	const n = namesFor(schema);
 	const isSql = sourceKind === "sql";
@@ -16845,8 +17049,8 @@ function ssrReadServerFile(schema, screen, sourceKind, accessEnabled, screenIds,
 		contents: `import type { PageServerLoad } from './$types'
 import type { ServerRequest } from '@svgrid/grid'
 ${isSql ? "import { createKitDataSource } from '@svgrid/enterprise'\n" : ""}${rbac ? "import { error } from '@sveltejs/kit'\nimport { authorizeAction, getServerRole } from '$lib/access'\n" : ""}${memImports.length ? `import { ${memImports.join(", ")} } from '$lib/data'\n` : ""}
-// The app shell is a client SPA (+layout.ts ssr=false); this screen opts back
-// INTO server rendering - real SSR HTML, not just a server-side load.
+// This screen renders on the server: real SSR HTML, not just a server-side
+// load. Stated explicitly so it holds whichever way the root layout is set.
 export const ssr = true
 ${rbac ? `\nconst SCREEN_IDS = ${JSON.stringify(screenIds)}\n` : ""}
 const PAGE: ServerRequest = { startRow: 0, endRow: 1000, pageIndex: 0, pageSize: 1000, sortModel: [], filterModel: {} }
@@ -16896,18 +17100,42 @@ function ssrQueryHelperFile() {
 	};
 }
 var htmlEsc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+/** Escape a value going inside a double-quoted HTML attribute. */
+var attrEsc = (s) => htmlEsc(s).replace(/"/g, "&quot;");
+/**
+* The field's own constraints as native HTML attributes, so a server-rendered
+* form validates in the browser too. The server still re-checks every one of
+* them: these only save a round-trip, they never decide anything.
+*/
+function attrs(f) {
+	const out = [];
+	if (f.input?.placeholder) out.push(`placeholder="${attrEsc(f.input.placeholder)}"`);
+	if (f.type === "number") {
+		if (f.min != null) out.push(`min="${f.min}"`);
+		if (f.max != null) out.push(`max="${f.max}"`);
+		if (f.input?.step != null) out.push(`step="${f.input.step}"`);
+	} else {
+		if (f.minLength != null) out.push(`minlength="${f.minLength}"`);
+		if (f.maxLength != null) out.push(`maxlength="${f.maxLength}"`);
+		if (f.pattern && !f.format) out.push(`pattern="${attrEsc(f.pattern)}"`);
+	}
+	return out.length ? " " + out.join(" ") : "";
+}
 /** The `+page.server.ts` + SSR `+page.svelte` for a single-grid CRUD screen. */
 function emitSsrGridScreen(schema, screen, sourceKind, accessEnabled, screenIds, byName) {
 	const n = namesFor(schema);
 	const isSql = sourceKind === "sql";
+	const isRest = sourceKind === "rest";
 	const relSchemaOf = (f) => byName.get(f.relation.entity);
 	const relIdOf = (rs) => rs.idField ?? rs.fields.find((x) => x.primaryKey)?.field ?? "id";
-	const grid = screen.blocks[0].config;
+	const grid = screen.blocks.find((b) => b.config.kind === "grid").config;
+	const facetPanel = screen.blocks.find((b) => b.config.kind === "filter")?.config;
 	const pageSize = grid.pageSize && grid.pageSize > 0 ? grid.pageSize : 25;
 	const wantsFilter = grid.filterable !== false;
 	const idField = schema.idField ?? schema.fields.find((f) => f.primaryKey)?.field ?? "id";
 	const isFormHidden = (f) => f.hidden === true || typeof f.hidden === "object" && !!f.hidden.form;
-	const formFields = schema.fields.filter((f) => f.field !== idField && !f.primaryKey && !f.readonly && !f.computed && !f.formula && !isFormHidden(f));
+	const editable = schema.fields.filter((f) => f.field !== idField && !f.primaryKey && !f.readonly && !f.computed && !f.formula && !isFormHidden(f));
+	const formFields = grid.formFields?.length ? grid.formFields.map((name) => editable.find((f) => f.field === name)).filter(Boolean) : editable;
 	const normType = (t) => t === "number" ? "number" : t === "boolean" ? "boolean" : "text";
 	const fieldTypesLit = `{ ${formFields.map((f) => `${jsStr(f.field)}: ${jsStr(normType(f.type))}`).join(", ")} }`;
 	const isRel = (f) => f.type === "relation" && !!f.relation && byName.has(f.relation.entity);
@@ -16924,12 +17152,18 @@ function emitSsrGridScreen(schema, screen, sourceKind, accessEnabled, screenIds,
 	const relReturn = relFields.map((f) => `, ${f.field}Options`).join("");
 	const src = isSql ? "source(fetch)" : n.sourceVar;
 	const fetchArg = isSql ? ", fetch" : "";
-	const enterpriseImports = isSql ? "validateAll, createKitDataSource" : "validateAll";
-	const sourceImport = isSql ? "" : `import { ${[.../* @__PURE__ */ new Set([n.sourceVar, ...relSourceVars]), "nextId"].join(", ")} } from '$lib/data'\n`;
+	const conditional = hasFieldConditions(schema);
+	const readValues = (fd) => conditional ? `stripHiddenValues(${n.schemaVar}, formToValues(${fd}))` : `formToValues(${fd})`;
+	const enterpriseImports = [
+		"validateAll",
+		...conditional ? ["stripHiddenValues"] : [],
+		...isSql ? ["createKitDataSource"] : []
+	].join(", ");
+	const sourceImport = isSql ? "" : `import { ${[.../* @__PURE__ */ new Set([n.sourceVar, ...relSourceVars]), ...isRest ? [] : ["nextId"]].join(", ")} } from '$lib/data'\n`;
 	const schemaImport = `import { ${n.schemaVar}${isSql ? `, type ${n.type}` : ""} } from '$lib/schemas'`;
-	const idConst = isSql ? "" : `\nconst ID_FIELD = ${jsStr(idField)}`;
+	const idConst = isSql || isRest ? "" : `\nconst ID_FIELD = ${jsStr(idField)}`;
 	const srcHelper = isSql ? `\n// Same-origin client over the connected /api/${n.route} route (that route runs\n// validation, RBAC, triggers + audit via createKitHandlers).\nconst source = (fetch: typeof globalThis.fetch) => createKitDataSource<${n.type}>({ endpoint: ${jsStr("/api/" + n.route)}, fetch })\n` : "";
-	const createCall = isSql ? `await ${src}.createRow(values)` : `await ${n.sourceVar}.createRow({ [ID_FIELD]: nextId(${jsStr(n.idPrefix)}), ...values })`;
+	const createCall = isSql || isRest ? `await ${src}.createRow(values)` : `await ${n.sourceVar}.createRow({ [ID_FIELD]: nextId(${jsStr(n.idPrefix)}), ...values })`;
 	const rbac = accessEnabled && !isSql;
 	const localsArg = rbac ? ", locals" : "";
 	const readGuard = rbac ? `    if (!authorizeAction(getServerRole({ locals }), 'read', SCREEN_IDS)) throw error(403, 'Not allowed')\n` : "";
@@ -16940,8 +17174,8 @@ import { ${enterpriseImports} } from '@svgrid/enterprise'
 ${rbac ? "import { authorizeAction, getServerRole } from '$lib/access'\n" : ""}${sourceImport}${schemaImport}
 import { planFromSearchParams } from '$lib/server/query'
 
-// The app shell is a client SPA (+layout.ts ssr=false); this screen opts back
-// INTO server rendering - real SSR HTML, not just a server-side load.
+// This screen renders on the server: real SSR HTML, not just a server-side
+// load. Stated explicitly so it holds whichever way the root layout is set.
 export const ssr = true
 ${idConst}${rbac ? `\nconst SCREEN_IDS = ${JSON.stringify(screenIds)}` : ""}
 const FIELD_TYPES: Record<string, 'text' | 'number' | 'boolean'> = ${fieldTypesLit}
@@ -16967,7 +17201,7 @@ ${relPrefetch ? relPrefetch + "\n" : ""}  return { rows, total: rowCount, page:
 
 export const actions: Actions = {
   create: async ({ request${fetchArg}${localsArg} }) => {
-${writeGuard("create")}    const values = formToValues(await request.formData())
+${writeGuard("create")}    const values = ${readValues("await request.formData()")}
     const errors = await validateAll(${n.schemaVar}, values)
     if (Object.keys(errors).length) return fail(422, { errors, values })
     ${createCall}
@@ -16976,7 +17210,7 @@ ${writeGuard("create")}    const values = formToValues(await request.formData())
   update: async ({ request${fetchArg}${localsArg} }) => {
     const fd = await request.formData()
 ${writeGuard("update")}    const id = String(fd.get('__id') ?? '')
-    const values = formToValues(fd)
+    const values = ${readValues("fd")}
     const errors = await validateAll(${n.schemaVar}, values)
     if (Object.keys(errors).length) return fail(422, { errors, values })
     await ${src}.updateRow(id, values)
@@ -16989,6 +17223,58 @@ ${writeGuard("delete")}    const fd = await request.formData()
   },
 }
 `;
+	const facetControls = {
+		select: false,
+		input: false
+	};
+	const facetForm = (() => {
+		if (!facetPanel) return "";
+		const fields = filterFieldsOf(schema, facetPanel);
+		if (!fields.length) return "";
+		const cur = (f) => `(page.url.searchParams.get(${jsStr("f_" + f.field)}) ?? '')`;
+		const optionList = (f, opts) => [`<option value="" selected={${cur(f)} === ''}>Any</option>`].concat(opts.map((o) => `<option value=${jsStr(o.value)} selected={${cur(f)} === ${jsStr(o.value)}}>${htmlEsc(o.label)}</option>`)).join("\n            ");
+		return `
+  <form method="GET" class="sk-facets">
+    <input type="hidden" name="sort" value={page.url.searchParams.get('sort') ?? ''} />
+${fields.map((f) => {
+			const key = jsStr("f_" + f.field);
+			const opts = enumOpts(f);
+			let control;
+			if (opts.length) {
+				facetControls.select = true;
+				control = `<select name=${key}>\n            ${optionList(f, opts)}\n          </select>`;
+			} else if (f.type === "boolean") {
+				facetControls.select = true;
+				control = `<select name=${key}>\n            ${optionList(f, [{
+					value: "true",
+					label: "Yes"
+				}, {
+					value: "false",
+					label: "No"
+				}])}\n          </select>`;
+			} else {
+				facetControls.input = true;
+				control = `<input name=${key} value={${cur(f)}} placeholder="Any" />`;
+			}
+			return `      <label class="sk-facet">\n        <span>${htmlEsc(f.label ?? f.field)}</span>\n        ${control}\n      </label>`;
+		}).join("\n")}
+    <div class="sk-facet-actions">
+      <button type="submit">Filter</button>
+      <a href={page.url.pathname}>Clear</a>
+    </div>
+  </form>
+`;
+	})();
+	const facetCss = !facetForm ? "" : [
+		"  .sk-facets { display: flex; flex-wrap: wrap; align-items: flex-end; gap: 12px; margin-bottom: 14px; padding: 12px 14px; border: 1px solid var(--sg-border, #cbd5e1); border-radius: 10px; background: var(--sg-surface, #f8fafc); }",
+		"  .sk-facet { display: flex; flex-direction: column; gap: 4px; font-size: 13px; }",
+		"  .sk-facet span { color: var(--sg-muted, #64748b); }",
+		...facetControls.select && facetControls.input ? ["  .sk-facet input, .sk-facet select { font: inherit; padding: 6px 9px; border-radius: 8px; border: 1px solid var(--sg-border, #cbd5e1); background: var(--sg-input-bg, #fff); color: var(--sg-fg, #0f172a); }"] : facetControls.select ? ["  .sk-facet select { font: inherit; padding: 6px 9px; border-radius: 8px; border: 1px solid var(--sg-border, #cbd5e1); background: var(--sg-input-bg, #fff); color: var(--sg-fg, #0f172a); }"] : ["  .sk-facet input { font: inherit; padding: 6px 9px; border-radius: 8px; border: 1px solid var(--sg-border, #cbd5e1); background: var(--sg-input-bg, #fff); color: var(--sg-fg, #0f172a); }"],
+		"  .sk-facet-actions { display: flex; align-items: center; gap: 10px; margin-left: auto; }",
+		"  .sk-facet-actions button { font: inherit; padding: 7px 14px; border-radius: 8px; border: 1px solid var(--sg-accent, #4f46e5); background: var(--sg-accent, #4f46e5); color: #fff; cursor: pointer; }",
+		"  .sk-facet-actions a { font-size: 13px; color: var(--sg-muted, #64748b); }",
+		""
+	].join("\n");
 	const row = `(editing as Record<string, unknown>)`;
 	const fieldBlocks = formFields.map((f) => {
 		const key = jsStr(f.field);
@@ -16997,13 +17283,49 @@ ${writeGuard("delete")}    const fd = await request.formData()
 		if (normType(f.type) === "boolean") input = `<input type="checkbox" name=${key} checked={!isCreate && !!${row}[${key}]} />`;
 		else if (f.options && f.options.length) input = `<select name=${key}${req}>${f.options.map((o) => `<option value=${jsStr(String(o.value))} selected={!isCreate && ${row}[${key}] === ${jsStr(String(o.value))}}>${htmlEsc(o.label ?? String(o.value))}</option>`).join("")}</select>`;
 		else if (isRel(f)) input = `<select name=${key}${req}>\n            <option value="">-</option>\n            {#each data.${f.field}Options as o (o.value)}<option value={o.value} selected={!isCreate && String(${row}[${key}] ?? '') === o.value}>{o.label}</option>{/each}\n          </select>`;
-		else input = `<input type="${normType(f.type) === "number" ? "number" : f.type === "date" || f.type === "dateString" ? "date" : "text"}" name=${key} value={isCreate ? '' : (${row}[${key}] ?? '')}${req} />`;
-		return `        <label class="sk-field">
+		else if (f.input?.editorType === "textarea" || f.type === "json") input = `<textarea name=${key}${req}${attrs(f)}>{isCreate ? '' : (${row}[${key}] ?? '')}</textarea>`;
+		else input = `<input type="${f.format === "email" ? "email" : f.format === "url" ? "url" : normType(f.type) === "number" ? "number" : f.type === "date" || f.type === "dateString" ? "date" : "text"}" name=${key} value={isCreate ? '' : (${row}[${key}] ?? '')}${req}${attrs(f)} />`;
+		const hint = f.input?.help;
+		return `        <label class="sk-field${f.input?.span === 2 ? " sk-field--wide" : ""}">
           <span>${htmlEsc(f.label ?? f.field)}${f.required ? " *" : ""}</span>
           ${input}
-          {#if form?.errors?.[${key}]}<em class="sk-err">{form.errors[${key}]}</em>{/if}
+${hint ? `          {#if !form?.errors?.[${key}]}<small class="sk-hint">${htmlEsc(hint)}</small>{/if}\n` : ""}          {#if form?.errors?.[${key}]}<em class="sk-err">{form.errors[${key}]}</em>{/if}
         </label>`;
-	}).join("\n");
+	});
+	const blockFor = (name) => {
+		const i = formFields.findIndex((f) => f.field === name);
+		return i === -1 ? null : fieldBlocks[i];
+	};
+	const layout = {
+		columns: grid.formColumns ?? schema.form?.columns,
+		sections: grid.formSections?.length ? grid.formSections : schema.form?.sections
+	};
+	const ssrSections = layout?.sections?.length ? (() => {
+		const assigned = /* @__PURE__ */ new Set();
+		const groups = layout.sections.map((s) => {
+			const items = s.fields.map((name) => {
+				assigned.add(name);
+				return blockFor(name);
+			}).filter(Boolean);
+			return {
+				title: s.title,
+				description: s.description,
+				columns: s.columns,
+				items
+			};
+		}).filter((g) => g.items.length);
+		const rest = formFields.filter((f) => !assigned.has(f.field)).map((f) => blockFor(f.field)).filter(Boolean);
+		return rest.length ? [...groups, {
+			title: void 0,
+			description: void 0,
+			columns: void 0,
+			items: rest
+		}] : groups;
+	})() : null;
+	const formCols = layout?.columns ?? 1;
+	const fieldsMarkup = ssrSections ? ssrSections.map((g) => `        <fieldset class="sk-group" style="--sk-cols: ${g.columns ?? formCols}">
+${g.title ? `          <legend>${htmlEsc(g.title)}</legend>\n` : ""}${g.description ? `          <p class="sk-group__desc">${htmlEsc(g.description)}</p>\n` : ""}${g.items.join("\n")}
+        </fieldset>`).join("\n") : `        <div class="sk-group" style="--sk-cols: ${formCols}">\n${fieldBlocks.join("\n")}\n        </div>`;
 	const page = `<script lang="ts">
   import { SvGrid, renderSnippet, type ColumnDef, type CellContext } from '@svgrid/grid'
   import { schemaToColumns } from '@svgrid/enterprise'
@@ -17072,7 +17394,7 @@ ${wantsFilter ? `
   <h1>{TITLE}</h1>
   <button type="button" class="sk-btn sk-btn--primary" onclick={() => (editing = 'create')}>{NEW_LABEL}</button>
 </header>
-
+${facetForm}
 <SvGrid
   data={data.rows}
   {columns}
@@ -17091,7 +17413,7 @@ ${wantsFilter ? `
     <form method="POST" action={isCreate ? '?/create' : '?/update'} class="sk-form" use:enhance={onSubmit}>
       <h2>{isCreate ? NEW_LABEL : 'Edit ${htmlEsc(n.label)}'}</h2>
       {#if !isCreate}<input type="hidden" name="__id" value={${row}[ID_FIELD] as string} />{/if}
-${fieldBlocks}
+${fieldsMarkup}
       <div class="sk-form__actions">
         <button type="button" class="sk-btn" onclick={() => (editing = null)}>Cancel</button>
         <button type="submit" class="sk-btn sk-btn--primary">Save</button>
@@ -17105,12 +17427,19 @@ ${fieldBlocks}
   .sk-head h1 { margin: 0; font-size: 20px; }
   .sk-btn { font: inherit; padding: 7px 14px; border-radius: 8px; border: 1px solid var(--sg-border, #cbd5e1); background: var(--sg-bg, #fff); color: var(--sg-fg, #0f172a); cursor: pointer; }
   .sk-btn--primary { background: var(--sg-accent, #4f46e5); border-color: var(--sg-accent, #4f46e5); color: #fff; }
-  .sk-rowact { display: flex; gap: 10px; }
+${facetCss}  .sk-rowact { display: flex; gap: 10px; }
   .sk-link { background: none; border: none; padding: 0; font: inherit; color: var(--sg-accent, #4f46e5); cursor: pointer; }
   .sk-danger { color: #dc2626; }
   .sk-overlay { position: fixed; inset: 0; background: rgba(15, 23, 42, 0.4); display: grid; place-items: center; z-index: 50; }
   .sk-form { width: min(480px, 92vw); max-height: 90vh; overflow: auto; background: var(--sg-bg, #fff); color: var(--sg-fg, #0f172a); border-radius: 12px; padding: 22px; display: flex; flex-direction: column; gap: 12px; box-shadow: 0 24px 60px -20px rgba(15, 23, 42, 0.5); }
   .sk-form h2 { margin: 0 0 4px; font-size: 16px; }
+  .sk-group { display: grid; grid-template-columns: repeat(var(--sk-cols, 1), minmax(0, 1fr)); gap: 12px; border: 0; padding: 0; margin: 0; min-width: 0; }
+  .sk-group + .sk-group { margin-top: 14px; padding-top: 14px; border-top: 1px solid var(--sg-border, #e2e8f0); }
+  .sk-group legend { grid-column: 1 / -1; padding: 0; font-size: 12px; font-weight: 700; letter-spacing: 0.02em; text-transform: uppercase; color: var(--sg-muted, #64748b); }
+  .sk-group__desc { grid-column: 1 / -1; margin: 0; font-size: 12px; color: var(--sg-muted, #64748b); }
+  .sk-field--wide { grid-column: 1 / -1; }
+  .sk-hint { color: var(--sg-muted, #64748b); font-size: 11.5px; }
+  @media (max-width: 560px) { .sk-group { grid-template-columns: 1fr; } }
   .sk-field { display: flex; flex-direction: column; gap: 4px; font-size: 13px; }
   .sk-field span { color: var(--sg-muted, #64748b); }
   .sk-field input, .sk-field select { font: inherit; padding: 7px 9px; border-radius: 8px; border: 1px solid var(--sg-border, #cbd5e1); background: var(--sg-input-bg, #fff); color: var(--sg-fg, #0f172a); }
@@ -17182,13 +17511,22 @@ function emitStudioProject(project) {
 		const schema = byName.get(screen.entity);
 		if (!schema) throw new Error(`emitStudioProject: screen "${screen.title}" references missing entity "${screen.entity}"`);
 		if (isSsrScreen(project, screen)) {
-			const srcKind = sources[screen.entity]?.kind === "sql" ? "sql" : "memory";
+			const kind = sources[screen.entity]?.kind;
+			const srcKind = kind === "sql" ? "sql" : kind === "rest" ? "rest" : "memory";
 			if (ssrScreenShape(project, screen) === "grid") pages.push(...emitSsrGridScreen(schema, screen, srcKind, accessEnabled, screensByEntity.get(screen.entity) ?? [], byName));
 			else pages.push(ssrReadServerFile(schema, screen, srcKind, accessEnabled, screensByEntity.get(screen.entity) ?? [], resolve), screenPage(schema, rawByName.get(screen.entity) ?? schema, screen, resolve, (name) => rawByName.get(name), accessEnabled, i18nEnabled, routeById, drillEnabled, true));
 			continue;
 		}
 		pages.push(screenPage(schema, rawByName.get(screen.entity) ?? schema, screen, resolve, (name) => rawByName.get(name), accessEnabled, i18nEnabled, routeById, drillEnabled, false, sources[screen.entity]));
 	}
+	if (project.screens.some((s) => isSsrScreen(project, s))) for (const screen of project.screens) {
+		if (isSsrScreen(project, screen) || !screen.route) continue;
+		pages.push({
+			path: `src/routes/${screen.route}/+page.ts`,
+			description: `${screen.title} renders in the browser (client data source).`,
+			contents: `// This screen loads its rows in the browser, so it opts out of the root\n// layout's server rendering.\nexport const ssr = false\n`
+		});
+	}
 	const ssrHelpers = project.screens.some((s) => isSsrScreen(project, s)) ? [ssrQueryHelperFile()] : [];
 	const actionRouteFiles = [...actionsById.values()].map(({ action, screenId }) => actionRouteFile(action, screenId, accessEnabled));
 	const nav = [...project.screens].filter((s) => s.nav?.show !== false).sort((a, b) => (a.nav?.order ?? 0) - (b.nav?.order ?? 0)).map((s) => ({
@@ -19162,6 +19500,23 @@ main().then(() => process.exit(0)).catch((err) => { console.error(err); process.
 	];
 }
 var appSlug = (title) => (title || "studio-app").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "studio-app";
+/**
+* The root `+layout.ts`.
+*
+* An app with server-rendered screens leaves SvelteKit's own default in place
+* (SSR on) and lets each client-only screen opt out in its own `+page.ts` - so
+* the app reads the way a hand-written SvelteKit app does, instead of announcing
+* itself as a SPA in the first file anyone opens. With nothing to server-render,
+* the whole app stays a SPA as before.
+*/
+function rootLayoutModule(project) {
+	const anySsr = project.screens.some((s) => isSsrScreen(project, s));
+	return {
+		path: "src/routes/+layout.ts",
+		description: anySsr ? "Root layout options (SSR on; client-only screens opt out per page)." : "Client SPA (in-memory sources persist across navigation).",
+		contents: anySsr ? `// Server rendering stays on (SvelteKit's default). Screens that have to run in\n// the browser - anything on an in-memory source, or a shape that can't render on\n// the server - opt out in their own +page.ts.\nexport const prerender = false\n` : `// In-memory sources are module singletons, so render as a client SPA. Move an\n// entity to SQL / Supabase and its /api route still runs server-side.\nexport const ssr = false\nexport const prerender = false\n`
+	};
+}
 /** The static SvelteKit + Vite scaffolding around the generated screens. */
 var SCAFFOLD_STATIC = [
 	{
@@ -19184,11 +19539,6 @@ var SCAFFOLD_STATIC = [
 		description: "SvelteKit app types.",
 		contents: `declare global {\n  namespace App {}\n}\n\nexport {}\n`
 	},
-	{
-		path: "src/routes/+layout.ts",
-		description: "Client SPA (in-memory sources persist across navigation).",
-		contents: `// In-memory sources are module singletons, so render as a client SPA. Move an\n// entity to SQL / Supabase and its /api route still runs server-side.\nexport const ssr = false\nexport const prerender = false\n`
-	},
 	{
 		path: ".npmrc",
 		description: "npm config.",
@@ -19523,9 +19873,10 @@ function svelteConfig(plan) {
 /** The runtime npm deps the generated source imports, keyed by package -> range.
 *  One source of truth for package.json AND the fragment-mode dependency report. */
 function runtimeDeps(project, allSource) {
+	const svgrid = `^${SVGRID_VERSION}`;
 	const dependencies = {
-		"@svgrid/grid": "latest",
-		"@svgrid/enterprise": "latest"
+		"@svgrid/grid": svgrid,
+		"@svgrid/enterprise": svgrid
 	};
 	if (allSource.includes("from '@supabase/supabase-js'")) dependencies["@supabase/supabase-js"] = "^2.45.0";
 	if (allSource.includes("import pg from 'pg'")) dependencies["pg"] = "^8.11.0";
@@ -19730,6 +20081,7 @@ function emitStudioAppBundle(project) {
 		},
 		...plan.files,
 		...cronScheduleFiles(project, plan),
+		rootLayoutModule(project),
 		...SCAFFOLD_STATIC,
 		...envExample(allSource) ? [{
 			path: ".env.example",
@@ -20325,14 +20677,14 @@ function crudAppFromSchemas(schemas, opts = {}) {
 			seed
 		} : source;
 	}
-	return sanitizeProject({
+	return withSsrDefaults(sanitizeProject({
 		title: opts.title ?? "My Studio App",
 		entities: [...schemas],
 		screens,
 		dataSource: kind,
 		dataSources,
 		...opts.theme ? { theme: opts.theme } : {}
-	});
+	}));
 }
 //#endregion
 //#region src/studio/samples/shared.ts
@@ -20379,6 +20731,28 @@ function pad(schema, rows, target, fkPools = {}) {
 }
 /** The `id` values of a seed array (for building foreign-key pools). */
 var ids = (rows) => rows.map((r) => String(r.id));
+/**
+* `field = value` as a form condition (see `EntityField.when`). Helpers rather
+* than hand-written literals because an operator the filter engine does not know
+* silently matches everything, which would leave a conditional field permanently
+* on-screen.
+*/
+var whenIs = (field, value) => ({
+	kind: "cmp",
+	column: field,
+	op: "equals",
+	value
+});
+/** `field` is any one of `values`. */
+var whenIsAny = (field, values) => ({
+	kind: "or",
+	parts: values.map((value) => ({
+		kind: "cmp",
+		column: field,
+		op: "equals",
+		value
+	}))
+});
 /** A Kanban board screen: an optional filter panel + a board grouping rows by an
 *  enum field into draggable columns (the signature "pipeline" view). */
 function boardScreen(entity, meta, opts) {
@@ -20859,6 +21233,38 @@ var deals$1 = {
 			field: "closeDate",
 			type: "date",
 			label: "Close date"
+		},
+		{
+			field: "lostReason",
+			type: "enum",
+			label: "Lost to",
+			hidden: { grid: true },
+			options: [
+				{
+					value: "price",
+					label: "Price"
+				},
+				{
+					value: "competitor",
+					label: "Competitor"
+				},
+				{
+					value: "timing",
+					label: "Timing"
+				},
+				{
+					value: "no-budget",
+					label: "No budget"
+				},
+				{
+					value: "other",
+					label: "Other"
+				}
+			],
+			when: {
+				visible: whenIs("stage", "lost"),
+				required: whenIs("stage", "lost")
+			}
 		}
 	]
 };
@@ -21175,7 +21581,8 @@ var seed$17 = {
 			value: 15e3,
 			probability: 0,
 			owner: "Priya Patel",
-			closeDate: "2026-05-10"
+			closeDate: "2026-05-10",
+			lostReason: "competitor"
 		},
 		{
 			id: "dl5",
@@ -23787,6 +24194,21 @@ var tickets = {
 			min: 0,
 			input: { help: "Time to the first agent reply" }
 		},
+		{
+			field: "resolution",
+			type: "text",
+			label: "Resolution",
+			hidden: { grid: true },
+			input: {
+				editorType: "textarea",
+				span: 2,
+				help: "What fixed it - required to resolve or close"
+			},
+			when: {
+				visible: whenIsAny("status", ["resolved", "closed"]),
+				required: whenIsAny("status", ["resolved", "closed"])
+			}
+		},
 		{
 			field: "satisfaction",
 			type: "number",
@@ -23796,7 +24218,8 @@ var tickets = {
 			input: {
 				editorType: "rating",
 				help: "Customer rating on close"
-			}
+			},
+			when: { visible: whenIsAny("status", ["resolved", "closed"]) }
 		},
 		{
 			field: "estimateHrs",
@@ -23991,7 +24414,8 @@ var seed$14 = {
 			firstResponseMins: 20,
 			satisfaction: 5,
 			estimateHrs: 1,
-			hourlyRate: 60
+			hourlyRate: 60,
+			resolution: "Walked the customer through Export > CSV in the toolbar."
 		},
 		{
 			id: "tk5",
@@ -24006,7 +24430,8 @@ var seed$14 = {
 			firstResponseMins: 8,
 			satisfaction: 4,
 			estimateHrs: 1,
-			hourlyRate: 75
+			hourlyRate: 75,
+			resolution: "Upgraded the account to Business and prorated the invoice."
 		},
 		{
 			id: "tk6",
@@ -24036,7 +24461,8 @@ var seed$14 = {
 			firstResponseMins: 15,
 			satisfaction: 4,
 			estimateHrs: 2,
-			hourlyRate: 90
+			hourlyRate: 90,
+			resolution: "Refunded the duplicate charge; payment retry guard added."
 		},
 		{
 			id: "tk8",
@@ -35563,14 +35989,31 @@ var claims = {
 			type: "number",
 			label: "Amount ($)",
 			min: 0,
-			required: true
+			required: true,
+			when: { disabled: whenIs("status", "paid") }
 		},
 		{
 			field: "deductible",
 			type: "number",
 			label: "Deductible ($)",
 			min: 0,
-			defaultValue: 500
+			defaultValue: 500,
+			when: { disabled: whenIs("status", "paid") }
+		},
+		{
+			field: "denialReason",
+			type: "text",
+			label: "Reason for denial",
+			hidden: { grid: true },
+			input: {
+				editorType: "textarea",
+				span: 2,
+				help: "Required to deny a claim"
+			},
+			when: {
+				visible: whenIs("status", "denied"),
+				required: whenIs("status", "denied")
+			}
 		},
 		{
 			field: "net",
@@ -35863,7 +36306,8 @@ var seed = {
 			fraudRisk: 5,
 			tags: ["suspicious", "late-report"],
 			incidentDate: "2026-01-20",
-			filedAt: "2026-01-28T16:45:00.000Z"
+			filedAt: "2026-01-28T16:45:00.000Z",
+			denialReason: "Loss reported 8 days after the incident, outside the policy window."
 		},
 		{
 			id: "cl5",
@@ -39372,6 +39816,34 @@ async function introspectSupabaseTable(options) {
 	return buildEntitySchema(o.table, columns);
 }
 //#endregion
+//#region src/studio/user-error.ts
+/**
+* UserError - a mistake the person at the keyboard can fix (a typo in a
+* connection string, an empty table selection, a folder that already holds
+* another app), as opposed to a defect in Studio.
+*
+* The CLI prints these plainly and stops. Everything else is treated as a crash
+* and gets a sanitized bug report plus a prefilled issue link, so ordinary
+* fat-fingering never looks like something worth reporting.
+*
+* `isUserError` is duck-typed rather than an `instanceof` check: the class can
+* cross a bundle boundary (browser ESM source vs. the Node build), and a
+* mis-detected user error would send someone to file an issue about their own
+* typo.
+*/
+var UserError = class extends Error {
+	constructor(message, hint) {
+		super(message);
+		this.isUserError = true;
+		this.name = "UserError";
+		if (hint !== void 0) this.hint = hint;
+	}
+};
+/** True for anything thrown as a `UserError`, across module instances. */
+function isUserError(err) {
+	return !!err && typeof err === "object" && err.isUserError === true;
+}
+//#endregion
 //#region src/studio/init-flow.ts
 var SOURCES = [
 	{
@@ -39407,6 +39879,28 @@ var DIALECTS = [
 	"mssql",
 	"sqlite"
 ];
+/** Shown above the connection prompt so the expected shape is never a guess. */
+var CONNECTION_EXAMPLES = {
+	postgres: "postgres://user:password@localhost:5432/mydb",
+	supabase: "postgres://postgres:password@db.abcdefgh.supabase.co:5432/postgres",
+	mysql: "mysql://user:password@localhost:3306/mydb",
+	mssql: "Server=localhost,1433;Database=mydb;User Id=sa;Password=secret;Encrypt=false",
+	sqlite: "./data.db"
+};
+/**
+* Files that mean the target folder already holds an app. Writing the bundle
+* over one of these replaces it wholesale (they carry no managed markers), so
+* the flow stops and asks first. A `studio.config.json` is the exception: that
+* folder IS a Studio app, and re-running init there is a regenerate.
+*/
+var CLOBBER_MARKERS = [
+	"package.json",
+	"svelte.config.js",
+	"svelte.config.ts",
+	"vite.config.ts",
+	"src/routes/+layout.svelte",
+	".env"
+];
 /** Ask a numbered-list question; returns the chosen index. */
 async function pick(prompts, heading, items, def = 1) {
 	prompts.say("");
@@ -39473,7 +39967,7 @@ async function gatherData(flags, prompts, db, fetchText) {
 		hint: d.description
 	})))].id;
 	const dataset = getStarterDataset(datasetId);
-	if (!dataset) throw new Error(`Unknown dataset "${datasetId}". Try: ${starterDatasets.map((d) => d.id).join(", ")}`);
+	if (!dataset) throw new UserError(`Unknown dataset "${datasetId}".`, `Try one of: ${starterDatasets.map((d) => d.id).join(", ")}`);
 	const { entities, seed } = dataset.build();
 	const kind = source === "pglite" ? "pglite" : "memory";
 	const sources = {};
@@ -39491,27 +39985,37 @@ async function gatherData(flags, prompts, db, fetchText) {
 	};
 }
 async function gatherFromDatabase(flags, prompts, db) {
-	if (!db) throw new Error("Connecting to a database is not available here.");
+	if (!db) throw new UserError("Connecting to a database is not available here.");
 	let dialect = flags.db;
 	if (!dialect) dialect = DIALECTS[await pick(prompts, "Which database?", DIALECTS.map((d) => ({ label: d })))];
 	let url = flags.url ?? "";
 	if (!url) {
 		if (isFileDialect(dialect)) url = (await prompts.ask("Database file:", "./data.db")).trim();
-		else url = (await prompts.ask("Connection string (blank to enter host/port instead):", "")).trim() || buildConnectionString(dialect, await askConnectionParts(prompts));
+		else {
+			prompts.say("");
+			prompts.say(`  Example: ${CONNECTION_EXAMPLES[dialect] ?? CONNECTION_EXAMPLES.postgres}`);
+			url = (await prompts.ask("Connection string (blank to enter host/port instead):", "")).trim() || buildConnectionString(dialect, await askConnectionParts(prompts));
+		}
 	}
-	if (!url) throw new Error("A connection string is required.");
+	if (!url) throw new UserError("A connection string is required.");
 	const driver = await db.ensureDriver(dialect);
-	if (!driver.ok) throw new Error(driver.message ?? `Could not install the ${dialect} driver.`);
+	if (!driver.ok) throw new UserError(driver.message ?? `Could not install the ${dialect} driver.`);
 	prompts.say("  Connecting...");
-	const execute = await db.connect(dialect, url);
-	const tables = await listDatabaseTables(dialect, execute);
-	if (tables.length === 0) throw new Error("Connected, but the database has no tables.");
+	let execute;
+	let tables;
+	try {
+		execute = await db.connect(dialect, url);
+		tables = await listDatabaseTables(dialect, execute);
+	} catch (e) {
+		throw new UserError(`Could not read the database: ${e instanceof Error ? e.message : String(e)}`, `Check the connection string. Expected shape: ${CONNECTION_EXAMPLES[dialect] ?? CONNECTION_EXAMPLES.postgres}`);
+	}
+	if (tables.length === 0) throw new UserError("Connected, but the database has no tables.", "Check that the connection string points at the right database and schema.");
 	const counts = await countTableRows(dialect, execute, tables);
 	prompts.say("");
 	prompts.say(`Found ${tables.length} ${tables.length === 1 ? "table" : "tables"}:`);
 	counts.forEach((t, i) => prompts.say(`  ${i + 1}. ${t.name}${t.rows == null ? "" : ` (${t.rows} rows)`}`));
 	const picked = parseSelection(flags.yes ? "all" : await prompts.ask("Which tables? (all, or a comma list of names/numbers)", "all"), tables);
-	if (picked.length === 0) throw new Error("No tables picked - nothing to build.");
+	if (picked.length === 0) throw new UserError("No tables picked - nothing to build.");
 	const schemas = [];
 	const sources = {};
 	for (const table of picked) try {
@@ -39529,7 +40033,7 @@ async function gatherFromDatabase(flags, prompts, db) {
 	} catch (e) {
 		prompts.say(`  ! Skipped ${table}: ${e instanceof Error ? e.message : String(e)}`);
 	}
-	if (schemas.length === 0) throw new Error("None of the picked tables could be read.");
+	if (schemas.length === 0) throw new UserError("None of the picked tables could be read.");
 	prompts.say(`  Read ${schemas.length} ${schemas.length === 1 ? "table" : "tables"}.`);
 	return {
 		schemas,
@@ -39543,11 +40047,21 @@ async function gatherFromDatabase(flags, prompts, db) {
 * DbGateway - just the project URL and the anon key.
 */
 async function gatherFromSupabase(flags, prompts) {
+	if (!flags.supabaseUrl || !flags.supabaseKey) {
+		prompts.say("");
+		prompts.say("  Both are in your Supabase project's API settings (Project Settings -> API).");
+		prompts.say("  The URL looks like https://abcdefgh.supabase.co");
+	}
 	const url = (flags.supabaseUrl ?? await prompts.ask("Project URL:", "")).trim();
 	const key = (flags.supabaseKey ?? await prompts.ask("Anon key:", "")).trim();
-	if (!url || !key) throw new Error("Both the project URL and the anon key are required.");
+	if (!url || !key) throw new UserError("Both the project URL and the anon key are required.");
 	prompts.say("  Reading the API...");
-	const tables = await listSupabaseTables(url, key);
+	let tables;
+	try {
+		tables = await listSupabaseTables(url, key);
+	} catch (e) {
+		throw new UserError(`Could not reach ${url}: ${e instanceof Error ? e.message : String(e)}`, "Check the project URL and anon key in Project Settings -> API.");
+	}
 	let picked;
 	if (tables.length) {
 		prompts.say("");
@@ -39558,7 +40072,7 @@ async function gatherFromSupabase(flags, prompts) {
 		prompts.say("  Couldn't list the tables (the API doc may be restricted for this key).");
 		picked = (await prompts.ask("Table names (comma separated):", "")).split(",").map((t) => t.trim()).filter(Boolean);
 	}
-	if (picked.length === 0) throw new Error("No tables picked - nothing to build.");
+	if (picked.length === 0) throw new UserError("No tables picked - nothing to build.");
 	const schemas = [];
 	const sources = {};
 	for (const table of picked) {
@@ -39579,7 +40093,7 @@ async function gatherFromSupabase(flags, prompts) {
 			key
 		};
 	}
-	if (schemas.length === 0) throw new Error("None of the picked tables could be read.");
+	if (schemas.length === 0) throw new UserError("None of the picked tables could be read.");
 	prompts.say(`  Read ${schemas.length} ${schemas.length === 1 ? "table" : "tables"}.`);
 	return {
 		schemas,
@@ -39598,14 +40112,14 @@ async function askConnectionParts(prompts) {
 	};
 }
 async function gatherFromRest(prompts, fetchText) {
-	if (!fetchText) throw new Error("Reading a REST endpoint is not available here.");
+	if (!fetchText) throw new UserError("Reading a REST endpoint is not available here.");
 	const src = (await prompts.ask("OpenAPI spec (file or URL), or a REST endpoint returning rows:", "")).trim();
-	if (!src) throw new Error("A spec path/URL or endpoint is required.");
+	if (!src) throw new UserError("A spec path/URL or endpoint is required.");
 	const text = await fetchText(src);
 	if (/"(openapi|swagger|paths)"\s*:/.test(text)) {
 		const { entities, sources, warnings } = introspectOpenApi(text);
 		for (const w of warnings) prompts.say(`  ! ${w}`);
-		if (entities.length === 0) throw new Error("The spec described no collection resources.");
+		if (entities.length === 0) throw new UserError("The spec described no collection resources.");
 		prompts.say(`  Read ${entities.length} REST ${entities.length === 1 ? "resource" : "resources"}.`);
 		return {
 			schemas: entities,
@@ -39614,9 +40128,19 @@ async function gatherFromRest(prompts, fetchText) {
 			kind: "rest"
 		};
 	}
-	const rows = unwrapRows(JSON.parse(text));
-	if (rows.length === 0) throw new Error("The endpoint returned no rows to read a shape from.");
-	const url = new URL(src);
+	let rows;
+	try {
+		rows = unwrapRows(JSON.parse(text));
+	} catch {
+		throw new UserError(`${src} did not return JSON.`, "Point this at an endpoint that returns rows, or at an OpenAPI (JSON) document.");
+	}
+	if (rows.length === 0) throw new UserError("The endpoint returned no rows to read a shape from.");
+	let url;
+	try {
+		url = new URL(src);
+	} catch {
+		throw new UserError(`"${src}" is not a full URL, so there is no endpoint to call at runtime.`, "Pass the absolute endpoint, for example https://api.example.com/widgets");
+	}
 	const path = url.pathname.replace(/^\/+|\/+$/g, "");
 	const suggested = path.split("/").filter(Boolean).pop() || "items";
 	const name = ((await prompts.ask("Table name:", suggested)).trim() || suggested).replace(/\W+/g, "_");
@@ -39690,12 +40214,45 @@ async function askTheme(flags, prompts) {
 		mode: dark ? "dark" : "light"
 	};
 }
+/** Prefix a path with the output folder (`.` writes into the current one). */
+var inDir = (outDir, path) => (!outDir || outDir === "." ? "" : outDir.replace(/[\\/]+$/, "") + "/") + path;
+/** Which marker files are present in `outDir` right now. */
+async function markersIn(outDir, io) {
+	const found = /* @__PURE__ */ new Set();
+	for (const marker of CLOBBER_MARKERS) if (await io.readFile(inDir(outDir, marker)) != null) found.add(marker);
+	return found;
+}
+/**
+* Stop before overwriting somebody else's app.
+*
+* `init` defaults to the current folder, and bare `svgrid-studio` in a terminal
+* runs it, so a mistaken run inside an existing project would replace its
+* package.json, svelte config and .env without a word. Re-running init on a
+* folder Studio itself generated is a regenerate, not a clobber, so a
+* `studio.config.json` waves the check through.
+*
+* `before` is the set of markers seen at startup, and only those count. Picking a
+* database makes Studio install a driver into this folder first, which writes a
+* package.json - without the snapshot the flow would trip over a file it had
+* just created itself and refuse to build anything.
+*/
+async function confirmTargetFolder(outDir, flags, prompts, io, before) {
+	if (flags.force) return;
+	if (await io.readFile(inDir(outDir, "studio.config.json")) != null) return;
+	const present = await markersIn(outDir, io);
+	const found = CLOBBER_MARKERS.filter((m) => present.has(m) && (before == null || before.has(m)));
+	if (found.length === 0) return;
+	const message = `${!outDir || outDir === "." ? "This folder" : outDir} already has ${found.join(", ")}, and Studio would overwrite ${found.length === 1 ? "it" : "them"}.`;
+	if (flags.yes) throw new UserError(message, "Pick an empty folder with --out <dir>, or pass --force to overwrite anyway.");
+	prompts.say("");
+	prompts.say(`  ! ${message}`);
+	if (!isYes(await prompts.ask("Overwrite? (y/N)", "n"), false)) throw new UserError("Stopped without writing anything.", "Re-run with --out <dir> to build somewhere else.");
+}
 /** Merge-write the generated files, preserving edits outside managed regions. */
 async function writeAll$1(files, outDir, io) {
 	const written = [];
-	const prefix = !outDir || outDir === "." ? "" : outDir.replace(/[\\/]+$/, "") + "/";
 	for (const file of files) {
-		const path = prefix + file.path;
+		const path = inDir(outDir, file.path);
 		const existing = await io.readFile(path);
 		if (skipUserOwned(file, existing != null)) continue;
 		await io.writeFile(path, mergeManaged(existing, file.contents));
@@ -39709,12 +40266,15 @@ async function writeAll$1(files, outDir, io) {
 */
 async function runStudioInit(flags, prompts, db, io, fetchText = null) {
 	prompts.say("SvGrid Studio - let's build your app.");
+	const candidateDir = flags.out ?? ".";
+	const markersBefore = await markersIn(candidateDir, io);
 	const data = await gatherData(flags, prompts, db, fetchText);
 	const perEntity = await askScreens(data.schemas, flags, prompts);
 	const theme = await askTheme(flags, prompts);
 	const defaultTitle = flags.title ?? data.title ?? "My app";
 	const title = flags.yes || flags.title ? defaultTitle : (await prompts.ask("\nApp name:", defaultTitle)).trim() || defaultTitle;
 	const outDir = flags.out ?? (flags.yes ? "." : (await prompts.ask("Write it where?", ".")).trim() || ".");
+	await confirmTargetFolder(outDir, flags, prompts, io, outDir === candidateDir ? markersBefore : null);
 	const project = crudAppFromSchemas(data.schemas, {
 		title,
 		dataSource: data.kind,
@@ -39725,7 +40285,7 @@ async function runStudioInit(flags, prompts, db, io, fetchText = null) {
 		...theme ? { theme } : {}
 	});
 	const written = await writeAll$1(emitStudioAppBundle(project), outDir, io);
-	const configPath = (!outDir || outDir === "." ? "" : outDir.replace(/[\\/]+$/, "") + "/") + "studio.config.json";
+	const configPath = inDir(outDir, "studio.config.json");
 	await io.writeFile(configPath, serializeProject(project));
 	written.push(configPath);
 	prompts.say("");
@@ -40145,8 +40705,49 @@ async function runStudioAddApp(schemas, options, io) {
 //#endregion
 //#region src/revoked.ts
 var REVOKED_KEYS = /* @__PURE__ */ new Set([]);
-/** Classify a license key string. Pure and side-effect-free. */
-function checkLicenseKey(key) {
+/**
+* Pull the expiry out of a key.
+*
+* Keys are `SVENTERPRISE[-KIND]-<SLUG>-<SEATS>-<DATE>-<RANDOM>`, so the date is
+* always the second-to-last segment regardless of whether a KIND is present.
+* Two widths are accepted:
+*
+*   YYYYMM   - subscription granularity; expires at the end of that month.
+*   YYYYMMDD - trial granularity; expires at the end of that day.
+*
+* The 6-digit form came first, so every key issued before day-precision trials
+* existed still parses. Anything else (including the older keys whose slug sits
+* in that position) yields null, which reads as "no expiry encoded".
+*
+* Boundaries are UTC so a key does not lapse at a different instant per
+* timezone. Kept in sync with `tools/issue-license.mjs`.
+*/
+function parseLicenseExpiry(key) {
+	if (!key) return null;
+	const segments = key.split("-");
+	if (segments.length < 3) return null;
+	const stamp = segments[segments.length - 2];
+	if (stamp == null) return null;
+	if (/^\d{6}$/.test(stamp)) {
+		const year = Number(stamp.slice(0, 4));
+		const month = Number(stamp.slice(4, 6));
+		if (month < 1 || month > 12) return null;
+		return /* @__PURE__ */ new Date(Date.UTC(year, month, 1) - 1);
+	}
+	if (/^\d{8}$/.test(stamp)) {
+		const year = Number(stamp.slice(0, 4));
+		const month = Number(stamp.slice(4, 6));
+		const day = Number(stamp.slice(6, 8));
+		if (month < 1 || month > 12 || day < 1 || day > 31) return null;
+		const end = new Date(Date.UTC(year, month - 1, day, 23, 59, 59, 999));
+		if (end.getUTCMonth() !== month - 1) return null;
+		return end;
+	}
+	return null;
+}
+/** Classify a license key string. Pure and side-effect-free.
+*  `now` is injectable so expiry behaviour is testable without faking clocks. */
+function checkLicenseKey(key, now = /* @__PURE__ */ new Date()) {
 	if (key == null || key === "") return {
 		status: "unset",
 		valid: false
@@ -40159,18 +40760,14 @@ function checkLicenseKey(key) {
 		status: "revoked",
 		valid: false
 	};
-	if (key.startsWith("SVENTERPRISE-DEV")) return {
-		status: "dev",
-		valid: true
-	};
-	if (key.startsWith("SVENTERPRISE-EVAL")) return {
-		status: "eval",
-		valid: true
-	};
+	const expiresAt = parseLicenseExpiry(key) ?? void 0;
+	const expired = expiresAt ? now.getTime() > expiresAt.getTime() : void 0;
 	return {
-		status: "licensed",
-		valid: true
+		status: key.startsWith("SVENTERPRISE-DEV") ? "dev" : key.startsWith("SVENTERPRISE-EVAL") ? "eval" : "licensed",
+		valid: true,
+		expiresAt,
+		expired
 	};
 }
 //#endregion
-export { CANVAS_COLS, CANVAS_GAP_PX, CANVAS_ROW_PX, CONTAINER_CHILD_KINDS, CONTAINER_DISPLAY_KINDS, CRUD_ACTIONS, DEFAULT_PORT, DRIVER_PACKAGE, FORM_SUBMIT, GRID_API_MEMBERS, GRID_CURATED_PROPS, GRID_EVENTS, GRID_PRESETS, MANAGED_END, MANAGED_START, ON_LOAD, PANE_LAYOUTS, STANDARD_UI_EVENTS, TAB_CHILD_KINDS, TRIGGER_EVENTS, UI_COMPONENT_REGISTRY, addAccordionBlock, addAccordionComponent, addAccordionSection, addBlock, addBlockAt, addComponentBlock, addCrudSuite, addEntity, addFreestandingScreen, addHandlerStep, addScreen, addScreenAction, addScreenFromTemplate, addStateVar, addTab, addTabBlock, addTabComponent, applyGridPreset, blockClassName, blockColumns, blockPalette, blockStyleCss, buildCanvasLayout, buildConnectionString, buildCopilotMessages, buildDockLayout, buildStudioBugReport, canvasOpts, canvasRectOf, changeSlot, checkLicenseKey, clickSlot, compileCondition, compileHandlerSteps, compileStep, compileTriggerStep, compileTriggerSteps, compileValue, componentHandleMembers, componentHandleName, componentHasBindings, countTableRows, createProject, crudAppFromSchemas, crudSuiteScreens, csvToEntity, ctxAmbientDts, ctxCompletions, dashScreen, defaultBlockConfig, defaultEntitySource, defaultScreenFor, defaultStudioTheme, deployCommands, detailScreen, detectDelimiter, disableScreenCode, dockOpts, dockPaneIds, dockPaneTitleOf, duplicateBlock, duplicateScreen, emitEntityModules, emitStudioApp, emitStudioAppBundle, emitStudioFragment, emitStudioProject, enableScreenCode, entityDataSource, entityOf, entityScreenPage, eventSlot, flattenBlocks, formScreen, generateRows, generateValue, getLiveDataSample, getSampleApp, getStarterDataset, getStudioTheme, gridApiSettableProps, gridColumns, gridConfig, gridOpts, gridPresetLabel, gridPropSurface, inferType, insertBlock, introspectDatabase, introspectDrizzle, introspectDrizzleAll, introspectJson, introspectOpenApi, introspectPrisma, introspectPrismaAll, isDarkTheme, isFileDialect, isPaneLayout, isProjectValid, isTenantScoped, linkRelationLabels, listDatabaseTables, listScreen, liveDataSamples, mapSqlType, mergeBlockStyle, mergeManaged, missingEnvKeys, moveBlock, moveHandlerStep, parseConnectionString, parseCsv, parseProject, parseSelection, pickLabelField, prepareEntities, probeConnection, projectFromModelText, reconcileDock, redactConnectionString, refineField, refineFields, removeAccordionBlock, removeAccordionSection, removeBlock, removeEntity, removeScreen, removeScreenAction, removeStateVar, removeTab, removeTabBlock, renameAccordionSection, renameTab, reorderBlock, reorderScreen, reseedScreenDock, resolveDeployTarget, resolveIdField, resolveSchema, resolveSchemas, resolveThemeTokens, resolveThemeTokensFor, roleCanAction, roleCanScreen, rowSelectSlot, runStudioAdd, runStudioAddApp, runStudioInit, runtimeDeps, sampleApps, sanitizeClassName, sanitizeProject, sanitizeStudioProject, scaffold, scaffoldApp, schemaToColumns, schemaToFormFields, screenDataset, screenFromTemplate, screenHandles, screenLayoutOf, seedUsers, serializeProject, setAccordionMultiple, setAuth, setCanvasRect, setComponentBinding, setComponentName, setDataLayer, setDataSource, setDeployTarget, setDockPaneTitle, setEntityDataSource, setHandlerBody, setHandlerSteps, setJob, setLayoutOpts, setScreenDock, setScreenHandlersSource, setScreenLayout, setScreenRenderGrid, setScreenRenderMode, setShell, setTenancy, setTheme, setThemePreset, setTrigger, skipUserOwned, splitOpts, ssrEligible, ssrScreenShape, stackOpts, starterDatasets, starterProject, stateInitExpr, stateTsType, statusPills, stepsToCode, studioDeployInfo, studioThemes, summarizeVerify, syncDockPanes, tenantField, themeStyleString, triggersOf, uiComponentSpec, updateBlock, updateEntity, updateHandlerStep, updateScreen, updateStateVar, validateProject, verifyScaffold };
+export { CANVAS_COLS, CANVAS_GAP_PX, CANVAS_ROW_PX, CONTAINER_CHILD_KINDS, CONTAINER_DISPLAY_KINDS, CRUD_ACTIONS, DEFAULT_PORT, DRIVER_PACKAGE, FORM_SUBMIT, GRID_API_MEMBERS, GRID_CURATED_PROPS, GRID_EVENTS, GRID_PRESETS, MANAGED_END, MANAGED_START, ON_LOAD, PANE_LAYOUTS, STANDARD_UI_EVENTS, TAB_CHILD_KINDS, TRIGGER_EVENTS, UI_COMPONENT_REGISTRY, UserError, addAccordionBlock, addAccordionComponent, addAccordionSection, addBlock, addBlockAt, addComponentBlock, addCrudSuite, addEntity, addFreestandingScreen, addHandlerStep, addScreen, addScreenAction, addScreenFromTemplate, addStateVar, addTab, addTabBlock, addTabComponent, applyGridPreset, blockClassName, blockColumns, blockPalette, blockStyleCss, buildCanvasLayout, buildConnectionString, buildCopilotMessages, buildDockLayout, buildStudioBugReport, canvasOpts, canvasRectOf, changeSlot, checkLicenseKey, clickSlot, compileCondition, compileHandlerSteps, compileStep, compileTriggerStep, compileTriggerSteps, compileValue, componentHandleMembers, componentHandleName, componentHasBindings, countTableRows, createProject, crudAppFromSchemas, crudSuiteScreens, csvToEntity, ctxAmbientDts, ctxCompletions, dashScreen, defaultBlockConfig, defaultEntitySource, defaultScreenFor, defaultStudioTheme, deployCommands, detailScreen, detectDelimiter, disableScreenCode, dockOpts, dockPaneIds, dockPaneTitleOf, duplicateBlock, duplicateScreen, emitEntityModules, emitStudioApp, emitStudioAppBundle, emitStudioFragment, emitStudioProject, enableScreenCode, entityDataSource, entityOf, entityScreenPage, eventSlot, flattenBlocks, formScreen, generateRows, generateValue, getLiveDataSample, getSampleApp, getStarterDataset, getStudioTheme, gridApiSettableProps, gridColumns, gridConfig, gridOpts, gridPresetLabel, gridPropSurface, inferType, insertBlock, introspectDatabase, introspectDrizzle, introspectDrizzleAll, introspectJson, introspectOpenApi, introspectPrisma, introspectPrismaAll, isDarkTheme, isFileDialect, isPaneLayout, isProjectValid, isTenantScoped, isUserError, linkRelationLabels, listDatabaseTables, listScreen, liveDataSamples, mapSqlType, mergeBlockStyle, mergeManaged, missingEnvKeys, moveBlock, moveHandlerStep, parseConnectionString, parseCsv, parseProject, parseSelection, pickLabelField, prepareEntities, probeConnection, projectFromModelText, reconcileDock, redactConnectionString, refineField, refineFields, removeAccordionBlock, removeAccordionSection, removeBlock, removeEntity, removeScreen, removeScreenAction, removeStateVar, removeTab, removeTabBlock, renameAccordionSection, renameTab, reorderBlock, reorderScreen, reseedScreenDock, resolveDeployTarget, resolveIdField, resolveSchema, resolveSchemas, resolveThemeTokens, resolveThemeTokensFor, roleCanAction, roleCanScreen, rowSelectSlot, runStudioAdd, runStudioAddApp, runStudioInit, runtimeDeps, sampleApps, sanitizeClassName, sanitizeProject, sanitizeStudioProject, scaffold, scaffoldApp, schemaToColumns, schemaToFormFields, screenDataset, screenFromTemplate, screenHandles, screenLayoutOf, seedUsers, serializeProject, setAccordionMultiple, setAuth, setCanvasRect, setComponentBinding, setComponentName, setDataLayer, setDataSource, setDeployTarget, setDockPaneTitle, setEntityDataSource, setHandlerBody, setHandlerSteps, setJob, setLayoutOpts, setScreenDock, setScreenHandlersSource, setScreenLayout, setScreenRenderGrid, setScreenRenderMode, setShell, setTenancy, setTheme, setThemePreset, setTrigger, skipUserOwned, splitOpts, ssrEligible, ssrScreenShape, stackOpts, starterDatasets, starterProject, stateInitExpr, stateTsType, statusPills, stepsToCode, studioDeployInfo, studioThemes, summarizeVerify, syncDockPanes, tenantField, themeStyleString, triggersOf, uiComponentSpec, updateBlock, updateEntity, updateHandlerStep, updateScreen, updateStateVar, validateProject, verifyScaffold, withSsrDefaults };