@svgrid/enterprise 2.5.2 → 2.6.0

package/src/sveltekit/transport.ts

@@ -1,373 +0,0 @@
-/**
- * SvelteKit transport - the deep integration an agnostic grid can't ship.
- *
- * Two halves that speak one small JSON protocol over a single route:
- *
- *   - `createKitDataSource({ endpoint })` runs in the browser (or a `load`
- *     function) and returns a `ServerDataSource` that POSTs requests to your
- *     endpoint. Drop it straight into `createServerDataSource`.
- *
- *   - `createKitHandlers({ schema, source })` runs on the server and returns a
- *     `POST` handler for a `+server.ts` route. It parses the protocol, calls
- *     your backend `ServerDataSource` (in-memory, SQL, Drizzle, ...), and
- *     returns JSON.
- *
- * Example `src/routes/api/customers/+server.ts`:
- *
- *     import { createKitHandlers } from '@svgrid/enterprise'
- *     import { customerSchema, customerSource } from '$lib/customers'
- *     export const { POST } = createKitHandlers({ schema: customerSchema, source: customerSource })
- *
- * Client:
- *
- *     const source = createKitDataSource({ endpoint: '/api/customers' })
- *     const controller = createServerDataSource(source, { onChange: ... })
- */
-import type {
-  RowData,
-  ServerDataSource,
-  ServerRequest,
-  ServerResult,
-} from '@svgrid/grid'
-import type { EntitySchema } from '../schema'
-import { validateAll } from '../edit-panel'
-import type { WritableDataSource } from './types'
-
-/** Wire protocol: the single JSON body shape the client POSTs and the server dispatches on. */
-export type KitMessage<TData> =
-  | { kind: 'query'; request: ServerRequest }
-  | { kind: 'mutate'; op: 'create'; input: Partial<TData> }
-  | { kind: 'mutate'; op: 'update'; id: string; patch: Partial<TData> }
-  | { kind: 'mutate'; op: 'delete'; id: string }
-
-type FetchLike = (input: string, init?: RequestInit) => Promise<Response>
-
-function jsonResponse(data: unknown, status = 200): Response {
-  return new Response(JSON.stringify(data), {
-    status,
-    headers: { 'content-type': 'application/json' },
-  })
-}
-
-// --- client ---------------------------------------------------------------
-
-export type KitDataSourceOptions = {
-  /** Route that `createKitHandlers` is mounted on, e.g. `'/api/customers'`. */
-  endpoint: string
-  /**
-   * Fetch implementation. Pass SvelteKit's event `fetch` inside a `load` so
-   * requests are same-origin and SSR-safe; defaults to the global `fetch`.
-   */
-  fetch?: FetchLike
-}
-
-export function createKitDataSource<TData extends RowData>(
-  options: KitDataSourceOptions,
-): WritableDataSource<TData> {
-  const doFetch: FetchLike = options.fetch ?? ((i, init) => fetch(i, init))
-
-  async function post<T>(body: KitMessage<TData>): Promise<T> {
-    const res = await doFetch(options.endpoint, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify(body),
-    })
-    if (!res.ok) {
-      const detail = await res.text().catch(() => '')
-      throw new Error(`svgrid kit: ${res.status} ${res.statusText}${detail ? ` - ${detail}` : ''}`)
-    }
-    return (await res.json()) as T
-  }
-
-  return {
-    getRows: (request) => post<ServerResult<TData>>({ kind: 'query', request }),
-    createRow: (input) => post<TData>({ kind: 'mutate', op: 'create', input }),
-    updateRow: (id, patch) => post<TData>({ kind: 'mutate', op: 'update', id, patch }),
-    deleteRow: (id) => post<void>({ kind: 'mutate', op: 'delete', id }).then(() => undefined),
-  }
-}
-
-// --- server ---------------------------------------------------------------
-
-/** The CRUD action a Kit message maps to (`query` -> `read`). */
-export type KitAction = 'read' | 'create' | 'update' | 'delete'
-/** Context passed to the `authorize` guard before every op. */
-export type KitAuthorizeContext<TData extends RowData> = {
-  action: KitAction
-  /** The SvelteKit request event, so you can read `locals` / session for the
-   *  caller's role or user id. Only `request` is guaranteed in non-Kit callers. */
-  event: { request: Request; locals?: Record<string, unknown> }
-  message: KitMessage<TData>
-}
-
-/** A field-error map (`{ field: message }`); empty/undefined means valid. */
-export type KitFieldErrors = Record<string, string>
-/** Context passed to a custom `validate` function before a create / update. */
-export type KitValidateContext<TData extends RowData> = {
-  action: 'create' | 'update'
-  values: Partial<TData>
-  event: { request: Request; locals?: Record<string, unknown> }
-}
-
-/** A row-scoping rule: every row this caller may touch has `field === value`. */
-export type KitScope = { field: string; value: unknown }
-
-export type KitHandlerOptions<TData extends RowData> = {
-  schema: EntitySchema<TData>
-  source: ServerDataSource<TData>
-  /**
-   * Restrict every operation to rows matching one column - the mechanism behind
-   * multi-tenancy (`field: 'tenantId'`), and usable for any "you only see your
-   * own rows" rule.
-   *
-   * Enforced on all four paths, because scoping reads alone is not isolation:
-   * - **read**: the predicate is merged into the query's filter model;
-   * - **create**: the value is stamped onto the row, overriding whatever the
-   *   client sent;
-   * - **update / delete**: the target row is re-read under the scope first, and
-   *   the write is rejected with `403` if it isn't the caller's - otherwise
-   *   guessing an id would reach across tenants.
-   *
-   * Return `null` to apply no scope (e.g. a super-admin). Throwing rejects the
-   * request, which is the safer default when a tenant cannot be resolved.
-   */
-  scope?: (ctx: { event: { request: Request; locals?: Record<string, unknown> } }) => KitScope | null | Promise<KitScope | null>
-  /**
-   * Optional server-side guard run BEFORE every op. Return `false` (or throw) to
-   * reject the request with `403`. Receives the SvelteKit event, so you can read
-   * `event.locals` / the session to resolve the caller's role - this is where
-   * server-enforced authorization (RBAC) lives, independent of any client UI.
-   */
-  authorize?: (ctx: KitAuthorizeContext<TData>) => boolean | Promise<boolean>
-  /**
-   * Server-enforced validation, run BEFORE a create / update reaches the source.
-   * - `true`: validate the payload against the `schema`'s declarative constraints
-   *   (required, min/max, length, pattern, email/url, per-field + cross-field
-   *   rules) via `validateAll`. Updates validate only the fields present in the
-   *   patch. Defect payloads are rejected with `422 { error, fieldErrors }`.
-   * - a function: your own check returning a `{ field: message }` map (non-empty
-   *   -> 422).
-   * Default off, so existing routes are unchanged; the Studio generator turns it
-   * on. Enforcing here means a client that skips its form validation still can't
-   * write bad data.
-   */
-  validate?: boolean | ((ctx: KitValidateContext<TData>) => KitFieldErrors | null | undefined | Promise<KitFieldErrors | null | undefined>)
-  /**
-   * Called AFTER a successful create / update / delete with the change details,
-   * so you can write an audit record (who / what / when). Receives the SvelteKit
-   * event for `locals` (the actor). Best-effort: a throw here is swallowed and
-   * logged, so an audit-sink hiccup never fails the underlying write.
-   */
-  audit?: (entry: KitAuditEntry<TData>) => void | Promise<void>
-  /**
-   * Business-logic lifecycle hooks, run server-side around each mutation (the
-   * Studio generator compiles a screen's visual "triggers" into these). A
-   * `before*` hook may transform the payload (return a new object) or throw to
-   * reject the write (-> `422 { error }`), so a rule enforced here holds even if
-   * the client skips it. `after*` hooks run once the write succeeds (cascades,
-   * notifications) - a throw there fails the request (`500`).
-   */
-  hooks?: KitHooks<TData>
-}
-
-/** The SvelteKit event slice handed to every hook (read `locals` for the actor). */
-export type KitEvent = { request: Request; locals?: Record<string, unknown> }
-
-/** Server-side mutation lifecycle hooks (see `KitHandlerOptions.hooks`). */
-export type KitHooks<TData extends RowData> = {
-  beforeCreate?: (ctx: { values: Partial<TData>; event: KitEvent }) => Partial<TData> | void | Promise<Partial<TData> | void>
-  afterCreate?: (ctx: { row: TData; event: KitEvent }) => void | Promise<void>
-  beforeUpdate?: (ctx: { id: string; patch: Partial<TData>; event: KitEvent }) => Partial<TData> | void | Promise<Partial<TData> | void>
-  afterUpdate?: (ctx: { id: string; row: TData; event: KitEvent }) => void | Promise<void>
-  beforeDelete?: (ctx: { id: string; event: KitEvent }) => void | Promise<void>
-  afterDelete?: (ctx: { id: string; event: KitEvent }) => void | Promise<void>
-}
-
-/** The change details handed to the `audit` hook after a successful mutation. */
-export type KitAuditEntry<TData extends RowData> = {
-  action: 'create' | 'update' | 'delete'
-  /** The affected row's id. */
-  id: string | null
-  /** Submitted values: create input / update patch. Undefined for delete. */
-  values?: Partial<TData>
-  /** The row the source returned (create / update). Undefined for delete. */
-  result?: TData
-  event: { request: Request; locals?: Record<string, unknown> }
-}
-
-export type KitHandlers = {
-  /** SvelteKit `+server.ts` route handler. Export it as `export const { POST } = ...`. */
-  POST: (event: { request: Request; locals?: Record<string, unknown> }) => Promise<Response>
-  /** Lower-level dispatcher over a raw `Request`, for custom wiring or tests. */
-  handle: (request: Request, event?: { locals?: Record<string, unknown> }) => Promise<Response>
-}
-
-const actionOf = <TData extends RowData>(msg: KitMessage<TData>): KitAction =>
-  msg.kind === 'query' ? 'read' : msg.op
-
-export function createKitHandlers<TData extends RowData>(
-  options: KitHandlerOptions<TData>,
-): KitHandlers {
-  const { source, authorize, validate, audit, hooks, scope } = options
-  const idField = options.schema.idField ?? options.schema.fields.find((f) => f.primaryKey)?.field ?? 'id'
-  const rowId = (row: unknown): string | null => {
-    const v = (row as Record<string, unknown> | null)?.[idField]
-    return v == null ? null : String(v)
-  }
-  // Best-effort: never let an audit-sink error fail the write it's recording.
-  const fireAudit = async (entry: KitAuditEntry<TData>) => {
-    if (!audit) return
-    try { await audit(entry) } catch (err) { console.error('svgrid kit: audit hook failed', err) }
-  }
-
-  async function handle(request: Request, event?: { locals?: Record<string, unknown> }): Promise<Response> {
-    let msg: KitMessage<TData>
-    try {
-      msg = (await request.json()) as KitMessage<TData>
-    } catch {
-      return jsonResponse({ error: 'invalid JSON body' }, 400)
-    }
-
-    // Authorize BEFORE touching the source. A thrown guard is treated as a deny.
-    if (authorize) {
-      let allowed: boolean
-      try {
-        allowed = await authorize({ action: actionOf(msg), event: { request, locals: event?.locals }, message: msg })
-      } catch (err) {
-        return jsonResponse({ error: err instanceof Error ? err.message : 'forbidden' }, 403)
-      }
-      if (!allowed) return jsonResponse({ error: 'forbidden' }, 403)
-    }
-
-    // Validate create / update payloads BEFORE the source. 422 on field errors.
-    if (validate && msg.kind === 'mutate' && (msg.op === 'create' || msg.op === 'update')) {
-      const values = (msg.op === 'create' ? msg.input : msg.patch) as Partial<TData>
-      let errors: KitFieldErrors | null | undefined
-      if (validate === true) {
-        const all = await validateAll(options.schema, values as Record<string, unknown>)
-        // On update, only the supplied fields are validated (a patch omits the rest).
-        errors = msg.op === 'update'
-          ? Object.fromEntries(Object.keys(values).filter((k) => all[k]).map((k) => [k, all[k]!]))
-          : all
-      } else {
-        errors = await validate({ action: msg.op, values, event: { request, locals: event?.locals } })
-      }
-      if (errors && Object.keys(errors).length) {
-        return jsonResponse({ error: 'validation failed', fieldErrors: errors }, 422)
-      }
-    }
-
-    // Resolve the row scope once per request. A thrown resolver is a rejection,
-    // not a 500: "I can't tell which tenant you are" must not fall through to
-    // an unscoped query.
-    let activeScope: KitScope | null = null
-    if (scope) {
-      try {
-        activeScope = (await scope({ event: { request, locals: event?.locals } })) ?? null
-      } catch (err) {
-        return jsonResponse({ error: err instanceof Error ? err.message : 'forbidden' }, 403)
-      }
-    }
-    /** True when `id` exists AND belongs to the caller's scope. */
-    const ownsRow = async (id: string): Promise<boolean> => {
-      if (!activeScope) return true
-      const idField = options.schema.idField ?? options.schema.fields.find((f) => f.primaryKey)?.field ?? 'id'
-      const { rows } = await source.getRows({
-        startRow: 0,
-        endRow: 1,
-        pageIndex: 0,
-        pageSize: 1,
-        sortModel: [],
-        filterModel: {
-          columns: {
-            [idField]: { operator: 'equals' as const, value: id },
-            [activeScope.field]: { operator: 'equals' as const, value: String(activeScope.value) },
-          },
-        },
-      })
-      return rows.length > 0
-    }
-
-    try {
-      if (msg.kind === 'query') {
-        // Merge the scope into the requested filter. Written last so a client
-        // that sends its own `tenantId` filter cannot widen the scope.
-        const request = activeScope
-          ? {
-              ...msg.request,
-              filterModel: {
-                ...msg.request.filterModel,
-                columns: {
-                  ...(msg.request.filterModel?.columns ?? {}),
-                  [activeScope.field]: { operator: 'equals' as const, value: String(activeScope.value) },
-                },
-              },
-            }
-          : msg.request
-        const result = await source.getRows(request)
-        return jsonResponse(result)
-      }
-      if (msg.kind === 'mutate') {
-        const evt = { request, locals: event?.locals }
-        // Cross-tenant writes: reject before the source sees the id.
-        if (activeScope && (msg.op === 'update' || msg.op === 'delete')) {
-          if (!(await ownsRow(msg.id))) return jsonResponse({ error: 'forbidden' }, 403)
-        }
-        // A `before*` hook throwing is a business-rule rejection -> 422 (not a 500).
-        const runBefore = async <R>(fn: () => Promise<R>): Promise<R | Response> => {
-          try { return await fn() } catch (err) { return jsonResponse({ error: err instanceof Error ? err.message : 'rejected' }, 422) }
-        }
-        if (msg.op === 'create') {
-          if (!source.createRow) return jsonResponse({ error: 'create not supported' }, 405)
-          let input = msg.input
-          if (hooks?.beforeCreate) {
-            const r = await runBefore(() => Promise.resolve(hooks.beforeCreate!({ values: input, event: evt })))
-            if (r instanceof Response) return r
-            if (r) input = r as Partial<TData>
-          }
-          // Stamp the scope LAST - after the before-hook - so neither the client
-          // nor a business rule can write a row into another tenant.
-          if (activeScope) input = { ...input, [activeScope.field]: activeScope.value } as Partial<TData>
-          const row = await source.createRow(input)
-          if (hooks?.afterCreate) await hooks.afterCreate({ row, event: evt })
-          await fireAudit({ action: 'create', id: rowId(row), values: input, result: row, event: evt })
-          return jsonResponse(row)
-        }
-        if (msg.op === 'update') {
-          if (!source.updateRow) return jsonResponse({ error: 'update not supported' }, 405)
-          let patch = msg.patch
-          if (hooks?.beforeUpdate) {
-            const r = await runBefore(() => Promise.resolve(hooks.beforeUpdate!({ id: msg.id, patch, event: evt })))
-            if (r instanceof Response) return r
-            if (r) patch = r as Partial<TData>
-          }
-          // A patch must not be able to hand the row to another tenant.
-          if (activeScope) patch = { ...patch, [activeScope.field]: activeScope.value } as Partial<TData>
-          const row = await source.updateRow(msg.id, patch)
-          if (hooks?.afterUpdate) await hooks.afterUpdate({ id: msg.id, row, event: evt })
-          await fireAudit({ action: 'update', id: msg.id, values: patch, result: row, event: evt })
-          return jsonResponse(row)
-        }
-        if (msg.op === 'delete') {
-          if (!source.deleteRow) return jsonResponse({ error: 'delete not supported' }, 405)
-          if (hooks?.beforeDelete) {
-            const r = await runBefore(() => Promise.resolve(hooks.beforeDelete!({ id: msg.id, event: evt })))
-            if (r instanceof Response) return r
-          }
-          await source.deleteRow(msg.id)
-          if (hooks?.afterDelete) await hooks.afterDelete({ id: msg.id, event: evt })
-          await fireAudit({ action: 'delete', id: msg.id, event: evt })
-          return jsonResponse({ ok: true })
-        }
-      }
-      return jsonResponse({ error: 'unknown message kind' }, 400)
-    } catch (err) {
-      return jsonResponse({ error: err instanceof Error ? err.message : String(err) }, 500)
-    }
-  }
-
-  return {
-    handle,
-    POST: (event) => handle(event.request, event),
-  }
-}

package/src/upgrade-prompt.test.ts

@@ -1,71 +0,0 @@
-/**
- * Tests for the moment-of-intent PLG upgrade prompt. Unlike the passive
- * watermark, this card is triggered when a Pro feature is actually invoked
- * unlicensed, names that feature, links to a free trial, and shows at most
- * once per session.
- */
-
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { showUpgradePrompt, dismissUpgradePrompt } from './upgrade-prompt'
-
-const CARD_ATTR = 'data-svgrid-enterprise-upgrade'
-
-function card(): HTMLElement | null {
-  return document.querySelector(`[${CARD_ATTR}]`)
-}
-
-describe('upgrade prompt (moment-of-intent PLG nudge)', () => {
-  beforeEach(() => {
-    dismissUpgradePrompt()
-    document.body.innerHTML = ''
-  })
-
-  afterEach(() => {
-    dismissUpgradePrompt()
-  })
-
-  it('renders a card naming the feature, with a trial CTA', () => {
-    showUpgradePrompt('Export')
-    const el = card()
-    expect(el).not.toBeNull()
-    expect(el!.textContent).toContain('Export')
-    expect(el!.textContent).toContain('Unlock SvGrid Pro')
-
-    const trial = el!.querySelector('a[data-act="trial"]') as HTMLAnchorElement
-    expect(trial).not.toBeNull()
-    expect(trial.href).toContain('svgrid.com/pricing')
-    expect(trial.href).toContain('ref=in-app')
-    expect(trial.target).toBe('_blank')
-  })
-
-  it('shows at most once per session', () => {
-    showUpgradePrompt('Export')
-    expect(card()).not.toBeNull()
-    // A second feature call must not stack a second card.
-    showUpgradePrompt('Import')
-    expect(document.querySelectorAll(`[${CARD_ATTR}]`).length).toBe(1)
-  })
-
-  it('removes the card on close and does not re-show for the session', () => {
-    vi.useFakeTimers()
-    try {
-      showUpgradePrompt('Print')
-      const closeBtn = card()!.querySelector('[data-act="x"]') as HTMLButtonElement
-      closeBtn.click()
-      // close animates out, then removes the node after the fade.
-      vi.advanceTimersByTime(300)
-      expect(card()).toBeNull()
-      // A later feature call must not bring it back this session (the flag
-      // stays set; only dismissUpgradePrompt() re-arms it).
-      showUpgradePrompt('AI assistant')
-      expect(card()).toBeNull()
-    } finally {
-      vi.useRealTimers()
-    }
-  })
-
-  it('falls back to a generic message when no feature is named', () => {
-    showUpgradePrompt()
-    expect(card()!.textContent).toContain('Pro')
-  })
-})

package/src/upgrade-prompt.ts

@@ -1,162 +0,0 @@
-// Product-led-growth (PLG) upgrade nudge, shown at the *moment of intent*: the
-// instant a developer actually calls a Pro feature (export / import / print /
-// AI) without a license key set. Unlike the passive corner watermark
-// (watermark.ts), this is a one-click contextual card that names the feature
-// they just used and links straight to a free trial.
-//
-// Rules of the road:
-//   - Soft, never blocking. The feature already ran; this only nudges.
-//   - Shows once per session (SPA lifetime). Once shown - whether the user
-//     acts on it or closes it - it stays quiet for the rest of the session.
-//     Calling setLicenseKey() silences it before it ever appears.
-//   - Storage-free: no cookies, no localStorage, no sessionStorage. State is
-//     a single in-memory flag, so the library keeps its "zero web storage"
-//     promise (see docs/help/security.md). A hard reload may show it once
-//     more - by design; that's still a moment-of-intent nudge.
-//   - SSR-safe: every DOM access is guarded. On the server it's a no-op.
-//   - Zero dependencies, inline styles - no CSS file to import, nothing to
-//     bundle, works in any host app regardless of its styling.
-
-const CARD_ATTR = 'data-svgrid-enterprise-upgrade'
-const PRICING_URL = 'https://svgrid.com/pricing'
-// ?ref=in-app lets us measure how many trials start from this exact prompt
-// vs. the pricing page itself - the whole point of a moment-of-intent CTA.
-const TRIAL_URL = 'https://svgrid.com/pricing?ref=in-app&utm_source=svgrid-enterprise&utm_medium=upgrade-prompt'
-
-let shownThisSession = false
-
-/** Human-readable labels for the Pro surfaces that gate behind a license. */
-export type EnterpriseFeatureLabel =
-  | 'Export'
-  | 'Import'
-  | 'Print'
-  | 'AI assistant'
-  | 'Pivot'
-  | 'Studio'
-
-/**
- * Show the contextual upgrade prompt for `feature`. No-ops if one has already
- * been shown this session, a card is already up, or we're on the server. Safe
- * to call on every Pro feature invocation - it self-throttles.
- */
-export function showUpgradePrompt(
-  feature?: EnterpriseFeatureLabel | string,
-  opts?: { expired?: boolean },
-): void {
-  if (shownThisSession) return
-  if (typeof document === 'undefined' || typeof window === 'undefined') return
-  if (document.querySelector(`[${CARD_ATTR}]`)) return
-  shownThisSession = true
-
-  const card = buildCard(feature, opts?.expired === true)
-  document.body.appendChild(card)
-  // Animate in on the next frame so the transition actually runs.
-  requestAnimationFrame(() => {
-    card.style.opacity = '1'
-    card.style.transform = 'translateY(0)'
-  })
-}
-
-/**
- * Remove the card if present and re-arm the once-per-session flag so a later
- * `showUpgradePrompt()` can show again. Mainly for hosts that want to control
- * the nudge themselves (and for tests).
- */
-export function dismissUpgradePrompt(): void {
-  shownThisSession = false
-  if (typeof document === 'undefined') return
-  document.querySelectorAll(`[${CARD_ATTR}]`).forEach((el) => el.remove())
-}
-
-// User closed or clicked through the card. Remove it, but leave
-// `shownThisSession` set so it does not reappear for the rest of the session.
-function close(card: HTMLElement): void {
-  card.style.opacity = '0'
-  card.style.transform = 'translateY(8px)'
-  window.setTimeout(() => card.remove(), 220)
-}
-
-function buildCard(feature?: EnterpriseFeatureLabel | string, expired = false): HTMLElement {
-  const card = document.createElement('div')
-  card.setAttribute(CARD_ATTR, '1')
-  card.setAttribute('role', 'dialog')
-  card.setAttribute('aria-label', expired ? 'Your trial has ended' : 'Unlock SvGrid Pro')
-  Object.assign(card.style, {
-    position: 'fixed',
-    bottom: '16px',
-    right: '16px',
-    zIndex: '2147483646', // one below the watermark so they never collide
-    width: '320px',
-    maxWidth: 'calc(100vw - 32px)',
-    boxSizing: 'border-box',
-    padding: '16px 16px 14px',
-    background: '#0f172a',
-    color: '#e2e8f0',
-    borderRadius: '12px',
-    border: '1px solid rgba(99,102,241,0.4)',
-    boxShadow: '0 12px 40px rgba(0,0,0,0.45)',
-    fontFamily: '-apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif',
-    fontSize: '13px',
-    lineHeight: '1.45',
-    opacity: '0',
-    transform: 'translateY(8px)',
-    transition: 'opacity 220ms ease, transform 220ms ease',
-  } as Partial<CSSStyleDeclaration> as CSSStyleDeclaration)
-
-  const featureName = feature ? String(feature) : 'This'
-  const featurePhrase = feature
-    ? `<strong style="color:#fff">${escapeHtml(featureName)}</strong> is a Pro feature.`
-    : `You just used a <strong style="color:#fff">Pro</strong> feature.`
-
-  // An expired trial is a different message from "you never had a licence":
-  // they already evaluated, so the ask is to convert, not to start over.
-  const badge = expired ? 'TRIAL ENDED' : 'PRO'
-  const heading = expired ? 'Your trial has ended' : 'Unlock SvGrid Pro'
-  const body = expired
-    ? `${featurePhrase} Your evaluation period is over - everything still works,
-       but this notice stays until a licence key is set.`
-    : `${featurePhrase} It runs in evaluation with a watermark - start a free trial
-       to remove it and ship to production.`
-  const cta = expired ? 'Buy a licence' : 'Start free trial'
-
-  card.innerHTML = `
-    <button type="button" data-act="x" aria-label="Dismiss"
-      style="position:absolute;top:8px;right:8px;width:24px;height:24px;display:flex;
-      align-items:center;justify-content:center;background:transparent;border:0;
-      color:#94a3b8;font-size:18px;line-height:1;cursor:pointer;border-radius:6px;">&times;</button>
-    <div style="display:flex;align-items:center;gap:8px;margin-bottom:8px;">
-      <span style="display:inline-block;background:${expired ? '#b45309' : '#4f46e5'};color:#fff;font-size:10px;
-        font-weight:700;letter-spacing:0.06em;padding:2px 7px;border-radius:999px;">${badge}</span>
-      <span style="font-weight:700;color:#fff;">${heading}</span>
-    </div>
-    <p style="margin:0 0 12px;color:#cbd5e1;">
-      ${body}
-    </p>
-    <div style="display:flex;gap:8px;align-items:center;">
-      <a data-act="trial" href="${TRIAL_URL}" target="_blank" rel="noopener noreferrer"
-        style="flex:1;text-align:center;background:#6366f1;color:#fff;font-weight:600;
-        text-decoration:none;padding:8px 12px;border-radius:8px;">${cta}</a>
-      <a data-act="pricing" href="${PRICING_URL}" target="_blank" rel="noopener noreferrer"
-        style="color:#a5b4fc;text-decoration:none;padding:8px 6px;font-weight:600;">Pricing</a>
-    </div>
-    <p style="margin:10px 0 0;font-size:11px;color:#64748b;">
-      Already licensed? Call <code style="color:#94a3b8;">setLicenseKey()</code> at startup to hide this.
-    </p>
-  `
-
-  card.querySelector('[data-act="x"]')?.addEventListener('click', () => close(card))
-  // Clicking through to a trial / pricing also counts as "handled" - close the
-  // card, but let the link open in its new tab first.
-  card.querySelector('[data-act="trial"]')?.addEventListener('click', () => close(card))
-  card.querySelector('[data-act="pricing"]')?.addEventListener('click', () => close(card))
-
-  return card
-}
-
-function escapeHtml(s: string): string {
-  return s
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-}

package/src/version.test.ts

@@ -1,17 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { readFileSync } from 'node:fs'
-import { resolve } from 'node:path'
-import { SVGRID_VERSION } from './version'
-
-describe('SVGRID_VERSION', () => {
-  it('matches package.json, so generated apps pin a version that exists', () => {
-    // Generated apps depend on `^SVGRID_VERSION`. If this drifts below the real
-    // version, every scaffolded app asks for a runtime older than the generator
-    // and can miss features the emitted code uses.
-    const pkg = JSON.parse(readFileSync(resolve(process.cwd(), 'package.json'), 'utf8')) as { name: string; version: string }
-    // Guard the guard: if the runner's cwd ever moves, fail loudly here rather
-    // than quietly comparing against some other package's version.
-    expect(pkg.name).toBe('@svgrid/enterprise')
-    expect(SVGRID_VERSION).toBe(pkg.version)
-  })
-})