@svgrid/enterprise 3.0.1 → 3.0.3

package/dist/sveltekit/sql.js

@@ -2,37 +2,66 @@ export function planToSql(plan, dialect = {}) {
     const q = dialect.quote ?? '"';
     const useIlike = dialect.ilike ?? false;
     const params = [];
-    const ph = () => {
-        if (dialect.placeholders === '$')
-            return `$${params.length}`;
-        if (dialect.placeholders === '@')
-            return `@p${params.length}`;
-        return '?';
-    };
-    const bind = (v) => {
-        params.push(v);
-        return ph();
-    };
     const columnFor = dialect.column ?? ((f) => f);
     const id = (field) => {
         const c = columnFor(field);
         return `${q}${c.replace(new RegExp(q, 'g'), q + q)}${q}`;
     };
-    const like = (field, pattern) => {
-        const p = bind(pattern);
-        return useIlike ? `${id(field)} ILIKE ${p}` : `LOWER(${id(field)}) LIKE LOWER(${p})`;
+    // The planner whitelists function names; this is the second lock on the
+    // same door, since an aggregate name is pasted into the statement raw.
+    const aggName = (fn) => {
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(fn))
+            throw new Error(`planToSql: "${fn}" is not an aggregate function name`);
+        return fn.toUpperCase();
     };
-    const clauses = [];
-    for (const pred of plan.where) {
-        clauses.push(predicateSql(pred, { id, bind, like }));
-    }
-    if (plan.search && plan.search.fields.length > 0) {
-        const term = `%${plan.search.term}%`;
-        const ors = plan.search.fields.map((f) => like(f, term));
-        clauses.push(`(${ors.join(' OR ')})`);
+    /**
+     * Render predicates + search into one WHERE body, binding into `into`.
+     * Placeholder numbering follows that array, so a second call with a fresh
+     * array (the grand total) starts from $1 again.
+     */
+    const buildWhere = (preds, into) => {
+        const ph = () => {
+            if (dialect.placeholders === '$')
+                return `$${into.length}`;
+            if (dialect.placeholders === '@')
+                return `@p${into.length}`;
+            return '?';
+        };
+        const bind = (v) => {
+            into.push(v);
+            return ph();
+        };
+        const like = (field, pattern) => {
+            const p = bind(pattern);
+            return useIlike ? `${id(field)} ILIKE ${p}` : `LOWER(${id(field)}) LIKE LOWER(${p})`;
+        };
+        const clauses = [];
+        for (const pred of preds)
+            clauses.push(predicateSql(pred, { id, bind, like }));
+        if (plan.search && plan.search.fields.length > 0) {
+            const term = `%${plan.search.term}%`;
+            const ors = plan.search.fields.map((f) => like(f, term));
+            clauses.push(`(${ors.join(' OR ')})`);
+        }
+        return clauses.join(' AND ');
+    };
+    const where = buildWhere(plan.where, params);
+    // A grouped level can only order by what it produces - the key and the
+    // aggregates (under pivot only the key, the aggregates being split per
+    // pivot key); a leaf column there is a SQL error. With nothing left the
+    // key orders the groups, so paging over them is deterministic. Same rule
+    // as the in-memory reference.
+    let order = plan.orderBy;
+    if (plan.groupBy) {
+        const produced = new Set([
+            plan.groupBy,
+            ...(plan.pivotBy?.length ? [] : (plan.aggregations ?? []).map((a) => a.field)),
+        ]);
+        order = order.filter((o) => produced.has(o.field));
+        if (order.length === 0)
+            order = [{ field: plan.groupBy, desc: false }];
     }
-    const where = clauses.join(' AND ');
-    const orderBy = plan.orderBy.map((o) => `${id(o.field)} ${o.desc ? 'DESC' : 'ASC'}`).join(', ');
+    const orderBy = order.map((o) => `${id(o.field)} ${o.desc ? 'DESC' : 'ASC'}`).join(', ');
     // ---- Grouping ----------------------------------------------------------
     // `plan.groupBy` is a single column: the grid asks one level at a time and
     // sends the chosen path as ordinary predicates, so there is never a
@@ -44,13 +73,89 @@ export function planToSql(plan, dialect = {}) {
         for (const agg of plan.aggregations ?? []) {
             // COUNT(*) rather than COUNT(col) so the tally counts rows in the group
             // rather than non-null values of one column.
-            const expr = agg.fn === 'count' ? 'COUNT(*)' : `${agg.fn.toUpperCase()}(${id(agg.field)})`;
+            const expr = agg.fn === 'count' ? 'COUNT(*)' : `${aggName(agg.fn)}(${id(agg.field)})`;
             // Aliased back to the source column name: that is the key the grid reads
             // the aggregate from on the group row.
             parts.push(`${expr} AS ${id(agg.field)}`);
         }
+        // What opening the group would show, for the badge beside its key: the
+        // distinct keys of the next level, or the rows when this is the innermost
+        // group level. Always emitted; a caller that does not want the extra
+        // aggregate can drop the alias from the list.
+        parts.push(plan.childGroupBy
+            ? `COUNT(DISTINCT ${id(plan.childGroupBy)}) AS ${id('childCount')}`
+            : `COUNT(*) AS ${id('childCount')}`);
         select = parts.join(', ');
     }
+    // The grand total aggregates over everything the FILTERS admit, so the
+    // group path (the trailing `pathPredicates` entries of `where`, per
+    // planQuery) is left out.
+    let grandTotalSelect = '';
+    let grandTotalWhereText = '';
+    const grandTotalParams = [];
+    if (plan.grandTotal) {
+        grandTotalSelect = (plan.aggregations ?? [])
+            .map((agg) => {
+            const expr = agg.fn === 'count' ? 'COUNT(*)' : `${aggName(agg.fn)}(${id(agg.field)})`;
+            return `${expr} AS ${id(agg.field)}`;
+        })
+            .join(', ');
+        const filtersOnly = plan.where.slice(0, plan.where.length - (plan.pathPredicates ?? 0));
+        const body = buildWhere(filtersOnly, grandTotalParams);
+        grandTotalWhereText = body ? `WHERE ${body}` : '';
+    }
+    // ---- Pivot ------------------------------------------------------------
+    let pivotKeysSelect = '';
+    let pivotSelect = () => ({ select: '', fields: [], grandTotalSelect: '' });
+    if (plan.groupBy && plan.pivotBy?.length) {
+        const pivotCols = plan.pivotBy;
+        const keyList = pivotCols
+            .map((c) => (columnFor(c) === c ? id(c) : `${id(c)} AS ${q}${c}${q}`))
+            .join(', ');
+        pivotKeysSelect = `DISTINCT ${keyList}`;
+        pivotSelect = (keyRows) => {
+            // Key paths in plain string order, so the field list (and the
+            // columns the grid builds from it) is the same whatever order the
+            // distinct-keys query returned - and the same as the reference.
+            const pathOf = (row) => pivotCols.map((c) => String(row[c] ?? '')).join('_');
+            keyRows = [...keyRows].sort((a, b) => {
+                const x = pathOf(a);
+                const y = pathOf(b);
+                return x < y ? -1 : x > y ? 1 : 0;
+            });
+            const groupCol = id(plan.groupBy);
+            const parts = [groupCol];
+            const totals = [];
+            const fields = [];
+            for (const keyRow of keyRows) {
+                const path = pivotCols.map((c) => String(keyRow[c] ?? ''));
+                // The key path as an inline condition. Values are quoted as string
+                // literals with doubled quotes; a caller with typed columns can
+                // rewrite through `pivotSelect` itself.
+                const cond = pivotCols
+                    .map((c, i) => `${id(c)} = '${path[i].replace(/'/g, "''")}'`)
+                    .join(' AND ');
+                for (const agg of plan.aggregations ?? []) {
+                    const field = `${path.join('_')}_${agg.field}`;
+                    const inner = agg.fn === 'count' ? '1' : id(agg.field);
+                    const fn = agg.fn === 'count' ? 'COUNT' : aggName(agg.fn);
+                    const expr = `${fn}(CASE WHEN ${cond} THEN ${inner} END) AS ${id(field)}`;
+                    parts.push(expr);
+                    totals.push(expr);
+                    fields.push(field);
+                }
+            }
+            // The plain aggregates too: the row total beside the per-key cells,
+            // which is what a Total column group reads.
+            for (const agg of plan.aggregations ?? []) {
+                const expr = agg.fn === 'count' ? 'COUNT(*)' : `${aggName(agg.fn)}(${id(agg.field)})`;
+                parts.push(`${expr} AS ${id(agg.field)}`);
+                totals.push(`${expr} AS ${id(agg.field)}`);
+            }
+            parts.push(`COUNT(*) AS ${id('childCount')}`);
+            return { select: parts.join(', '), fields, grandTotalSelect: totals.join(', ') };
+        };
+    }
     // A grouped total is the number of distinct keys, not of underlying rows.
     const countText = plan.groupBy
         ? `COUNT(DISTINCT ${id(plan.groupBy)})`
@@ -67,6 +172,11 @@ export function planToSql(plan, dialect = {}) {
         groupBy,
         groupByText: groupBy ? `GROUP BY ${groupBy}` : '',
         countText,
+        grandTotalSelect,
+        grandTotalWhereText,
+        grandTotalParams,
+        pivotKeysSelect,
+        pivotSelect,
     };
 }
 function predicateSql(pred, ctx) {

package/dist/sveltekit/transport.d.ts

@@ -23,7 +23,7 @@
  *     const source = createKitDataSource({ endpoint: '/api/customers' })
  *     const controller = createServerDataSource(source, { onChange: ... })
  */
-import type { RowData, ServerDataSource, ServerRequest } from '@svgrid/grid';
+import type { RowData, ServerDataSource, ServerFilterModel, ServerRequest, ServerSelectionRule } from '@svgrid/grid';
 import type { EntitySchema } from '../schema.js';
 import type { WritableDataSource } from './types.js';
 /** Wire protocol: the single JSON body shape the client POSTs and the server dispatches on. */
@@ -43,6 +43,14 @@ export type KitMessage<TData> = {
     kind: 'mutate';
     op: 'delete';
     id: string;
+}
+/** A bulk edit by rule: every row the filter and the selection name. */
+ | {
+    kind: 'mutate';
+    op: 'updateWhere';
+    filterModel: ServerFilterModel;
+    patch: Partial<TData>;
+    selection: ServerSelectionRule;
 };
 type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
 export type KitDataSourceOptions = {
@@ -54,7 +62,7 @@ export type KitDataSourceOptions = {
      */
     fetch?: FetchLike;
 };
-export declare function createKitDataSource<TData extends RowData>(options: KitDataSourceOptions): WritableDataSource<TData>;
+export declare function createKitDataSource<TData extends RowData>(options: KitDataSourceOptions): WritableDataSource<TData> & Required<Pick<ServerDataSource<TData>, 'updateWhere'>>;
 /** The CRUD action a Kit message maps to (`query` -> `read`). */
 export type KitAction = 'read' | 'create' | 'update' | 'delete';
 /** Context passed to the `authorize` guard before every op. */

package/dist/sveltekit/transport.js

@@ -7,11 +7,12 @@ function jsonResponse(data, status = 200) {
 }
 export function createKitDataSource(options) {
     const doFetch = options.fetch ?? ((i, init) => fetch(i, init));
-    async function post(body) {
+    async function post(body, signal) {
         const res = await doFetch(options.endpoint, {
             method: 'POST',
             headers: { 'content-type': 'application/json' },
             body: JSON.stringify(body),
+            ...(signal ? { signal } : {}),
         });
         if (!res.ok) {
             const detail = await res.text().catch(() => '');
@@ -20,13 +21,15 @@ export function createKitDataSource(options) {
         return (await res.json());
     }
     return {
-        getRows: (request) => post({ kind: 'query', request }),
+        // The abort signal rides on the fetch, not in the body.
+        getRows: ({ signal, ...request }) => post({ kind: 'query', request }, signal),
         createRow: (input) => post({ kind: 'mutate', op: 'create', input }),
         updateRow: (id, patch) => post({ kind: 'mutate', op: 'update', id, patch }),
         deleteRow: (id) => post({ kind: 'mutate', op: 'delete', id }).then(() => undefined),
+        updateWhere: (filterModel, patch, selection) => post({ kind: 'mutate', op: 'updateWhere', filterModel, patch, selection }).then((r) => r.count),
     };
 }
-const actionOf = (msg) => msg.kind === 'query' ? 'read' : msg.op;
+const actionOf = (msg) => msg.kind === 'query' ? 'read' : msg.op === 'updateWhere' ? 'update' : msg.op;
 export function createKitHandlers(options) {
     const { source, authorize, validate, audit, hooks, scope } = options;
     const idField = options.schema.idField ?? options.schema.fields.find((f) => f.primaryKey)?.field ?? 'id';
@@ -66,18 +69,18 @@ export function createKitHandlers(options) {
                 return jsonResponse({ error: 'forbidden' }, 403);
         }
         // Validate create / update payloads BEFORE the source. 422 on field errors.
-        if (validate && msg.kind === 'mutate' && (msg.op === 'create' || msg.op === 'update')) {
+        if (validate && msg.kind === 'mutate' && msg.op !== 'delete') {
             const values = (msg.op === 'create' ? msg.input : msg.patch);
             let errors;
             if (validate === true) {
                 const all = await validateAll(options.schema, values);
                 // On update, only the supplied fields are validated (a patch omits the rest).
-                errors = msg.op === 'update'
+                errors = msg.op !== 'create'
                     ? Object.fromEntries(Object.keys(values).filter((k) => all[k]).map((k) => [k, all[k]]))
                     : all;
             }
             else {
-                errors = await validate({ action: msg.op, values, event: { request, locals: event?.locals } });
+                errors = await validate({ action: msg.op === 'create' ? 'create' : 'update', values, event: { request, locals: event?.locals } });
             }
             if (errors && Object.keys(errors).length) {
                 return jsonResponse({ error: 'validation failed', fieldErrors: errors }, 422);
@@ -191,6 +194,27 @@ export function createKitHandlers(options) {
                     await fireAudit({ action: 'update', id: msg.id, values: patch, result: row, event: evt });
                     return jsonResponse(row);
                 }
+                if (msg.op === 'updateWhere') {
+                    if (!source.updateWhere)
+                        return jsonResponse({ error: 'updateWhere not supported' }, 405);
+                    // The scope narrows the rule the same way it narrows a query, and
+                    // the patch cannot move rows out of it.
+                    let filterModel = msg.filterModel;
+                    let patch = msg.patch;
+                    if (activeScope) {
+                        filterModel = {
+                            ...filterModel,
+                            columns: {
+                                ...(filterModel.columns ?? {}),
+                                [activeScope.field]: { operator: 'equals', value: String(activeScope.value) },
+                            },
+                        };
+                        patch = { ...patch, [activeScope.field]: activeScope.value };
+                    }
+                    const count = await source.updateWhere(filterModel, patch, msg.selection);
+                    await fireAudit({ action: 'update', id: null, values: patch, event: evt });
+                    return jsonResponse({ count });
+                }
                 if (msg.op === 'delete') {
                     if (!source.deleteRow)
                         return jsonResponse({ error: 'delete not supported' }, 405);

package/dist/upgrade-prompt.d.ts

@@ -1,5 +1,5 @@
 /** Human-readable labels for the Pro surfaces that gate behind a license. */
-export type EnterpriseFeatureLabel = 'Export' | 'Import' | 'Print' | 'AI assistant' | 'Pivot' | 'Studio';
+export type EnterpriseFeatureLabel = 'Export' | 'Import' | 'Print' | 'AI assistant' | 'Pivot' | 'Server-side row model' | 'Spreadsheet' | 'Studio';
 /**
  * Show the contextual upgrade prompt for `feature`. No-ops if one has already
  * been shown this session, a card is already up, or we're on the server. Safe

package/dist/version.d.ts

@@ -10,4 +10,4 @@
  *
  * `version.test.ts` asserts this matches `package.json`, so the two cannot drift.
  */
-export declare const SVGRID_VERSION = "3.0.0";
+export declare const SVGRID_VERSION = "3.0.3";

package/dist/version.js

@@ -10,4 +10,4 @@
  *
  * `version.test.ts` asserts this matches `package.json`, so the two cannot drift.
  */
-export const SVGRID_VERSION = '3.0.0';
+export const SVGRID_VERSION = '3.0.3';

package/dist/watermark.js

@@ -1,4 +1,4 @@
-// Soft-gate UX for unlicensed @svgrid/enterprise use. Shows a small clickable
+// Evaluation UX for unlicensed @svgrid/enterprise use. Shows a small clickable
 // "www.svgrid.com" watermark in the bottom-right corner of every SvGrid on
 // the page, which fades out after 5 seconds, and emits a one-time console
 // nudge. Hard errors (revoked / bad-prefix keys) still throw via license.ts -
@@ -70,7 +70,32 @@ function attachToAllGrids() {
     document
         .querySelectorAll(`[${WATERMARK_ATTR}="fixed"]`)
         .forEach((el) => el.remove());
-    grids.forEach(attachWatermarkTo);
+    const hosts = new Set();
+    grids.forEach((grid) => {
+        const host = watermarkHost(grid);
+        if (host)
+            hosts.add(host);
+    });
+    hosts.forEach(attachWatermarkTo);
+}
+/**
+ * Where the watermark for a matched grid actually hangs.
+ *
+ * The selector above matches the grid's root container AND the `role="grid"`
+ * element inside it, which is the TABLE. A link is not a legal child of a
+ * table, and `role="grid"` allows only rows under it, so appending there is
+ * invalid HTML and an axe `aria-required-children` violation on every
+ * unlicensed grid. So: the grid's own root when the match sits inside one,
+ * otherwise the nearest ancestor outside the table's content model.
+ */
+function watermarkHost(grid) {
+    const root = grid.closest('.sv-grid-root');
+    if (root)
+        return root;
+    let host = grid;
+    while (host && /^(TABLE|THEAD|TBODY|TFOOT|TR|COLGROUP)$/.test(host.tagName))
+        host = host.parentElement;
+    return host;
 }
 function attachWatermarkTo(grid) {
     // Show the watermark once per grid. The marker survives the fade-out so the
@@ -118,6 +143,14 @@ function scheduleFadeOut(el) {
         return;
     }
     window.setTimeout(() => {
+        // Five seconds is a long time in a teardown. The environment can go
+        // away between these two timers - a jsdom test finishing, a page
+        // unloading - and reaching for `window` then throws where the guard
+        // above was put precisely to avoid it. Same check, second chance.
+        if (typeof window === 'undefined') {
+            el.remove();
+            return;
+        }
         el.style.opacity = '0';
         window.setTimeout(() => el.remove(), FADE_MS);
     }, VISIBLE_MS);