@svgrid/enterprise 3.0.2 → 3.0.3

package/dist/sveltekit/transport.d.ts

@@ -23,7 +23,7 @@
  *     const source = createKitDataSource({ endpoint: '/api/customers' })
  *     const controller = createServerDataSource(source, { onChange: ... })
  */
-import type { RowData, ServerDataSource, ServerRequest } from '@svgrid/grid';
+import type { RowData, ServerDataSource, ServerFilterModel, ServerRequest, ServerSelectionRule } from '@svgrid/grid';
 import type { EntitySchema } from '../schema.js';
 import type { WritableDataSource } from './types.js';
 /** Wire protocol: the single JSON body shape the client POSTs and the server dispatches on. */
@@ -43,6 +43,14 @@ export type KitMessage<TData> = {
     kind: 'mutate';
     op: 'delete';
     id: string;
+}
+/** A bulk edit by rule: every row the filter and the selection name. */
+ | {
+    kind: 'mutate';
+    op: 'updateWhere';
+    filterModel: ServerFilterModel;
+    patch: Partial<TData>;
+    selection: ServerSelectionRule;
 };
 type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
 export type KitDataSourceOptions = {
@@ -54,7 +62,7 @@ export type KitDataSourceOptions = {
      */
     fetch?: FetchLike;
 };
-export declare function createKitDataSource<TData extends RowData>(options: KitDataSourceOptions): WritableDataSource<TData>;
+export declare function createKitDataSource<TData extends RowData>(options: KitDataSourceOptions): WritableDataSource<TData> & Required<Pick<ServerDataSource<TData>, 'updateWhere'>>;
 /** The CRUD action a Kit message maps to (`query` -> `read`). */
 export type KitAction = 'read' | 'create' | 'update' | 'delete';
 /** Context passed to the `authorize` guard before every op. */

package/dist/sveltekit/transport.js

@@ -7,11 +7,12 @@ function jsonResponse(data, status = 200) {
 }
 export function createKitDataSource(options) {
     const doFetch = options.fetch ?? ((i, init) => fetch(i, init));
-    async function post(body) {
+    async function post(body, signal) {
         const res = await doFetch(options.endpoint, {
             method: 'POST',
             headers: { 'content-type': 'application/json' },
             body: JSON.stringify(body),
+            ...(signal ? { signal } : {}),
         });
         if (!res.ok) {
             const detail = await res.text().catch(() => '');
@@ -20,13 +21,15 @@ export function createKitDataSource(options) {
         return (await res.json());
     }
     return {
-        getRows: (request) => post({ kind: 'query', request }),
+        // The abort signal rides on the fetch, not in the body.
+        getRows: ({ signal, ...request }) => post({ kind: 'query', request }, signal),
         createRow: (input) => post({ kind: 'mutate', op: 'create', input }),
         updateRow: (id, patch) => post({ kind: 'mutate', op: 'update', id, patch }),
         deleteRow: (id) => post({ kind: 'mutate', op: 'delete', id }).then(() => undefined),
+        updateWhere: (filterModel, patch, selection) => post({ kind: 'mutate', op: 'updateWhere', filterModel, patch, selection }).then((r) => r.count),
     };
 }
-const actionOf = (msg) => msg.kind === 'query' ? 'read' : msg.op;
+const actionOf = (msg) => msg.kind === 'query' ? 'read' : msg.op === 'updateWhere' ? 'update' : msg.op;
 export function createKitHandlers(options) {
     const { source, authorize, validate, audit, hooks, scope } = options;
     const idField = options.schema.idField ?? options.schema.fields.find((f) => f.primaryKey)?.field ?? 'id';
@@ -66,18 +69,18 @@ export function createKitHandlers(options) {
                 return jsonResponse({ error: 'forbidden' }, 403);
         }
         // Validate create / update payloads BEFORE the source. 422 on field errors.
-        if (validate && msg.kind === 'mutate' && (msg.op === 'create' || msg.op === 'update')) {
+        if (validate && msg.kind === 'mutate' && msg.op !== 'delete') {
             const values = (msg.op === 'create' ? msg.input : msg.patch);
             let errors;
             if (validate === true) {
                 const all = await validateAll(options.schema, values);
                 // On update, only the supplied fields are validated (a patch omits the rest).
-                errors = msg.op === 'update'
+                errors = msg.op !== 'create'
                     ? Object.fromEntries(Object.keys(values).filter((k) => all[k]).map((k) => [k, all[k]]))
                     : all;
             }
             else {
-                errors = await validate({ action: msg.op, values, event: { request, locals: event?.locals } });
+                errors = await validate({ action: msg.op === 'create' ? 'create' : 'update', values, event: { request, locals: event?.locals } });
             }
             if (errors && Object.keys(errors).length) {
                 return jsonResponse({ error: 'validation failed', fieldErrors: errors }, 422);
@@ -191,6 +194,27 @@ export function createKitHandlers(options) {
                     await fireAudit({ action: 'update', id: msg.id, values: patch, result: row, event: evt });
                     return jsonResponse(row);
                 }
+                if (msg.op === 'updateWhere') {
+                    if (!source.updateWhere)
+                        return jsonResponse({ error: 'updateWhere not supported' }, 405);
+                    // The scope narrows the rule the same way it narrows a query, and
+                    // the patch cannot move rows out of it.
+                    let filterModel = msg.filterModel;
+                    let patch = msg.patch;
+                    if (activeScope) {
+                        filterModel = {
+                            ...filterModel,
+                            columns: {
+                                ...(filterModel.columns ?? {}),
+                                [activeScope.field]: { operator: 'equals', value: String(activeScope.value) },
+                            },
+                        };
+                        patch = { ...patch, [activeScope.field]: activeScope.value };
+                    }
+                    const count = await source.updateWhere(filterModel, patch, msg.selection);
+                    await fireAudit({ action: 'update', id: null, values: patch, event: evt });
+                    return jsonResponse({ count });
+                }
                 if (msg.op === 'delete') {
                     if (!source.deleteRow)
                         return jsonResponse({ error: 'delete not supported' }, 405);

package/dist/upgrade-prompt.d.ts

@@ -1,5 +1,5 @@
 /** Human-readable labels for the Pro surfaces that gate behind a license. */
-export type EnterpriseFeatureLabel = 'Export' | 'Import' | 'Print' | 'AI assistant' | 'Pivot' | 'Studio';
+export type EnterpriseFeatureLabel = 'Export' | 'Import' | 'Print' | 'AI assistant' | 'Pivot' | 'Server-side row model' | 'Spreadsheet' | 'Studio';
 /**
  * Show the contextual upgrade prompt for `feature`. No-ops if one has already
  * been shown this session, a card is already up, or we're on the server. Safe

package/dist/version.d.ts

@@ -10,4 +10,4 @@
  *
  * `version.test.ts` asserts this matches `package.json`, so the two cannot drift.
  */
-export declare const SVGRID_VERSION = "3.0.2";
+export declare const SVGRID_VERSION = "3.0.3";

package/dist/version.js

@@ -10,4 +10,4 @@
  *
  * `version.test.ts` asserts this matches `package.json`, so the two cannot drift.
  */
-export const SVGRID_VERSION = '3.0.2';
+export const SVGRID_VERSION = '3.0.3';

package/dist/watermark.js

@@ -1,4 +1,4 @@
-// Soft-gate UX for unlicensed @svgrid/enterprise use. Shows a small clickable
+// Evaluation UX for unlicensed @svgrid/enterprise use. Shows a small clickable
 // "www.svgrid.com" watermark in the bottom-right corner of every SvGrid on
 // the page, which fades out after 5 seconds, and emits a one-time console
 // nudge. Hard errors (revoked / bad-prefix keys) still throw via license.ts -
@@ -70,7 +70,32 @@ function attachToAllGrids() {
     document
         .querySelectorAll(`[${WATERMARK_ATTR}="fixed"]`)
         .forEach((el) => el.remove());
-    grids.forEach(attachWatermarkTo);
+    const hosts = new Set();
+    grids.forEach((grid) => {
+        const host = watermarkHost(grid);
+        if (host)
+            hosts.add(host);
+    });
+    hosts.forEach(attachWatermarkTo);
+}
+/**
+ * Where the watermark for a matched grid actually hangs.
+ *
+ * The selector above matches the grid's root container AND the `role="grid"`
+ * element inside it, which is the TABLE. A link is not a legal child of a
+ * table, and `role="grid"` allows only rows under it, so appending there is
+ * invalid HTML and an axe `aria-required-children` violation on every
+ * unlicensed grid. So: the grid's own root when the match sits inside one,
+ * otherwise the nearest ancestor outside the table's content model.
+ */
+function watermarkHost(grid) {
+    const root = grid.closest('.sv-grid-root');
+    if (root)
+        return root;
+    let host = grid;
+    while (host && /^(TABLE|THEAD|TBODY|TFOOT|TR|COLGROUP)$/.test(host.tagName))
+        host = host.parentElement;
+    return host;
 }
 function attachWatermarkTo(grid) {
     // Show the watermark once per grid. The marker survives the fade-out so the
@@ -118,6 +143,14 @@ function scheduleFadeOut(el) {
         return;
     }
     window.setTimeout(() => {
+        // Five seconds is a long time in a teardown. The environment can go
+        // away between these two timers - a jsdom test finishing, a page
+        // unloading - and reaching for `window` then throws where the guard
+        // above was put precisely to avoid it. Same check, second chance.
+        if (typeof window === 'undefined') {
+            el.remove();
+            return;
+        }
         el.style.opacity = '0';
         window.setTimeout(() => el.remove(), FADE_MS);
     }, VISIBLE_MS);