@svgrid/enterprise 3.1.25 → 3.1.27

package/dist/pdf-worker.js

@@ -0,0 +1,147 @@
+/// <reference path="./pdfmake-shims.d.ts" />
+/**
+ * Render a PDF export in a worker, so a large report does not freeze the
+ * page. pdfmake lays out and writes the whole document in one synchronous
+ * run, about a millisecond per row of eight columns on a desktop machine:
+ * a 20,000-row export held the main thread for over twenty seconds.
+ *
+ * The app owns the worker file, so any bundler builds it:
+ *
+ * ```ts
+ * // pdf.worker.ts
+ * import { servePdfWorker } from '@svgrid/enterprise/pdf-worker'
+ * servePdfWorker()
+ * ```
+ *
+ * ```ts
+ * await api.exportData({
+ *   format: 'pdf',
+ *   pdf: { worker: () => new Worker(new URL('./pdf.worker.ts', import.meta.url), { type: 'module' }) },
+ * })
+ * ```
+ *
+ * The main thread builds the document as plain data (`buildPdfDocData`) and
+ * posts it here with the font, if any; the worker loads pdfmake, attaches
+ * the layout and footer functions (`hydratePdfDoc`), renders, and posts the
+ * bytes back with progress along the way.
+ */
+import { hydratePdfDoc, registerPdfFont, registerPdfFonts } from './export-pdf.js';
+/** Tags this channel's messages, so a worker shared with other traffic ignores the rest. */
+export const PDF_WORKER_CHANNEL = 'svgrid-pdf';
+/**
+ * Render a document from `buildPdfDocData` with the pdfmake given. The
+ * worker's half of the export, exported so it can run anywhere pdfmake does.
+ */
+export function renderPdfDoc(doc, pdfMake, opts = {}) {
+    if (opts.font)
+        registerPdfFont(pdfMake, opts.font);
+    const def = hydratePdfDoc(doc);
+    return new Promise((resolve, reject) => {
+        const done = (bytes) => resolve(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes));
+        try {
+            // 0.2 calls back; 0.3 returns a promise and ignores the callback.
+            const returned = pdfMake.createPdf(def).getBuffer(done, { progressCallback: opts.onProgress });
+            if (returned && typeof returned.then === 'function') {
+                ;
+                returned.then(done, reject);
+            }
+        }
+        catch (err) {
+            reject(err);
+        }
+    });
+}
+async function loadPdfMake() {
+    // @ts-ignore - "pdfmake" is an optional peerDependency
+    const mod = (await import('pdfmake/build/pdfmake'));
+    // @ts-ignore - "pdfmake" is an optional peerDependency
+    const vfs = await import('pdfmake/build/vfs_fonts');
+    const pdfMake = (mod.default ?? mod);
+    if (!registerPdfFonts(pdfMake, vfs)) {
+        throw new Error('"pdfmake/build/vfs_fonts" did not contain a font map; the installed pdfmake is not one this export knows.');
+    }
+    // createPdf reads `pdfMake.tableLayouts` off the global, and a bundled
+    // import never sets that global, so without this every render failed with
+    // "Cannot read properties of undefined (reading 'tableLayouts')". The page
+    // side does the same in ensureGlobals.
+    ;
+    globalThis.pdfMake = pdfMake;
+    return pdfMake;
+}
+/** Answer PDF export requests from the main thread. Call it once, in the worker. */
+export function servePdfWorker(options = {}) {
+    const scope = options.scope ?? globalThis;
+    const load = options.loadPdfMake ?? loadPdfMake;
+    let pdfMake = null;
+    const reply = (message, transfer) => scope.postMessage(message, transfer);
+    const listener = async (event) => {
+        const msg = event.data;
+        if (!msg || msg.channel !== PDF_WORKER_CHANNEL || typeof msg.id !== 'number' || !msg.doc)
+            return;
+        const { id, doc, font } = msg;
+        try {
+            pdfMake ?? (pdfMake = load());
+            // pdfmake reports progress per item drawn: a 5,000-row table sent
+            // 79,129 messages. One per percent is enough for a progress bar.
+            let sent = -1;
+            const bytes = await renderPdfDoc(doc, await pdfMake, {
+                font,
+                onProgress: (progress) => {
+                    if (progress < 1 && progress - sent < 0.01)
+                        return;
+                    sent = progress;
+                    reply({ channel: PDF_WORKER_CHANNEL, id, progress });
+                },
+            });
+            // A copy of exactly these bytes, handed over rather than cloned.
+            const pdf = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+            reply({ channel: PDF_WORKER_CHANNEL, id, pdf }, [pdf]);
+        }
+        catch (err) {
+            pdfMake = null;
+            reply({ channel: PDF_WORKER_CHANNEL, id, error: err instanceof Error ? err.message : String(err) });
+        }
+    };
+    scope.addEventListener('message', listener);
+    return { dispose: () => scope.removeEventListener('message', listener) };
+}
+let nextJob = 1;
+/**
+ * The main thread's half: post the document to a fresh worker, report its
+ * progress, and resolve with the PDF. An abort terminates the worker.
+ */
+export function renderPdfInWorker(makeWorker, doc, opts = {}) {
+    const worker = makeWorker();
+    const id = nextJob++;
+    return new Promise((resolve, reject) => {
+        const finish = () => {
+            opts.signal?.removeEventListener('abort', onAbort);
+            worker.terminate();
+        };
+        const onAbort = () => {
+            finish();
+            reject(new DOMException('Export aborted', 'AbortError'));
+        };
+        if (opts.signal?.aborted)
+            return onAbort();
+        opts.signal?.addEventListener('abort', onAbort, { once: true });
+        worker.addEventListener('message', (event) => {
+            const msg = event.data;
+            if (!msg || msg.channel !== PDF_WORKER_CHANNEL || msg.id !== id)
+                return;
+            if ('progress' in msg)
+                return opts.onProgress?.(msg.progress);
+            finish();
+            if ('pdf' in msg)
+                resolve(new Blob([msg.pdf], { type: 'application/pdf' }));
+            else
+                reject(new Error(`@svgrid/enterprise: the PDF worker failed: ${msg.error}`));
+        });
+        worker.addEventListener('error', (event) => {
+            finish();
+            reject(new Error(`@svgrid/enterprise: the PDF worker failed to start or crashed: ${event.message || 'no message'}. Check that it calls servePdfWorker().`));
+        });
+        const request = { channel: PDF_WORKER_CHANNEL, id, doc, ...(opts.font ? { font: opts.font } : {}) };
+        worker.postMessage(request);
+    });
+}

package/dist/sheet/ods-document.js

@@ -17,6 +17,7 @@ import { colToLetters, lettersToCol } from './address.js';
 import { tokenize } from './tokenize.js';
 import { formatKeyAt } from './format-store.js';
 import { linkAt } from './links.js';
+import { createUnzipBudget, readZipEntry } from '../xlsx-limits.js';
 import { threadAt } from './comments.js';
 import { loadZip } from './xlsx-document.js';
 import { accountingParts, accountingPattern } from './number-format.js';
@@ -747,6 +748,7 @@ function durationSeconds(text) {
 export async function documentFromOds(file, JSZip) {
     const Zip = await loadZip(JSZip);
     const zip = await Zip.loadAsync(file);
+    const budget = createUnzipBudget();
     const parts = {};
     const pending = [];
     zip.forEach((path, entry) => {
@@ -755,7 +757,7 @@ export async function documentFromOds(file, JSZip) {
         if (!/\.(xml)$/i.test(path))
             return;
         const clean = path.replace(/^\//, '');
-        pending.push(entry.async('string').then((text) => { parts[clean] = text; }));
+        pending.push(readZipEntry(entry, 'string', budget).then((text) => { parts[clean] = text; }));
     });
     await Promise.all(pending);
     return sheetStateFromOds(parts);

package/dist/sheet/open-file.js

@@ -14,6 +14,7 @@ import { documentFromXlsxParts, loadZip } from './xlsx-document.js';
 import { sheetStateFromOds } from './ods-document.js';
 import { sheetStateFromCsv } from './csv.js';
 import { isXlsFile, sheetStateFromXls } from './xls-document.js';
+import { createUnzipBudget, readZipEntry } from '../xlsx-limits.js';
 /** A picture travels as the data URL the document holds, as in the xlsx reader. */
 const MEDIA_PREFIX = 'xl/media/';
 const mediaTypeOf = (path) => {
@@ -31,6 +32,7 @@ export async function readSpreadsheetFile(file, JSZip) {
     }
     const Zip = await loadZip(JSZip);
     const zip = await Zip.loadAsync(file);
+    const budget = createUnzipBudget();
     const parts = {};
     const pending = [];
     zip.forEach((path, entry) => {
@@ -38,12 +40,12 @@ export async function readSpreadsheetFile(file, JSZip) {
             return;
         const clean = path.replace(/^\//, '');
         if (clean.startsWith(MEDIA_PREFIX)) {
-            pending.push(entry.async('base64').then((base64) => { parts[clean] = `data:${mediaTypeOf(clean)};base64,${base64}`; }));
+            pending.push(readZipEntry(entry, 'base64', budget).then((base64) => { parts[clean] = `data:${mediaTypeOf(clean)};base64,${base64}`; }));
             return;
         }
         if (!/\.(xml|rels|vml)$/i.test(clean))
             return;
-        pending.push(entry.async('string').then((text) => { parts[clean] = text; }));
+        pending.push(readZipEntry(entry, 'string', budget).then((text) => { parts[clean] = text; }));
     });
     await Promise.all(pending);
     if (parts['content.xml'] && !parts['xl/workbook.xml'])

package/dist/sheet/xlsx-document.d.ts

@@ -23,6 +23,7 @@
  * unzip them with jszip, an optional peer loaded on demand.
  */
 import type { SheetDocument, SheetState } from './document.js';
+import { type ZipEntryLike } from '../xlsx-limits.js';
 export declare const isoToSerial: (iso: string) => number | null;
 export declare const serialToIso: (serial: number) => string;
 /** Excel's built-in number formats, the ones a file names by id alone. */
@@ -94,9 +95,8 @@ export type ZipCtor = {
         file(path: string): {
             async(type: 'string' | 'base64'): Promise<string>;
         } | null;
-        forEach(fn: (path: string, entry: {
+        forEach(fn: (path: string, entry: ZipEntryLike & {
             dir: boolean;
-            async(type: 'string' | 'base64'): Promise<string>;
         }) => void): void;
     }>;
 };

package/dist/sheet/xlsx-document.js

@@ -13,6 +13,7 @@ import { drawingPartsFor, objectsFromDrawing, rectOfRef, REL_DRAWING } from './x
 import { objectId } from './objects.js';
 import { sparklineLines, sparklineId } from './sparklines.js';
 import { autoFilterXlsx, filteredRows, filtersFromXlsx } from './filter-files.js';
+import { createUnzipBudget, readZipEntry, XLSX_MAX_COLS, XLSX_MAX_FILL, XLSX_MAX_ROWS, xlsxFillError } from '../xlsx-limits.js';
 // ---------------------------------------------------------------------------
 // Shared pieces
 // ---------------------------------------------------------------------------
@@ -1282,10 +1283,24 @@ export function documentFromXlsxParts(parts) {
         const outlineCols = emptyOutline();
         if (xml) {
             const root = parseXml(xml, path).documentElement;
+            // Rows and lines are filled up to the cell, so a reference from the
+            // file decides how much is allocated: a cell outside the sheet is
+            // skipped, as other malformed parts are, and the blanks are budgeted
+            // (xlsx-limits.ts).
+            let filled = 0;
             const put = (r, c, text) => {
+                if (r >= XLSX_MAX_ROWS || c >= XLSX_MAX_COLS)
+                    return;
+                if (r > cells.length)
+                    filled += r - cells.length;
                 while (cells.length <= r)
                     cells.push([]);
                 const line = cells[r];
+                if (c >= line.length) {
+                    filled += c - line.length;
+                    if (filled > XLSX_MAX_FILL)
+                        throw xlsxFillError();
+                }
                 while (line.length <= c)
                     line.push('');
                 line[c] = text;
@@ -1828,6 +1843,7 @@ export async function documentToXlsx(doc, JSZip) {
 export async function documentFromXlsx(file, JSZip) {
     const Zip = await loadZip(JSZip);
     const zip = await Zip.loadAsync(file);
+    const budget = createUnzipBudget();
     const parts = {};
     const pending = [];
     zip.forEach((path, entry) => {
@@ -1837,12 +1853,12 @@ export async function documentFromXlsx(file, JSZip) {
         // A picture comes back as the data URL an image object holds, so the
         // rest of the reader never has to think about bytes.
         if (clean.startsWith(MEDIA_PREFIX)) {
-            pending.push(entry.async('base64').then((base64) => { parts[clean] = `data:${mediaTypeOf(clean)};base64,${base64}`; }));
+            pending.push(readZipEntry(entry, 'base64', budget).then((base64) => { parts[clean] = `data:${mediaTypeOf(clean)};base64,${base64}`; }));
             return;
         }
         if (!/\.(xml|rels|vml)$/i.test(path))
             return;
-        pending.push(entry.async('string').then((text) => { parts[clean] = text; }));
+        pending.push(readZipEntry(entry, 'string', budget).then((text) => { parts[clean] = text; }));
     });
     await Promise.all(pending);
     return documentFromXlsxParts(parts);

package/dist/studio/emit-schema.js

@@ -834,8 +834,8 @@ export function layoutFile(nav, opts = {}) {
         ? `<div class="sv-app__toolbar">
       <div class="sv-app__search">
         <svg class="sv-app__search-ic" viewBox="0 0 24 24" width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><circle cx="11" cy="11" r="7"/><path d="M21 21l-4.35-4.35"/></svg>
-        <input class="sv-app__search-in" type="search" placeholder="Search {brand}…" bind:value={q} bind:this={searchEl} aria-label="Search screens" />
-        <kbd class="sv-app__kbd" aria-hidden="true">⌘K</kbd>
+        <input class="sv-app__search-in" type="search" placeholder="Search {brand}…" bind:value={q} aria-label="Search screens" />
+        <button type="button" class="sv-app__kbd" title="Command palette (⌘K / Ctrl+K)" aria-label="Open the command palette" onclick={() => (paletteOpen = true)}>⌘K</button>
         {#if results.length}
           <div class="sv-app__results">
             {#each results as r (r.href)}
@@ -881,6 +881,7 @@ export function layoutFile(nav, opts = {}) {
         </div>
       </div>
       {#if bellOpen || menuOpen}<button type="button" class="sv-app__scrim" tabindex="-1" aria-label="Close menus" onclick={() => { bellOpen = false; menuOpen = false }}></button>{/if}
+      <SvCommand bind:open={paletteOpen} {commands} placeholder="Go to a screen or run an action…" emptyText="No matching screen" />
     </div>\n    `
         : '';
     // Supabase Auth: gate the whole app behind a client-side sign-in. SvAuthGate shows
@@ -987,7 +988,7 @@ export function layoutFile(nav, opts = {}) {
   import '../app.css'
   import '../custom.css'
   import { page } from '$app/state'
-  import { setLicenseKey } from '@svgrid/enterprise'${opts.access ? `\n  import { currentRole, canScreen } from '../lib/access'` : ''}${opts.i18n ? `\n  import { t, currentLocale, locales } from '../lib/i18n'` : ''}${opts.auth ? `\n  import type { LayoutData } from './$types'` : ''}${opts.supabaseAuth ? `\n  import { SvAuthGate, type SupabaseAuthClientLike } from '@svgrid/enterprise'\n  import { supabaseClient } from '../lib/connections'` : ''}
+  import { setLicenseKey } from '@svgrid/enterprise'${toolbarOn ? `\n  import { goto } from '$app/navigation'\n  import { SvCommand, type CommandItem } from '@svgrid/grid'` : ''}${opts.access ? `\n  import { currentRole, canScreen } from '../lib/access'` : ''}${opts.i18n ? `\n  import { t, currentLocale, locales } from '../lib/i18n'` : ''}${opts.auth ? `\n  import type { LayoutData } from './$types'` : ''}${opts.supabaseAuth ? `\n  import { SvAuthGate, type SupabaseAuthClientLike } from '@svgrid/enterprise'\n  import { supabaseClient } from '../lib/connections'` : ''}
 
   // VITE_SVPRO_KEY in .env is your SvGrid license key; it removes the unlicensed watermark.
   if (import.meta.env.VITE_SVPRO_KEY) setLicenseKey(import.meta.env.VITE_SVPRO_KEY)
@@ -1013,24 +1014,30 @@ export function layoutFile(nav, opts = {}) {
     try { const s = localStorage.getItem('svapp:theme'); if (s === 'light' || s === 'dark') t = s } catch (_) { /* storage blocked */ }
     applyTheme(t)
   })` : ''}${sideState}${toolbarOn ? `
-  // App-chrome quick-search: filter the screens by label as you type.
+  // App-chrome quick-search: filter the screens by label as you type. Only the
+  // screens the sidebar would show${opts.access ? ' to this role' : ''}.
   const initials = ${JSON.stringify(initials)}
   const acctEmail = ${JSON.stringify(`admin@${brandSlug}.com`)}
+  const visibleNav = ${opts.access ? '$derived(nav.filter((n) => !n.id || canScreen($currentRole, n.id)))' : 'nav'}
   let q = $state('')
-  const results = $derived(q.trim() ? nav.filter((n) => n.label.toLowerCase().includes(q.trim().toLowerCase())).slice(0, 6) : [])
+  const results = $derived(q.trim() ? visibleNav.filter((n) => n.label.toLowerCase().includes(q.trim().toLowerCase())).slice(0, 6) : [])
+  // Cmd/Ctrl+K: a palette over the same screens. SvCommand binds the key itself.
+  let paletteOpen = $state(false)
+  const commands: CommandItem[] = $derived([
+    ...visibleNav.map((n) => ({ id: 'go:' + n.href, label: ${opts.i18n ? "n.id ? $t('nav.' + n.id, n.label) : n.label" : 'n.label'}, group: 'Go to', onRun: () => goto(n.href) })),${hasSwitch ? `
+    { id: 'theme', label: theme === 'dark' ? 'Switch to light mode' : 'Switch to dark mode', group: 'Actions', onRun: toggleTheme },` : ''}
+  ])
   let bellOpen = $state(false)
   let menuOpen = $state(false)
-  let searchEl: HTMLInputElement | null = $state(null)
   const notifications = [
     { title: 'Welcome to ' + brand, time: 'just now', color: 'var(--sg-accent, #6366f1)' },
     { title: 'Your workspace is ready', time: '2m ago', color: '#10b981' },
     { title: 'Sample data loaded', time: '5m ago', color: '#f59e0b' },
   ]
-  // Cmd/Ctrl+K focuses search; Escape closes the menus.
+  // Escape closes the menus.
   $effect(() => {
     function onKey(e: KeyboardEvent) {
-      if ((e.metaKey || e.ctrlKey) && e.key.toLowerCase() === 'k') { e.preventDefault(); searchEl?.focus() }
-      else if (e.key === 'Escape') { bellOpen = false; menuOpen = false }
+      if (e.key === 'Escape') { bellOpen = false; menuOpen = false }
     }
     window.addEventListener('keydown', onKey)
     return () => window.removeEventListener('keydown', onKey)
@@ -1069,7 +1076,8 @@ ${styles}
   .sv-app__tool:hover { color: var(--sg-fg, #0f172a); border-color: color-mix(in srgb, var(--sg-fg, #0f172a) 20%, var(--sg-border, #e6e8ec)); }
   .sv-app__dot { position: absolute; top: 5px; right: 5px; width: 6px; height: 6px; border-radius: 50%; background: var(--sg-accent, #6366f1); box-shadow: 0 0 0 2px var(--sg-bg, #fff); }
   .sv-app__avatar { display: inline-flex; align-items: center; justify-content: center; width: 32px; height: 32px; padding: 0; border: none; border-radius: 50%; font: inherit; font-size: 12px; font-weight: 700; color: #fff; background: var(--sg-accent, #6366f1); letter-spacing: 0.02em; cursor: pointer; }
-  .sv-app__kbd { position: absolute; right: 8px; font-size: 10.5px; font-weight: 600; color: var(--sg-muted, #94a3b8); background: color-mix(in srgb, var(--sg-fg, #0f172a) 6%, transparent); border: 1px solid var(--sg-border, #e6e8ec); border-radius: 5px; padding: 1px 5px; pointer-events: none; }
+  .sv-app__kbd { position: absolute; right: 8px; font-size: 10.5px; font-weight: 600; color: var(--sg-muted, #94a3b8); background: color-mix(in srgb, var(--sg-fg, #0f172a) 6%, transparent); border: 1px solid var(--sg-border, #e6e8ec); border-radius: 5px; padding: 1px 5px; font-family: inherit; line-height: inherit; cursor: pointer; }
+  .sv-app__kbd:hover { color: var(--sg-fg, #0f172a); }
   .sv-app__pop { position: relative; }
   .sv-app__scrim { position: fixed; inset: 0; z-index: 44; border: 0; padding: 0; background: transparent; cursor: default; }
   .sv-app__menu { position: absolute; top: calc(100% + 8px); right: 0; z-index: 46; min-width: 232px; padding: 6px; background: var(--sg-bg, #fff); border: 1px solid var(--sg-border, #e6e8ec); border-radius: 11px; box-shadow: 0 16px 40px -10px rgba(15, 23, 42, 0.3); }

package/dist/version.d.ts

@@ -10,7 +10,7 @@
  *
  * `version.test.ts` asserts this matches `package.json`, so the two cannot drift.
  */
-export declare const SVGRID_VERSION = "3.1.25";
+export declare const SVGRID_VERSION = "3.1.27";
 /**
  * The version of `@svgrid/grid`, which releases on its own line: enterprise is
  * on 3.1.x while the grid is on 3.0.x.
@@ -23,4 +23,4 @@ export declare const SVGRID_VERSION = "3.1.25";
  *
  * `version.test.ts` asserts this matches packages/grid/package.json.
  */
-export declare const GRID_VERSION = "3.0.22";
+export declare const GRID_VERSION = "3.0.23";

package/dist/version.js

@@ -10,7 +10,7 @@
  *
  * `version.test.ts` asserts this matches `package.json`, so the two cannot drift.
  */
-export const SVGRID_VERSION = '3.1.25';
+export const SVGRID_VERSION = '3.1.27';
 /**
  * The version of `@svgrid/grid`, which releases on its own line: enterprise is
  * on 3.1.x while the grid is on 3.0.x.
@@ -23,4 +23,4 @@ export const SVGRID_VERSION = '3.1.25';
  *
  * `version.test.ts` asserts this matches packages/grid/package.json.
  */
-export const GRID_VERSION = '3.0.22';
+export const GRID_VERSION = '3.0.23';

package/dist/wc/{GridMenus-h7RsvcmI.js → GridMenus-BIQXB6a7.js}

@@ -988,7 +988,7 @@ function Mt(r, u) {
 		let e = n(Y) ?? n(J);
 		if (!e) return;
 		let t = n(Q).find((t) => t.id === e);
-		ue(t?.columnDef) && (n(Kt) || import("./SvDateTimePicker-DmK_QkkU.js").then((e) => y(Kt, e.default, !0)), n(qt) || import("./SvDateRangeInput-CJZohgBe.js").then((e) => y(qt, e.default, !0)));
+		ue(t?.columnDef) && (n(Kt) || import("./SvDateTimePicker-DmK_QkkU.js").then((e) => y(Kt, e.default, !0)), n(qt) || import("./SvDateRangeInput-DHYuAJeY.js").then((e) => y(qt, e.default, !0)));
 	});
 	function Jt(e, t) {
 		let n = () => {

package/dist/wc/{SvDateRangeInput-CJZohgBe.js → SvDateRangeInput-DHYuAJeY.js}

@@ -107,6 +107,7 @@ function A(t, r) {
 				value: e(Se),
 				disabled: L(),
 				...t,
+				role: "combobox",
 				"aria-haspopup": "dialog",
 				"aria-expanded": e(K),
 				onkeydown: De