@svgrid/enterprise 3.1.7 → 3.1.9

package/dist/fields/UserCell.svelte

@@ -0,0 +1,39 @@
+<script lang="ts">
+  /**
+   * User, created-by and last-modified-by cells: an avatar (the picture, or
+   * initials on a color from the name) and the name. Several users show as
+   * overlapping avatars with the first name.
+   */
+  import type { FieldCellProps } from './registry.svelte'
+  import { findFieldUser, type FieldUser } from './sources.svelte'
+  import UserFace from './UserFace.svelte'
+
+  let { value }: FieldCellProps = $props()
+
+  const list = $derived(
+    (Array.isArray(value) ? value : value == null || value === '' ? [] : [value])
+      .map((v) => (v && typeof v === 'object' ? (v as FieldUser) : findFieldUser(v) ?? { id: String(v), name: String(v) }))
+      .filter((u) => !!u),
+  )
+  const label = $derived(list.map((u) => u.name).join(', '))
+</script>
+
+<span class="sv-fus" title={label} aria-label={label || 'Nobody'}>
+  <span class="sv-fus-faces">
+    {#each list.slice(0, 4) as u (u.id)}
+      <UserFace user={u} />
+    {/each}
+  </span>
+  {#if list.length === 1}
+    <span class="sv-fus-name">{list[0]!.name}</span>
+  {:else if list.length > 1}
+    <span class="sv-fus-name">{list[0]!.name} +{list.length - 1}</span>
+  {/if}
+</span>
+
+<style>
+  .sv-fus { display: inline-flex; align-items: center; gap: 6px; min-width: 0; }
+  .sv-fus-faces { display: inline-flex; flex: none; }
+  .sv-fus-faces > :global(* + *) { margin-inline-start: -6px; }
+  .sv-fus-name { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+</style>

package/dist/fields/UserCell.svelte.d.ts

@@ -0,0 +1,9 @@
+/**
+   * User, created-by and last-modified-by cells: an avatar (the picture, or
+   * initials on a color from the name) and the name. Several users show as
+   * overlapping avatars with the first name.
+   */
+import type { FieldCellProps } from './registry.svelte.js';
+declare const UserCell: import("svelte").Component<FieldCellProps, {}, "">;
+type UserCell = ReturnType<typeof UserCell>;
+export default UserCell;

package/dist/fields/UserFace.svelte

@@ -0,0 +1,30 @@
+<script lang="ts">
+  /**
+   * A person's avatar as user cells and the user editor draw it: the picture,
+   * or initials on a color from the name.
+   */
+  import type { FieldUser } from './sources.svelte'
+  import { safeUrl } from './attachments'
+
+  let { user, size = 20 }: { user: FieldUser; size?: number } = $props()
+
+  const initials = (name: string) =>
+    name.split(/\s+/).filter(Boolean).slice(0, 2).map((w) => w[0]!.toUpperCase()).join('') || '?'
+  const hue = (s: string) => [...s].reduce((h, c) => (h * 31 + c.charCodeAt(0)) % 360, 7)
+  const src = $derived(user.avatarUrl ? safeUrl(user.avatarUrl, true) : null)
+</script>
+
+{#if src}
+  <img class="sv-fuf" {src} alt="" width={size} height={size} loading="lazy" decoding="async" style:--s={`${size}px`} />
+{:else}
+  <span class="sv-fuf" style:--s={`${size}px`} style:background={`hsl(${hue(user.name)} 55% 46%)`} aria-hidden="true">{initials(user.name)}</span>
+{/if}
+
+<style>
+  .sv-fuf {
+    display: inline-flex; flex: none; align-items: center; justify-content: center;
+    width: var(--s); height: var(--s); border-radius: 999px; object-fit: cover;
+    color: #fff; font-size: calc(var(--s) * 0.45); font-weight: 600;
+    box-shadow: 0 0 0 2px var(--sg-bg, #fff);
+  }
+</style>

package/dist/fields/UserFace.svelte.d.ts

@@ -0,0 +1,12 @@
+/**
+   * A person's avatar as user cells and the user editor draw it: the picture,
+   * or initials on a color from the name.
+   */
+import type { FieldUser } from './sources.svelte.js';
+type $$ComponentProps = {
+    user: FieldUser;
+    size?: number;
+};
+declare const UserFace: import("svelte").Component<$$ComponentProps, {}, "">;
+type UserFace = ReturnType<typeof UserFace>;
+export default UserFace;

package/dist/fields/activity.svelte.d.ts

@@ -0,0 +1,50 @@
+export type RecordComment = {
+    id: string;
+    rowId: string;
+    /** The table of `<SvBase tables>` the record is in. */
+    tableId?: string;
+    text: string;
+    at: number;
+    by?: string;
+};
+/** Which record a comment store is asked about, beyond its row id. */
+export type RecordCommentContext = {
+    /** The table of `<SvBase tables>` the record is in; undefined for a single table or a plain grid. */
+    tableId?: string;
+    /** The grid's api. */
+    api: unknown;
+};
+/** Where comments are kept: the app's backend, or memory by default. */
+export type RecordCommentStore = {
+    list: (rowId: string, api: unknown, context: RecordCommentContext) => ReadonlyArray<RecordComment>;
+    add: (rowId: string, comment: RecordComment, api: unknown, context: RecordCommentContext) => void;
+};
+export type RecordChange = {
+    at: number;
+    /** The signed-in user who made it; undefined when nobody was signed in. */
+    by?: string;
+    /** The automation that made it, by name. */
+    automation?: string;
+    columnId: string;
+    value: unknown;
+};
+/** A grid, or a table of a base named by id (an automation's change). */
+export type ActivityScope = object | string | {
+    base?: object;
+    tableId: string;
+};
+/** The table id a grid of `<SvBase tables>` carries; undefined for any other grid. */
+export declare function tableIdOf(ctrl: any): string | undefined;
+/** Keep comments in the app's store (null: back to memory). */
+export declare function setRecordComments(next: RecordCommentStore | null): void;
+/**
+ * Note a change to a cell (called after every edit, paste, fill and clear).
+ * `scope` is the grid, or the table (its base and id) for a change made
+ * outside it (an automation). `automation` names the automation that made it.
+ */
+export declare function noteChange(scope: ActivityScope, rowId: string, columnId: string, value: unknown, automation?: string): void;
+export declare function changesOf(scope: ActivityScope, rowId: string): ReadonlyArray<RecordChange>;
+export declare function commentsOf(ctrl: any, rowId: string): ReadonlyArray<RecordComment>;
+export declare function addComment(ctrl: any, rowId: string, text: string): void;
+/** "just now", "5 minutes ago", "3 hours ago", else the date. */
+export declare function timeAgo(at: number, now?: number): string;

package/dist/fields/activity.svelte.js

@@ -0,0 +1,110 @@
+/**
+ * A record's activity, as the expanded record shows it: the changes made to
+ * it in this session (who changed which field to what, and when) and its
+ * comments. Comments live in memory unless the app hands over a store of its
+ * own (`setRecordComments`) that saves them.
+ *
+ * In a grid of `<SvBase tables>` both are kept by table id and row id, so
+ * they outlive the grid (switching tables draws a new one) and two tables
+ * with the same row ids keep apart. A plain grid keeps them per grid.
+ */
+import { getCurrentUser } from './sources.svelte.js';
+// Bumped on every change so the panel redraws.
+let version = $state(0);
+const changes = { bases: new WeakMap(), grids: new WeakMap() };
+const memory = { bases: new WeakMap(), grids: new WeakMap() };
+// The base of a table named by id alone.
+const ANY_BASE = {};
+let store = null;
+/** The table id a grid of `<SvBase tables>` carries; undefined for any other grid. */
+export function tableIdOf(ctrl) {
+    const id = ctrl?.props?.baseTableId;
+    return typeof id === 'string' && id ? id : undefined;
+}
+/** The records' lists for a grid, or for a table of a base. */
+function rowsOf(kept, scope, create) {
+    const named = typeof scope === 'string' ? { tableId: scope } : 'tableId' in scope && typeof scope.tableId === 'string' ? scope : null;
+    const tableId = named ? named.tableId : tableIdOf(scope);
+    if (!tableId) {
+        let byRow = kept.grids.get(scope);
+        if (!byRow && create)
+            kept.grids.set(scope, (byRow = new Map()));
+        return byRow;
+    }
+    const base = (named ? named.base : scope?.props?.baseScope) ?? ANY_BASE;
+    let byTable = kept.bases.get(base);
+    if (!byTable && create)
+        kept.bases.set(base, (byTable = new Map()));
+    let byRow = byTable?.get(tableId);
+    if (!byRow && byTable && create)
+        byTable.set(tableId, (byRow = new Map()));
+    return byRow;
+}
+/** Keep comments in the app's store (null: back to memory). */
+export function setRecordComments(next) {
+    store = next;
+    version += 1;
+}
+/**
+ * Note a change to a cell (called after every edit, paste, fill and clear).
+ * `scope` is the grid, or the table (its base and id) for a change made
+ * outside it (an automation). `automation` names the automation that made it.
+ */
+export function noteChange(scope, rowId, columnId, value, automation) {
+    const byRow = rowsOf(changes, scope, true);
+    const list = byRow.get(rowId) ?? [];
+    // Kept short: the panel shows the latest.
+    list.push({ at: Date.now(), ...(automation ? { automation } : { by: getCurrentUser()?.id }), columnId, value: Array.isArray(value) ? [...value] : value });
+    if (list.length > 50)
+        list.splice(0, list.length - 50);
+    byRow.set(rowId, list);
+    version += 1;
+}
+export function changesOf(scope, rowId) {
+    void version;
+    return rowsOf(changes, scope, false)?.get(rowId) ?? [];
+}
+const contextOf = (ctrl) => ({ tableId: tableIdOf(ctrl), api: ctrl?.buildApi?.() });
+export function commentsOf(ctrl, rowId) {
+    void version;
+    if (store) {
+        const context = contextOf(ctrl);
+        return store.list(rowId, context.api, context);
+    }
+    return rowsOf(memory, ctrl, false)?.get(rowId) ?? [];
+}
+let seq = 0;
+export function addComment(ctrl, rowId, text) {
+    const body = text.trim();
+    if (!body)
+        return;
+    const context = contextOf(ctrl);
+    const comment = {
+        id: `c${Date.now().toString(36)}${(seq += 1)}`,
+        rowId,
+        ...(context.tableId ? { tableId: context.tableId } : {}),
+        text: body,
+        at: Date.now(),
+        by: getCurrentUser()?.id,
+    };
+    if (store)
+        store.add(rowId, comment, context.api, context);
+    else {
+        const byRow = rowsOf(memory, ctrl, true);
+        byRow.set(rowId, [...(byRow.get(rowId) ?? []), comment]);
+    }
+    version += 1;
+}
+/** "just now", "5 minutes ago", "3 hours ago", else the date. */
+export function timeAgo(at, now = Date.now()) {
+    const s = Math.max(0, Math.round((now - at) / 1000));
+    if (s < 45)
+        return 'just now';
+    const m = Math.round(s / 60);
+    if (m < 60)
+        return `${m} minute${m === 1 ? '' : 's'} ago`;
+    const h = Math.round(m / 60);
+    if (h < 24)
+        return `${h} hour${h === 1 ? '' : 's'} ago`;
+    return new Date(at).toLocaleDateString();
+}

package/dist/fields/attachments.d.ts

@@ -0,0 +1,95 @@
+/**
+ * The attachment field's value and the work around it: uploading a file,
+ * turning pasted URLs into attachments, the text a copy or an export writes.
+ * A cell holds an array, so it can hold several files.
+ */
+export type Attachment = {
+    id: string;
+    url: string;
+    name: string;
+    /** MIME type, e.g. 'image/png'. */
+    type: string;
+    size?: number;
+    width?: number;
+    height?: number;
+    /** A smaller image for the cell; the cell falls back to `url`. */
+    thumbnailUrl?: string;
+};
+/** What an upload function is told about the file it uploads. */
+export type AttachmentUploadContext = {
+    row: unknown;
+    columnId: string;
+    /** Aborted when the user removes the file or closes the dialog mid-upload. */
+    signal: AbortSignal;
+    /** Report progress, 0..1. */
+    onProgress: (fraction: number) => void;
+};
+export type AttachmentUploader = (file: File, ctx: AttachmentUploadContext) => Promise<Attachment>;
+/** The attachment field's `fieldProps`. */
+export type AttachmentFieldProps = {
+    /** Accepted types, as for `<input accept>`: 'image/*,.pdf'. Default: anything. */
+    accept?: string;
+    /** Most files a cell holds. Default 20. */
+    maxFiles?: number;
+    /** Largest file in bytes. Default 25 MB. */
+    maxSize?: number;
+    /** Uploads a file and returns its attachment. Default: the app-wide uploader. */
+    upload?: AttachmentUploader;
+};
+/**
+ * The uploader every attachment column uses unless its `fieldProps.upload`
+ * sets one. Without any, files stay in this page as `blob:` URLs: fine for a
+ * demo, gone on reload, so a real app sets one.
+ */
+export declare function setAttachmentUploader(upload: AttachmentUploader | null): void;
+export declare const newAttachmentId: () => string;
+/** Upload one file with the column's uploader, the app's, or as a local blob URL. */
+export declare function uploadAttachment(file: File, props: AttachmentFieldProps, ctx: AttachmentUploadContext): Promise<Attachment>;
+/** 'At most 1 file', 'At most 20 files'. */
+export declare const tooManyFiles: (maxFiles: number) => string;
+/**
+ * Why a file is refused, or null when it is fine. `count` is how many the
+ * cell holds already. Works for an attachment added by URL too: its type
+ * comes from the name's extension, and a size is checked only when known.
+ */
+export declare function rejectReason(file: {
+    name: string;
+    type: string;
+    size?: number;
+}, props: AttachmentFieldProps, count: number): string | null;
+/** The attachments the field takes, in order, and why each of the others was refused. */
+export declare function limitAttachments(list: ReadonlyArray<Attachment>, props: AttachmentFieldProps, count?: number): {
+    kept: Attachment[];
+    rejected: string[];
+};
+/**
+ * The attachment column's valueParser: a list (a copied cell) or text with
+ * URLs in it (a paste), kept to the field's accept, maxSize and maxFiles.
+ */
+export declare function parseAttachments(value: unknown, props: AttachmentFieldProps): Attachment[];
+/** `<input accept>` semantics: '.pdf', 'image/*', 'application/json'. */
+export declare function accepts(accept: string, file: {
+    name: string;
+    type: string;
+}): boolean;
+export declare function guessType(name: string): string;
+export declare const isImage: (a: {
+    type?: string;
+    name?: string;
+}) => boolean;
+export declare const isPdf: (a: {
+    type?: string;
+    name?: string;
+}) => boolean;
+export declare function formatBytes(n: number | undefined): string;
+/** The cell value as a clean array: anything that is not an attachment is dropped. */
+export declare function toAttachments(value: unknown): Attachment[];
+/** What a copy and an export write: the file names. */
+export declare function attachmentsText(value: unknown): string;
+/** Pasted text -> attachments, one per http(s) URL in it. Anything else is ignored. */
+export declare function attachmentsFromText(text: string): Attachment[];
+/**
+ * A URL safe to use: http(s) and blob: only. `forImage` also allows data:
+ * images (raster and SVG), which are inert inside <img> but never become a link.
+ */
+export declare function safeUrl(url: unknown, forImage?: boolean): string | null;

package/dist/fields/attachments.js

@@ -0,0 +1,145 @@
+/**
+ * The attachment field's value and the work around it: uploading a file,
+ * turning pasted URLs into attachments, the text a copy or an export writes.
+ * A cell holds an array, so it can hold several files.
+ */
+let appUploader = null;
+/**
+ * The uploader every attachment column uses unless its `fieldProps.upload`
+ * sets one. Without any, files stay in this page as `blob:` URLs: fine for a
+ * demo, gone on reload, so a real app sets one.
+ */
+export function setAttachmentUploader(upload) {
+    appUploader = upload;
+}
+let counter = 0;
+export const newAttachmentId = () => `att-${Date.now().toString(36)}-${(counter++).toString(36)}`;
+/** Upload one file with the column's uploader, the app's, or as a local blob URL. */
+export async function uploadAttachment(file, props, ctx) {
+    const upload = props.upload ?? appUploader;
+    if (upload)
+        return upload(file, ctx);
+    ctx.onProgress(1);
+    return { id: newAttachmentId(), url: URL.createObjectURL(file), name: file.name, type: file.type || guessType(file.name), size: file.size };
+}
+/** 'At most 1 file', 'At most 20 files'. */
+export const tooManyFiles = (maxFiles) => `At most ${maxFiles} ${maxFiles === 1 ? 'file' : 'files'}`;
+/**
+ * Why a file is refused, or null when it is fine. `count` is how many the
+ * cell holds already. Works for an attachment added by URL too: its type
+ * comes from the name's extension, and a size is checked only when known.
+ */
+export function rejectReason(file, props, count) {
+    const maxFiles = props.maxFiles ?? 20;
+    const maxSize = props.maxSize ?? 25 * 1024 * 1024;
+    if (count >= maxFiles)
+        return tooManyFiles(maxFiles);
+    if (file.size != null && file.size > maxSize)
+        return `Larger than ${formatBytes(maxSize)}`;
+    if (props.accept && !accepts(props.accept, file))
+        return 'Not an accepted type';
+    return null;
+}
+/** The attachments the field takes, in order, and why each of the others was refused. */
+export function limitAttachments(list, props, count = 0) {
+    const kept = [];
+    const rejected = [];
+    for (const a of list) {
+        const why = rejectReason(a, props, count + kept.length);
+        if (why)
+            rejected.push(`${a.name}: ${why}`);
+        else
+            kept.push(a);
+    }
+    return { kept, rejected };
+}
+/**
+ * The attachment column's valueParser: a list (a copied cell) or text with
+ * URLs in it (a paste), kept to the field's accept, maxSize and maxFiles.
+ */
+export function parseAttachments(value, props) {
+    const list = Array.isArray(value) ? toAttachments(value) : attachmentsFromText(String(value ?? ''));
+    return limitAttachments(list, props).kept;
+}
+/** `<input accept>` semantics: '.pdf', 'image/*', 'application/json'. */
+export function accepts(accept, file) {
+    const name = file.name.toLowerCase();
+    const type = (file.type || guessType(file.name)).toLowerCase();
+    return accept
+        .split(',')
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean)
+        .some((rule) => rule.startsWith('.') ? name.endsWith(rule) : rule.endsWith('/*') ? type.startsWith(rule.slice(0, -1)) : type === rule);
+}
+const EXT_TYPES = {
+    png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif', webp: 'image/webp', svg: 'image/svg+xml', avif: 'image/avif',
+    pdf: 'application/pdf', txt: 'text/plain', csv: 'text/csv', json: 'application/json', zip: 'application/zip',
+    doc: 'application/msword', docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    xls: 'application/vnd.ms-excel', xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    mp4: 'video/mp4', webm: 'video/webm', mov: 'video/quicktime', mp3: 'audio/mpeg', wav: 'audio/wav',
+};
+export function guessType(name) {
+    const ext = name.split(/[?#]/)[0].split('.').pop()?.toLowerCase() ?? '';
+    return EXT_TYPES[ext] ?? 'application/octet-stream';
+}
+export const isImage = (a) => (a.type || guessType(a.name ?? '')).startsWith('image/');
+export const isPdf = (a) => (a.type || guessType(a.name ?? '')) === 'application/pdf';
+export function formatBytes(n) {
+    if (n == null || !Number.isFinite(n))
+        return '';
+    if (n < 1024)
+        return `${n} B`;
+    // One decimal below 10, none above; a whole number drops its '.0' (10 MB, 1.5 MB).
+    const short = (x) => (x < 10 ? x.toFixed(1).replace(/\.0$/, '') : String(Math.round(x)));
+    if (n < 1024 * 1024)
+        return `${short(n / 1024)} KB`;
+    if (n < 1024 * 1024 * 1024)
+        return `${short(n / 1024 / 1024)} MB`;
+    return `${short(n / 1024 / 1024 / 1024)} GB`;
+}
+/** The cell value as a clean array: anything that is not an attachment is dropped. */
+export function toAttachments(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((a) => !!a && typeof a === 'object' && typeof a.url === 'string');
+}
+/** What a copy and an export write: the file names. */
+export function attachmentsText(value) {
+    return toAttachments(value).map((a) => a.name).join(', ');
+}
+/** Pasted text -> attachments, one per http(s) URL in it. Anything else is ignored. */
+export function attachmentsFromText(text) {
+    const out = [];
+    for (const token of text.split(/[\s,]+/)) {
+        let url;
+        try {
+            url = new URL(token);
+        }
+        catch {
+            continue;
+        }
+        if (url.protocol !== 'http:' && url.protocol !== 'https:')
+            continue;
+        const name = decodeURIComponent(url.pathname.split('/').filter(Boolean).pop() ?? url.hostname);
+        out.push({ id: newAttachmentId(), url: url.href, name, type: guessType(name) });
+    }
+    return out;
+}
+/**
+ * A URL safe to use: http(s) and blob: only. `forImage` also allows data:
+ * images (raster and SVG), which are inert inside <img> but never become a link.
+ */
+export function safeUrl(url, forImage = false) {
+    if (typeof url !== 'string')
+        return null;
+    // An SVG drawn by <img> runs no script, so a data: SVG is as inert as a PNG there.
+    if (forImage && /^data:image\/(png|jpeg|gif|webp|avif|svg\+xml)[;,]/i.test(url))
+        return url;
+    try {
+        const u = new URL(url, typeof location !== 'undefined' ? location.href : 'https://x.invalid/');
+        return u.protocol === 'http:' || u.protocol === 'https:' || u.protocol === 'blob:' ? u.href : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/fields/automation-outbound.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Automation actions that leave the base: call a webhook, send an email.
+ *
+ * Both fill `{Field name}` tokens from the record. A webhook may also name
+ * secrets, `{secret:SLACK_TOKEN}`, which only the server runner reads (from
+ * its `secrets` option): in the browser such a webhook fails and says to run
+ * the automation on the server, so a key never has to live in the page.
+ */
+type Row = Record<string, unknown>;
+/** POST (or PUT, PATCH) to a URL; `body` is a template, JSON by default. */
+export type WebhookAction = {
+    type: 'webhook';
+    url: string;
+    method?: 'POST' | 'PUT' | 'PATCH';
+    /** `Name: value` pairs; values may name fields and secrets. */
+    headers?: Record<string, string>;
+    /** The request body. Empty: `{ automation, table, record }` with every field as text. */
+    body?: string;
+};
+/** An email, sent by the server runner's `sendEmail`. */
+export type EmailAction = {
+    type: 'email';
+    to: string;
+    subject: string;
+    body: string;
+};
+export type OutboundContext = {
+    automation: string;
+    table: string;
+    record: Row | null;
+    /** A template with `{Field name}` filled in from the record. */
+    fill: (template: string) => string;
+    /** Every field of the record as its cell shows it, by field name. */
+    fields: () => Record<string, string>;
+    /** A secret by name; the browser runner has none. */
+    secret?: (name: string) => string | undefined;
+    fetch?: typeof fetch;
+};
+export declare function callWebhook(action: WebhookAction, ctx: OutboundContext): Promise<string>;
+export type OutgoingEmail = {
+    to: string[];
+    subject: string;
+    text: string;
+};
+export declare function sendEmailAction(action: EmailAction, ctx: OutboundContext, send: ((email: OutgoingEmail) => Promise<unknown> | unknown) | undefined): Promise<string>;
+export {};

package/dist/fields/automation-outbound.js

@@ -0,0 +1,61 @@
+/**
+ * Automation actions that leave the base: call a webhook, send an email.
+ *
+ * Both fill `{Field name}` tokens from the record. A webhook may also name
+ * secrets, `{secret:SLACK_TOKEN}`, which only the server runner reads (from
+ * its `secrets` option): in the browser such a webhook fails and says to run
+ * the automation on the server, so a key never has to live in the page.
+ */
+const SECRET = /\{secret:([A-Za-z0-9_.-]+)\}/g;
+function withSecrets(text, ctx) {
+    return text.replace(SECRET, (_m, name) => {
+        if (!ctx.secret)
+            throw new Error(`{secret:${name}} is read on the server only; run this automation on the server`);
+        const value = ctx.secret(name);
+        if (value == null)
+            throw new Error(`No secret named ${name}`);
+        return value;
+    });
+}
+/** Fill a JSON body template: a field's text is escaped so the JSON stays valid. */
+function fillJson(template, ctx) {
+    const escaped = (s) => JSON.stringify(s).slice(1, -1);
+    return template.replace(/\{([^{}\n]+)\}/g, (m, name) => (name.startsWith('secret:') ? m : escaped(ctx.fill(`{${name}}`))));
+}
+export async function callWebhook(action, ctx) {
+    const doFetch = ctx.fetch ?? globalThis.fetch;
+    if (!doFetch)
+        throw new Error('No fetch here to call the webhook with');
+    const url = withSecrets(action.url.replace(/\{([^{}\n]+)\}/g, (m, name) => (name.startsWith('secret:') ? m : encodeURIComponent(ctx.fill(`{${name}}`)))), ctx);
+    if (!/^https?:\/\//i.test(url))
+        throw new Error('A webhook URL starts with https:// or http://');
+    const headers = { 'content-type': 'application/json' };
+    for (const [k, v] of Object.entries(action.headers ?? {}))
+        headers[k.toLowerCase()] = withSecrets(ctx.fill(v), ctx);
+    const json = (headers['content-type'] ?? '').includes('json');
+    const body = action.body?.trim()
+        ? withSecrets(json ? fillJson(action.body, ctx) : ctx.fill(action.body), ctx)
+        : JSON.stringify({ automation: ctx.automation, table: ctx.table, record: ctx.record ? { id: ctx.record.id ?? null, ...ctx.fields() } : null });
+    const method = action.method ?? 'POST';
+    const res = await doFetch(url, { method, headers, body });
+    const host = (() => {
+        try {
+            return new URL(url).host;
+        }
+        catch {
+            return url;
+        }
+    })();
+    if (!res.ok)
+        throw new Error(`${method} ${host} answered ${res.status}${res.statusText ? ` ${res.statusText}` : ''}`);
+    return `${method} ${host}: ${res.status}`;
+}
+export async function sendEmailAction(action, ctx, send) {
+    if (!send)
+        throw new Error('Email is sent by the server runner; give createAutomationServer a sendEmail');
+    const to = ctx.fill(action.to).split(/\s*[,;]\s*/).filter(Boolean);
+    if (!to.length)
+        throw new Error('No address to send to');
+    await send({ to, subject: ctx.fill(action.subject), text: ctx.fill(action.body) });
+    return `To ${to.join(', ')}: ${ctx.fill(action.subject)}`;
+}

package/dist/fields/automation-server.d.ts

@@ -0,0 +1,53 @@
+import { type BaseTable } from './base-tables.js';
+import { type AutomationRun } from './automations.svelte.js';
+import { type OutgoingEmail } from './automation-outbound.js';
+type Row = Record<string, unknown>;
+export type AutomationNotice = {
+    message: string;
+    severity: 'info' | 'success' | 'warning' | 'error';
+    automation: string;
+    table: string;
+    record: Row | null;
+};
+export type AutomationServerOptions = {
+    /** The tables, each with its `source` and `automations` (its `data` is read from the source). */
+    tables: BaseTable[];
+    /** Secrets a webhook names as `{secret:NAME}`: an object, or a lookup such as `(n) => env[n]`. */
+    secrets?: Record<string, string | undefined> | ((name: string) => string | undefined);
+    /** Sends the "Send an email" action: your mail provider. */
+    sendEmail?: (email: OutgoingEmail) => Promise<unknown> | unknown;
+    /** "Show a notice" on the server: log it, push it to the people concerned. */
+    notify?: (notice: AutomationNotice) => void;
+    /** Each run as it finishes, with what each action did. */
+    onRun?: (run: AutomationRun) => void;
+    fetch?: typeof fetch;
+    now?: () => Date;
+    /** How many runs `runs` keeps (default 200). */
+    keepRuns?: number;
+};
+export declare function createAutomationServer(options: AutomationServerOptions): {
+    prime: () => Promise<void>;
+    recordChanged: (tableId: string, change: {
+        before?: Row | null;
+        after?: Row | null;
+    }, opts?: {
+        db?: boolean;
+    }) => Promise<AutomationRun[]>;
+    tableChanged: (tableId: string) => Promise<AutomationRun[]>;
+    audit: (tableId: string) => (entry: {
+        action: "create" | "update" | "delete";
+        id: string | null;
+        result?: unknown;
+    }) => Promise<void>;
+    formSubmitted: (tableId: string, recordId: string, view?: string) => Promise<AutomationRun[]>;
+    buttonPressed: (tableId: string, recordId: string, field: string) => Promise<AutomationRun[]>;
+    tick: (at?: Date) => Promise<AutomationRun[]>;
+    /** The latest runs, newest first: hand them to `<SvBase serverRuns>` from an endpoint. */
+    readonly runs: ReadonlyArray<AutomationRun>;
+    /** Resolves when every queued run has finished. */
+    settled: () => Promise<undefined>;
+    /** The tables as it last read them. */
+    readonly tables: ReadonlyArray<BaseTable>;
+};
+export type AutomationServer = ReturnType<typeof createAutomationServer>;
+export {};