sheetrender 0.1.0__tar.gz

sheetrender-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,40 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: uv run ruff check src tests
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: uv sync --frozen
+      - run: uv run pytest -q
+
+  render:
+    # Real-Chromium pass: the unit job self-skips every test that needs a
+    # browser, so this job is what actually proves rendering works.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - run: uv sync --frozen
+      - run: uv run playwright install --with-deps chromium
+      - run: uv run pytest tests/test_render.py -q

sheetrender-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,36 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      # The tag is the release request; the version in pyproject is what
+      # actually ships. Refuse to publish a mismatch.
+      - run: |
+          tag="${GITHUB_REF_NAME#v}"
+          version="$(uv version --short)"
+          [ "$tag" = "$version" ] || { echo "tag v$tag != project version $version" >&2; exit 1; }
+      - run: uv build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write  # PyPI Trusted Publishing (OIDC) — no API token stored
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

sheetrender-0.1.0/.gitignore

@@ -0,0 +1,7 @@
+__pycache__/
+*.pyc
+.venv/
+dist/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/

sheetrender-0.1.0/CHANGELOG.md

@@ -0,0 +1,7 @@
+# Changelog
+
+## Unreleased
+
+- Initial extraction of the SheetRender render engine: Chromium PDF rendering
+  with browser recycling, sandboxed Jinja templating, CSV/XLSX ingestion, row
+  grouping, filename templates, merge/zip, and the `sheetrender` CLI.

sheetrender-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,40 @@
+# Contributing
+
+Thanks for looking under the hood.
+
+## Running the tests
+
+You don't need Python installed — everything runs in containers (Docker or
+rootless Podman):
+
+```sh
+scripts/test.sh            # unit suite; Chromium-dependent tests self-skip
+scripts/test.sh --render   # the real-Chromium tests, in Playwright's Python image
+scripts/test.sh --all      # both — run this before opening a PR
+scripts/lint.sh            # ruff
+```
+
+The first run downloads dependencies into named volumes
+(`sheetrender-lib-uv-*`); later runs are fast. Any pytest arguments pass
+through: `scripts/test.sh tests/test_templating.py -k money`.
+
+If you prefer a local environment: `uv sync`, `uv run playwright install
+chromium`, `uv run pytest`.
+
+## Ground rules
+
+- **A green plain run is not a passing suite.** The unit run skips the seven
+  Chromium test cases; `--all` is the bar.
+- New behavior needs a test. Bug fixes need a test that fails without the fix.
+- This engine also powers [sheetrender.com](https://sheetrender.com), which
+  pins exact versions — behavior changes to rendering output (pagination,
+  stamping, sanitization) get extra scrutiny because a thousand production
+  templates depend on them.
+- Dependencies: floors only in `pyproject.toml`; `uv.lock` is committed. Bump
+  deliberately, one PR per bump.
+
+## Reporting bugs
+
+A failing template is the perfect bug report: open an issue with the smallest
+HTML + a few CSV rows that reproduce it. For anything security-relevant, see
+[SECURITY.md](SECURITY.md) instead of a public issue.

sheetrender-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Final Dynamics
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

sheetrender-0.1.0/PKG-INFO

@@ -0,0 +1,241 @@
+Metadata-Version: 2.5
+Name: sheetrender
+Version: 0.1.0
+Summary: Spreadsheet + HTML template in, a PDF per row out. The batch rendering engine behind sheetrender.com.
+Project-URL: Homepage, https://sheetrender.com
+Project-URL: Source, https://github.com/sheetrender/sheetrender
+Project-URL: Issues, https://github.com/sheetrender/sheetrender/issues
+Project-URL: Changelog, https://github.com/sheetrender/sheetrender/blob/master/CHANGELOG.md
+Author-email: SheetRender <info@finaldynamics.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: batch,csv,html-to-pdf,invoice,jinja2,mail-merge,pdf,playwright,spreadsheet,xlsx
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Office/Business
+Classifier: Topic :: Printing
+Classifier: Topic :: Text Processing :: Markup :: HTML
+Requires-Python: <3.14,>=3.11
+Requires-Dist: jinja2>=3.1
+Requires-Dist: nh3>=0.3
+Requires-Dist: openpyxl>=3.1
+Requires-Dist: pikepdf>=10
+Requires-Dist: pillow>=11
+Requires-Dist: playwright>=1.44
+Requires-Dist: pypdf>=6
+Requires-Dist: pypdfium2>=5
+Description-Content-Type: text/markdown
+
+# SheetRender
+
+**Spreadsheet + HTML template in, a stack of PDFs out.**
+
+SheetRender turns a CSV or XLSX file and an HTML template into one
+well-paginated PDF per row — or per group of rows, for documents with line
+items like invoices and statements. It is the exact rendering engine behind
+[sheetrender.com](https://sheetrender.com), extracted as a standalone MIT
+library and CLI.
+
+```sh
+git clone https://github.com/sheetrender/sheetrender && cd sheetrender
+uvx sheetrender batch examples/invoice/template.html examples/invoice/data.csv \
+  -o out/ --group-by invoice_no --filename "{{ invoice_no }}.pdf" --zip invoices.zip
+```
+
+That renders one invoice per `invoice_no`, with the group's rows available to
+the template as `items`, names each file from a template, and zips the stack.
+(The clone is only for the example files — `uvx sheetrender` itself needs no
+install at all.)
+
+## Why this exists
+
+Every "generate PDFs from a spreadsheet" recipe on the internet glues a
+headless browser to a for-loop and hopes. This engine has rendered documents
+in production for a long time, and the parts that took real debugging are the
+parts you get for free:
+
+- **Chromium rendering with lifecycle management** — a shared browser with a
+  priority-aware concurrency gate, recycled after N renders or N minutes, so
+  thousand-row batches don't leak memory or wedge.
+- **Print CSS that behaves** — margins, page sizes, backgrounds, webfont
+  readiness with a bounded wait (a stalled font fetch degrades to fallback
+  fonts instead of hanging a render slot).
+- **Safe templating over untrusted data** — sandboxed Jinja2 with
+  `StrictUndefined` (typos fail loudly instead of rendering blanks) and
+  autoescaping on.
+- **HTML sanitization + network egress control** — templates are sanitized
+  with [nh3](https://github.com/messense/nh3), and the browser context blocks
+  all network requests except an allowlist (Google Fonts by default).
+- **Batch ergonomics** — filename templates with cross-platform sanitization
+  and de-duplication, row grouping with auto-detection, merged PDFs with
+  stamped page numbers, zip output, thumbnails, PDF metadata.
+
+## Install
+
+```sh
+uv add sheetrender          # or: pip install sheetrender
+uv run playwright install chromium
+```
+
+Or run the CLI without installing anything: `uvx sheetrender --help`. You
+still need Chromium once; without a local playwright on PATH that's
+
+```sh
+uvx --from playwright playwright install chromium
+```
+
+## CLI
+
+```sh
+# One PDF per row
+sheetrender batch template.html data.csv -o out/
+
+# One PDF per invoice, line items available as {{ items }}
+sheetrender batch template.html data.csv -o out/ --group-by invoice_no
+
+# Name files from row data, merge everything, add page numbers
+sheetrender batch template.html data.csv -o out/ \
+  --filename "{{ customer }}-{{ invoice_no }}.pdf" \
+  --merge all.pdf --page-numbers
+
+# Single document from a JSON object file (or --set key=value)
+sheetrender render letter.html -o letter.pdf --data row.json
+
+# What's in this file, and what will the template see?
+sheetrender inspect data.xlsx
+
+# PNG thumbnail of the first page
+sheetrender thumbnail template.html -o thumb.png --data row.json
+```
+
+Page geometry: `--page-size A3|A4|A5|Letter|Legal|Tabloid --landscape
+--margin 12mm`. Watermarking (`batch` only):
+`--watermark-html '<div style="position:fixed;bottom:0">DRAFT</div>'` injects
+your snippet before `</body>` — use `position:fixed` if it should repeat on
+every printed page rather than sit at the end of the document. Data files are
+`.csv` or `.xlsx`; the single-document `--data` flag takes a JSON object file.
+
+## Python API
+
+```python
+import asyncio
+from pathlib import Path
+
+import sheetrender as sr
+
+async def main() -> None:
+    out = Path("out")
+    out.mkdir(exist_ok=True)
+    await sr.start_browser()
+    try:
+        template = sr.compile_template(Path("template.html").read_text())
+        parsed = sr.parse_csv("data.csv")
+        async with sr.render_context() as renderer:
+            for i, row in enumerate(sr.iter_rows("data.csv", parsed["columns"])):
+                html = sr.render_compiled(template, row)
+                pdf = await renderer.render_pdf(html)
+                (out / f"row_{i:04}.pdf").write_bytes(pdf)
+    finally:
+        await sr.stop_browser()
+
+asyncio.run(main())
+```
+
+Renders inside one `render_context` share the browser and are gated to
+`RenderConfig.concurrency` parallel pages. `merge_pdfs`, `zip_files`,
+`render_thumbnail`, `apply_pdf_metadata`, and the grouping helpers
+(`grouped_render_units`, `group_context`, `detect_group_candidates`) are all
+exported from the package root.
+
+## Templates
+
+Templates are plain HTML + CSS rendered by Chromium's print pipeline, with
+Jinja2 for data. Each row's columns become top-level variables — a header of
+`Invoice No.` is available as `{{ invoice_no }}` (`sheetrender inspect` shows
+the exact mapping). The environment is sandboxed, autoescaped, and strict:
+referencing a column that doesn't exist is an error, not a silent blank.
+
+Null-safe formatting filters (bad input renders as an empty string, never a
+crash mid-batch):
+
+| Filter | Example output | Notes |
+|---|---|---|
+| `money` | `$1,234` | whole-dollar |
+| `money2` | `$1,234.50` | cents |
+| `money_k` | `$234K`, `$1.2M` | compact, negatives as `-$…` |
+| `comma` / `comma2` | `1,234` / `1,234.50` | no currency symbol |
+| `pct` | `89%` | rounds to whole percent |
+| `bar_width` | `0`–`100` | clamped, for CSS bar charts |
+| `sign_class` | `positive` / `negative` | `{{ actual \| sign_class(target) }}` — compares two values |
+| `yesno_class` | `""` / `no` | empty string for truthy (default styling), `no` for falsy |
+| `sumcol` | `{{ items \| sumcol('amount') \| money2 }}` | Decimal-exact column sum; strips `$€£` and commas, treats `(123)` as negative |
+
+Rendering is deterministic across machines: the browser context is pinned to
+`en-US` / UTC, so dates and numbers format the same everywhere.
+
+### Grouped documents
+
+`--group-by customer_id` (or `grouped_render_units` in Python) renders one
+document per group. The template sees the first row's fields at the top level
+plus three reserved names: `items` (every row in the group), `item_count`, and
+`group_key`. See [`examples/invoice/`](examples/invoice/) for a complete
+line-item invoice.
+
+## Security model
+
+Designed for rendering templates you didn't write:
+
+- Jinja2 runs in `SandboxedEnvironment` — no attribute traversal to
+  dangerous internals, autoescape on.
+- Template HTML is sanitized with nh3 (allowlist-based) before it reaches the
+  browser.
+- The browser context intercepts all network requests and blocks everything
+  outside `RenderConfig.allowed_egress_hosts` (default: Google Fonts) — a
+  malicious template can't exfiltrate row data via an `<img>` beacon.
+- Chromium runs with its sandbox left **on** (don't run the engine as root).
+- Author `@page` rules are stripped so template CSS can't override the page
+  geometry you asked for.
+
+## Configuration
+
+```python
+from sheetrender import RenderConfig, configure
+
+configure(RenderConfig(
+    concurrency=4,                      # parallel Chromium pages
+    recycle_max_renders=300,            # recycle the browser after N renders…
+    recycle_max_age_minutes=30,         # …or N minutes, whichever comes first
+    allowed_egress_hosts=frozenset({"fonts.googleapis.com", "fonts.gstatic.com"}),
+    pdf_producer=None,                  # PDF metadata; default "sheetrender/<version>"
+))
+```
+
+Call `configure()` once, before `start_browser()` (or the first render, which
+starts it) — `concurrency` sizes the browser's gate at startup and changes
+after that are ignored.
+
+## Development
+
+No local Python needed — the test suite runs in containers:
+
+```sh
+scripts/test.sh            # unit suite (Chromium-dependent tests self-skip)
+scripts/test.sh --render   # real-Chromium tests in the Playwright image
+scripts/test.sh --all      # both
+scripts/lint.sh            # ruff
+```
+
+## Hosted version
+
+[sheetrender.com](https://sheetrender.com) is the hosted product built on this
+engine: a template wizard with AI design generation, Google Sheets sync,
+scheduled runs, and email/Drive delivery. If you'd rather not run Python,
+that's the two-minute path.
+
+## License
+
+[MIT](LICENSE)

sheetrender-0.1.0/README.md

@@ -0,0 +1,209 @@
+# SheetRender
+
+**Spreadsheet + HTML template in, a stack of PDFs out.**
+
+SheetRender turns a CSV or XLSX file and an HTML template into one
+well-paginated PDF per row — or per group of rows, for documents with line
+items like invoices and statements. It is the exact rendering engine behind
+[sheetrender.com](https://sheetrender.com), extracted as a standalone MIT
+library and CLI.
+
+```sh
+git clone https://github.com/sheetrender/sheetrender && cd sheetrender
+uvx sheetrender batch examples/invoice/template.html examples/invoice/data.csv \
+  -o out/ --group-by invoice_no --filename "{{ invoice_no }}.pdf" --zip invoices.zip
+```
+
+That renders one invoice per `invoice_no`, with the group's rows available to
+the template as `items`, names each file from a template, and zips the stack.
+(The clone is only for the example files — `uvx sheetrender` itself needs no
+install at all.)
+
+## Why this exists
+
+Every "generate PDFs from a spreadsheet" recipe on the internet glues a
+headless browser to a for-loop and hopes. This engine has rendered documents
+in production for a long time, and the parts that took real debugging are the
+parts you get for free:
+
+- **Chromium rendering with lifecycle management** — a shared browser with a
+  priority-aware concurrency gate, recycled after N renders or N minutes, so
+  thousand-row batches don't leak memory or wedge.
+- **Print CSS that behaves** — margins, page sizes, backgrounds, webfont
+  readiness with a bounded wait (a stalled font fetch degrades to fallback
+  fonts instead of hanging a render slot).
+- **Safe templating over untrusted data** — sandboxed Jinja2 with
+  `StrictUndefined` (typos fail loudly instead of rendering blanks) and
+  autoescaping on.
+- **HTML sanitization + network egress control** — templates are sanitized
+  with [nh3](https://github.com/messense/nh3), and the browser context blocks
+  all network requests except an allowlist (Google Fonts by default).
+- **Batch ergonomics** — filename templates with cross-platform sanitization
+  and de-duplication, row grouping with auto-detection, merged PDFs with
+  stamped page numbers, zip output, thumbnails, PDF metadata.
+
+## Install
+
+```sh
+uv add sheetrender          # or: pip install sheetrender
+uv run playwright install chromium
+```
+
+Or run the CLI without installing anything: `uvx sheetrender --help`. You
+still need Chromium once; without a local playwright on PATH that's
+
+```sh
+uvx --from playwright playwright install chromium
+```
+
+## CLI
+
+```sh
+# One PDF per row
+sheetrender batch template.html data.csv -o out/
+
+# One PDF per invoice, line items available as {{ items }}
+sheetrender batch template.html data.csv -o out/ --group-by invoice_no
+
+# Name files from row data, merge everything, add page numbers
+sheetrender batch template.html data.csv -o out/ \
+  --filename "{{ customer }}-{{ invoice_no }}.pdf" \
+  --merge all.pdf --page-numbers
+
+# Single document from a JSON object file (or --set key=value)
+sheetrender render letter.html -o letter.pdf --data row.json
+
+# What's in this file, and what will the template see?
+sheetrender inspect data.xlsx
+
+# PNG thumbnail of the first page
+sheetrender thumbnail template.html -o thumb.png --data row.json
+```
+
+Page geometry: `--page-size A3|A4|A5|Letter|Legal|Tabloid --landscape
+--margin 12mm`. Watermarking (`batch` only):
+`--watermark-html '<div style="position:fixed;bottom:0">DRAFT</div>'` injects
+your snippet before `</body>` — use `position:fixed` if it should repeat on
+every printed page rather than sit at the end of the document. Data files are
+`.csv` or `.xlsx`; the single-document `--data` flag takes a JSON object file.
+
+## Python API
+
+```python
+import asyncio
+from pathlib import Path
+
+import sheetrender as sr
+
+async def main() -> None:
+    out = Path("out")
+    out.mkdir(exist_ok=True)
+    await sr.start_browser()
+    try:
+        template = sr.compile_template(Path("template.html").read_text())
+        parsed = sr.parse_csv("data.csv")
+        async with sr.render_context() as renderer:
+            for i, row in enumerate(sr.iter_rows("data.csv", parsed["columns"])):
+                html = sr.render_compiled(template, row)
+                pdf = await renderer.render_pdf(html)
+                (out / f"row_{i:04}.pdf").write_bytes(pdf)
+    finally:
+        await sr.stop_browser()
+
+asyncio.run(main())
+```
+
+Renders inside one `render_context` share the browser and are gated to
+`RenderConfig.concurrency` parallel pages. `merge_pdfs`, `zip_files`,
+`render_thumbnail`, `apply_pdf_metadata`, and the grouping helpers
+(`grouped_render_units`, `group_context`, `detect_group_candidates`) are all
+exported from the package root.
+
+## Templates
+
+Templates are plain HTML + CSS rendered by Chromium's print pipeline, with
+Jinja2 for data. Each row's columns become top-level variables — a header of
+`Invoice No.` is available as `{{ invoice_no }}` (`sheetrender inspect` shows
+the exact mapping). The environment is sandboxed, autoescaped, and strict:
+referencing a column that doesn't exist is an error, not a silent blank.
+
+Null-safe formatting filters (bad input renders as an empty string, never a
+crash mid-batch):
+
+| Filter | Example output | Notes |
+|---|---|---|
+| `money` | `$1,234` | whole-dollar |
+| `money2` | `$1,234.50` | cents |
+| `money_k` | `$234K`, `$1.2M` | compact, negatives as `-$…` |
+| `comma` / `comma2` | `1,234` / `1,234.50` | no currency symbol |
+| `pct` | `89%` | rounds to whole percent |
+| `bar_width` | `0`–`100` | clamped, for CSS bar charts |
+| `sign_class` | `positive` / `negative` | `{{ actual \| sign_class(target) }}` — compares two values |
+| `yesno_class` | `""` / `no` | empty string for truthy (default styling), `no` for falsy |
+| `sumcol` | `{{ items \| sumcol('amount') \| money2 }}` | Decimal-exact column sum; strips `$€£` and commas, treats `(123)` as negative |
+
+Rendering is deterministic across machines: the browser context is pinned to
+`en-US` / UTC, so dates and numbers format the same everywhere.
+
+### Grouped documents
+
+`--group-by customer_id` (or `grouped_render_units` in Python) renders one
+document per group. The template sees the first row's fields at the top level
+plus three reserved names: `items` (every row in the group), `item_count`, and
+`group_key`. See [`examples/invoice/`](examples/invoice/) for a complete
+line-item invoice.
+
+## Security model
+
+Designed for rendering templates you didn't write:
+
+- Jinja2 runs in `SandboxedEnvironment` — no attribute traversal to
+  dangerous internals, autoescape on.
+- Template HTML is sanitized with nh3 (allowlist-based) before it reaches the
+  browser.
+- The browser context intercepts all network requests and blocks everything
+  outside `RenderConfig.allowed_egress_hosts` (default: Google Fonts) — a
+  malicious template can't exfiltrate row data via an `<img>` beacon.
+- Chromium runs with its sandbox left **on** (don't run the engine as root).
+- Author `@page` rules are stripped so template CSS can't override the page
+  geometry you asked for.
+
+## Configuration
+
+```python
+from sheetrender import RenderConfig, configure
+
+configure(RenderConfig(
+    concurrency=4,                      # parallel Chromium pages
+    recycle_max_renders=300,            # recycle the browser after N renders…
+    recycle_max_age_minutes=30,         # …or N minutes, whichever comes first
+    allowed_egress_hosts=frozenset({"fonts.googleapis.com", "fonts.gstatic.com"}),
+    pdf_producer=None,                  # PDF metadata; default "sheetrender/<version>"
+))
+```
+
+Call `configure()` once, before `start_browser()` (or the first render, which
+starts it) — `concurrency` sizes the browser's gate at startup and changes
+after that are ignored.
+
+## Development
+
+No local Python needed — the test suite runs in containers:
+
+```sh
+scripts/test.sh            # unit suite (Chromium-dependent tests self-skip)
+scripts/test.sh --render   # real-Chromium tests in the Playwright image
+scripts/test.sh --all      # both
+scripts/lint.sh            # ruff
+```
+
+## Hosted version
+
+[sheetrender.com](https://sheetrender.com) is the hosted product built on this
+engine: a template wizard with AI design generation, Google Sheets sync,
+scheduled runs, and email/Drive delivery. If you'd rather not run Python,
+that's the two-minute path.
+
+## License
+
+[MIT](LICENSE)

sheetrender-0.1.0/SECURITY.md

@@ -0,0 +1,25 @@
+# Security
+
+## Model
+
+SheetRender is built to render **untrusted templates over untrusted data**:
+
+- Jinja2 executes in `SandboxedEnvironment` with autoescaping on.
+- Template HTML passes through an nh3 allowlist sanitizer before reaching the
+  browser.
+- The Chromium context intercepts every network request and blocks all hosts
+  outside `RenderConfig.allowed_egress_hosts` (default: Google Fonts only), so
+  a template cannot exfiltrate row data.
+- Chromium's own sandbox is left enabled — run the engine as an unprivileged
+  user, not root.
+
+Anything that escapes one of those layers is a vulnerability we want to know
+about: sandbox escapes, sanitizer bypasses that reach script execution, egress
+allowlist bypasses, or a template that can read another render's data.
+
+## Reporting
+
+Email **info@finaldynamics.com** with a proof-of-concept template/data pair.
+Please don't open a public issue for suspected vulnerabilities. We'll respond
+within a few days, and credit you in the changelog unless you'd rather not be
+named.

sheetrender-0.1.0/examples/invoice/README.md

@@ -0,0 +1,14 @@
+# Line-item invoice (grouped mode)
+
+`data.csv` has one row per line item; `invoice_no` identifies the invoice each
+line belongs to. Grouped rendering emits one PDF per invoice, with the group's
+rows available to the template as `items` and the total computed by
+`{{ items | sumcol('line_total') | money2 }}`.
+
+```sh
+uvx sheetrender batch template.html data.csv -o out/ \
+  --group-by invoice_no --filename "{{ invoice_no }}.pdf" --zip invoices.zip
+```
+
+Expected output: `INV-2041.pdf` (3 line items), `INV-2042.pdf` (2),
+`INV-2043.pdf` (1), plus `invoices.zip`.

sheetrender-0.1.0/examples/invoice/data.csv

@@ -0,0 +1,7 @@
+invoice_no,invoice_date,due_date,customer,contact_email,address_line1,address_line2,description,qty,unit_price,line_total
+INV-2041,2026-08-03,2026-09-02,Harbor & Lane LLC,accounts@harborlane.example,214 Dockside Ave,"Portland, OR 97209",Brand identity refresh,1,"$3,200.00","$3,200.00"
+INV-2041,2026-08-03,2026-09-02,Harbor & Lane LLC,accounts@harborlane.example,214 Dockside Ave,"Portland, OR 97209",Landing page design,2,"$850.00","$1,700.00"
+INV-2041,2026-08-03,2026-09-02,Harbor & Lane LLC,accounts@harborlane.example,214 Dockside Ave,"Portland, OR 97209",Hosting (August),1,"$40.00","$40.00"
+INV-2042,2026-08-05,2026-09-04,Cordova Analytics,billing@cordova.example,88 Ninth St Suite 410,"Seattle, WA 98104",Quarterly data audit,1,"$2,400.00","$2,400.00"
+INV-2042,2026-08-05,2026-09-04,Cordova Analytics,billing@cordova.example,88 Ninth St Suite 410,"Seattle, WA 98104",Dashboard maintenance,3,"$300.00","$900.00"
+INV-2043,2026-08-11,2026-09-10,Bright Fern Studio,hello@brightfern.example,7 Alder Walk,"Eugene, OR 97401",Illustration set (12 pieces),1,"$1,560.00","$1,560.00"