Vendored grid

Jspreadsheet CE and its one runtime dependency, jsuites. Both MIT — the licences are beside the code as LICENSE.jspreadsheet and LICENSE.jsuites.

Vendored, not fetched: spec §6 and AGENTS.md both rule out a CDN and a build step. These files are served from this app's own origin, with a content hash in the URL, and they change only when somebody runs the commands below and commits the result.

Versions

| File | Package | Version | |---|---|---| | jspreadsheet.js, jspreadsheet.css | jspreadsheet-ce | 5.0.2 | | jsuites.js, jsuites.css | jsuites | 5.13.5 |

jsuites is pinned to the newest 5.x, not to npm's latest. Version 6 is out, and jspreadsheet-ce@5.0.2 declares jsuites: ^5.8.5 — so 6.x is a major it has never claimed to work with, and taking latest would silently cross that line on the next upgrade.

Upgrading

Re-run this from the repository root, then commit the diff:

D=$(mktemp -d)
JS=5.0.2
SU=5.13.5
mkdir -p "$D/js" "$D/su"
curl -sSL -o "$D/js.tgz" "https://registry.npmjs.org/jspreadsheet-ce/-/jspreadsheet-ce-$JS.tgz"
curl -sSL -o "$D/su.tgz" "https://registry.npmjs.org/jsuites/-/jsuites-$SU.tgz"
tar xzf "$D/js.tgz" -C "$D/js"
tar xzf "$D/su.tgz" -C "$D/su"

V=internal/sheets/static/vendor
install -m 644 "$D/js/package/dist/index.js"         "$V/jspreadsheet.js"
install -m 644 "$D/js/package/dist/jspreadsheet.css" "$V/jspreadsheet.css"
install -m 644 "$D/su/package/dist/jsuites.js"       "$V/jsuites.js"
install -m 644 "$D/su/package/dist/jsuites.css"      "$V/jsuites.css"
install -m 644 "$D/js/package/LICENSE"               "$V/LICENSE.jspreadsheet"
install -m 644 "$D/su/package/LICENSE"               "$V/LICENSE.jsuites"

Then update the table above, and check two things by hand, because nothing else will:

1. Formula evaluation stays off. grid.js never enables it. Our engine computes and the client paints; a client-side evaluator would disagree with the server on the first SUM(1,2,"3") — the divergence the formula corpus already documents — and the disagreement would be invisible.
2. The two files are the only exemptions in internal/guardstest/jscap_test.go. That test caps our own JavaScript at 300 lines and names each vendored blob explicitly, so a third file dropped in here is not silently exempt.