@nexa-stack/framework 1.0.0

package/packages/sms/src/index.ts

@@ -0,0 +1,33 @@
+import { appendFileSync, mkdirSync, existsSync } from "fs";
+import { join } from "path";
+import { config } from "../../core/src/config.js";
+import { log } from "../../log/src/index.js";
+
+export async function sms(to: string, message: string): Promise<void> {
+  const driver = config("SMS_DRIVER") || "log";
+
+  if (driver === "log") {
+    const dir = join(process.cwd(), "storage", "logs");
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    appendFileSync(
+      join(dir, "sms.log"),
+      `[${new Date().toISOString()}] to=${to} msg=${message}\n`
+    );
+    log.info(`SMS (log) → ${to}`);
+    return;
+  }
+
+  // Hook for Twilio / local gateways — set SMS_WEBHOOK to POST
+  const webhook = config("SMS_WEBHOOK");
+  if (driver === "webhook" && webhook) {
+    await fetch(webhook, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ to, message }),
+    });
+    log.info(`SMS (webhook) → ${to}`);
+    return;
+  }
+
+  throw new Error(`Unknown SMS_DRIVER: ${driver}`);
+}

package/packages/storage/src/upload.ts

@@ -0,0 +1,36 @@
+import { mkdirSync, existsSync } from "fs";
+import { writeFile } from "fs/promises";
+import { join, extname } from "path";
+import { randomUUID } from "crypto";
+import { config } from "../../core/src/config.js";
+
+const UPLOAD_DIR = join(process.cwd(), "storage", "uploads");
+
+export function ensureStorage(): void {
+  if (!existsSync(UPLOAD_DIR)) mkdirSync(UPLOAD_DIR, { recursive: true });
+}
+
+export async function saveUpload(file: File): Promise<string> {
+  ensureStorage();
+  const maxBytes = Number(config("UPLOAD_MAX_BYTES") || 5_000_000);
+  if (file.size > maxBytes) {
+    throw new Error(`File too large (max ${maxBytes} bytes)`);
+  }
+  const ext = extname(file.name) || ".bin";
+  const name = `${randomUUID()}${ext}`;
+  const path = join(UPLOAD_DIR, name);
+  const buf = Buffer.from(await file.arrayBuffer());
+  await writeFile(path, buf);
+  return `/storage/uploads/${name}`;
+}
+
+export function storagePath(urlPath: string): string | null {
+  if (!urlPath.startsWith("/storage/uploads/")) return null;
+  const name = urlPath.replace("/storage/uploads/", "");
+  if (name.includes("..") || name.includes("/") || name.includes("\\")) return null;
+  return join(UPLOAD_DIR, name);
+}
+
+export function isImageExt(ext: string): boolean {
+  return [".jpg", ".jpeg", ".png", ".gif", ".webp"].includes(ext.toLowerCase());
+}

package/packages/testing/src/index.ts

@@ -0,0 +1,67 @@
+import { createDatabase, type Database } from "../../database/src/database.js";
+import { Router } from "../../server/src/router.js";
+import { setupAuth, login, signToken, type AuthUser } from "../../auth/src/auth.js";
+import { setupQueue } from "../../queue/src/index.js";
+import { setupNotifications } from "../../notifications/src/index.js";
+import { getResources } from "../../core/src/registry.js";
+import { getCustomRoutes } from "../../core/src/routes.js";
+
+export interface TestApp {
+  db: Database;
+  router: Router;
+  request: (method: string, path: string, opts?: RequestInit & { token?: string }) => Promise<Response>;
+  actingAs: (user: AuthUser) => { request: TestApp["request"] };
+  loginAs: (email: string, password: string) => Promise<string>;
+  close: () => void;
+}
+
+/** Build an isolated in-memory app for tests (call after defining resources). */
+export async function createTestApp(): Promise<TestApp> {
+  const db = createDatabase(":memory:");
+  await db.connect();
+
+  for (const def of getResources()) {
+    await db.createTable(def);
+  }
+  await setupQueue(db);
+  await setupNotifications(db);
+  await setupAuth({ secret: "test-secret" }, db);
+
+  const router = new Router(db);
+  for (const def of getResources()) router.registerResource(def);
+  router.registerAuthRoutes();
+  router.registerNotificationRoutes();
+  router.registerCustomRoutes([...getCustomRoutes()]);
+
+  const request: TestApp["request"] = async (method, path, opts = {}) => {
+    const headers = new Headers(opts.headers);
+    if (opts.token) headers.set("Authorization", `Bearer ${opts.token}`);
+    if (opts.body && !headers.has("Content-Type") && typeof opts.body === "string") {
+      headers.set("Content-Type", "application/json");
+    }
+    const { token: _t, ...rest } = opts;
+    return router.handle(
+      new Request(`http://localhost${path}`, { method, ...rest, headers })
+    );
+  };
+
+  return {
+    db,
+    router,
+    request,
+    actingAs(user) {
+      const token = signToken(user);
+      return {
+        request: (method, path, opts = {}) => request(method, path, { ...opts, token }),
+      };
+    },
+    async loginAs(email, password) {
+      const result = await login(email, password);
+      if (!result) throw new Error("login failed");
+      return result.token;
+    },
+    close() {
+      db.close();
+    },
+  };
+}

package/packages/validation/src/index.ts

@@ -0,0 +1 @@
+export { validate, type ValidationError } from "./validate.js";

package/packages/validation/src/validate.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from "vitest";
+import { validate } from "./validate.js";
+import { resolveFields, string, number, email, belongsTo } from "../../core/src/fields.js";
+
+describe("validate", () => {
+  test("required field missing", () => {
+    const fields = resolveFields({ name: string().required() });
+    const result = validate(fields, {});
+    expect(result.valid).toBe(false);
+    if (!result.valid) expect(result.errors[0].field).toBe("name");
+  });
+
+  test("valid string and number", () => {
+    const fields = resolveFields({ name: string().required(), price: number().required() });
+    const result = validate(fields, { name: "Book", price: 10 });
+    expect(result.valid).toBe(true);
+    if (result.valid) {
+      expect(result.data.name).toBe("Book");
+      expect(result.data.price).toBe(10);
+    }
+  });
+
+  test("invalid email", () => {
+    const fields = resolveFields({ mail: email().required() });
+    const result = validate(fields, { mail: "bad" });
+    expect(result.valid).toBe(false);
+  });
+
+  test("relation accepts id", () => {
+    const fields = resolveFields({ category: belongsTo("categories").required() });
+    const result = validate(fields, { category: 1 });
+    expect(result.valid).toBe(true);
+    if (result.valid) expect(result.data.category_id).toBe(1);
+  });
+});

package/packages/validation/src/validate.ts

@@ -0,0 +1,112 @@
+import type { FieldDef } from "../../core/src/fields.js";
+import { fieldColumn, isStoredField } from "../../core/src/fields.js";
+
+export interface ValidationError {
+  field: string;
+  message: string;
+}
+
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+export function validate(
+  fields: Record<string, FieldDef>,
+  data: Record<string, unknown>,
+  partial = false
+):
+  | { valid: true; data: Record<string, unknown> }
+  | { valid: false; errors: ValidationError[] } {
+  const errors: ValidationError[] = [];
+  const parsed: Record<string, unknown> = {};
+
+  for (const [name, field] of Object.entries(fields)) {
+    if (!isStoredField(field)) continue;
+
+    const col = fieldColumn(name, field);
+    if (!col) continue;
+
+    const value = data[name] ?? data[col];
+
+    if (value === undefined || value === null || value === "") {
+      if (field.required && !partial) {
+        errors.push({ field: name, message: `${name} is required` });
+      }
+      continue;
+    }
+
+    switch (field.type) {
+      case "number":
+      case "money": {
+        const num = Number(value);
+        if (Number.isNaN(num)) {
+          errors.push({ field: name, message: `${name} must be a number` });
+        } else {
+          if (field.min !== undefined && num < field.min) {
+            errors.push({ field: name, message: `${name} min is ${field.min}` });
+          }
+          if (field.max !== undefined && num > field.max) {
+            errors.push({ field: name, message: `${name} max is ${field.max}` });
+          }
+          parsed[col] = num;
+        }
+        break;
+      }
+      case "boolean": {
+        parsed[col] = value === true || value === "true" || value === 1 || value === "1";
+        break;
+      }
+      case "email": {
+        const str = String(value);
+        if (!EMAIL_RE.test(str)) {
+          errors.push({ field: name, message: `${name} must be a valid email` });
+        } else {
+          parsed[col] = str;
+        }
+        break;
+      }
+      case "select": {
+        const str = String(value);
+        if (field.options?.length && !field.options.includes(str)) {
+          errors.push({
+            field: name,
+            message: `${name} must be one of: ${field.options.join(", ")}`,
+          });
+        } else {
+          parsed[col] = str;
+        }
+        break;
+      }
+      case "date":
+      case "datetime": {
+        parsed[col] = String(value);
+        break;
+      }
+      case "relation": {
+        const num = Number(value);
+        if (!Number.isInteger(num) || num <= 0) {
+          errors.push({ field: name, message: `${name} must be a valid id` });
+        } else {
+          parsed[col] = num;
+        }
+        break;
+      }
+      case "file":
+      case "image": {
+        parsed[col] = String(value);
+        break;
+      }
+      default: {
+        const str = String(value);
+        if (field.min !== undefined && str.length < field.min) {
+          errors.push({ field: name, message: `${name} min length is ${field.min}` });
+        }
+        if (field.max !== undefined && str.length > field.max) {
+          errors.push({ field: name, message: `${name} max length is ${field.max}` });
+        }
+        parsed[col] = str;
+      }
+    }
+  }
+
+  if (errors.length > 0) return { valid: false, errors };
+  return { valid: true, data: parsed };
+}

package/public/admin.html

@@ -0,0 +1,369 @@
+<!DOCTYPE html>
+<html lang="en" dir="ltr">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Nexa</title>
+  <style>
+    * { box-sizing: border-box; margin: 0; padding: 0; }
+    body { font-family: system-ui, sans-serif; background: #f1f5f9; min-height: 100vh; color: #1e293b; }
+
+    #login { display: flex; align-items: center; justify-content: center; min-height: 100vh; background: #0f172a; }
+    .login-card { background: #fff; padding: 36px; border-radius: 16px; width: 380px; }
+    .login-card h1 { margin-bottom: 8px; }
+    .login-card p { color: #64748b; font-size: .85rem; margin-bottom: 24px; }
+
+    input, select {
+      width: 100%; padding: 11px 12px; margin-bottom: 12px;
+      border: 1px solid #cbd5e1; border-radius: 8px; font-size: .95rem;
+    }
+    button {
+      padding: 10px 18px; background: #2563eb; color: #fff;
+      border: none; border-radius: 8px; cursor: pointer; font-size: .9rem;
+    }
+    button:hover { background: #1d4ed8; }
+    button.danger { background: #dc2626; }
+    button.ghost { background: #e2e8f0; color: #475569; }
+
+    #app { display: none; grid-template-columns: 220px 1fr; min-height: 100vh; }
+    nav { background: #0f172a; color: #fff; padding: 20px 0; }
+    nav .logo { padding: 0 20px 24px; font-size: 1.2rem; font-weight: bold; color: #38bdf8; }
+    nav .logo a { color: inherit; text-decoration: none; }
+    nav .docs-link {
+      display: block; padding: 0 20px 16px; font-size: .8rem; color: #64748b; text-decoration: none;
+    }
+    nav .docs-link:hover { color: #94a3b8; }
+    nav button {
+      display: block; width: 100%; text-align: right; padding: 11px 20px;
+      background: none; color: #94a3b8; border: none; cursor: pointer; font-size: .9rem;
+    }
+    nav button.active, nav button:hover { background: #1e293b; color: #fff; }
+
+    main { padding: 28px; overflow-y: auto; }
+    .stats { display: grid; grid-template-columns: repeat(auto-fill, minmax(160px, 1fr)); gap: 14px; margin-bottom: 28px; }
+    .stat { background: #fff; padding: 18px; border-radius: 12px; box-shadow: 0 1px 3px rgba(0,0,0,.06); }
+    .stat .num { font-size: 1.8rem; font-weight: bold; color: #2563eb; }
+    .stat .lbl { font-size: .8rem; color: #64748b; margin-top: 4px; }
+
+    table { width: 100%; background: #fff; border-radius: 10px; border-collapse: collapse; box-shadow: 0 1px 3px rgba(0,0,0,.06); }
+    th, td { padding: 11px 14px; text-align: right; border-bottom: 1px solid #f1f5f9; font-size: .88rem; }
+    th { background: #f8fafc; color: #64748b; }
+
+    .form-box { background: #fff; padding: 20px; border-radius: 10px; margin-bottom: 20px; box-shadow: 0 1px 3px rgba(0,0,0,.06); }
+    .form-row { display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 12px; }
+    label { display: block; font-size: .78rem; color: #64748b; margin-bottom: 4px; }
+    .header { display: flex; justify-content: space-between; align-items: center; margin-bottom: 20px; }
+    .header h1 { font-size: 1.4rem; }
+    .lang-switch { display: flex; gap: 6px; padding: 0 20px 16px; }
+    .lang-switch button { flex: 1; padding: 6px; font-size: .8rem; background: #1e293b; color: #94a3b8; }
+    .lang-switch button.active { background: #2563eb; color: #fff; }
+    .hidden { display: none !important; }
+    .error-msg { background: #fee2e2; color: #dc2626; padding: 12px; border-radius: 8px; margin-bottom: 16px; }
+  </style>
+</head>
+<body>
+
+  <div id="login">
+    <div class="login-card">
+      <h1>Nexa</h1>
+      <p id="loginSub">Resource admin</p>
+      <p id="loginError" class="error-msg hidden"></p>
+      <input id="email" value="admin@nexa.dev" />
+      <input id="pass" type="password" value="123456" />
+      <button id="loginBtn" onclick="doLogin()" style="width:100%">Login</button>
+      <div class="lang-switch" style="padding:16px 0 0;margin:0">
+        <button id="lang-ar" onclick="setLang('ar')">عربي</button>
+        <button id="lang-en" onclick="setLang('en')">EN</button>
+      </div>
+    </div>
+  </div>
+
+  <div id="app">
+    <nav>
+      <div class="logo">Nexa</div>
+      <a class="docs-link" href="/docs" target="_blank">Docs ↗</a>
+      <div class="lang-switch">
+        <button id="nav-lang-ar" onclick="setLang('ar')">عربي</button>
+        <button id="nav-lang-en" onclick="setLang('en')">EN</button>
+      </div>
+      <button onclick="openDash()" id="tab-dashboard">Dashboard</button>
+      <div id="menu"></div>
+      <button class="ghost" id="logoutBtn" style="margin:20px;color:#64748b;background:none" onclick="logout()">Logout</button>
+    </nav>
+    <main>
+      <div id="dashboard">
+        <div class="header"><h1 id="dashTitle">Dashboard</h1></div>
+        <div class="stats" id="stats"></div>
+      </div>
+      <div id="page" class="hidden">
+        <div class="header">
+          <h1 id="title">—</h1>
+          <input id="searchBox" placeholder="Search…" oninput="onSearch()" style="width:220px;margin:0" />
+        </div>
+        <div id="pageError" class="error-msg hidden"></div>
+        <div class="form-box" id="formBox"></div>
+        <table><thead id="thead"></thead><tbody id="tbody"></tbody></table>
+      </div>
+    </main>
+  </div>
+
+  <script>
+    const API = location.origin;
+    let token = localStorage.getItem("token");
+    let schemas = [];
+    let current = null;
+    let lang = localStorage.getItem("lang") || "en";
+    let uiTexts = {};
+    let relCache = {};
+
+    setLang(lang, false);
+    if (token) boot();
+
+    async function setLang(l, reload = true) {
+      lang = l;
+      localStorage.setItem("lang", l);
+      document.documentElement.lang = l;
+      document.documentElement.dir = l === "ar" ? "rtl" : "ltr";
+      document.querySelectorAll(".lang-switch button").forEach(b => b.classList.remove("active"));
+      document.getElementById(`lang-${l}`)?.classList.add("active");
+      document.getElementById(`nav-lang-${l}`)?.classList.add("active");
+      const pre = await fetch(`${API}/api/schema?lang=${l}`, {
+        headers: token ? { Authorization: `Bearer ${token}` } : {},
+      });
+      const preData = await pre.json();
+      uiTexts = preData.ui || {};
+      document.getElementById("loginSub").textContent = uiTexts.title || "";
+      document.getElementById("loginBtn").textContent = uiTexts.login || "Login";
+      if (reload && token) boot();
+    }
+
+    function applyUi() {
+      document.getElementById("tab-dashboard").textContent = uiTexts.dashboard || "Dashboard";
+      document.getElementById("dashTitle").textContent = uiTexts.dashboard || "Dashboard";
+      document.getElementById("logoutBtn").textContent = uiTexts.logout || "Logout";
+    }
+
+    function headers(authRequired = false) {
+      const h = { "Content-Type": "application/json" };
+      if (token) h.Authorization = `Bearer ${token}`;
+      return h;
+    }
+
+    function apiHeaders() {
+      return token ? { Authorization: `Bearer ${token}` } : {};
+    }
+
+    function showError(msg) {
+      const el = document.getElementById("pageError");
+      el.textContent = msg;
+      el.classList.remove("hidden");
+    }
+
+    function hideError() {
+      document.getElementById("pageError").classList.add("hidden");
+    }
+
+    async function doLogin() {
+      const res = await fetch(`${API}/api/auth/login`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          email: document.getElementById("email").value,
+          password: document.getElementById("pass").value,
+        }),
+      });
+      const data = await res.json();
+      if (!res.ok) {
+        const err = document.getElementById("loginError");
+        err.textContent = data.error || "Login failed";
+        err.classList.remove("hidden");
+        return;
+      }
+      document.getElementById("loginError").classList.add("hidden");
+      token = data.data.token;
+      localStorage.setItem("token", token);
+      boot();
+    }
+
+    function logout() { localStorage.removeItem("token"); location.reload(); }
+
+    async function boot() {
+      const res = await fetch(`${API}/api/schema?lang=${lang}`, { headers: apiHeaders() });
+      const data = await res.json();
+      if (!res.ok) {
+        logout();
+        return;
+      }
+      schemas = data.data || [];
+      uiTexts = data.ui || {};
+      applyUi();
+
+      document.getElementById("login").style.display = "none";
+      document.getElementById("app").style.display = "grid";
+
+      document.getElementById("menu").innerHTML = schemas.map(s =>
+        `<button onclick="openPage('${s.name}')" id="tab-${s.name}">${s.label}</button>`
+      ).join("");
+
+      openDash();
+    }
+
+    async function openDash() {
+      current = null;
+      hideError();
+      document.querySelectorAll("#menu button, #tab-dashboard").forEach(b => b.classList.remove("active"));
+      document.getElementById("tab-dashboard").classList.add("active");
+      document.getElementById("dashboard").classList.remove("hidden");
+      document.getElementById("page").classList.add("hidden");
+
+      try {
+        const res = await fetch(`${API}/api/dashboard?lang=${lang}`, { headers: apiHeaders() });
+        const json = await res.json();
+        if (!res.ok) throw new Error(json.error || "Dashboard error");
+        document.getElementById("stats").innerHTML = (json.data.stats || []).map(s =>
+          `<div class="stat" onclick="openPage('${s.name}')" style="cursor:pointer">
+            <div class="num">${s.count}</div><div class="lbl">${s.label}</div></div>`
+        ).join("") || `<p style="color:#64748b">${uiTexts.empty || "Empty"}</p>`;
+      } catch (e) {
+        document.getElementById("stats").innerHTML = `<p class="error-msg">${e.message}</p>`;
+      }
+    }
+
+    async function openPage(name) {
+      current = schemas.find(s => s.name === name);
+      if (!current) return alert("Not found: " + name);
+      hideError();
+      document.querySelectorAll("#menu button, #tab-dashboard").forEach(b => b.classList.remove("active"));
+      document.getElementById(`tab-${name}`)?.classList.add("active");
+      document.getElementById("dashboard").classList.add("hidden");
+      document.getElementById("page").classList.remove("hidden");
+      document.getElementById("title").textContent = current.label;
+      await renderForm();
+      await load();
+    }
+
+    async function getRel(name) {
+      if (relCache[name]) return relCache[name];
+      const s = schemas.find(x => x.name === name);
+      const res = await fetch(`${API}/api/${name}`, { headers: apiHeaders() });
+      const data = await res.json();
+      if (!res.ok) throw new Error(data.error || `Failed to load ${name}`);
+      relCache[name] = data.data;
+      return data.data;
+    }
+
+    async function renderForm() {
+      const box = document.getElementById("formBox");
+      let html = `<h3 style="margin-bottom:14px">${uiTexts.add || "Add"} ${current.label}</h3><div class="form-row">`;
+
+      try {
+        for (const f of current.fields) {
+          const label = f.label || f.name;
+          if (f.type === "relation") {
+            const items = await getRel(f.relation);
+            html += `<div><label>${label}</label><select id="f-${f.name}" ${f.required ? "required" : ""}>
+              <option value="">—</option>
+              ${items.map(i => `<option value="${i.id}">${i.name || i.title || "#"+i.id}</option>`).join("")}
+            </select></div>`;
+          } else if (f.type === "select") {
+            const opts = f.options || [];
+            html += `<div><label>${label}</label><select id="f-${f.name}" ${f.required ? "required" : ""}>
+              <option value="">—</option>
+              ${opts.map(o => `<option value="${o}">${o}</option>`).join("")}
+            </select></div>`;
+          } else if (f.type === "boolean") {
+            html += `<div><label>${label}</label>
+              <select id="f-${f.name}"><option value="false">${lang === "ar" ? "لا" : "No"}</option><option value="true">${lang === "ar" ? "نعم" : "Yes"}</option></select></div>`;
+          } else if (f.type === "text") {
+            html += `<div style="grid-column:1/-1"><label>${label}</label>
+              <textarea id="f-${f.name}" rows="3" style="width:100%;padding:11px 12px;border:1px solid #cbd5e1;border-radius:8px;font:inherit" ${f.required ? "required" : ""}></textarea></div>`;
+          } else {
+            const type =
+              f.type === "number" || f.type === "money" ? "number" :
+              f.type === "date" ? "date" :
+              f.type === "datetime" ? "datetime-local" :
+              f.type === "email" ? "email" : "text";
+            html += `<div><label>${label}</label>
+              <input id="f-${f.name}" type="${type}" ${f.required ? "required" : ""} /></div>`;
+          }
+        }
+        html += `</div><button type="button" onclick="add()" style="margin-top:14px">${uiTexts.add || "Add"}</button>`;
+        box.innerHTML = html;
+      } catch (e) {
+        box.innerHTML = `<p class="error-msg">${e.message}</p>`;
+      }
+    }
+
+    function val(row, f) {
+      const v = row[f.name];
+      if (f.type === "boolean") {
+        const yes = lang === "ar" ? "نعم" : "Yes";
+        const no = lang === "ar" ? "لا" : "No";
+        return v === true || v === 1 || v === "1" ? yes : no;
+      }
+      if (v && typeof v === "object") return v.name || v.title || `#${v.id}`;
+      return v ?? row[f.name + "_id"] ?? "—";
+    }
+
+    let searchTimer = null;
+
+    function onSearch() {
+      clearTimeout(searchTimer);
+      searchTimer = setTimeout(() => load(), 300);
+    }
+
+    async function load() {
+      try {
+        const q = document.getElementById("searchBox")?.value?.trim();
+        const url = new URL(`${API}/api/${current.name}`);
+        if (q) url.searchParams.set("search", q);
+        const res = await fetch(url, { headers: apiHeaders() });
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.error || "Load failed");
+
+        const rows = data.data ?? [];
+        document.getElementById("thead").innerHTML =
+          `<tr>${current.fields.map(f => `<th>${f.label || f.name}</th>`).join("")}<th></th></tr>`;
+        document.getElementById("tbody").innerHTML = rows.length
+          ? rows.map(row => `<tr>
+              ${current.fields.map(f => `<td>${val(row, f)}</td>`).join("")}
+              <td><button class="danger" onclick="del(${row.id})">${uiTexts.delete || "Delete"}</button></td></tr>`).join("")
+          : `<tr><td colspan="${current.fields.length + 1}">${uiTexts.empty || "Empty"}</td></tr>`;
+      } catch (e) {
+        showError(e.message);
+        document.getElementById("tbody").innerHTML = "";
+      }
+    }
+
+    async function add() {
+      const body = {};
+      for (const f of current.fields) {
+        const el = document.getElementById(`f-${f.name}`);
+        if (!el) continue;
+        const v = el.value;
+        if (f.type === "number" || f.type === "money") body[f.name] = Number(v);
+        else if (f.type === "boolean") body[f.name] = v === "true";
+        else if (f.type === "relation") body[f.name] = v ? Number(v) : undefined;
+        else body[f.name] = v;
+      }
+      const res = await fetch(`${API}/api/${current.name}`, {
+        method: "POST",
+        headers: headers(),
+        body: JSON.stringify(body),
+      });
+      const d = await res.json();
+      if (!res.ok) return showError(d.error || JSON.stringify(d.errors));
+      hideError();
+      relCache = {};
+      await renderForm();
+      await load();
+    }
+
+    async function del(id) {
+      if (!confirm(uiTexts.confirm_delete || "Delete?")) return;
+      await fetch(`${API}/api/${current.name}/${id}`, { method: "DELETE", headers: apiHeaders() });
+      await load();
+    }
+  </script>
+</body>
+</html>