sveltekit-admin 0.5.3 → 0.8.1

package/dist/server/runtime.js

@@ -0,0 +1,210 @@
+import { isSensitiveFieldName } from './introspection/parser.js';
+import { buildRelationGraph } from './introspection/relations.js';
+import { primaryKeyOf } from './data.js';
+import { validateListFilterConfig } from './query/filterDetection.js';
+import { isCompositeFilter, isLeafFilter, normalizeScope } from './adapters/filter.js';
+import { toLabel } from './views/html.js';
+import { AdminConfigError } from './errors.js';
+export function scopeFrom(relConfig, ctx) {
+    return relConfig?.where ? normalizeScope(relConfig.where(ctx)) : undefined;
+}
+export function listScopeFrom(runtime, model, ctx) {
+    const listScope = runtime.config.models?.[model.name]?.listWhere?.(ctx);
+    // A scope function returning `{}` (falsy-looking but truthy as
+    // an object) would otherwise silently fail OPEN — `{}` composed
+    // into an AND matches every row, exactly the opposite of what a
+    // caller configuring listWhere expects (real gap found in
+    // review: `locals.userId` undefined after a session expires is
+    // a realistic way to hit this). Fail loud instead: a scope
+    // function is either omitted entirely, or must return at least
+    // one condition every time it runs.
+    if (listScope && Object.keys(listScope).length === 0) {
+        throw new AdminConfigError(`[sveltekit-admin] models.${model.name}.listWhere returned an empty object ({}), ` +
+            `which would silently disable list scoping (fail-open). Return undefined/omit the ` +
+            `scope entirely if there is genuinely nothing to scope by for this request, or a ` +
+            `condition that actually restricts rows otherwise.`);
+    }
+    return listScope;
+}
+export function modelScopeFrom(runtime, model, ctx) {
+    const scope = runtime.config.models?.[model.name]?.scope;
+    if (!scope)
+        return undefined;
+    const raw = scope(ctx);
+    if (!raw || (typeof raw === 'object' && !Array.isArray(raw) && Object.keys(raw).length === 0)) {
+        throw new AdminConfigError(`[sveltekit-admin] models.${model.name}.scope must return a non-empty condition; ` +
+            'refusing to fail open.');
+    }
+    const normalized = normalizeScope(raw);
+    const valid = (node) => {
+        if (isLeafFilter(node))
+            return node.value !== undefined;
+        return isCompositeFilter(node) && node.clauses.length > 0 && node.clauses.every(valid);
+    };
+    if (!valid(normalized)) {
+        throw new AdminConfigError(`[sveltekit-admin] models.${model.name}.scope returned an invalid condition; refusing to fail open.`);
+    }
+    return normalized;
+}
+/** Extract equality predicates so create can force tenant-owned columns. */
+export function modelScopeValues(runtime, model, ctx) {
+    const normalized = modelScopeFrom(runtime, model, ctx);
+    if (!normalized)
+        return {};
+    const values = {};
+    const visit = (node) => {
+        if (isLeafFilter(node)) {
+            if (node.op !== 'eq')
+                return false;
+            if (node.field in values && values[node.field] !== node.value)
+                return false;
+            values[node.field] = node.value;
+            return true;
+        }
+        if (!isCompositeFilter(node) || node.op === 'or')
+            return false;
+        return node.clauses.every(visit);
+    };
+    if (!visit(normalized) || Object.keys(values).length === 0) {
+        throw new AdminConfigError(`[sveltekit-admin] models.${model.name}.scope must contain only equality conditions for creation`);
+    }
+    return values;
+}
+export function createAdminRuntime(config) {
+    const { basePath = '/admin', exclude = [], hidePivotTables = true, models: modelsConfig = {} } = config;
+    const adapter = config.adapter;
+    const introspector = adapter.introspector;
+    // Introspect the schema once at startup — same failure handling as before:
+    // a broken/missing schema source degrades to "no models known" rather than
+    // throwing out of `createAdminHandler` itself.
+    let schema = null;
+    let relationGraph = null;
+    try {
+        const introspected = introspector.introspect();
+        if (introspected instanceof Promise) {
+            throw new Error('[sveltekit-admin] SchemaIntrospector.introspect() returned a Promise — ' +
+                'createAdminHandler only supports synchronous introspection today.');
+        }
+        schema = introspected;
+        relationGraph = buildRelationGraph(schema);
+        for (const d of relationGraph.diagnostics) {
+            console.warn(`[sveltekit-admin] ${d}`);
+        }
+    }
+    catch (e) {
+        console.warn('[sveltekit-admin] Could not introspect schema:', e);
+    }
+    const models = schema?.models.filter((m) => {
+        // Exclude explicitly excluded models
+        if (exclude.includes(m.name))
+            return false;
+        // Exclude pivot tables if option is enabled
+        if (hidePivotTables && m.isPivotTable)
+            return false;
+        return true;
+    }) || [];
+    // Valider `listFilter` au démarrage : une config invalide (champ
+    // inexistant, sensible, relation, type non supporté) doit échouer fort
+    // ici plutôt que produire silencieusement un filtre mort à chaque rendu
+    // de liste (docs/design §8, même politique que le groupe ambigu de
+    // relations.ts).
+    const hiddenFieldsOf = (m) => new Set(modelsConfig[m.name]?.hidden ?? []);
+    for (const m of models) {
+        const entries = modelsConfig[m.name]?.listFilter;
+        // Non-null par construction : `models` n'existe que si le schéma
+        // a été parsé, et le graphe est construit dans la même branche de boot.
+        if (entries)
+            validateListFilterConfig(m.name, entries, m, relationGraph, hiddenFieldsOf(m));
+    }
+    const labelOf = (m) => {
+        const configured = modelsConfig[m.name]?.label;
+        if (configured)
+            return configured;
+        const label = toLabel(m.name);
+        return label.charAt(0).toUpperCase() + label.slice(1);
+    };
+    const modelList = models.map((m) => ({ name: m.name, label: labelOf(m) }));
+    const findModel = (name) => models.find((m) => m.name.toLowerCase() === name?.toLowerCase());
+    const viewModel = (m) => ({
+        name: m.name,
+        label: labelOf(m),
+        fields: m.fields,
+        primaryKey: primaryKeyOf(m),
+        // Non-null par construction : `m` vient toujours de `models`,
+        // dérivé du schéma qu'on vient de parser avec succès.
+        relationGraph: relationGraph
+    });
+    const selectThreshold = config.relationDefaults?.selectThreshold ?? 200;
+    const filterLinkThreshold = config.listFilterDefaults?.linkThreshold ?? 20;
+    const labelFieldCandidates = config.relationDefaults?.labelFields ?? [
+        'name', 'title', 'label', 'email', 'username', 'slug'
+    ];
+    /**
+     * Champs qu'un `?f.<field>=` est autorisé à cibler pour ce modèle : tout
+     * champ scalaire non-liste, non-relation, de type filtrable
+     * (String/Int/Float/Decimal/BigInt/Boolean/DateTime/enum — donc pas
+     * Json/Bytes), non sensible, et non listé dans `hidden` pour ce modèle.
+     * Sans ce dernier point, `hidden: ['internalNotes']` ne fait que masquer
+     * l'affichage : le champ reste un oracle de confirmation de valeur via
+     * `?f.internalNotes=...contains...`, exactement la faille §0.a fermée
+     * ailleurs pour les champs sensibles par nom — `hidden` et le prédicat
+     * de sensibilité sont deux sources distinctes, toutes deux doivent
+     * fermer l'oracle (docs/design §10, "deux sources, un seul prédicat
+     * partagé, sinon divergence garantie"). Défense en profondeur :
+     * `listQuery.ts` revérifie lui-même la sensibilité par nom, ce set est
+     * la première passe et la seule à connaître la config `hidden`.
+     */
+    const resolveFilterableFields = (model) => {
+        const hidden = hiddenFieldsOf(model);
+        const out = new Set();
+        for (const f of model.fields) {
+            if (f.relation || f.isList)
+                continue;
+            if (['Json', 'Bytes'].includes(f.type))
+                continue;
+            if (isSensitiveFieldName(f.name))
+                continue;
+            if (hidden.has(f.name))
+                continue;
+            out.add(f.name);
+        }
+        return out;
+    };
+    /**
+     * Résout le label BRUT (non échappé) d'une ligne : premier champ String
+     * candidat présent, sinon template `{a} {b}` si configuré, sinon la PK.
+     * Déterministe. Svelte échappe automatiquement à l'interpolation dans les
+     * composants — pas besoin d'échapper ici.
+     */
+    const resolveLabel = (targetModel, row, labelTemplate) => {
+        if (labelTemplate) {
+            return labelTemplate.replace(/\{(\w+)\}/g, (_, k) => String(row[k] ?? ''));
+        }
+        for (const candidate of labelFieldCandidates) {
+            const field = targetModel.fields.find((f) => f.name === candidate);
+            if (field && field.type === 'String' && row[candidate] != null) {
+                return String(row[candidate]);
+            }
+        }
+        return String(row[primaryKeyOf(targetModel)]);
+    };
+    return {
+        adapter,
+        schema,
+        relationGraph,
+        models,
+        modelList,
+        config,
+        basePath,
+        perPage: 20,
+        selectThreshold,
+        filterLinkThreshold,
+        labelFieldCandidates,
+        findModel,
+        labelOf,
+        hiddenFieldsOf,
+        viewModel,
+        resolveLabel,
+        resolveFilterableFields
+    };
+}

package/dist/server/search.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `_search` JSON endpoint — split out of `handler.ts`, pure orchestration
+ * over `AdminRuntime`.
+ */
+import { type AdminRuntime } from './runtime.js';
+/**
+ * Endpoint de recherche `GET {basePath}/_search?rel=Model.field&q=...&page=N`.
+ * Sert les options d'une relation to-one-owning ou m2m en JSON
+ * paginé — la voie prévue pour un futur widget autocomplete côté client
+ * quand le nombre d'options dépasse `selectThreshold`. Respecte le `where`
+ * de scoping configuré sur la relation, comme le select et la validation
+ * POST : même garantie anti-IDOR sur les trois chemins.
+ */
+export declare function handleSearch(runtime: AdminRuntime, event: any): Promise<Response>;

package/dist/server/search.js

@@ -0,0 +1,78 @@
+/**
+ * `_search` JSON endpoint — split out of `handler.ts`, pure orchestration
+ * over `AdminRuntime`.
+ */
+import { primaryKeyOf, paginate } from './data.js';
+import { scopeFrom, modelScopeFrom } from './runtime.js';
+/**
+ * Endpoint de recherche `GET {basePath}/_search?rel=Model.field&q=...&page=N`.
+ * Sert les options d'une relation to-one-owning ou m2m en JSON
+ * paginé — la voie prévue pour un futur widget autocomplete côté client
+ * quand le nombre d'options dépasse `selectThreshold`. Respecte le `where`
+ * de scoping configuré sur la relation, comme le select et la validation
+ * POST : même garantie anti-IDOR sur les trois chemins.
+ */
+export async function handleSearch(runtime, event) {
+    const modelsConfig = runtime.config.models ?? {};
+    const relParam = event.url.searchParams.get('rel') ?? '';
+    const [modelName, fieldName] = relParam.split('.');
+    const q = event.url.searchParams.get('q') ?? '';
+    const { page } = paginate(event.url.searchParams.get('page'), runtime.perPage);
+    const model = runtime.findModel(modelName);
+    const edge = model && runtime.relationGraph
+        ? runtime.relationGraph.edges.get(`${model.name}.${fieldName}`)
+        : undefined;
+    if (!model || !edge || (edge.kind !== 'to-one-owning' && edge.kind !== 'm2m') || edge.unsupported) {
+        return new Response(JSON.stringify({ error: 'unknown relation' }), {
+            status: 404,
+            headers: { 'Content-Type': 'application/json' }
+        });
+    }
+    const targetModel = runtime.schema.models.find((m) => m.name === edge.target);
+    const relConfig = modelsConfig[model.name]?.relations?.[edge.field];
+    const configWhere = scopeFrom(relConfig, { locals: event.locals });
+    const modelWhere = modelScopeFrom(runtime, targetModel, { locals: event.locals });
+    // Recherche sur le premier champ String candidat du modèle cible — le
+    // même champ que celui utilisé pour construire le label par défaut.
+    const searchField = runtime.labelFieldCandidates.find((c) => targetModel.fields.some((f) => f.name === c && f.type === 'String'));
+    // `_search` must stay case-sensitive on every adapter/provider. A
+    // `{ op: 'contains' }` leaf would pick up the adapter-wide
+    // `caseInsensitiveSearch` flag (Prisma `mode: 'insensitive'`, Drizzle
+    // `ilike`). `containsExact` compiles to `{ contains }` / `LIKE` with
+    // no case-folding — same observable Prisma behavior as the previous
+    // opaque `{ [field]: { contains: q } }` pass-through.
+    const containsFilter = q && searchField
+        ? { op: 'containsExact', field: searchField, value: q }
+        : undefined;
+    const searchClauses = [modelWhere, configWhere, containsFilter].filter(Boolean);
+    const searchFilter = searchClauses.length > 1
+        ? { op: 'and', clauses: searchClauses }
+        : searchClauses[0];
+    try {
+        // Count + fetch are independent reads — run them in parallel (as this
+        // endpoint always has, pre-refactor) rather than doubling latency with
+        // two sequential awaits.
+        const [total, rows] = await Promise.all([
+            runtime.adapter.data.countRecords(targetModel, searchFilter),
+            runtime.adapter.data.findMany(targetModel, {
+                filter: searchFilter,
+                orderBy: relConfig?.orderBy,
+                skip: (page - 1) * runtime.perPage,
+                take: runtime.perPage
+            })
+        ]);
+        const options = rows.map((row) => ({
+            id: row[primaryKeyOf(targetModel)],
+            label: runtime.resolveLabel(targetModel, row, relConfig?.labelTemplate)
+        }));
+        return new Response(JSON.stringify({ options, total, page }), {
+            headers: { 'Content-Type': 'application/json' }
+        });
+    }
+    catch {
+        return new Response(JSON.stringify({ error: 'search failed' }), {
+            status: 500,
+            headers: { 'Content-Type': 'application/json' }
+        });
+    }
+}

package/dist/server/types/schema.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Generic schema shapes shared by every schema-source adapter (Prisma today,
+ * others later). Deliberately identical in shape to what `introspection/
+ * parser.ts` has always produced — this file is a rename of that shape, not
+ * a redesign of it. `PrismaSchema`/`PrismaModel`/`PrismaField` in parser.ts
+ * become aliases of these.
+ */
+export interface Field {
+    name: string;
+    type: string;
+    isRequired: boolean;
+    isList: boolean;
+    isUnique: boolean;
+    isId: boolean;
+    isUpdatedAt: boolean;
+    isCreatedAt: boolean;
+    hasDefault: boolean;
+    defaultValue?: string;
+    /** true si `type` correspond à un `enum` déclaré dans le même schéma. */
+    isEnum?: boolean;
+    relation?: {
+        name?: string;
+        model: string;
+        fields?: string[];
+        references?: string[];
+    };
+    documentation?: string;
+}
+export interface Model {
+    name: string;
+    fields: Field[];
+    documentation?: string;
+    primaryKey?: string;
+    isPivotTable?: boolean;
+}
+export interface Schema {
+    models: Model[];
+    enums: Map<string, string[]>;
+    provider?: string;
+}

package/dist/server/types/schema.js

@@ -0,0 +1,8 @@
+/**
+ * Generic schema shapes shared by every schema-source adapter (Prisma today,
+ * others later). Deliberately identical in shape to what `introspection/
+ * parser.ts` has always produced — this file is a rename of that shape, not
+ * a redesign of it. `PrismaSchema`/`PrismaModel`/`PrismaField` in parser.ts
+ * become aliases of these.
+ */
+export {};

package/dist/server/views/Form.svelte

@@ -1,23 +1,26 @@
 <script lang="ts">
   import type { AdminHandlerConfig } from '../handler.js';
-  import type { ViewModel } from './types.js';
+  import type { RecordAction, ViewModel } from './types.js';
   import FieldInput from './FieldInput.svelte';
   import RelationSelect from './RelationSelect.svelte';
   import RelationCheckboxes from './RelationCheckboxes.svelte';
   import RelatedBlock from './RelatedBlock.svelte';
+  import { escapeHtml } from './html.js';
 
   let {
     mode,
     model,
     basePath,
     config,
-    item
+    item,
+    recordActions = []
   }: {
     mode: 'create' | 'edit';
     model: ViewModel;
     basePath: string;
     config: AdminHandlerConfig;
     item?: any;
+    recordActions?: RecordAction[];
   } = $props();
 
   const modelConfig = $derived(config.models?.[model.name] || {});
@@ -69,7 +72,7 @@
       ? [...model.relationGraph.edges.values()].filter(
           (e) =>
             e.model === model.name &&
-            e.kind === 'm2m-implicit' &&
+            e.kind === 'm2m' &&
             !e.unsupported &&
             !hidden.includes(e.field) &&
             model.relationOptions?.has(`${e.model}.${e.field}`)
@@ -77,6 +80,24 @@
       : []
   );
 
+  // Built as a single string (rather than {#if}/{#each}) so an empty/create-mode
+  // render stays a single @html call: Svelte 5's SSR wraps every {#if}/{#each} node
+  // in its own hydration-boundary comment regardless of the branch/array taken, so
+  // nesting recordActions in its own control-flow blocks would add bytes to every
+  // edit-form render even when recordActions is []. `label` and `href` are both
+  // escaped manually since this goes through @html instead of Svelte's
+  // auto-escaped text/attributes.
+  const recordActionsHtml = $derived(
+    mode === 'edit' && recordActions.length > 0
+      ? `<div class="ska-record-actions">${recordActions
+          .map(
+            (action) =>
+              `<a href="${escapeHtml(action.href)}" class="ska-btn ska-btn--secondary ska-btn--sm">${escapeHtml(action.label)}</a>`
+          )
+          .join('')}</div>`
+      : ''
+  );
+
   const inverseEdges = $derived(
     model.relationGraph
       ? [...model.relationGraph.edges.values()].filter(
@@ -92,6 +113,9 @@
   <p class="ska-subtitle">ID: {item[model.primaryKey]}</p>
 {/if}
 
+<!-- eslint-disable-next-line svelte/no-at-html-tags -- recordActionsHtml escapes both action.label and action.href via escapeHtml -->
+{@html recordActionsHtml}
+
 <div class="ska-card">
   <form method="POST" class="ska-form">
     <input type="hidden" name="_action" value={mode === 'create' ? 'create' : 'update'} />

package/dist/server/views/Form.svelte.d.ts

@@ -1,11 +1,12 @@
 import type { AdminHandlerConfig } from '../handler.js';
-import type { ViewModel } from './types.js';
+import type { RecordAction, ViewModel } from './types.js';
 type $$ComponentProps = {
     mode: 'create' | 'edit';
     model: ViewModel;
     basePath: string;
     config: AdminHandlerConfig;
     item?: any;
+    recordActions?: RecordAction[];
 };
 declare const Form: import("svelte").Component<$$ComponentProps, {}, "">;
 type Form = ReturnType<typeof Form>;

package/dist/server/views/Layout.svelte

@@ -6,12 +6,16 @@
     content,
     config,
     modelList,
-    currentModel
+    currentModel,
+    extraStyles = '',
+    extraScripts = ''
   }: {
     content: string;
     config: AdminHandlerConfig;
     modelList: Array<{ name: string; label: string }>;
     currentModel?: string;
+    extraStyles?: string;
+    extraScripts?: string;
   } = $props();
 
   const branding = $derived(config.branding ?? {});
@@ -21,6 +25,25 @@
   // No button at all if `logout` isn't configured — an admin that never
   // opted into this option looks exactly as it did before it existed.
   const showLogout = $derived(Boolean(config.logout));
+
+  // extraStyles is concatenated into the SAME @html expression as the theme <style>
+  // below, rather than a sibling {#if}/{@html} block: Svelte 5's SSR unconditionally
+  // wraps every {#if}/{#each}/{@html} node in its own hydration-boundary comment, even
+  // for a false/empty branch (see svelte/internal/server's `html()` helper) — a sibling
+  // block would add bytes to every render regardless of extraStyles being set.
+  // Concatenating keeps this ONE @html call, byte-identical to the pre-plugin-slots
+  // template when extraStyles is ''. extraScripts (bottom of <body>) has no such
+  // pre-existing @html call to fold into, so it stays its own @html — the smallest
+  // achievable footprint, though it still adds a fixed hydration-boundary comment
+  // pair even when empty (see task-6-report.md fix-round-1 notes).
+  //
+  // Built as a $derived here (rather than a nested template literal inline in the
+  // markup below) so tooling that tag-sniffs {@html} expressions for literal
+  // <style>/<script> text doesn't misparse the nested backticks.
+  const headStyleHtml = $derived(
+    `<style>${styles(primaryColor)}</style>${extraStyles ? `<style>${extraStyles}</style>` : ''}`
+  );
+  const bodyScriptHtml = $derived(extraScripts ? '<script>' + extraScripts + '</scr' + 'ipt>' : '');
 </script>
 
 <!doctype html>
@@ -31,7 +54,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>{title}</title>
   <!-- eslint-disable-next-line svelte/no-at-html-tags -- CSS injected as raw text; a literal <style> block can't take a dynamic value; primaryColor is developer-supplied config, not request/database data, and this raw interpolation is unchanged from the original layout.ts implementation, not a new injection point introduced by this migration -->
-  {@html `<style>${styles(primaryColor)}</style>`}
+  {@html headStyleHtml}
 </head>
 <!-- eslint-disable-next-line svelte/no-raw-special-elements -- server-only full-document template, never mounted client-side -->
 <body>
@@ -74,5 +97,7 @@
       {@html content}
     </main>
   </div>
+  <!-- eslint-disable-next-line svelte/no-at-html-tags -- plugin JS is developer-supplied, same trust as branding.primaryColor -->
+  {@html bodyScriptHtml}
 </body>
 </html>

package/dist/server/views/Layout.svelte.d.ts

@@ -7,6 +7,8 @@ type $$ComponentProps = {
         label: string;
     }>;
     currentModel?: string;
+    extraStyles?: string;
+    extraScripts?: string;
 };
 declare const Layout: import("svelte").Component<$$ComponentProps, {}, "">;
 type Layout = ReturnType<typeof Layout>;

package/dist/server/views/List.svelte

@@ -1,10 +1,9 @@
 <script lang="ts">
   import type { AdminHandlerConfig } from '../handler.js';
-  import type { ViewModel } from './types.js';
+  import type { ViewModel, ListRecordAction, FkFilterMeta } from './types.js';
   import type { ListQuery } from '../query/listQuery.js';
   import type { ResolvedFilterField } from '../query/filterDetection.js';
   import { DATETIME_PRESETS } from '../query/filterDetection.js';
-  import type { FkFilterMeta } from './types.js';
   import { getDisplayFields } from '../introspection/parser.js';
   import { buildListUrl, hiddenParams } from '../query/urls.js';
   import { escapeHtml, toLabel, formatValue } from './html.js';
@@ -19,7 +18,8 @@
     query,
     currentUrl,
     listFilters,
-    fkFilterMeta
+    fkFilterMeta,
+    recordActions = []
   }: {
     model: ViewModel;
     items: any[];
@@ -34,6 +34,7 @@
     listFilters?: ResolvedFilterField[];
     /** Métadonnées async (options scopées + label actif) pour les filtres FK configurés. */
     fkFilterMeta?: Map<string, FkFilterMeta>;
+    recordActions?: ListRecordAction[];
   } = $props();
 
   const modelConfig = $derived(config.models?.[model.name] || {});
@@ -126,6 +127,28 @@
    * pour un champ sensible que pour un champ inconnu (§0.a, §5.4) — ne
    * jamais dire "champ interdit", ça confirmerait son existence.
    */
+  // A per-row function (rather than {#each} in the markup) so an empty recordActions
+  // keeps this to the smallest possible footprint: Svelte 5's SSR wraps every
+  // {#each}/{@html} node in its own hydration-boundary comment regardless of the
+  // array's length/content (verified empirically — even {@html ''} still emits
+  // `<!--hash--><!---->`), so there is no template-level construct that renders zero
+  // bytes for an empty array here. Folding this into the pre-existing delete-form
+  // {@html} call (right below) was considered and rejected: recordActions must render
+  // *before* Edit (see list.test.ts "rend le lien avant Edit"), but the delete form's
+  // pre-existing {@html} — and thus its hydration marker — sits *after* Edit, so
+  // reusing it would either reorder Edit/recordActions or move the marker in front of
+  // Edit for every row, not just when recordActions is non-empty. Neither is
+  // byte-identical to the pre-recordActions baseline (see task-6-report.md fix-round-1
+  // notes). `action.label` and `hrefFor`'s return value are both escaped manually
+  // since this goes through @html instead of Svelte's auto-escaped text/attributes.
+  const recordActionsHtml = (id: string | number) =>
+    recordActions
+      .map(
+        (action) =>
+          `<a href="${escapeHtml(action.hrefFor(id))}" class="ska-btn ska-btn--secondary ska-btn--sm">${escapeHtml(action.label)}</a>`
+      )
+      .join('');
+
   const ignoredMessages = $derived.by(() => {
     return (query?.ignored ?? []).map((entry) => {
       // `param` est soit `f.<field>` / `f.<field>__<op>` (nouveau format),
@@ -217,6 +240,8 @@
               <!-- eslint-disable-next-line svelte/no-at-html-tags -- formatValue already escapes string values itself and returns a literal <span> only for null/undefined -->
               {#each displayFields as f (f.name)}<td>{@html formatValue(item[f.name], f.type)}</td>{/each}
               <td class="ska-table__actions">
+                <!-- eslint-disable-next-line svelte/no-at-html-tags -- recordActionsHtml escapes both action.label and hrefFor's return value via escapeHtml -->
+                {@html recordActionsHtml(item[model.primaryKey])}
                 <a href="{listPath}/{item[model.primaryKey]}" class="ska-btn ska-btn--secondary ska-btn--sm">Edit</a>
                 <!-- eslint-disable-next-line svelte/no-at-html-tags -- Svelte 5 rejects a literal onsubmit string as an event attribute; the PK is escaped manually here since it can't go through Svelte's native attribute escaping; the whole form (not just onsubmit) is rendered as raw HTML because there's no native-Svelte way to attach a plain inline onsubmit="..." string attribute at all in Svelte 5 templates, so the whole element had to be raw text to preserve the exact prior confirm-dialog behavior in a page that's never hydrated by a Svelte runtime -->
                 {@html `<form method="POST" action="${listPath}/${escapeHtml(String(item[model.primaryKey]))}" style="display:inline" onsubmit="return confirm('Delete this item?')"><input type="hidden" name="_action" value="delete"><button type="submit" class="ska-btn ska-btn--danger ska-btn--sm">Delete</button></form>`}

package/dist/server/views/List.svelte.d.ts

@@ -1,8 +1,7 @@
 import type { AdminHandlerConfig } from '../handler.js';
-import type { ViewModel } from './types.js';
+import type { ViewModel, ListRecordAction, FkFilterMeta } from './types.js';
 import type { ListQuery } from '../query/listQuery.js';
 import type { ResolvedFilterField } from '../query/filterDetection.js';
-import type { FkFilterMeta } from './types.js';
 type $$ComponentProps = {
     model: ViewModel;
     items: any[];
@@ -21,6 +20,7 @@ type $$ComponentProps = {
     listFilters?: ResolvedFilterField[];
     /** Métadonnées async (options scopées + label actif) pour les filtres FK configurés. */
     fkFilterMeta?: Map<string, FkFilterMeta>;
+    recordActions?: ListRecordAction[];
 };
 declare const List: import("svelte").Component<$$ComponentProps, {}, "">;
 type List = ReturnType<typeof List>;

package/dist/server/views/RelationCheckboxes.svelte

@@ -17,7 +17,7 @@
 </script>
 
 <!--
-  Fieldset de checkboxes pour une arête m2m-implicite.
+  Fieldset de checkboxes pour une arête m2m.
 
   Nommage `__rel__<field>` pour les valeurs cochées et un hidden sentinelle
   `__rel_present__<field>` toujours émis : en HTML, zéro checkbox cochée

package/dist/server/views/types.d.ts

@@ -22,6 +22,14 @@ export interface ViewModel {
     /** Compteurs des relations inverses (1-N, 1-1), indexés par "Model.field" */
     relatedCounts?: Map<string, number>;
 }
+export interface RecordAction {
+    label: string;
+    href: string;
+}
+export interface ListRecordAction {
+    label: string;
+    hrefFor: (id: string | number) => string;
+}
 /**
  * Résolution async d'un filtre FK (kind 'fk' dans ResolvedFilterField) :
  * options scopées pour la sidebar + label du chip actif scopé lui aussi