tempest-express-sdk 0.24.0 → 0.25.0

package/dist/index.js

@@ -1,5 +1,5 @@
-import { z, looseBoolean, toDict, PasswordUtils } from './chunk-6KJTKSG5.js';
-export { PasswordUtils, VERSION, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, centsField, corsSettingsShape, databaseSettingsShape, looseBoolean as envBoolean, hexColorField, latitudeField, loadSettings, longitudeField, looseBoolean, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, percentField, portField, positiveFloatField, positiveIntField, priceField, ratingField, ratioField, serverSettingsShape, slugField, toDict, z } from './chunk-6KJTKSG5.js';
+import { z, looseBoolean, toDict, PasswordUtils } from './chunk-TIW2KPT2.js';
+export { PasswordUtils, VERSION, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, centsField, corsSettingsShape, databaseSettingsShape, looseBoolean as envBoolean, hexColorField, latitudeField, loadSettings, longitudeField, looseBoolean, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, percentField, portField, positiveFloatField, positiveIntField, priceField, ratingField, ratioField, serverSettingsShape, slugField, toDict, z } from './chunk-TIW2KPT2.js';
 import { AsyncLocalStorage } from 'async_hooks';
 import { Model, column, sql, BaseRepository, RecordNotFound, detectDialect, columnsOf, NodeSqliteDriver, AsyncEngine, or, and } from 'tempest-db-js';
 export { AsyncEngine, AsyncResult, AsyncSession, BaseRepository, Column, DeleteBuilder, InsertBuilder, Model, NoResultError, NodeSqliteDriver, PostgresDialect, RecordNotFound, SelectBuilder, SqliteDialect, SyncEngine, SyncSession, UpdateBuilder, and, belongsTo, column, columnsOf, createEngine, createSyncEngine, del, detectDialect, getDialect, hasMany, insert, join, loadRelations, not, or, parseDatabaseUrl, select, sql, update } from 'tempest-db-js';
@@ -9317,6 +9317,21 @@ var MessagingHub = class {
   }
 };
 
+// src/admin/actions.ts
+function slugify(label) {
+  return label.normalize("NFD").replace(/\p{M}/gu, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "action";
+}
+function adminAction(options, handler) {
+  const name = options.name ?? slugify(options.label);
+  if (name === "") throw new Error("adminAction requires a non-empty name or label");
+  return {
+    name,
+    label: options.label,
+    handler,
+    dangerous: options.dangerous ?? false
+  };
+}
+
 // src/admin/columns.ts
 function humanizeField(name) {
   return name.replace(/[_-]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").trim().split(/\s+/).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
@@ -9397,6 +9412,9 @@ function filterForColumn(column6) {
   }
   return { kind: "text", options: [] };
 }
+function foreignKeyTable(column6) {
+  return column6.reference?.table ?? null;
+}
 function isSearchableColumn(column6) {
   const { kind } = column6.type;
   return kind === "varchar" || kind === "text" || kind === "char";
@@ -9433,6 +9451,7 @@ var AdminModel = class {
   canEdit;
   /** Whether the delete action is exposed. */
   canDelete;
+  actions = /* @__PURE__ */ new Map();
   slugOverride;
   listDisplayOverride;
   verboseNameOverride;
@@ -9457,6 +9476,14 @@ var AdminModel = class {
     this.canCreate = options.canCreate ?? true;
     this.canEdit = options.canEdit ?? true;
     this.canDelete = options.canDelete ?? true;
+    for (const action of options.actions ?? []) {
+      if (this.actions.has(action.name)) {
+        throw new Error(
+          `Duplicate admin action name "${action.name}" on ${this.model.tablename}`
+        );
+      }
+      this.actions.set(action.name, action);
+    }
     const known = new Set(this.columnNames());
     for (const [option, names] of [
       ["listDisplay", this.listDisplayOverride ?? []],
@@ -9559,6 +9586,25 @@ var AdminModel = class {
     const skip = /* @__PURE__ */ new Set([...this.readonlyFields, ...NEVER_EDITABLE]);
     return this.columnNames().filter((name) => !skip.has(name));
   }
+  /**
+   * Return the registered custom actions, in declaration order.
+   *
+   * @returns The actions passed via `actions` (empty when none). The model
+   *   type is erased here, the way {@link AdminSite} erases it when it stores a
+   *   configuration — a registry keyed by slug cannot stay generic.
+   */
+  customActions() {
+    return [...this.actions.values()];
+  }
+  /**
+   * Look a custom action up by name.
+   *
+   * @param name - The action identifier (its submitted form value).
+   * @returns The action, or `null` when nothing matches.
+   */
+  getAction(name) {
+    return this.actions.get(name) ?? null;
+  }
   /**
    * Build a repository for this model bound to a session.
    *
@@ -9600,10 +9646,12 @@ function buildFormFields(admin, options = {}) {
   const columns = adminColumns(admin.model);
   const values = options.values ?? {};
   const errors = options.errors ?? {};
+  const foreignKeys = options.foreignKeyOptions ?? {};
   return admin.editableFieldNames().flatMap((name) => {
     const column6 = columns[name];
     if (column6 === void 0) return [];
-    const spec = widgetForColumn(column6);
+    const related = foreignKeys[name];
+    const spec = related === void 0 ? widgetForColumn(column6) : { widget: "select", step: null, options: related };
     const raw = name in values ? values[name] : literalDefault(column6);
     return [
       {
@@ -9653,7 +9701,7 @@ function coerceValue(column6, widget, raw) {
         throw new Error("Enter valid JSON.");
       }
     case "select": {
-      const allowed = meta.values ?? [];
+      const allowed = kind === "enum" ? meta.values ?? [] : [];
       if (allowed.length > 0 && !allowed.includes(raw)) {
         throw new Error(`Choose one of: ${allowed.join(", ")}.`);
       }
@@ -9701,6 +9749,28 @@ function formatCellValue(value) {
   if (typeof value === "object") return JSON.stringify(value);
   return String(value);
 }
+function foreignKeyFields(admin) {
+  const columns = adminColumns(admin.model);
+  const out = {};
+  for (const name of admin.editableFieldNames()) {
+    const column6 = columns[name];
+    if (column6 === void 0) continue;
+    const table = foreignKeyTable(column6);
+    if (table !== null) out[name] = table;
+  }
+  return out;
+}
+function foreignKeyLabel(admin, row) {
+  for (const field of admin.searchFields) {
+    const value = row[field];
+    if (typeof value === "string" && value !== "") return value;
+  }
+  for (const field of ["name", "title", "email", "label", "reference"]) {
+    const value = row[field];
+    if (typeof value === "string" && value !== "") return value;
+  }
+  return String(row[admin.identityField] ?? "");
+}
 
 // src/admin/auth.ts
 var UserModelAuthBackend = class {
@@ -11838,15 +11908,40 @@ function renderFilter(filter) {
   return `<label><span>${escapeHtml(filter.label)}</span><input type="text" name="${escapeHtml(name)}" value="${escapeHtml(filter.value)}"></label>`;
 }
 function renderListPage(context, view) {
+  const bulk = view.bulkActions.length > 0 && context.session !== null;
+  const checkColumn = bulk ? 1 : 0;
   const headers = view.columns.map((column6) => {
     const state = view.sort[column6];
     if (state === void 0) return `<th>${escapeHtml(column6)}</th>`;
     const arrow = state.active ? state.ascending ? "\u25B2" : "\u25BC" : "\u2195";
     return `<th><a class="tempest-sort${state.active ? " tempest-sort--active" : ""}" href="${escapeHtml(state.url)}"><span>${escapeHtml(column6)}</span><span class="tempest-sort__arrow" aria-hidden="true">${arrow}</span></a></th>`;
   }).join("");
-  const rows = view.rows.length > 0 ? view.rows.map(
-    (row) => `<tr>${row.cells.map((cell) => `<td>${escapeHtml(cell)}</td>`).join("")}<td><a href="${escapeHtml(row.url)}">View</a></td></tr>`
-  ).join("") : `<tr><td colspan="${view.columns.length + 1}">No records.</td></tr>`;
+  const rows = view.rows.length > 0 ? view.rows.map((row) => {
+    const check = bulk ? `<td class="tempest-admin-list__check"><input type="checkbox" name="ids" value="${escapeHtml(row.identity)}" data-row-check aria-label="Select row"></td>` : "";
+    const cells = row.cells.map((cell) => `<td>${escapeHtml(cell)}</td>`).join("");
+    return `<tr>${check}${cells}<td><a href="${escapeHtml(row.url)}">View</a></td></tr>`;
+  }).join("") : `<tr><td colspan="${view.columns.length + 1 + checkColumn}">No records.</td></tr>`;
+  const bulkBar = bulk ? `<form method="post" action="${escapeHtml(view.bulkUrl)}" class="tempest-admin-bulk" onsubmit="return confirm('Apply the selected action to the checked rows?');">
+    <input type="hidden" name="csrf_token" value="${escapeHtml(context.session?.csrfToken)}">
+    <div class="tempest-admin-bulk__bar">
+      <select name="action" aria-label="Bulk action">
+        ${view.bulkActions.map(
+    (action) => `<option value="${escapeHtml(action.value)}">${escapeHtml(action.label)}${action.dangerous ? " \u26A0" : ""}</option>`
+  ).join("")}
+      </select>
+      <button type="submit">Apply to selected</button>
+    </div>` : "";
+  const selectAllScript = bulk ? `<script>
+    (function () {
+      var master = document.querySelector('[data-select-all]');
+      if (!master) return;
+      master.addEventListener('change', function () {
+        document.querySelectorAll('[data-row-check]').forEach(function (box) {
+          box.checked = master.checked;
+        });
+      });
+    })();
+  </script>` : "";
   const hasControls = view.searchable || view.filters.length > 0;
   const body = `<section class="tempest-admin-list">
   <header class="tempest-admin-list__header">
@@ -11861,14 +11956,19 @@ function renderListPage(context, view) {
     </form>
     <div class="tempest-admin-list__actions">
       ${view.newUrl !== null ? `<a class="tempest-admin-list__new" href="${escapeHtml(view.newUrl)}">+ New</a>` : ""}
+      <a href="${escapeHtml(view.exportCsvUrl)}">Export CSV</a>
+      <a href="${escapeHtml(view.exportJsonUrl)}">Export JSON</a>
     </div>
   </div>
+  ${bulkBar}
   <div class="tempest-admin-table-wrap">
     <table class="tempest-admin-list__table">
-      <thead><tr>${headers}<th>Actions</th></tr></thead>
+      <thead><tr>${bulk ? '<th class="tempest-admin-list__check"><input type="checkbox" data-select-all aria-label="Select all"></th>' : ""}${headers}<th>Actions</th></tr></thead>
       <tbody>${rows}</tbody>
     </table>
   </div>
+  ${bulk ? "</form>" : ""}
+  ${selectAllScript}
   ${view.pages > 1 ? `<nav class="tempest-admin-list__pagination" aria-label="Pagination">
     ${view.prevUrl !== null ? `<a href="${escapeHtml(view.prevUrl)}">\u2190 Prev</a>` : ""}
     <span>Page ${escapeHtml(view.page)} of ${escapeHtml(view.pages)}</span>
@@ -11962,11 +12062,16 @@ function renderFormPage(context, view) {
   return renderLayout(context, `${heading} \xB7 ${context.site.title}`, body);
 }
 var logger2 = new JSONLogger("tempest_express_sdk.admin.router");
+var FK_OPTION_CAP = 1e3;
+var FLASH_MAX_LENGTH = 300;
 var FLASH_MESSAGES = {
   created: { text: "Record created.", level: "success" },
   updated: { text: "Record updated.", level: "success" },
   deleted: { text: "Record deleted.", level: "success" }
 };
+async function runCustomAction(action, context) {
+  return await action.handler(context) ?? null;
+}
 function queryString(value) {
   if (typeof value === "string") return value.trim();
   if (Array.isArray(value) && typeof value[0] === "string") return value[0].trim();
@@ -11984,6 +12089,7 @@ function makeAdminRouter(site, options) {
   const prefix = (options.prefix ?? "/admin").replace(/\/$/, "");
   const theme = resolveAdminTheme(site.theme);
   const showMetrics = options.showMetrics ?? true;
+  const exportMaxRows = options.exportMaxRows ?? 5e3;
   const sessions = new AdminSessionStore({
     secret: options.secretKey,
     ...options.cookieName === void 0 ? {} : { cookieName: options.cookieName },
@@ -12007,8 +12113,17 @@ function makeAdminRouter(site, options) {
     messages: flashFor(req)
   });
   const flashFor = (req) => {
-    const message = FLASH_MESSAGES[queryString(req.query.ok)];
-    return message === void 0 ? [] : [message];
+    const fixed = FLASH_MESSAGES[queryString(req.query.ok)];
+    if (fixed !== void 0) return [fixed];
+    const text = queryString(req.query.flash);
+    if (text === "") return [];
+    const level = queryString(req.query.level);
+    return [
+      {
+        text: text.slice(0, FLASH_MAX_LENGTH),
+        level: level === "error" || level === "warning" ? level : "success"
+      }
+    ];
   };
   const html = (res, body, status = 200) => {
     res.status(status).type("html").send(body);
@@ -12044,7 +12159,7 @@ function makeAdminRouter(site, options) {
       res.redirect(`${prefix}/mfa`);
       return null;
     }
-    return { session, dbSession };
+    return { session, dbSession, principal };
   };
   const resolveAdmin = (req, res, state) => {
     const admin = site.get(String(req.params.slug));
@@ -12200,7 +12315,9 @@ function makeAdminRouter(site, options) {
         renderFormPage(context(req, state.session), {
           mode: "create",
           title: admin.verboseName(),
-          fields: buildFormFields(admin),
+          fields: buildFormFields(admin, {
+            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession)
+          }),
           actionUrl: `${prefix}/m/${admin.slug()}/new`,
           backUrl: `${prefix}/m/${admin.slug()}`,
           error: null
@@ -12222,13 +12339,18 @@ function makeAdminRouter(site, options) {
       if (!checkCsrf(req, res, state)) return;
       const body = req.body;
       const parsed = parseFormBody(admin, body);
+      const foreignKeyOptions = await foreignKeyOptionsFor(admin, state.dbSession);
       const rerender = (error, status) => {
         html(
           res,
           renderFormPage(context(req, state.session), {
             mode: "create",
             title: admin.verboseName(),
-            fields: buildFormFields(admin, { values: body, errors: parsed.errors }),
+            fields: buildFormFields(admin, {
+              values: body,
+              errors: parsed.errors,
+              foreignKeyOptions
+            }),
             actionUrl: `${prefix}/m/${admin.slug()}/new`,
             backUrl: `${prefix}/m/${admin.slug()}`,
             error
@@ -12249,6 +12371,106 @@ function makeAdminRouter(site, options) {
       res.redirect(`${prefix}/m/${admin.slug()}?ok=created`);
     })
   );
+  router.get(
+    `${prefix}/m/:slug/export.:format`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      const format = String(req.params.format);
+      if (format !== "csv" && format !== "json") {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      const query = await resolveListQuery(req, admin, state.dbSession);
+      const result = await admin.repository(state.dbSession).paginate({
+        page: 1,
+        pageSize: exportMaxRows,
+        ...query.orderBy === void 0 ? {} : { orderBy: query.orderBy },
+        ascending: query.ascending,
+        ...query.where === void 0 ? {} : { filters: query.where }
+      });
+      const columns = admin.listDisplayNames();
+      const rows = result.items;
+      const payload = format === "csv" ? toCsv(columns, rows) : toJson(columns, rows);
+      res.status(200).type(format === "csv" ? "text/csv; charset=utf-8" : "application/json").set("content-disposition", `attachment; filename="${admin.slug()}.${format}"`).send(payload);
+    })
+  );
+  router.post(
+    `${prefix}/m/:slug/bulk`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      if (!checkCsrf(req, res, state)) return;
+      const body = req.body;
+      const action = typeof body.action === "string" ? body.action : "";
+      const raw = body.ids;
+      const ids = (Array.isArray(raw) ? raw : raw === void 0 ? [] : [raw]).filter((value) => typeof value === "string").filter((value) => value !== "");
+      const listUrl = `${prefix}/m/${admin.slug()}`;
+      const back = (message, level) => {
+        res.redirect(`${listUrl}?${buildQuery({ flash: message, level })}`);
+      };
+      if (ids.length === 0) {
+        back("No rows were selected.", "warning");
+        return;
+      }
+      if (!bulkActionsFor(admin).some((option) => option.value === action)) {
+        html(res, renderNotFound(context(req, state.session)), 400);
+        return;
+      }
+      const repository = admin.repository(state.dbSession);
+      const scope = { [admin.identityField]: { in: ids } };
+      if (action.startsWith("custom:")) {
+        const custom = admin.getAction(action.slice("custom:".length));
+        if (custom === null) {
+          html(res, renderNotFound(context(req, state.session)), 400);
+          return;
+        }
+        let result;
+        try {
+          result = await runCustomAction(custom, {
+            ids,
+            repository,
+            dbSession: state.dbSession,
+            request: req,
+            session: state.session,
+            principal: state.principal
+          });
+        } catch (error) {
+          logger2.error("Admin action failed", {
+            slug: admin.slug(),
+            action: custom.name,
+            error: error instanceof Error ? error.message : String(error)
+          });
+          back(
+            `${custom.label} failed: ${error instanceof Error ? error.message : String(error)}`,
+            "error"
+          );
+          return;
+        }
+        if (result === null) {
+          res.redirect(listUrl);
+          return;
+        }
+        back(result.message, result.category ?? "success");
+        return;
+      }
+      if (action === "delete") {
+        const removed = await repository.delete(scope);
+        back(`Deleted ${removed} record${removed === 1 ? "" : "s"}.`, "success");
+        return;
+      }
+      const active = action === "activate";
+      const changed = await repository.update(scope, { isActive: active });
+      back(
+        `${active ? "Activated" : "Deactivated"} ${changed} record${changed === 1 ? "" : "s"}.`,
+        "success"
+      );
+    })
+  );
   router.get(
     `${prefix}/m/:slug/:identity`,
     guarded(async (req, res) => {
@@ -12293,7 +12515,10 @@ function makeAdminRouter(site, options) {
         renderFormPage(context(req, state.session), {
           mode: "edit",
           title: admin.verboseName(),
-          fields: buildFormFields(admin, { values: row }),
+          fields: buildFormFields(admin, {
+            values: row,
+            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession)
+          }),
           actionUrl: `${prefix}/m/${admin.slug()}/${identity}/edit`,
           backUrl: `${prefix}/m/${admin.slug()}/${identity}`,
           error: null
@@ -12316,13 +12541,18 @@ function makeAdminRouter(site, options) {
       if (!checkCsrf(req, res, state)) return;
       const body = req.body;
       const parsed = parseFormBody(admin, body);
+      const foreignKeyOptions = await foreignKeyOptionsFor(admin, state.dbSession);
       const rerender = (error, status) => {
         html(
           res,
           renderFormPage(context(req, state.session), {
             mode: "edit",
             title: admin.verboseName(),
-            fields: buildFormFields(admin, { values: body, errors: parsed.errors }),
+            fields: buildFormFields(admin, {
+              values: body,
+              errors: parsed.errors,
+              foreignKeyOptions
+            }),
             actionUrl: `${prefix}/m/${admin.slug()}/${identity}/edit`,
             backUrl: `${prefix}/m/${admin.slug()}/${identity}`,
             error
@@ -12369,8 +12599,69 @@ function makeAdminRouter(site, options) {
   }
   async function renderList(req, admin, state) {
     const columns = adminColumns(admin.model);
-    const search = queryString(req.query.q);
+    const query = await resolveListQuery(req, admin, state.dbSession);
     const page2 = Math.max(1, Number.parseInt(queryString(req.query.page), 10) || 1);
+    const result = await admin.repository(state.dbSession).paginate({
+      page: page2,
+      pageSize: admin.pageSize,
+      ...query.orderBy === void 0 ? {} : { orderBy: query.orderBy },
+      ascending: query.ascending,
+      ...query.where === void 0 ? {} : { filters: query.where }
+    });
+    const displayed = admin.listDisplayNames();
+    const sort = {};
+    for (const column6 of displayed) {
+      if (!(column6 in columns)) continue;
+      const active = (query.sortColumn ?? admin.orderKey) === column6;
+      const nextAscending = active ? !query.ascending : true;
+      sort[column6] = {
+        url: `?${buildQuery({
+          ...query.baseQuery,
+          sort: column6,
+          dir: nextAscending ? "asc" : "desc"
+        })}`,
+        active,
+        ascending: query.ascending
+      };
+    }
+    const sortParams = {
+      sort: query.sortColumn ?? void 0,
+      dir: query.sortColumn === null ? void 0 : query.ascending ? "asc" : "desc"
+    };
+    const pageUrl = (target) => `?${buildQuery({ ...query.baseQuery, ...sortParams, page: target })}`;
+    const exportQuery = buildQuery({ ...query.baseQuery, ...sortParams });
+    const exportUrl = (format) => `${prefix}/m/${admin.slug()}/export.${format}${exportQuery === "" ? "" : `?${exportQuery}`}`;
+    const view = {
+      title: admin.verboseNamePlural(),
+      columns: displayed,
+      rows: result.items.map((row) => {
+        const identity = String(row[admin.identityField]);
+        return {
+          identity,
+          cells: displayed.map((column6) => formatCellValue(row[column6])),
+          url: `${prefix}/m/${admin.slug()}/${identity}`
+        };
+      }),
+      total: result.total,
+      page: result.page,
+      pages: result.pages,
+      prevUrl: result.page > 1 ? pageUrl(result.page - 1) : null,
+      nextUrl: result.page < result.pages ? pageUrl(result.page + 1) : null,
+      searchable: query.searchable.length > 0,
+      searchValue: query.search,
+      filters: query.filterViews,
+      sort,
+      newUrl: admin.canCreate ? `${prefix}/m/${admin.slug()}/new` : null,
+      bulkActions: bulkActionsFor(admin),
+      bulkUrl: `${prefix}/m/${admin.slug()}/bulk`,
+      exportCsvUrl: exportUrl("csv"),
+      exportJsonUrl: exportUrl("json")
+    };
+    return renderListPage(context(req, state.session), view);
+  }
+  async function resolveListQuery(req, admin, dbSession) {
+    const columns = adminColumns(admin.model);
+    const search = queryString(req.query.q);
     const sortField = queryString(req.query.sort);
     const sortColumn = sortField in columns ? sortField : null;
     const ascending = sortColumn === null ? admin.orderAscending : queryString(req.query.dir) !== "desc";
@@ -12398,6 +12689,8 @@ function makeAdminRouter(site, options) {
         });
         continue;
       }
+      const related = await relatedOptions(column6, dbSession);
+      const options2 = related ?? spec.options;
       const value = queryString(req.query[`filter_${field}`]);
       if (value !== "") {
         conditions.push({
@@ -12407,11 +12700,11 @@ function makeAdminRouter(site, options) {
       filterViews.push({
         field,
         label: humanizeField(field),
-        kind: spec.kind,
+        kind: related === null ? spec.kind : "select",
         value,
         valueFrom: "",
         valueTo: "",
-        options: spec.options.map((option) => ({
+        options: options2.map((option) => ({
           value: option.value,
           label: option.label,
           selected: option.value === value
@@ -12427,72 +12720,98 @@ function makeAdminRouter(site, options) {
         or(...searchable.map((field) => ({ [field]: { ilike: `%${search}%` } })))
       );
     }
-    const where = conditions.length === 0 ? void 0 : and(...conditions);
-    const orderBy = sortColumn ?? admin.orderKey ?? void 0;
-    const result = await admin.repository(state.dbSession).paginate({
-      page: page2,
-      pageSize: admin.pageSize,
-      ...orderBy === void 0 ? {} : { orderBy },
-      ascending,
-      ...where === void 0 ? {} : { filters: where }
-    });
-    const displayed = admin.listDisplayNames();
     const baseQuery = { q: search };
-    for (const view2 of filterViews) {
-      if (view2.kind === "daterange") {
-        baseQuery[`filter_${view2.field}_from`] = view2.valueFrom;
-        baseQuery[`filter_${view2.field}_to`] = view2.valueTo;
+    for (const view of filterViews) {
+      if (view.kind === "daterange") {
+        baseQuery[`filter_${view.field}_from`] = view.valueFrom;
+        baseQuery[`filter_${view.field}_to`] = view.valueTo;
       } else {
-        baseQuery[`filter_${view2.field}`] = view2.value;
+        baseQuery[`filter_${view.field}`] = view.value;
       }
     }
-    const sort = {};
-    for (const column6 of displayed) {
-      if (!(column6 in columns)) continue;
-      const active = (sortColumn ?? admin.orderKey) === column6;
-      const nextAscending = active ? !ascending : true;
-      sort[column6] = {
-        url: `?${buildQuery({
-          ...baseQuery,
-          sort: column6,
-          dir: nextAscending ? "asc" : "desc"
-        })}`,
-        active,
-        ascending
-      };
-    }
-    const pageUrl = (target) => `?${buildQuery({
-      ...baseQuery,
-      sort: sortColumn ?? void 0,
-      dir: sortColumn === null ? void 0 : ascending ? "asc" : "desc",
-      page: target
-    })}`;
-    const view = {
-      title: admin.verboseNamePlural(),
-      columns: displayed,
-      rows: result.items.map((row) => {
-        const identity = String(row[admin.identityField]);
-        return {
-          identity,
-          cells: displayed.map((column6) => formatCellValue(row[column6])),
-          url: `${prefix}/m/${admin.slug()}/${identity}`
-        };
-      }),
-      total: result.total,
-      page: result.page,
-      pages: result.pages,
-      prevUrl: result.page > 1 ? pageUrl(result.page - 1) : null,
-      nextUrl: result.page < result.pages ? pageUrl(result.page + 1) : null,
-      searchable: searchable.length > 0,
-      searchValue: search,
-      filters: filterViews,
-      sort,
-      newUrl: admin.canCreate ? `${prefix}/m/${admin.slug()}/new` : null
+    return {
+      search,
+      searchable,
+      where: conditions.length === 0 ? void 0 : and(...conditions),
+      orderBy: sortColumn ?? admin.orderKey ?? void 0,
+      ascending,
+      sortColumn,
+      filterViews,
+      baseQuery
     };
-    return renderListPage(context(req, state.session), view);
+  }
+  async function relatedOptions(column6, dbSession) {
+    const table = foreignKeyTable(column6);
+    if (table === null) return null;
+    const referenced = site.get(table);
+    if (referenced === null) return null;
+    const rows = await referenced.repository(dbSession).list();
+    return rows.slice(0, FK_OPTION_CAP).map((row) => ({
+      value: String(row[referenced.identityField]),
+      label: foreignKeyLabel(referenced, row)
+    }));
+  }
+  async function foreignKeyOptionsFor(admin, dbSession) {
+    const columns = adminColumns(admin.model);
+    const options2 = {};
+    for (const field of Object.keys(foreignKeyFields(admin))) {
+      const column6 = columns[field];
+      if (column6 === void 0) continue;
+      const related = await relatedOptions(column6, dbSession);
+      if (related !== null) options2[field] = related;
+    }
+    return options2;
   }
   return router;
 }
+function bulkActionsFor(admin) {
+  const actions = [];
+  const hasActiveFlag = "isActive" in adminColumns(admin.model);
+  if (admin.canEdit && hasActiveFlag) {
+    actions.push({ value: "activate", label: "Activate", dangerous: false });
+    actions.push({ value: "deactivate", label: "Deactivate", dangerous: false });
+  }
+  if (admin.canDelete) {
+    actions.push({ value: "delete", label: "Delete", dangerous: true });
+  }
+  for (const action of admin.customActions()) {
+    actions.push({
+      value: `custom:${action.name}`,
+      label: action.label,
+      dangerous: action.dangerous
+    });
+  }
+  return actions;
+}
+function exportValue(value) {
+  if (value instanceof Date) return value.toISOString();
+  if (typeof value === "bigint") return value.toString();
+  if (value instanceof Uint8Array) return Buffer.from(value).toString("base64");
+  return value;
+}
+function csvField(value) {
+  if (value === null || value === void 0) return "";
+  const text = typeof value === "object" ? JSON.stringify(value) : String(value);
+  if (/[",\r\n]/.test(text)) return `"${text.replace(/"/g, '""')}"`;
+  return text;
+}
+function toCsv(columns, rows) {
+  const lines = [columns.map(csvField).join(",")];
+  for (const row of rows) {
+    lines.push(columns.map((column6) => csvField(exportValue(row[column6]))).join(","));
+  }
+  return `${lines.join("\r\n")}\r
+`;
+}
+function toJson(columns, rows) {
+  return JSON.stringify(
+    rows.map(
+      (row) => Object.fromEntries(columns.map((column6) => [column6, exportValue(row[column6])]))
+    ),
+    null,
+    2
+  );
+}
 function describeWriteFailure(admin, error) {
   const detail = error instanceof Error ? error.message : String(error);
   return `The database refused this ${admin.verboseName().toLowerCase()}: ${detail}`;
@@ -14496,6 +14815,6 @@ async function withTestDatabase(models, fn) {
   }
 }
 
-export { ADMIN_CSS, ActivationService, AdminJsonSite, AdminModel, AdminSessionStore, AdminSite, AppException, AttemptThrottle, AuditAction, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_DOCS_FAVICON, DEFAULT_LOCALE, EmailProvider, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, HTTPClient, HTTP_500_LOG_FILE, HTTP_500_MARKER, HttpMetrics, IDEMPOTENCY_HEADER, InvalidTokenException, JSONLogger, JWTUtils, LEVEL_LOG_FILES, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MessagingHub, MetricsUtils, MfaService, NotFoundException, OAuthError, OIDCProvider, OutboxRelay, OutboxStatus, PHONE_BR_PATTERN, PasswordResetService, REDOC_CDN_URL, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisIdempotencyStore, RedisRateLimitStore, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, S3UploadStorage, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TenantScopedRepository, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, UserModelAuthBackend, UserTokenPurpose, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WebhookSignatureVerifier, WhatsAppProvider, activationSchema, addLogSink, adminColumns, adminThemeCss, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildFormFields, buildPaginationLinkHeader, cached2 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, csrfTokenMatches, cursorPaginationFilterSchema, cursorPaginationSchema, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, envList, escapeHtml, filterForColumn, formatCellValue, formatFieldValue, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, humanizeField, idempotencyMiddleware, inboundMessageSchema, isColumnOptional, isSearchableColumn, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, listStates, logEntrySchema, logSettingsShape, loginSchema, makeAdminJsonRouter, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, parseFormBody, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderDashboardPage, renderDetailPage, renderFormPage, renderLayout, renderListPage, renderLoginPage, renderMfaPage, renderPasswordResetFormPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveAdminTheme, resolveDownloadPath, resolveRedocBundle, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, widgetForColumn, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };
+export { ADMIN_CSS, ActivationService, AdminJsonSite, AdminModel, AdminSessionStore, AdminSite, AppException, AttemptThrottle, AuditAction, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_DOCS_FAVICON, DEFAULT_LOCALE, EmailProvider, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, HTTPClient, HTTP_500_LOG_FILE, HTTP_500_MARKER, HttpMetrics, IDEMPOTENCY_HEADER, InvalidTokenException, JSONLogger, JWTUtils, LEVEL_LOG_FILES, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MessagingHub, MetricsUtils, MfaService, NotFoundException, OAuthError, OIDCProvider, OutboxRelay, OutboxStatus, PHONE_BR_PATTERN, PasswordResetService, REDOC_CDN_URL, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisIdempotencyStore, RedisRateLimitStore, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, S3UploadStorage, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TenantScopedRepository, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, UserModelAuthBackend, UserTokenPurpose, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WebhookSignatureVerifier, WhatsAppProvider, activationSchema, addLogSink, adminAction, adminColumns, adminThemeCss, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildFormFields, buildPaginationLinkHeader, cached2 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, csrfTokenMatches, cursorPaginationFilterSchema, cursorPaginationSchema, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, envList, escapeHtml, filterForColumn, foreignKeyFields, foreignKeyLabel, foreignKeyTable, formatCellValue, formatFieldValue, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, humanizeField, idempotencyMiddleware, inboundMessageSchema, isColumnOptional, isSearchableColumn, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, listStates, logEntrySchema, logSettingsShape, loginSchema, makeAdminJsonRouter, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, parseFormBody, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderDashboardPage, renderDetailPage, renderFormPage, renderLayout, renderListPage, renderLoginPage, renderMfaPage, renderPasswordResetFormPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveAdminTheme, resolveDownloadPath, resolveRedocBundle, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, widgetForColumn, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map