tempest-express-sdk 0.26.0 → 0.27.0

package/dist/index.cjs

@@ -9498,6 +9498,85 @@ function adminAction(options, handler) {
   };
 }
 
+// src/admin/multipart.ts
+var BUSBOY_HINT = "The admin's upload and CSV-import screens need the optional peer `busboy`. Install it with: npm install busboy";
+async function loadBusboy() {
+  try {
+    const module = await import('busboy');
+    return module.default ?? module;
+  } catch {
+    throw new Error(BUSBOY_HINT);
+  }
+}
+var MultipartLimitError = class extends Error {
+  /**
+   * @param message - The operator-facing explanation.
+   */
+  constructor(message) {
+    super(message);
+    this.name = "MultipartLimitError";
+  }
+};
+async function parseMultipart(req, options = {}) {
+  const maxFileBytes = options.maxFileBytes ?? 10 * 1024 * 1024;
+  const maxFiles = options.maxFiles ?? 10;
+  const busboy = await loadBusboy();
+  return await new Promise((resolve, reject) => {
+    const fields = {};
+    const files = [];
+    let settled = false;
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      reject(error);
+    };
+    const parser = busboy({
+      headers: req.headers,
+      limits: { fileSize: maxFileBytes, files: maxFiles }
+    });
+    parser.on("field", ((name, value) => {
+      fields[name] = value;
+    }));
+    parser.on("file", ((name, stream, info) => {
+      const chunks = [];
+      stream.on("data", ((chunk) => chunks.push(chunk)));
+      stream.on("limit", () => {
+        fail(
+          new MultipartLimitError(
+            `The file is larger than the ${Math.floor(maxFileBytes / 1024 / 1024)} MB limit.`
+          )
+        );
+      });
+      stream.on("end", () => {
+        const data = Buffer.concat(chunks);
+        const filename = (info.filename ?? "").split(/[/\\]/).pop() ?? "";
+        if (filename === "" || data.length === 0) return;
+        files.push({
+          field: name,
+          filename,
+          contentType: info.mimeType ?? "application/octet-stream",
+          data
+        });
+      });
+    }));
+    parser.on("filesLimit", () => {
+      fail(new MultipartLimitError(`At most ${maxFiles} files can be uploaded at once.`));
+    });
+    parser.on("error", ((error) => {
+      fail(error instanceof Error ? error : new Error(String(error)));
+    }));
+    parser.on("close", () => {
+      if (settled) return;
+      settled = true;
+      resolve({ fields, files });
+    });
+    req.pipe(parser);
+  });
+}
+function isMultipart(req) {
+  return (req.header("content-type") ?? "").toLowerCase().startsWith("multipart/form-data");
+}
+
 // src/admin/columns.ts
 function humanizeField(name) {
   return name.replace(/[_-]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").trim().split(/\s+/).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
@@ -9591,6 +9670,8 @@ var NEVER_EDITABLE = [
   "id",
   "createdAt",
   "updatedAt",
+  "createdBy",
+  "updatedBy",
   "hashedPassword"
 ];
 var NEVER_LISTED = ["hashedPassword"];
@@ -9627,6 +9708,14 @@ var AdminModel = class {
   auditModel;
   /** Saved list-view presets, in declaration order. */
   lenses;
+  /** Columns rendered as file inputs. */
+  uploadFields;
+  /** Backend persisting uploaded files, or `null`. */
+  uploadStorage;
+  /** Whether the CSV import page is exposed. */
+  canImport;
+  /** Foreign-key columns rendered as a typed search box. */
+  autocompleteFields;
   actions = /* @__PURE__ */ new Map();
   slugOverride;
   listDisplayOverride;
@@ -9654,6 +9743,15 @@ var AdminModel = class {
     this.canDelete = options.canDelete ?? true;
     this.auditModel = options.auditModel ?? null;
     this.lenses = [...options.lenses ?? []];
+    this.uploadFields = [...options.uploadFields ?? []];
+    this.uploadStorage = options.uploadStorage ?? null;
+    this.canImport = options.canImport ?? false;
+    this.autocompleteFields = [...options.autocompleteFields ?? []];
+    if (this.uploadFields.length > 0 && this.uploadStorage === null) {
+      throw new Error(
+        `AdminModel(${this.model.tablename}).uploadFields requires an uploadStorage (e.g. LocalUploadStorage / S3UploadStorage) \u2014 without one there is nowhere to write the file.`
+      );
+    }
     for (const action of options.actions ?? []) {
       if (this.actions.has(action.name)) {
         throw new Error(
@@ -9668,7 +9766,9 @@ var AdminModel = class {
       ["listFilter", this.listFilter],
       ["searchFields", this.searchFields],
       ["readonlyFields", this.readonlyFields],
-      ["identityField", [this.identityField]]
+      ["identityField", [this.identityField]],
+      ["uploadFields", this.uploadFields],
+      ["autocompleteFields", this.autocompleteFields]
     ]) {
       for (const name of names) {
         if (!known.has(name)) {
@@ -9850,11 +9950,15 @@ function buildFormFields(admin, options = {}) {
   const values = options.values ?? {};
   const errors = options.errors ?? {};
   const foreignKeys = options.foreignKeyOptions ?? {};
+  const autocompleteUrls = options.autocompleteUrls ?? {};
+  const autocompleteLabels = options.autocompleteLabels ?? {};
+  const uploads = new Set(admin.uploadFields);
   return admin.editableFieldNames().flatMap((name) => {
     const column6 = columns[name];
     if (column6 === void 0) return [];
     const related = foreignKeys[name];
-    const spec = related === void 0 ? widgetForColumn(column6) : { widget: "select", step: null, options: related };
+    const autocompleteUrl = autocompleteUrls[name];
+    const spec = uploads.has(name) ? { widget: "file", step: null, options: [] } : autocompleteUrl !== void 0 ? { widget: "autocomplete", step: null, options: [] } : related === void 0 ? widgetForColumn(column6) : { widget: "select", step: null, options: related };
     const raw = name in values ? values[name] : literalDefault(column6);
     return [
       {
@@ -9866,7 +9970,9 @@ function buildFormFields(admin, options = {}) {
         checked: spec.widget === "checkbox" && toBoolean(raw),
         step: spec.step,
         options: spec.options,
-        error: errors[name] ?? null
+        error: errors[name] ?? null,
+        autocompleteUrl: autocompleteUrl ?? null,
+        displayLabel: autocompleteLabels[name] ?? ""
       }
     ];
   });
@@ -9914,13 +10020,15 @@ function coerceValue(column6, widget, raw) {
       return raw;
   }
 }
-function parseFormBody(admin, body) {
+function parseFormBody(admin, body, options = {}) {
   const columns = adminColumns(admin.model);
   const data = {};
   const errors = {};
+  const uploads = options.uploadsAsText === true ? /* @__PURE__ */ new Set() : new Set(admin.uploadFields);
   for (const name of admin.editableFieldNames()) {
     const column6 = columns[name];
     if (column6 === void 0) continue;
+    if (uploads.has(name)) continue;
     const { widget } = widgetForColumn(column6);
     if (widget === "checkbox") {
       data[name] = toBoolean(body[name]);
@@ -12206,6 +12314,7 @@ function renderListPage(context, view) {
     </form>
     <div class="tempest-admin-list__actions">
       ${view.newUrl !== null ? `<a class="tempest-admin-list__new" href="${escapeHtml(view.newUrl)}">+ New</a>` : ""}
+      ${view.importUrl !== null ? `<a href="${escapeHtml(view.importUrl)}">Import CSV</a>` : ""}
       <a href="${escapeHtml(view.exportCsvUrl)}">Export CSV</a>
       <a href="${escapeHtml(view.exportJsonUrl)}">Export JSON</a>
     </div>
@@ -12305,6 +12414,18 @@ function renderFormField(field) {
       control = `<label><span>${label}${field.required ? " *" : ""}</span><select name="${name}"${required}>${blank}${options}</select></label>`;
       break;
     }
+    case "file":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="file" name="${name}"${required}></label>${field.value === "" ? "" : `<small class="tempest-admin-form__hint">Current: ${value} \u2014 choose a file to replace it.</small>`}`;
+      break;
+    case "autocomplete":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span>
+        <div class="tempest-admin-ac" data-ac data-ac-url="${escapeHtml(field.autocompleteUrl)}">
+          <input type="text" class="tempest-admin-ac__search" value="${escapeHtml(field.displayLabel)}" placeholder="Search\u2026" autocomplete="off" data-ac-search>
+          <input type="hidden" name="${name}" value="${value}"${required} data-ac-value>
+          <ul class="tempest-admin-ac__results" data-ac-results hidden></ul>
+        </div>
+      </label>`;
+      break;
     case "number":
       control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="number" name="${name}" value="${value}"${field.step !== null ? ` step="${escapeHtml(field.step)}"` : ""}${required}></label>`;
       break;
@@ -12332,7 +12453,7 @@ function renderFormPage(context, view) {
     <a href="${escapeHtml(view.backUrl)}">\u2190 Back</a>
   </header>
   ${view.error !== null ? `<p class="tempest-admin-form__error">${escapeHtml(view.error)}</p>` : ""}
-  <form method="post" action="${escapeHtml(view.actionUrl)}" class="tempest-admin-form__form">
+  <form method="post" action="${escapeHtml(view.actionUrl)}" class="tempest-admin-form__form"${view.fields.some((field) => field.widget === "file") ? ' enctype="multipart/form-data"' : ""}>
     <input type="hidden" name="csrf_token" value="${escapeHtml(context.session.csrfToken)}">
     ${view.fields.map(renderFormField).join("")}
     <div class="tempest-admin-form__actions">
@@ -12340,10 +12461,97 @@ function renderFormPage(context, view) {
       <a href="${escapeHtml(view.backUrl)}" class="tempest-admin-form__cancel">Cancel</a>
     </div>
   </form>
+  ${view.fields.some((field) => field.widget === "autocomplete") ? AUTOCOMPLETE_SCRIPT : ""}
 </section>`;
   return renderLayout(context, `${heading} \xB7 ${context.site.title}`, body);
 }
+function renderImportPage(context, view) {
+  if (context.session === null) throw new Error("The import page requires a session");
+  const summary = view.created === null ? "" : `<p class="tempest-admin-import__summary">Created ${escapeHtml(view.created)} record${view.created === 1 ? "" : "s"}.</p>`;
+  const failures = view.rowErrors.length > 0 ? `<table class="tempest-admin-import__errors"><thead><tr><th>Row</th><th>Problem</th></tr></thead><tbody>${view.rowErrors.map(
+    (failure) => `<tr><td>${escapeHtml(failure.row)}</td><td>${escapeHtml(failure.message)}</td></tr>`
+  ).join("")}</tbody></table>` : "";
+  const body = `<section class="tempest-admin-import">
+  <header class="tempest-admin-detail__header">
+    <h1>Import ${escapeHtml(view.title)}</h1>
+    <a href="${escapeHtml(view.backUrl)}">\u2190 Back</a>
+  </header>
+  ${view.error !== null ? `<p class="tempest-admin-form__error">${escapeHtml(view.error)}</p>` : ""}
+  ${summary}
+  ${failures}
+  <form method="post" action="${escapeHtml(view.actionUrl)}" class="tempest-admin-form__form" enctype="multipart/form-data">
+    <input type="hidden" name="csrf_token" value="${escapeHtml(context.session.csrfToken)}">
+    <div class="tempest-admin-form__field">
+      <label>
+        <span>CSV file *</span>
+        <input type="file" name="file" accept=".csv,text/csv" required>
+      </label>
+      <small class="tempest-admin-form__hint">
+        UTF-8, comma-separated, with a header row. Recognised columns:
+        <code>${escapeHtml(view.columns.join(", "))}</code>. Unknown columns are ignored.
+      </small>
+    </div>
+    <div class="tempest-admin-form__actions">
+      <button type="submit">Import</button>
+      <a href="${escapeHtml(view.backUrl)}" class="tempest-admin-form__cancel">Cancel</a>
+    </div>
+  </form>
+</section>`;
+  return renderLayout(context, `Import ${view.title} \xB7 ${context.site.title}`, body);
+}
+var AUTOCOMPLETE_SCRIPT = `<script>
+(function () {
+  document.querySelectorAll("[data-ac]").forEach(function (box) {
+    var search = box.querySelector("[data-ac-search]");
+    var value = box.querySelector("[data-ac-value]");
+    var results = box.querySelector("[data-ac-results]");
+    var url = box.getAttribute("data-ac-url");
+    var timer = null;
+
+    function close() {
+      results.hidden = true;
+      results.innerHTML = "";
+    }
+
+    function pick(option) {
+      value.value = option.value;
+      search.value = option.label;
+      close();
+    }
+
+    function run() {
+      var term = search.value.trim();
+      fetch(url + "?q=" + encodeURIComponent(term), { credentials: "same-origin" })
+        .then(function (response) { return response.ok ? response.json() : { options: [] }; })
+        .then(function (payload) {
+          results.innerHTML = "";
+          (payload.options || []).forEach(function (option) {
+            var item = document.createElement("li");
+            item.textContent = option.label;
+            item.setAttribute("role", "option");
+            item.addEventListener("mousedown", function (event) {
+              event.preventDefault();
+              pick(option);
+            });
+            results.appendChild(item);
+          });
+          results.hidden = results.children.length === 0;
+        })
+        .catch(close);
+    }
+
+    search.addEventListener("input", function () {
+      value.value = "";
+      window.clearTimeout(timer);
+      timer = window.setTimeout(run, 250);
+    });
+    search.addEventListener("focus", run);
+    search.addEventListener("blur", function () { window.setTimeout(close, 150); });
+  });
+})();
+</script>`;
 var logger2 = new JSONLogger("tempest_express_sdk.admin.router");
+var AUTOCOMPLETE_LIMIT = 20;
 var AUDIT_HISTORY_LIMIT = 50;
 var FK_OPTION_CAP = 1e3;
 var FLASH_MAX_LENGTH = 300;
@@ -12373,6 +12581,7 @@ function makeAdminRouter(site, options) {
   const theme = resolveAdminTheme(site.theme);
   const showMetrics = options.showMetrics ?? true;
   const exportMaxRows = options.exportMaxRows ?? 5e3;
+  const maxUploadBytes = options.maxUploadBytes ?? 10 * 1024 * 1024;
   const sessions = new AdminSessionStore({
     secret: options.secretKey,
     ...options.cookieName === void 0 ? {} : { cookieName: options.cookieName },
@@ -12630,7 +12839,8 @@ function makeAdminRouter(site, options) {
           mode: "create",
           title: admin.verboseName(),
           fields: buildFormFields(admin, {
-            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession)
+            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession),
+            autocompleteUrls: autocompleteUrlsFor(admin)
           }),
           actionUrl: `${prefix}/m/${admin.slug()}/new`,
           backUrl: `${prefix}/m/${admin.slug()}`,
@@ -12650,10 +12860,28 @@ function makeAdminRouter(site, options) {
         html(res, renderNotFound(context(req, state.session, state.visible)), 404);
         return;
       }
-      if (!checkCsrf(req, res, state)) return;
-      const body = req.body;
+      let uploadError = null;
+      let submission;
+      try {
+        submission = await readSubmission(req);
+      } catch (error) {
+        if (!(error instanceof MultipartLimitError)) throw error;
+        submission = { fields: {}, files: [] };
+        uploadError = error.message;
+      }
+      const body = submission.fields;
+      if (uploadError === null && !csrfTokenMatches(state.session, body.csrf_token)) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 403);
+        return;
+      }
       const parsed = parseFormBody(admin, body);
+      await applyUploads(admin, parsed.data, parsed.errors, submission.files, true);
       const foreignKeyOptions = await foreignKeyOptionsFor(admin, state.dbSession);
+      const autocompleteLabels = await autocompleteLabelsFor(
+        admin,
+        body,
+        state.dbSession
+      );
       const rerender = (error, status) => {
         html(
           res,
@@ -12663,7 +12891,9 @@ function makeAdminRouter(site, options) {
             fields: buildFormFields(admin, {
               values: body,
               errors: parsed.errors,
-              foreignKeyOptions
+              foreignKeyOptions,
+              autocompleteUrls: autocompleteUrlsFor(admin),
+              autocompleteLabels
             }),
             actionUrl: `${prefix}/m/${admin.slug()}/new`,
             backUrl: `${prefix}/m/${admin.slug()}`,
@@ -12672,6 +12902,10 @@ function makeAdminRouter(site, options) {
           status
         );
       };
+      if (uploadError !== null) {
+        rerender(uploadError, 400);
+        return;
+      }
       if (Object.keys(parsed.errors).length > 0) {
         rerender("Please fix the highlighted fields.", 400);
         return;
@@ -12791,6 +13025,129 @@ function makeAdminRouter(site, options) {
       );
     })
   );
+  router.get(
+    `${prefix}/m/:slug/import`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = await resolveAdmin(req, res, state, AdminPermission.CREATE);
+      if (admin === null) return;
+      if (!admin.canImport) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 404);
+        return;
+      }
+      html(res, renderImport(req, state, admin, null, null, []));
+    })
+  );
+  router.post(
+    `${prefix}/m/:slug/import`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = await resolveAdmin(req, res, state, AdminPermission.CREATE);
+      if (admin === null) return;
+      if (!admin.canImport) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 404);
+        return;
+      }
+      let submission;
+      try {
+        submission = await readSubmission(req);
+      } catch (error) {
+        if (!(error instanceof MultipartLimitError)) throw error;
+        html(res, renderImport(req, state, admin, error.message, null, []), 400);
+        return;
+      }
+      if (!csrfTokenMatches(state.session, submission.fields.csrf_token)) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 403);
+        return;
+      }
+      const file = submission.files[0];
+      if (file === void 0) {
+        html(
+          res,
+          renderImport(req, state, admin, "Choose a CSV file to import.", null, []),
+          400
+        );
+        return;
+      }
+      let rows;
+      try {
+        rows = parseCsv(file.data.toString("utf8"));
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Could not read the file as UTF-8 CSV.";
+        html(res, renderImport(req, state, admin, message, null, []), 400);
+        return;
+      }
+      const repository = admin.repository(state.dbSession);
+      const actorId = backend.principalId(state.principal);
+      const rowErrors = [];
+      let created = 0;
+      for (const [index, row] of rows.entries()) {
+        const parsed = parseFormBody(admin, row, { uploadsAsText: true });
+        const failures = Object.entries(parsed.errors);
+        if (failures.length > 0) {
+          rowErrors.push({
+            row: index + 2,
+            message: failures.map(([field, error]) => `${field}: ${error}`).join("; ")
+          });
+          continue;
+        }
+        stampActor(admin, parsed.data, actorId, true);
+        try {
+          await repository.create(parsed.data);
+          created += 1;
+        } catch (error) {
+          rowErrors.push({
+            row: index + 2,
+            message: error instanceof Error ? error.message : String(error)
+          });
+        }
+      }
+      html(res, renderImport(req, state, admin, null, created, rowErrors));
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug/autocomplete/:field`,
+    guarded(async (req, res) => {
+      if (sessions.load(req) === null) {
+        res.status(401).json({ options: [] });
+        return;
+      }
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = site.get(String(req.params.slug));
+      const field = String(req.params.field);
+      if (admin === null || !admin.autocompleteFields.includes(field) || !await allows(state.principal, admin, AdminPermission.VIEW)) {
+        res.status(404).json({ options: [] });
+        return;
+      }
+      const column6 = adminColumns(admin.model)[field];
+      const table = column6 === void 0 ? null : foreignKeyTable(column6);
+      const referenced = table === null ? null : site.get(table);
+      if (referenced === null) {
+        res.json({ options: [] });
+        return;
+      }
+      const term = queryString(req.query.q);
+      const searchable = referenced.searchFields.filter((name) => {
+        const target = adminColumns(referenced.model)[name];
+        return target !== void 0 && isSearchableColumn(target);
+      });
+      const filters = term === "" || searchable.length === 0 ? void 0 : tempestDbJs.or(...searchable.map((name) => ({ [name]: { ilike: `%${term}%` } })));
+      const page2 = await referenced.repository(state.dbSession).paginate({
+        page: 1,
+        pageSize: AUTOCOMPLETE_LIMIT,
+        ...filters === void 0 ? {} : { filters }
+      });
+      res.json({
+        options: page2.items.map((row) => ({
+          value: String(row[referenced.identityField]),
+          label: foreignKeyLabel(referenced, row)
+        }))
+      });
+    })
+  );
   router.get(
     `${prefix}/m/:slug/:identity`,
     guarded(async (req, res) => {
@@ -12838,7 +13195,9 @@ function makeAdminRouter(site, options) {
           title: admin.verboseName(),
           fields: buildFormFields(admin, {
             values: row,
-            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession)
+            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession),
+            autocompleteUrls: autocompleteUrlsFor(admin),
+            autocompleteLabels: await autocompleteLabelsFor(admin, row, state.dbSession)
           }),
           actionUrl: `${prefix}/m/${admin.slug()}/${identity}/edit`,
           backUrl: `${prefix}/m/${admin.slug()}/${identity}`,
@@ -12859,10 +13218,28 @@ function makeAdminRouter(site, options) {
         html(res, renderNotFound(context(req, state.session, state.visible)), 404);
         return;
       }
-      if (!checkCsrf(req, res, state)) return;
-      const body = req.body;
+      let uploadError = null;
+      let submission;
+      try {
+        submission = await readSubmission(req);
+      } catch (error) {
+        if (!(error instanceof MultipartLimitError)) throw error;
+        submission = { fields: {}, files: [] };
+        uploadError = error.message;
+      }
+      const body = submission.fields;
+      if (uploadError === null && !csrfTokenMatches(state.session, body.csrf_token)) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 403);
+        return;
+      }
       const parsed = parseFormBody(admin, body);
+      await applyUploads(admin, parsed.data, parsed.errors, submission.files, false);
       const foreignKeyOptions = await foreignKeyOptionsFor(admin, state.dbSession);
+      const autocompleteLabels = await autocompleteLabelsFor(
+        admin,
+        body,
+        state.dbSession
+      );
       const rerender = (error, status) => {
         html(
           res,
@@ -12872,7 +13249,9 @@ function makeAdminRouter(site, options) {
             fields: buildFormFields(admin, {
               values: body,
               errors: parsed.errors,
-              foreignKeyOptions
+              foreignKeyOptions,
+              autocompleteUrls: autocompleteUrlsFor(admin),
+              autocompleteLabels
             }),
             actionUrl: `${prefix}/m/${admin.slug()}/${identity}/edit`,
             backUrl: `${prefix}/m/${admin.slug()}/${identity}`,
@@ -12881,6 +13260,10 @@ function makeAdminRouter(site, options) {
           status
         );
       };
+      if (uploadError !== null) {
+        rerender(uploadError, 400);
+        return;
+      }
       if (Object.keys(parsed.errors).length > 0) {
         rerender("Please fix the highlighted fields.", 400);
         return;
@@ -12964,6 +13347,44 @@ function makeAdminRouter(site, options) {
     const row = await admin.repository(dbSession).first({ [admin.identityField]: identity });
     return row ?? null;
   }
+  function renderImport(req, state, admin, error, created, rowErrors) {
+    return renderImportPage(context(req, state.session, state.visible), {
+      title: admin.verboseNamePlural(),
+      actionUrl: `${prefix}/m/${admin.slug()}/import`,
+      backUrl: `${prefix}/m/${admin.slug()}`,
+      columns: admin.editableFieldNames(),
+      error,
+      created,
+      rowErrors
+    });
+  }
+  async function readSubmission(req) {
+    if (!isMultipart(req)) {
+      return { fields: req.body ?? {}, files: [] };
+    }
+    const parsed = await parseMultipart(req, { maxFileBytes: maxUploadBytes });
+    return { fields: parsed.fields, files: parsed.files };
+  }
+  async function applyUploads(admin, data, errors, files, creating) {
+    if (admin.uploadFields.length === 0) return;
+    const storage2 = admin.uploadStorage;
+    if (storage2 === null) return;
+    const columns = adminColumns(admin.model);
+    for (const field of admin.uploadFields) {
+      const file = files.find((candidate) => candidate.field === field);
+      if (file === void 0) {
+        const column6 = columns[field];
+        if (creating && column6 !== void 0 && !isColumnOptional(column6)) {
+          errors[field] = "This field is required.";
+        }
+        continue;
+      }
+      const extension = file.filename.includes(".") ? `.${file.filename.split(".").pop()}` : "";
+      const key = `${admin.slug()}/${field}/${crypto.randomUUID()}${extension}`;
+      const saved = await storage2.save(key, file.data, { contentType: file.contentType });
+      data[field] = saved.key;
+    }
+  }
   async function permittedBulkActions(admin, principal) {
     const permitted = [];
     for (const option of bulkActionsFor(admin)) {
@@ -13027,6 +13448,7 @@ function makeAdminRouter(site, options) {
       filters: query.filterViews,
       sort,
       newUrl: await allows(state.principal, admin, AdminPermission.CREATE) ? `${prefix}/m/${admin.slug()}/new` : null,
+      importUrl: admin.canImport && await allows(state.principal, admin, AdminPermission.CREATE) ? `${prefix}/m/${admin.slug()}/import` : null,
       bulkActions: await permittedBulkActions(admin, state.principal),
       bulkUrl: `${prefix}/m/${admin.slug()}/bulk`,
       exportCsvUrl: exportUrl("csv"),
@@ -13151,6 +13573,7 @@ function makeAdminRouter(site, options) {
     const columns = adminColumns(admin.model);
     const options2 = {};
     for (const field of Object.keys(foreignKeyFields(admin))) {
+      if (admin.autocompleteFields.includes(field)) continue;
       const column6 = columns[field];
       if (column6 === void 0) continue;
       const related = await relatedOptions(column6, dbSession);
@@ -13158,6 +13581,29 @@ function makeAdminRouter(site, options) {
     }
     return options2;
   }
+  function autocompleteUrlsFor(admin) {
+    const urls = {};
+    for (const field of admin.autocompleteFields) {
+      urls[field] = `${prefix}/m/${admin.slug()}/autocomplete/${field}`;
+    }
+    return urls;
+  }
+  async function autocompleteLabelsFor(admin, row, dbSession) {
+    const labels = {};
+    if (row === null) return labels;
+    const columns = adminColumns(admin.model);
+    for (const field of admin.autocompleteFields) {
+      const value = row[field];
+      if (value === null || value === void 0 || value === "") continue;
+      const column6 = columns[field];
+      const table = column6 === void 0 ? null : foreignKeyTable(column6);
+      const referenced = table === null ? null : site.get(table);
+      if (referenced === null) continue;
+      const related = await referenced.repository(dbSession).first({ [referenced.identityField]: value });
+      if (related !== null) labels[field] = foreignKeyLabel(referenced, related);
+    }
+    return labels;
+  }
   return router;
 }
 function flagAllows(admin, action) {
@@ -13249,6 +13695,55 @@ function bulkActionsFor(admin) {
   }
   return actions;
 }
+function parseCsv(text) {
+  const source = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+  const rows = [];
+  let row = [];
+  let field = "";
+  let quoted = false;
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index];
+    if (quoted) {
+      if (char === '"') {
+        if (source[index + 1] === '"') {
+          field += '"';
+          index += 1;
+        } else {
+          quoted = false;
+        }
+      } else {
+        field += char;
+      }
+      continue;
+    }
+    if (char === '"') {
+      quoted = true;
+    } else if (char === ",") {
+      row.push(field);
+      field = "";
+    } else if (char === "\n" || char === "\r") {
+      if (char === "\r" && source[index + 1] === "\n") index += 1;
+      row.push(field);
+      rows.push(row);
+      row = [];
+      field = "";
+    } else {
+      field += char;
+    }
+  }
+  if (field !== "" || row.length > 0) {
+    row.push(field);
+    rows.push(row);
+  }
+  const header = rows.shift();
+  if (header === void 0 || header.length === 0) {
+    throw new Error("The file has no header row.");
+  }
+  const keys = header.map((name) => name.trim());
+  return rows.filter((entry) => entry.some((value) => value.trim() !== "")).map(
+    (entry) => Object.fromEntries(keys.map((key, position) => [key, entry[position] ?? ""]))
+  );
+}
 function exportValue(value) {
   if (value instanceof Date) return value.toISOString();
   if (typeof value === "bigint") return value.toString();
@@ -15282,7 +15777,7 @@ async function withTestDatabase(models, fn) {
 }
 
 // src/version.ts
-var VERSION = "0.26.0";
+var VERSION = "0.27.0";
 
 Object.defineProperty(exports, "OpenAPIRegistry", {
   enumerable: true,
@@ -15496,6 +15991,7 @@ exports.MessageCatalog = MessageCatalog;
 exports.MessagingHub = MessagingHub;
 exports.MetricsUtils = MetricsUtils;
 exports.MfaService = MfaService;
+exports.MultipartLimitError = MultipartLimitError;
 exports.NotFoundException = NotFoundException;
 exports.OAuthError = OAuthError;
 exports.OIDCProvider = OIDCProvider;
@@ -15608,6 +16104,7 @@ exports.humanizeField = humanizeField;
 exports.idempotencyMiddleware = idempotencyMiddleware;
 exports.inboundMessageSchema = inboundMessageSchema;
 exports.isColumnOptional = isColumnOptional;
+exports.isMultipart = isMultipart;
 exports.isSearchableColumn = isSearchableColumn;
 exports.isValidCep = isValidCep;
 exports.isValidCity = isValidCity;
@@ -15667,7 +16164,9 @@ exports.paginationFilterSchema = paginationFilterSchema;
 exports.paginationSchema = paginationSchema;
 exports.parseAcceptLanguage = parseAcceptLanguage;
 exports.parseCookies = parseCookies;
+exports.parseCsv = parseCsv;
 exports.parseFormBody = parseFormBody;
+exports.parseMultipart = parseMultipart;
 exports.partitionTotal = partitionTotal;
 exports.passwordResetConfirmSchema = passwordResetConfirmSchema;
 exports.passwordResetRequestSchema = passwordResetRequestSchema;
@@ -15689,6 +16188,7 @@ exports.renderAuthResultPage = renderAuthResultPage;
 exports.renderDashboardPage = renderDashboardPage;
 exports.renderDetailPage = renderDetailPage;
 exports.renderFormPage = renderFormPage;
+exports.renderImportPage = renderImportPage;
 exports.renderLayout = renderLayout;
 exports.renderListPage = renderListPage;
 exports.renderLoginPage = renderLoginPage;