tempest-express-sdk 0.26.0 → 0.28.0

package/dist/index.cjs

@@ -9461,6 +9461,23 @@ function partitionTotal(partition) {
   return partition.segments.reduce((total, segment) => total + segment.value, 0);
 }
 
+// src/admin/inlines.ts
+function adminInline(options) {
+  const slug = options.model.tablename;
+  if (typeof slug !== "string" || slug === "") {
+    throw new Error("adminInline requires a concrete model with a tablename");
+  }
+  return {
+    model: options.model,
+    slug,
+    fkField: options.fkField,
+    listDisplay: options.listDisplay === void 0 ? null : [...options.listDisplay],
+    label: options.label ?? null,
+    editable: options.editable ?? false,
+    canDelete: options.canDelete ?? false
+  };
+}
+
 // src/admin/lenses.ts
 function slugify(name) {
   return name.normalize("NFD").replace(/\p{M}/gu, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "lens";
@@ -9498,6 +9515,85 @@ function adminAction(options, handler) {
   };
 }
 
+// src/admin/multipart.ts
+var BUSBOY_HINT = "The admin's upload and CSV-import screens need the optional peer `busboy`. Install it with: npm install busboy";
+async function loadBusboy() {
+  try {
+    const module = await import('busboy');
+    return module.default ?? module;
+  } catch {
+    throw new Error(BUSBOY_HINT);
+  }
+}
+var MultipartLimitError = class extends Error {
+  /**
+   * @param message - The operator-facing explanation.
+   */
+  constructor(message) {
+    super(message);
+    this.name = "MultipartLimitError";
+  }
+};
+async function parseMultipart(req, options = {}) {
+  const maxFileBytes = options.maxFileBytes ?? 10 * 1024 * 1024;
+  const maxFiles = options.maxFiles ?? 10;
+  const busboy = await loadBusboy();
+  return await new Promise((resolve, reject) => {
+    const fields = {};
+    const files = [];
+    let settled = false;
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      reject(error);
+    };
+    const parser = busboy({
+      headers: req.headers,
+      limits: { fileSize: maxFileBytes, files: maxFiles }
+    });
+    parser.on("field", ((name, value) => {
+      fields[name] = value;
+    }));
+    parser.on("file", ((name, stream, info) => {
+      const chunks = [];
+      stream.on("data", ((chunk) => chunks.push(chunk)));
+      stream.on("limit", () => {
+        fail(
+          new MultipartLimitError(
+            `The file is larger than the ${Math.floor(maxFileBytes / 1024 / 1024)} MB limit.`
+          )
+        );
+      });
+      stream.on("end", () => {
+        const data = Buffer.concat(chunks);
+        const filename = (info.filename ?? "").split(/[/\\]/).pop() ?? "";
+        if (filename === "" || data.length === 0) return;
+        files.push({
+          field: name,
+          filename,
+          contentType: info.mimeType ?? "application/octet-stream",
+          data
+        });
+      });
+    }));
+    parser.on("filesLimit", () => {
+      fail(new MultipartLimitError(`At most ${maxFiles} files can be uploaded at once.`));
+    });
+    parser.on("error", ((error) => {
+      fail(error instanceof Error ? error : new Error(String(error)));
+    }));
+    parser.on("close", () => {
+      if (settled) return;
+      settled = true;
+      resolve({ fields, files });
+    });
+    req.pipe(parser);
+  });
+}
+function isMultipart(req) {
+  return (req.header("content-type") ?? "").toLowerCase().startsWith("multipart/form-data");
+}
+
 // src/admin/columns.ts
 function humanizeField(name) {
   return name.replace(/[_-]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").trim().split(/\s+/).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
@@ -9591,6 +9687,8 @@ var NEVER_EDITABLE = [
   "id",
   "createdAt",
   "updatedAt",
+  "createdBy",
+  "updatedBy",
   "hashedPassword"
 ];
 var NEVER_LISTED = ["hashedPassword"];
@@ -9627,6 +9725,16 @@ var AdminModel = class {
   auditModel;
   /** Saved list-view presets, in declaration order. */
   lenses;
+  /** Columns rendered as file inputs. */
+  uploadFields;
+  /** Backend persisting uploaded files, or `null`. */
+  uploadStorage;
+  /** Whether the CSV import page is exposed. */
+  canImport;
+  /** Foreign-key columns rendered as a typed search box. */
+  autocompleteFields;
+  /** Related child models listed on the detail view. */
+  inlines;
   actions = /* @__PURE__ */ new Map();
   slugOverride;
   listDisplayOverride;
@@ -9654,6 +9762,16 @@ var AdminModel = class {
     this.canDelete = options.canDelete ?? true;
     this.auditModel = options.auditModel ?? null;
     this.lenses = [...options.lenses ?? []];
+    this.uploadFields = [...options.uploadFields ?? []];
+    this.uploadStorage = options.uploadStorage ?? null;
+    this.canImport = options.canImport ?? false;
+    this.autocompleteFields = [...options.autocompleteFields ?? []];
+    this.inlines = [...options.inlines ?? []];
+    if (this.uploadFields.length > 0 && this.uploadStorage === null) {
+      throw new Error(
+        `AdminModel(${this.model.tablename}).uploadFields requires an uploadStorage (e.g. LocalUploadStorage / S3UploadStorage) \u2014 without one there is nowhere to write the file.`
+      );
+    }
     for (const action of options.actions ?? []) {
       if (this.actions.has(action.name)) {
         throw new Error(
@@ -9668,7 +9786,9 @@ var AdminModel = class {
       ["listFilter", this.listFilter],
       ["searchFields", this.searchFields],
       ["readonlyFields", this.readonlyFields],
-      ["identityField", [this.identityField]]
+      ["identityField", [this.identityField]],
+      ["uploadFields", this.uploadFields],
+      ["autocompleteFields", this.autocompleteFields]
     ]) {
       for (const name of names) {
         if (!known.has(name)) {
@@ -9850,11 +9970,15 @@ function buildFormFields(admin, options = {}) {
   const values = options.values ?? {};
   const errors = options.errors ?? {};
   const foreignKeys = options.foreignKeyOptions ?? {};
+  const autocompleteUrls = options.autocompleteUrls ?? {};
+  const autocompleteLabels = options.autocompleteLabels ?? {};
+  const uploads = new Set(admin.uploadFields);
   return admin.editableFieldNames().flatMap((name) => {
     const column6 = columns[name];
     if (column6 === void 0) return [];
     const related = foreignKeys[name];
-    const spec = related === void 0 ? widgetForColumn(column6) : { widget: "select", step: null, options: related };
+    const autocompleteUrl = autocompleteUrls[name];
+    const spec = uploads.has(name) ? { widget: "file", step: null, options: [] } : autocompleteUrl !== void 0 ? { widget: "autocomplete", step: null, options: [] } : related === void 0 ? widgetForColumn(column6) : { widget: "select", step: null, options: related };
     const raw = name in values ? values[name] : literalDefault(column6);
     return [
       {
@@ -9866,7 +9990,9 @@ function buildFormFields(admin, options = {}) {
         checked: spec.widget === "checkbox" && toBoolean(raw),
         step: spec.step,
         options: spec.options,
-        error: errors[name] ?? null
+        error: errors[name] ?? null,
+        autocompleteUrl: autocompleteUrl ?? null,
+        displayLabel: autocompleteLabels[name] ?? ""
       }
     ];
   });
@@ -9914,13 +10040,17 @@ function coerceValue(column6, widget, raw) {
       return raw;
   }
 }
-function parseFormBody(admin, body) {
+function parseFormBody(admin, body, options = {}) {
   const columns = adminColumns(admin.model);
   const data = {};
   const errors = {};
+  const uploads = options.uploadsAsText === true ? /* @__PURE__ */ new Set() : new Set(admin.uploadFields);
+  const only = options.only === void 0 ? null : new Set(options.only);
   for (const name of admin.editableFieldNames()) {
+    if (only !== null && !only.has(name)) continue;
     const column6 = columns[name];
     if (column6 === void 0) continue;
+    if (uploads.has(name)) continue;
     const { widget } = widgetForColumn(column6);
     if (widget === "checkbox") {
       data[name] = toBoolean(body[name]);
@@ -12206,6 +12336,7 @@ function renderListPage(context, view) {
     </form>
     <div class="tempest-admin-list__actions">
       ${view.newUrl !== null ? `<a class="tempest-admin-list__new" href="${escapeHtml(view.newUrl)}">+ New</a>` : ""}
+      ${view.importUrl !== null ? `<a href="${escapeHtml(view.importUrl)}">Import CSV</a>` : ""}
       <a href="${escapeHtml(view.exportCsvUrl)}">Export CSV</a>
       <a href="${escapeHtml(view.exportJsonUrl)}">Export JSON</a>
     </div>
@@ -12250,10 +12381,97 @@ function renderDetailPage(context, view) {
     </div>
   </header>
   <dl class="tempest-admin-detail__fields">${fields}</dl>
+  ${view.inlines.map((inline) => renderInline(inline, context.session?.csrfToken ?? "", view.inlineError)).join("")}
   ${auditPanel}
 </section>`;
   return renderLayout(context, `${view.title} \xB7 ${view.identity}`, body);
 }
+function renderInlineCell(field) {
+  const required = field.required ? " required" : "";
+  const name = escapeHtml(field.name);
+  const value = escapeHtml(field.value);
+  let control;
+  switch (field.widget) {
+    case "checkbox":
+      control = `<input type="checkbox" name="${name}" value="true"${field.checked ? " checked" : ""}>`;
+      break;
+    case "textarea":
+    case "json":
+      control = `<textarea name="${name}" rows="2"${required}>${value}</textarea>`;
+      break;
+    case "select": {
+      const blank = field.required ? "" : '<option value="">\u2014 none \u2014</option>';
+      const options = field.options.map(
+        (option) => `<option value="${escapeHtml(option.value)}"${option.value === field.value ? " selected" : ""}>${escapeHtml(option.label)}</option>`
+      ).join("");
+      control = `<select name="${name}"${required}>${blank}${options}</select>`;
+      break;
+    }
+    case "number":
+      control = `<input type="number" name="${name}" value="${value}"${field.step !== null ? ` step="${escapeHtml(field.step)}"` : ""}${required}>`;
+      break;
+    case "datetime":
+      control = `<input type="datetime-local" name="${name}" value="${value}"${required}>`;
+      break;
+    case "date":
+      control = `<input type="date" name="${name}" value="${value}"${required}>`;
+      break;
+    case "time":
+      control = `<input type="time" name="${name}" value="${value}"${required}>`;
+      break;
+    default:
+      control = `<input type="text" name="${name}" value="${value}"${required}>`;
+  }
+  const error = field.error !== null ? `<small class="tempest-admin-form__field-error">${escapeHtml(field.error)}</small>` : "";
+  return `${control}${error}`;
+}
+function renderInline(inline, csrfToken, error) {
+  const heading = `<header class="tempest-admin-inline__header">
+      <h2>${escapeHtml(inline.label)}${inline.total > 0 ? ` <span class="tempest-admin-inline__count">(${escapeHtml(inline.total)})</span>` : ""}</h2>
+      ${inline.addUrl !== null ? `<a class="tempest-admin-btn" href="${escapeHtml(inline.addUrl)}">Add</a>` : ""}
+    </header>`;
+  const more = inline.truncated ? `<p class="tempest-admin-inline__more"><em>Showing the first ${escapeHtml(inline.rows.length)} of ${escapeHtml(inline.total)}.</em></p>` : "";
+  if (!inline.editable) {
+    if (inline.rows.length === 0) {
+      return `<section class="tempest-admin-inline">${heading}<p><em>No related records.</em></p></section>`;
+    }
+    const head2 = `<tr>${inline.columns.map((column6) => `<th>${escapeHtml(column6)}</th>`).join("")}<th></th></tr>`;
+    const body = inline.rows.map(
+      (row) => `<tr>${row.cells.map((cell) => `<td>${escapeHtml(cell)}</td>`).join("")}<td>${row.url === null ? "" : `<a href="${escapeHtml(row.url)}">View</a>`}</td></tr>`
+    ).join("");
+    return `<section class="tempest-admin-inline">
+      ${heading}
+      <div class="tempest-admin-inline__scroll">
+        <table class="tempest-admin-inline__table">
+          <thead>${head2}</thead>
+          <tbody>${body}</tbody>
+        </table>
+      </div>
+      ${more}
+    </section>`;
+  }
+  const head = `<tr>${inline.columns.map((column6) => `<th>${escapeHtml(column6)}</th>`).join("")}${inline.canDelete ? "<th>Delete</th>" : ""}</tr>`;
+  const renderRow = (row, isNew) => `<tr${isNew ? ' class="tempest-admin-inline__new"' : ""}>${row.fields.map((field) => `<td>${renderInlineCell(field)}</td>`).join("")}${inline.canDelete ? `<td class="tempest-admin-inline__del">${isNew ? "" : `<input type="checkbox" name="row.${escapeHtml(row.key)}.__delete" value="true">`}</td>` : ""}</tr>`;
+  const rows = inline.rows.map((row) => renderRow(row, false)).join("");
+  const blank = inline.newRow === null ? "" : renderRow(inline.newRow, true);
+  return `<section class="tempest-admin-inline">
+    ${heading}
+    ${error !== null ? `<p class="tempest-admin-form__error">${escapeHtml(error)}</p>` : ""}
+    <form method="post" action="${escapeHtml(inline.formAction)}" class="tempest-admin-inline__form">
+      <input type="hidden" name="csrf_token" value="${escapeHtml(csrfToken)}">
+      <div class="tempest-admin-inline__scroll">
+        <table class="tempest-admin-inline__table">
+          <thead>${head}</thead>
+          <tbody>${rows}${blank}</tbody>
+        </table>
+      </div>
+      <div class="tempest-admin-form__actions">
+        <button type="submit">Save ${escapeHtml(inline.label)}</button>
+      </div>
+    </form>
+    ${more}
+  </section>`;
+}
 function renderAuditPanel(audit) {
   const rows = audit.fields.map(
     (field) => `<dt>${escapeHtml(field.label)}</dt><dd>${field.value === "" ? "<em>\u2014</em>" : escapeHtml(field.value)}</dd>`
@@ -12305,6 +12523,18 @@ function renderFormField(field) {
       control = `<label><span>${label}${field.required ? " *" : ""}</span><select name="${name}"${required}>${blank}${options}</select></label>`;
       break;
     }
+    case "file":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="file" name="${name}"${required}></label>${field.value === "" ? "" : `<small class="tempest-admin-form__hint">Current: ${value} \u2014 choose a file to replace it.</small>`}`;
+      break;
+    case "autocomplete":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span>
+        <div class="tempest-admin-ac" data-ac data-ac-url="${escapeHtml(field.autocompleteUrl)}">
+          <input type="text" class="tempest-admin-ac__search" value="${escapeHtml(field.displayLabel)}" placeholder="Search\u2026" autocomplete="off" data-ac-search>
+          <input type="hidden" name="${name}" value="${value}"${required} data-ac-value>
+          <ul class="tempest-admin-ac__results" data-ac-results hidden></ul>
+        </div>
+      </label>`;
+      break;
     case "number":
       control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="number" name="${name}" value="${value}"${field.step !== null ? ` step="${escapeHtml(field.step)}"` : ""}${required}></label>`;
       break;
@@ -12332,7 +12562,7 @@ function renderFormPage(context, view) {
     <a href="${escapeHtml(view.backUrl)}">\u2190 Back</a>
   </header>
   ${view.error !== null ? `<p class="tempest-admin-form__error">${escapeHtml(view.error)}</p>` : ""}
-  <form method="post" action="${escapeHtml(view.actionUrl)}" class="tempest-admin-form__form">
+  <form method="post" action="${escapeHtml(view.actionUrl)}" class="tempest-admin-form__form"${view.fields.some((field) => field.widget === "file") ? ' enctype="multipart/form-data"' : ""}>
     <input type="hidden" name="csrf_token" value="${escapeHtml(context.session.csrfToken)}">
     ${view.fields.map(renderFormField).join("")}
     <div class="tempest-admin-form__actions">
@@ -12340,10 +12570,98 @@ function renderFormPage(context, view) {
       <a href="${escapeHtml(view.backUrl)}" class="tempest-admin-form__cancel">Cancel</a>
     </div>
   </form>
+  ${view.fields.some((field) => field.widget === "autocomplete") ? AUTOCOMPLETE_SCRIPT : ""}
 </section>`;
   return renderLayout(context, `${heading} \xB7 ${context.site.title}`, body);
 }
+function renderImportPage(context, view) {
+  if (context.session === null) throw new Error("The import page requires a session");
+  const summary = view.created === null ? "" : `<p class="tempest-admin-import__summary">Created ${escapeHtml(view.created)} record${view.created === 1 ? "" : "s"}.</p>`;
+  const failures = view.rowErrors.length > 0 ? `<table class="tempest-admin-import__errors"><thead><tr><th>Row</th><th>Problem</th></tr></thead><tbody>${view.rowErrors.map(
+    (failure) => `<tr><td>${escapeHtml(failure.row)}</td><td>${escapeHtml(failure.message)}</td></tr>`
+  ).join("")}</tbody></table>` : "";
+  const body = `<section class="tempest-admin-import">
+  <header class="tempest-admin-detail__header">
+    <h1>Import ${escapeHtml(view.title)}</h1>
+    <a href="${escapeHtml(view.backUrl)}">\u2190 Back</a>
+  </header>
+  ${view.error !== null ? `<p class="tempest-admin-form__error">${escapeHtml(view.error)}</p>` : ""}
+  ${summary}
+  ${failures}
+  <form method="post" action="${escapeHtml(view.actionUrl)}" class="tempest-admin-form__form" enctype="multipart/form-data">
+    <input type="hidden" name="csrf_token" value="${escapeHtml(context.session.csrfToken)}">
+    <div class="tempest-admin-form__field">
+      <label>
+        <span>CSV file *</span>
+        <input type="file" name="file" accept=".csv,text/csv" required>
+      </label>
+      <small class="tempest-admin-form__hint">
+        UTF-8, comma-separated, with a header row. Recognised columns:
+        <code>${escapeHtml(view.columns.join(", "))}</code>. Unknown columns are ignored.
+      </small>
+    </div>
+    <div class="tempest-admin-form__actions">
+      <button type="submit">Import</button>
+      <a href="${escapeHtml(view.backUrl)}" class="tempest-admin-form__cancel">Cancel</a>
+    </div>
+  </form>
+</section>`;
+  return renderLayout(context, `Import ${view.title} \xB7 ${context.site.title}`, body);
+}
+var AUTOCOMPLETE_SCRIPT = `<script>
+(function () {
+  document.querySelectorAll("[data-ac]").forEach(function (box) {
+    var search = box.querySelector("[data-ac-search]");
+    var value = box.querySelector("[data-ac-value]");
+    var results = box.querySelector("[data-ac-results]");
+    var url = box.getAttribute("data-ac-url");
+    var timer = null;
+
+    function close() {
+      results.hidden = true;
+      results.innerHTML = "";
+    }
+
+    function pick(option) {
+      value.value = option.value;
+      search.value = option.label;
+      close();
+    }
+
+    function run() {
+      var term = search.value.trim();
+      fetch(url + "?q=" + encodeURIComponent(term), { credentials: "same-origin" })
+        .then(function (response) { return response.ok ? response.json() : { options: [] }; })
+        .then(function (payload) {
+          results.innerHTML = "";
+          (payload.options || []).forEach(function (option) {
+            var item = document.createElement("li");
+            item.textContent = option.label;
+            item.setAttribute("role", "option");
+            item.addEventListener("mousedown", function (event) {
+              event.preventDefault();
+              pick(option);
+            });
+            results.appendChild(item);
+          });
+          results.hidden = results.children.length === 0;
+        })
+        .catch(close);
+    }
+
+    search.addEventListener("input", function () {
+      value.value = "";
+      window.clearTimeout(timer);
+      timer = window.setTimeout(run, 250);
+    });
+    search.addEventListener("focus", run);
+    search.addEventListener("blur", function () { window.setTimeout(close, 150); });
+  });
+})();
+</script>`;
 var logger2 = new JSONLogger("tempest_express_sdk.admin.router");
+var INLINE_ROW_LIMIT = 50;
+var AUTOCOMPLETE_LIMIT = 20;
 var AUDIT_HISTORY_LIMIT = 50;
 var FK_OPTION_CAP = 1e3;
 var FLASH_MAX_LENGTH = 300;
@@ -12373,6 +12691,7 @@ function makeAdminRouter(site, options) {
   const theme = resolveAdminTheme(site.theme);
   const showMetrics = options.showMetrics ?? true;
   const exportMaxRows = options.exportMaxRows ?? 5e3;
+  const maxUploadBytes = options.maxUploadBytes ?? 10 * 1024 * 1024;
   const sessions = new AdminSessionStore({
     secret: options.secretKey,
     ...options.cookieName === void 0 ? {} : { cookieName: options.cookieName },
@@ -12630,7 +12949,8 @@ function makeAdminRouter(site, options) {
           mode: "create",
           title: admin.verboseName(),
           fields: buildFormFields(admin, {
-            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession)
+            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession),
+            autocompleteUrls: autocompleteUrlsFor(admin)
           }),
           actionUrl: `${prefix}/m/${admin.slug()}/new`,
           backUrl: `${prefix}/m/${admin.slug()}`,
@@ -12650,10 +12970,28 @@ function makeAdminRouter(site, options) {
         html(res, renderNotFound(context(req, state.session, state.visible)), 404);
         return;
       }
-      if (!checkCsrf(req, res, state)) return;
-      const body = req.body;
+      let uploadError = null;
+      let submission;
+      try {
+        submission = await readSubmission(req);
+      } catch (error) {
+        if (!(error instanceof MultipartLimitError)) throw error;
+        submission = { fields: {}, files: [] };
+        uploadError = error.message;
+      }
+      const body = submission.fields;
+      if (uploadError === null && !csrfTokenMatches(state.session, body.csrf_token)) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 403);
+        return;
+      }
       const parsed = parseFormBody(admin, body);
+      await applyUploads(admin, parsed.data, parsed.errors, submission.files, true);
       const foreignKeyOptions = await foreignKeyOptionsFor(admin, state.dbSession);
+      const autocompleteLabels = await autocompleteLabelsFor(
+        admin,
+        body,
+        state.dbSession
+      );
       const rerender = (error, status) => {
         html(
           res,
@@ -12663,7 +13001,9 @@ function makeAdminRouter(site, options) {
             fields: buildFormFields(admin, {
               values: body,
               errors: parsed.errors,
-              foreignKeyOptions
+              foreignKeyOptions,
+              autocompleteUrls: autocompleteUrlsFor(admin),
+              autocompleteLabels
             }),
             actionUrl: `${prefix}/m/${admin.slug()}/new`,
             backUrl: `${prefix}/m/${admin.slug()}`,
@@ -12672,6 +13012,10 @@ function makeAdminRouter(site, options) {
           status
         );
       };
+      if (uploadError !== null) {
+        rerender(uploadError, 400);
+        return;
+      }
       if (Object.keys(parsed.errors).length > 0) {
         rerender("Please fix the highlighted fields.", 400);
         return;
@@ -12791,6 +13135,129 @@ function makeAdminRouter(site, options) {
       );
     })
   );
+  router.get(
+    `${prefix}/m/:slug/import`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = await resolveAdmin(req, res, state, AdminPermission.CREATE);
+      if (admin === null) return;
+      if (!admin.canImport) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 404);
+        return;
+      }
+      html(res, renderImport(req, state, admin, null, null, []));
+    })
+  );
+  router.post(
+    `${prefix}/m/:slug/import`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = await resolveAdmin(req, res, state, AdminPermission.CREATE);
+      if (admin === null) return;
+      if (!admin.canImport) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 404);
+        return;
+      }
+      let submission;
+      try {
+        submission = await readSubmission(req);
+      } catch (error) {
+        if (!(error instanceof MultipartLimitError)) throw error;
+        html(res, renderImport(req, state, admin, error.message, null, []), 400);
+        return;
+      }
+      if (!csrfTokenMatches(state.session, submission.fields.csrf_token)) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 403);
+        return;
+      }
+      const file = submission.files[0];
+      if (file === void 0) {
+        html(
+          res,
+          renderImport(req, state, admin, "Choose a CSV file to import.", null, []),
+          400
+        );
+        return;
+      }
+      let rows;
+      try {
+        rows = parseCsv(file.data.toString("utf8"));
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Could not read the file as UTF-8 CSV.";
+        html(res, renderImport(req, state, admin, message, null, []), 400);
+        return;
+      }
+      const repository = admin.repository(state.dbSession);
+      const actorId = backend.principalId(state.principal);
+      const rowErrors = [];
+      let created = 0;
+      for (const [index, row] of rows.entries()) {
+        const parsed = parseFormBody(admin, row, { uploadsAsText: true });
+        const failures = Object.entries(parsed.errors);
+        if (failures.length > 0) {
+          rowErrors.push({
+            row: index + 2,
+            message: failures.map(([field, error]) => `${field}: ${error}`).join("; ")
+          });
+          continue;
+        }
+        stampActor(admin, parsed.data, actorId, true);
+        try {
+          await repository.create(parsed.data);
+          created += 1;
+        } catch (error) {
+          rowErrors.push({
+            row: index + 2,
+            message: error instanceof Error ? error.message : String(error)
+          });
+        }
+      }
+      html(res, renderImport(req, state, admin, null, created, rowErrors));
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug/autocomplete/:field`,
+    guarded(async (req, res) => {
+      if (sessions.load(req) === null) {
+        res.status(401).json({ options: [] });
+        return;
+      }
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = site.get(String(req.params.slug));
+      const field = String(req.params.field);
+      if (admin === null || !admin.autocompleteFields.includes(field) || !await allows(state.principal, admin, AdminPermission.VIEW)) {
+        res.status(404).json({ options: [] });
+        return;
+      }
+      const column6 = adminColumns(admin.model)[field];
+      const table = column6 === void 0 ? null : foreignKeyTable(column6);
+      const referenced = table === null ? null : site.get(table);
+      if (referenced === null) {
+        res.json({ options: [] });
+        return;
+      }
+      const term = queryString(req.query.q);
+      const searchable = referenced.searchFields.filter((name) => {
+        const target = adminColumns(referenced.model)[name];
+        return target !== void 0 && isSearchableColumn(target);
+      });
+      const filters = term === "" || searchable.length === 0 ? void 0 : tempestDbJs.or(...searchable.map((name) => ({ [name]: { ilike: `%${term}%` } })));
+      const page2 = await referenced.repository(state.dbSession).paginate({
+        page: 1,
+        pageSize: AUTOCOMPLETE_LIMIT,
+        ...filters === void 0 ? {} : { filters }
+      });
+      res.json({
+        options: page2.items.map((row) => ({
+          value: String(row[referenced.identityField]),
+          label: foreignKeyLabel(referenced, row)
+        }))
+      });
+    })
+  );
   router.get(
     `${prefix}/m/:slug/:identity`,
     guarded(async (req, res) => {
@@ -12810,6 +13277,8 @@ function makeAdminRouter(site, options) {
           title: admin.verboseName(),
           identity,
           audit: await buildAuditView(admin, row, state.dbSession),
+          inlines: await buildInlines(admin, row, state, identity),
+          inlineError: null,
           fields: admin.detailFieldNames().map((name) => ({ label: name, value: formatCellValue(row[name]) })),
           backUrl: `${prefix}/m/${admin.slug()}`,
           editUrl: await allows(state.principal, admin, AdminPermission.EDIT) ? `${prefix}/m/${admin.slug()}/${identity}/edit` : null,
@@ -12838,7 +13307,9 @@ function makeAdminRouter(site, options) {
           title: admin.verboseName(),
           fields: buildFormFields(admin, {
             values: row,
-            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession)
+            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession),
+            autocompleteUrls: autocompleteUrlsFor(admin),
+            autocompleteLabels: await autocompleteLabelsFor(admin, row, state.dbSession)
           }),
           actionUrl: `${prefix}/m/${admin.slug()}/${identity}/edit`,
           backUrl: `${prefix}/m/${admin.slug()}/${identity}`,
@@ -12859,10 +13330,28 @@ function makeAdminRouter(site, options) {
         html(res, renderNotFound(context(req, state.session, state.visible)), 404);
         return;
       }
-      if (!checkCsrf(req, res, state)) return;
-      const body = req.body;
+      let uploadError = null;
+      let submission;
+      try {
+        submission = await readSubmission(req);
+      } catch (error) {
+        if (!(error instanceof MultipartLimitError)) throw error;
+        submission = { fields: {}, files: [] };
+        uploadError = error.message;
+      }
+      const body = submission.fields;
+      if (uploadError === null && !csrfTokenMatches(state.session, body.csrf_token)) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 403);
+        return;
+      }
       const parsed = parseFormBody(admin, body);
+      await applyUploads(admin, parsed.data, parsed.errors, submission.files, false);
       const foreignKeyOptions = await foreignKeyOptionsFor(admin, state.dbSession);
+      const autocompleteLabels = await autocompleteLabelsFor(
+        admin,
+        body,
+        state.dbSession
+      );
       const rerender = (error, status) => {
         html(
           res,
@@ -12872,7 +13361,9 @@ function makeAdminRouter(site, options) {
             fields: buildFormFields(admin, {
               values: body,
               errors: parsed.errors,
-              foreignKeyOptions
+              foreignKeyOptions,
+              autocompleteUrls: autocompleteUrlsFor(admin),
+              autocompleteLabels
             }),
             actionUrl: `${prefix}/m/${admin.slug()}/${identity}/edit`,
             backUrl: `${prefix}/m/${admin.slug()}/${identity}`,
@@ -12881,6 +13372,10 @@ function makeAdminRouter(site, options) {
           status
         );
       };
+      if (uploadError !== null) {
+        rerender(uploadError, 400);
+        return;
+      }
       if (Object.keys(parsed.errors).length > 0) {
         rerender("Please fix the highlighted fields.", 400);
         return;
@@ -12904,6 +13399,103 @@ function makeAdminRouter(site, options) {
       res.redirect(`${prefix}/m/${admin.slug()}/${identity}?ok=updated`);
     })
   );
+  router.post(
+    `${prefix}/m/:slug/:identity/inlines/:child`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = await resolveAdmin(req, res, state);
+      if (admin === null) return;
+      if (!checkCsrf(req, res, state)) return;
+      const childSlug = String(req.params.child);
+      const inline = admin.inlines.find(
+        (entry) => entry.slug === childSlug && entry.editable
+      );
+      const childAdmin = inline === void 0 ? null : site.get(childSlug);
+      if (inline === void 0 || childAdmin === null || !await allows(state.principal, childAdmin, AdminPermission.EDIT)) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 404);
+        return;
+      }
+      const identity = String(req.params.identity);
+      const parent = await findRow(admin, state.dbSession, identity);
+      if (parent === null) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 404);
+        return;
+      }
+      const parentId = parent[admin.identityField];
+      const { rows: grouped, deletions } = groupInlineSubmission(
+        req.body
+      );
+      const names = inlineFieldNames(childAdmin, inline);
+      const childRepo = childAdmin.repository(state.dbSession);
+      const actorId = backend.principalId(state.principal);
+      const canDelete = inline.canDelete && await allows(state.principal, childAdmin, AdminPermission.DELETE);
+      const failed = [];
+      let formError = null;
+      const owned = async (key) => await childRepo.first({
+        [childAdmin.identityField]: key,
+        [inline.fkField]: parentId
+      });
+      for (const [key, values] of Object.entries(grouped)) {
+        const isNew = key.startsWith("new");
+        if (!isNew && canDelete && deletions.has(key)) {
+          if (await owned(key) !== null) {
+            await childRepo.delete({ [childAdmin.identityField]: key });
+          }
+          continue;
+        }
+        if (isNew && Object.values(values).every((value) => value.trim() === "")) {
+          continue;
+        }
+        const parsed = parseFormBody(childAdmin, values, { only: names });
+        if (Object.keys(parsed.errors).length > 0) {
+          failed.push({ key, values, errors: parsed.errors });
+          continue;
+        }
+        try {
+          if (isNew) {
+            stampActor(childAdmin, parsed.data, actorId, true);
+            await childRepo.create({
+              ...parsed.data,
+              [inline.fkField]: parentId
+            });
+          } else {
+            if (await owned(key) === null) continue;
+            stampActor(childAdmin, parsed.data, actorId, false);
+            await childRepo.update(
+              { [childAdmin.identityField]: key },
+              parsed.data
+            );
+          }
+        } catch (error) {
+          formError = describeWriteFailure(childAdmin, error);
+          failed.push({ key, values, errors: {} });
+        }
+      }
+      if (failed.length > 0) {
+        const fresh = await findRow(admin, state.dbSession, identity) ?? parent;
+        html(
+          res,
+          renderDetailPage(context(req, state.session, state.visible), {
+            title: admin.verboseName(),
+            identity,
+            audit: await buildAuditView(admin, fresh, state.dbSession),
+            inlines: await buildInlines(admin, fresh, state, identity, {
+              [childSlug]: failed
+            }),
+            inlineError: formError ?? "Some inline rows could not be saved.",
+            fields: admin.detailFieldNames().map((name) => ({ label: name, value: formatCellValue(fresh[name]) })),
+            backUrl: `${prefix}/m/${admin.slug()}`,
+            editUrl: await allows(state.principal, admin, AdminPermission.EDIT) ? `${prefix}/m/${admin.slug()}/${identity}/edit` : null,
+            deleteUrl: await allows(state.principal, admin, AdminPermission.DELETE) ? `${prefix}/m/${admin.slug()}/${identity}/delete` : null
+          }),
+          400
+        );
+        return;
+      }
+      res.redirect(`${prefix}/m/${admin.slug()}/${identity}?ok=updated`);
+    })
+  );
   router.post(
     `${prefix}/m/:slug/:identity/delete`,
     guarded(async (req, res) => {
@@ -12925,6 +13517,89 @@ function makeAdminRouter(site, options) {
     const principal = await backend.loadPrincipal(dbSession, String(actor));
     return principal === null ? String(actor) : backend.displayName(principal);
   }
+  async function buildInlines(admin, parent, state, identity, overrides = {}) {
+    const parentId = parent[admin.identityField];
+    const blocks = [];
+    for (const inline of admin.inlines) {
+      const childAdmin = site.get(inline.slug);
+      const repository = childAdmin === null ? new tempestDbJs.BaseRepository(inline.model, state.dbSession) : childAdmin.repository(state.dbSession);
+      const children = await repository.list({
+        [inline.fkField]: parentId
+      });
+      const columns = inline.listDisplay ?? childAdmin?.listDisplayNames() ?? Object.keys(adminColumns(inline.model));
+      const label = inline.label ?? childAdmin?.verboseNamePlural() ?? humanizeField(inline.slug);
+      const visible = children.slice(0, INLINE_ROW_LIMIT);
+      const editable = inline.editable && childAdmin !== null && await allows(state.principal, childAdmin, AdminPermission.EDIT);
+      const addUrl = childAdmin !== null && await allows(state.principal, childAdmin, AdminPermission.CREATE) ? `${prefix}/m/${inline.slug}/new` : null;
+      if (!editable || childAdmin === null) {
+        blocks.push({
+          label,
+          total: children.length,
+          columns,
+          editable: false,
+          canDelete: false,
+          addUrl,
+          formAction: "",
+          rows: visible.map((child) => ({
+            key: String(child[childAdmin?.identityField ?? "id"]),
+            cells: columns.map((column6) => formatCellValue(child[column6])),
+            fields: [],
+            url: childAdmin === null ? null : `${prefix}/m/${inline.slug}/${String(child[childAdmin.identityField])}`
+          })),
+          newRow: null,
+          truncated: children.length > visible.length
+        });
+        continue;
+      }
+      const names = inlineFieldNames(childAdmin, inline);
+      const submitted = overrides[inline.slug];
+      const rows = [];
+      if (submitted !== void 0) {
+        for (const entry of submitted) {
+          rows.push({
+            key: entry.key,
+            cells: [],
+            fields: inlineFields(
+              childAdmin,
+              names,
+              entry.key,
+              entry.values,
+              entry.errors
+            ),
+            url: null
+          });
+        }
+      } else {
+        for (const child of visible) {
+          const key = String(child[childAdmin.identityField]);
+          rows.push({
+            key,
+            cells: [],
+            fields: inlineFields(childAdmin, names, key, child, {}),
+            url: `${prefix}/m/${inline.slug}/${key}`
+          });
+        }
+      }
+      blocks.push({
+        label,
+        total: children.length,
+        columns: names.map(humanizeField),
+        editable: true,
+        canDelete: inline.canDelete && childAdmin.canDelete,
+        addUrl,
+        formAction: `${prefix}/m/${admin.slug()}/${identity}/inlines/${inline.slug}`,
+        rows,
+        newRow: {
+          key: "new1",
+          cells: [],
+          fields: inlineFields(childAdmin, names, "new1", {}, {}),
+          url: null
+        },
+        truncated: children.length > visible.length
+      });
+    }
+    return blocks;
+  }
   async function buildAuditView(admin, row, dbSession) {
     const fields = [];
     for (const name of admin.auditFieldNames()) {
@@ -12964,6 +13639,44 @@ function makeAdminRouter(site, options) {
     const row = await admin.repository(dbSession).first({ [admin.identityField]: identity });
     return row ?? null;
   }
+  function renderImport(req, state, admin, error, created, rowErrors) {
+    return renderImportPage(context(req, state.session, state.visible), {
+      title: admin.verboseNamePlural(),
+      actionUrl: `${prefix}/m/${admin.slug()}/import`,
+      backUrl: `${prefix}/m/${admin.slug()}`,
+      columns: admin.editableFieldNames(),
+      error,
+      created,
+      rowErrors
+    });
+  }
+  async function readSubmission(req) {
+    if (!isMultipart(req)) {
+      return { fields: req.body ?? {}, files: [] };
+    }
+    const parsed = await parseMultipart(req, { maxFileBytes: maxUploadBytes });
+    return { fields: parsed.fields, files: parsed.files };
+  }
+  async function applyUploads(admin, data, errors, files, creating) {
+    if (admin.uploadFields.length === 0) return;
+    const storage2 = admin.uploadStorage;
+    if (storage2 === null) return;
+    const columns = adminColumns(admin.model);
+    for (const field of admin.uploadFields) {
+      const file = files.find((candidate) => candidate.field === field);
+      if (file === void 0) {
+        const column6 = columns[field];
+        if (creating && column6 !== void 0 && !isColumnOptional(column6)) {
+          errors[field] = "This field is required.";
+        }
+        continue;
+      }
+      const extension = file.filename.includes(".") ? `.${file.filename.split(".").pop()}` : "";
+      const key = `${admin.slug()}/${field}/${crypto.randomUUID()}${extension}`;
+      const saved = await storage2.save(key, file.data, { contentType: file.contentType });
+      data[field] = saved.key;
+    }
+  }
   async function permittedBulkActions(admin, principal) {
     const permitted = [];
     for (const option of bulkActionsFor(admin)) {
@@ -13027,6 +13740,7 @@ function makeAdminRouter(site, options) {
       filters: query.filterViews,
       sort,
       newUrl: await allows(state.principal, admin, AdminPermission.CREATE) ? `${prefix}/m/${admin.slug()}/new` : null,
+      importUrl: admin.canImport && await allows(state.principal, admin, AdminPermission.CREATE) ? `${prefix}/m/${admin.slug()}/import` : null,
       bulkActions: await permittedBulkActions(admin, state.principal),
       bulkUrl: `${prefix}/m/${admin.slug()}/bulk`,
       exportCsvUrl: exportUrl("csv"),
@@ -13151,6 +13865,7 @@ function makeAdminRouter(site, options) {
     const columns = adminColumns(admin.model);
     const options2 = {};
     for (const field of Object.keys(foreignKeyFields(admin))) {
+      if (admin.autocompleteFields.includes(field)) continue;
       const column6 = columns[field];
       if (column6 === void 0) continue;
       const related = await relatedOptions(column6, dbSession);
@@ -13158,8 +13873,60 @@ function makeAdminRouter(site, options) {
     }
     return options2;
   }
+  function autocompleteUrlsFor(admin) {
+    const urls = {};
+    for (const field of admin.autocompleteFields) {
+      urls[field] = `${prefix}/m/${admin.slug()}/autocomplete/${field}`;
+    }
+    return urls;
+  }
+  async function autocompleteLabelsFor(admin, row, dbSession) {
+    const labels = {};
+    if (row === null) return labels;
+    const columns = adminColumns(admin.model);
+    for (const field of admin.autocompleteFields) {
+      const value = row[field];
+      if (value === null || value === void 0 || value === "") continue;
+      const column6 = columns[field];
+      const table = column6 === void 0 ? null : foreignKeyTable(column6);
+      const referenced = table === null ? null : site.get(table);
+      if (referenced === null) continue;
+      const related = await referenced.repository(dbSession).first({ [referenced.identityField]: value });
+      if (related !== null) labels[field] = foreignKeyLabel(referenced, related);
+    }
+    return labels;
+  }
   return router;
 }
+function groupInlineSubmission(body) {
+  const rows = {};
+  const deletions = /* @__PURE__ */ new Set();
+  for (const [key, raw] of Object.entries(body)) {
+    if (!key.startsWith("row.")) continue;
+    const parts = key.split(".");
+    if (parts.length !== 3) continue;
+    const [, rowKey, field] = parts;
+    const value = typeof raw === "string" ? raw : "";
+    if (field === "__delete") {
+      if (!["", "false", "off", "0", "no"].includes(value.trim().toLowerCase())) {
+        deletions.add(rowKey);
+      }
+      continue;
+    }
+    const row = rows[rowKey] ?? {};
+    row[field] = value;
+    rows[rowKey] = row;
+  }
+  return { rows, deletions };
+}
+function inlineFieldNames(childAdmin, inline) {
+  return childAdmin.editableFieldNames().filter(
+    (name) => name !== inline.fkField && !childAdmin.uploadFields.includes(name) && !childAdmin.autocompleteFields.includes(name)
+  );
+}
+function inlineFields(childAdmin, names, key, values, errors) {
+  return buildFormFields(childAdmin, { values, errors }).filter((field) => names.includes(field.name)).map((field) => ({ ...field, name: `row.${key}.${field.name}` }));
+}
 function flagAllows(admin, action) {
   if (action === AdminPermission.CREATE) return admin.canCreate;
   if (action === AdminPermission.EDIT) return admin.canEdit;
@@ -13249,6 +14016,55 @@ function bulkActionsFor(admin) {
   }
   return actions;
 }
+function parseCsv(text) {
+  const source = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+  const rows = [];
+  let row = [];
+  let field = "";
+  let quoted = false;
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index];
+    if (quoted) {
+      if (char === '"') {
+        if (source[index + 1] === '"') {
+          field += '"';
+          index += 1;
+        } else {
+          quoted = false;
+        }
+      } else {
+        field += char;
+      }
+      continue;
+    }
+    if (char === '"') {
+      quoted = true;
+    } else if (char === ",") {
+      row.push(field);
+      field = "";
+    } else if (char === "\n" || char === "\r") {
+      if (char === "\r" && source[index + 1] === "\n") index += 1;
+      row.push(field);
+      rows.push(row);
+      row = [];
+      field = "";
+    } else {
+      field += char;
+    }
+  }
+  if (field !== "" || row.length > 0) {
+    row.push(field);
+    rows.push(row);
+  }
+  const header = rows.shift();
+  if (header === void 0 || header.length === 0) {
+    throw new Error("The file has no header row.");
+  }
+  const keys = header.map((name) => name.trim());
+  return rows.filter((entry) => entry.some((value) => value.trim() !== "")).map(
+    (entry) => Object.fromEntries(keys.map((key, position) => [key, entry[position] ?? ""]))
+  );
+}
 function exportValue(value) {
   if (value instanceof Date) return value.toISOString();
   if (typeof value === "bigint") return value.toString();
@@ -15282,7 +16098,7 @@ async function withTestDatabase(models, fn) {
 }
 
 // src/version.ts
-var VERSION = "0.26.0";
+var VERSION = "0.28.0";
 
 Object.defineProperty(exports, "OpenAPIRegistry", {
   enumerable: true,
@@ -15496,6 +16312,7 @@ exports.MessageCatalog = MessageCatalog;
 exports.MessagingHub = MessagingHub;
 exports.MetricsUtils = MetricsUtils;
 exports.MfaService = MfaService;
+exports.MultipartLimitError = MultipartLimitError;
 exports.NotFoundException = NotFoundException;
 exports.OAuthError = OAuthError;
 exports.OIDCProvider = OIDCProvider;
@@ -15541,6 +16358,7 @@ exports.activationSchema = activationSchema;
 exports.addLogSink = addLogSink;
 exports.adminAction = adminAction;
 exports.adminColumns = adminColumns;
+exports.adminInline = adminInline;
 exports.adminLens = adminLens;
 exports.adminThemeCss = adminThemeCss;
 exports.attachWebSocketHub = attachWebSocketHub;
@@ -15602,12 +16420,14 @@ exports.getConditions = getConditions;
 exports.getPaginationConditions = getPaginationConditions;
 exports.getRequestId = getRequestId;
 exports.getState = getState;
+exports.groupInlineSubmission = groupInlineSubmission;
 exports.hashOpaqueToken = hashOpaqueToken;
 exports.hexColorField = hexColorField;
 exports.humanizeField = humanizeField;
 exports.idempotencyMiddleware = idempotencyMiddleware;
 exports.inboundMessageSchema = inboundMessageSchema;
 exports.isColumnOptional = isColumnOptional;
+exports.isMultipart = isMultipart;
 exports.isSearchableColumn = isSearchableColumn;
 exports.isValidCep = isValidCep;
 exports.isValidCity = isValidCity;
@@ -15667,7 +16487,9 @@ exports.paginationFilterSchema = paginationFilterSchema;
 exports.paginationSchema = paginationSchema;
 exports.parseAcceptLanguage = parseAcceptLanguage;
 exports.parseCookies = parseCookies;
+exports.parseCsv = parseCsv;
 exports.parseFormBody = parseFormBody;
+exports.parseMultipart = parseMultipart;
 exports.partitionTotal = partitionTotal;
 exports.passwordResetConfirmSchema = passwordResetConfirmSchema;
 exports.passwordResetRequestSchema = passwordResetRequestSchema;
@@ -15689,6 +16511,7 @@ exports.renderAuthResultPage = renderAuthResultPage;
 exports.renderDashboardPage = renderDashboardPage;
 exports.renderDetailPage = renderDetailPage;
 exports.renderFormPage = renderFormPage;
+exports.renderImportPage = renderImportPage;
 exports.renderLayout = renderLayout;
 exports.renderListPage = renderListPage;
 exports.renderLoginPage = renderLoginPage;