tempest-express-sdk 0.26.0 → 0.28.0

package/dist/index.js

@@ -1,5 +1,5 @@
-import { z, looseBoolean, toDict, PasswordUtils } from './chunk-GLZYNX63.js';
-export { PasswordUtils, VERSION, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, centsField, corsSettingsShape, databaseSettingsShape, looseBoolean as envBoolean, hexColorField, latitudeField, loadSettings, longitudeField, looseBoolean, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, percentField, portField, positiveFloatField, positiveIntField, priceField, ratingField, ratioField, serverSettingsShape, slugField, toDict, z } from './chunk-GLZYNX63.js';
+import { z, looseBoolean, toDict, PasswordUtils } from './chunk-3NS5KVHT.js';
+export { PasswordUtils, VERSION, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, centsField, corsSettingsShape, databaseSettingsShape, looseBoolean as envBoolean, hexColorField, latitudeField, loadSettings, longitudeField, looseBoolean, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, percentField, portField, positiveFloatField, positiveIntField, priceField, ratingField, ratioField, serverSettingsShape, slugField, toDict, z } from './chunk-3NS5KVHT.js';
 import { AsyncLocalStorage } from 'async_hooks';
 import { Model, column, sql, BaseRepository, RecordNotFound, detectDialect, columnsOf, NodeSqliteDriver, AsyncEngine, or, and } from 'tempest-db-js';
 export { AsyncEngine, AsyncResult, AsyncSession, BaseRepository, Column, DeleteBuilder, InsertBuilder, Model, NoResultError, NodeSqliteDriver, PostgresDialect, RecordNotFound, SelectBuilder, SqliteDialect, SyncEngine, SyncSession, UpdateBuilder, and, belongsTo, column, columnsOf, createEngine, createSyncEngine, del, detectDialect, getDialect, hasMany, insert, join, loadRelations, not, or, parseDatabaseUrl, select, sql, update } from 'tempest-db-js';
@@ -9334,6 +9334,23 @@ function partitionTotal(partition) {
   return partition.segments.reduce((total, segment) => total + segment.value, 0);
 }
 
+// src/admin/inlines.ts
+function adminInline(options) {
+  const slug = options.model.tablename;
+  if (typeof slug !== "string" || slug === "") {
+    throw new Error("adminInline requires a concrete model with a tablename");
+  }
+  return {
+    model: options.model,
+    slug,
+    fkField: options.fkField,
+    listDisplay: options.listDisplay === void 0 ? null : [...options.listDisplay],
+    label: options.label ?? null,
+    editable: options.editable ?? false,
+    canDelete: options.canDelete ?? false
+  };
+}
+
 // src/admin/lenses.ts
 function slugify(name) {
   return name.normalize("NFD").replace(/\p{M}/gu, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "lens";
@@ -9371,6 +9388,85 @@ function adminAction(options, handler) {
   };
 }
 
+// src/admin/multipart.ts
+var BUSBOY_HINT = "The admin's upload and CSV-import screens need the optional peer `busboy`. Install it with: npm install busboy";
+async function loadBusboy() {
+  try {
+    const module = await import('busboy');
+    return module.default ?? module;
+  } catch {
+    throw new Error(BUSBOY_HINT);
+  }
+}
+var MultipartLimitError = class extends Error {
+  /**
+   * @param message - The operator-facing explanation.
+   */
+  constructor(message) {
+    super(message);
+    this.name = "MultipartLimitError";
+  }
+};
+async function parseMultipart(req, options = {}) {
+  const maxFileBytes = options.maxFileBytes ?? 10 * 1024 * 1024;
+  const maxFiles = options.maxFiles ?? 10;
+  const busboy = await loadBusboy();
+  return await new Promise((resolve, reject) => {
+    const fields = {};
+    const files = [];
+    let settled = false;
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      reject(error);
+    };
+    const parser = busboy({
+      headers: req.headers,
+      limits: { fileSize: maxFileBytes, files: maxFiles }
+    });
+    parser.on("field", ((name, value) => {
+      fields[name] = value;
+    }));
+    parser.on("file", ((name, stream, info) => {
+      const chunks = [];
+      stream.on("data", ((chunk) => chunks.push(chunk)));
+      stream.on("limit", () => {
+        fail(
+          new MultipartLimitError(
+            `The file is larger than the ${Math.floor(maxFileBytes / 1024 / 1024)} MB limit.`
+          )
+        );
+      });
+      stream.on("end", () => {
+        const data = Buffer.concat(chunks);
+        const filename = (info.filename ?? "").split(/[/\\]/).pop() ?? "";
+        if (filename === "" || data.length === 0) return;
+        files.push({
+          field: name,
+          filename,
+          contentType: info.mimeType ?? "application/octet-stream",
+          data
+        });
+      });
+    }));
+    parser.on("filesLimit", () => {
+      fail(new MultipartLimitError(`At most ${maxFiles} files can be uploaded at once.`));
+    });
+    parser.on("error", ((error) => {
+      fail(error instanceof Error ? error : new Error(String(error)));
+    }));
+    parser.on("close", () => {
+      if (settled) return;
+      settled = true;
+      resolve({ fields, files });
+    });
+    req.pipe(parser);
+  });
+}
+function isMultipart(req) {
+  return (req.header("content-type") ?? "").toLowerCase().startsWith("multipart/form-data");
+}
+
 // src/admin/columns.ts
 function humanizeField(name) {
   return name.replace(/[_-]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").trim().split(/\s+/).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
@@ -9464,6 +9560,8 @@ var NEVER_EDITABLE = [
   "id",
   "createdAt",
   "updatedAt",
+  "createdBy",
+  "updatedBy",
   "hashedPassword"
 ];
 var NEVER_LISTED = ["hashedPassword"];
@@ -9500,6 +9598,16 @@ var AdminModel = class {
   auditModel;
   /** Saved list-view presets, in declaration order. */
   lenses;
+  /** Columns rendered as file inputs. */
+  uploadFields;
+  /** Backend persisting uploaded files, or `null`. */
+  uploadStorage;
+  /** Whether the CSV import page is exposed. */
+  canImport;
+  /** Foreign-key columns rendered as a typed search box. */
+  autocompleteFields;
+  /** Related child models listed on the detail view. */
+  inlines;
   actions = /* @__PURE__ */ new Map();
   slugOverride;
   listDisplayOverride;
@@ -9527,6 +9635,16 @@ var AdminModel = class {
     this.canDelete = options.canDelete ?? true;
     this.auditModel = options.auditModel ?? null;
     this.lenses = [...options.lenses ?? []];
+    this.uploadFields = [...options.uploadFields ?? []];
+    this.uploadStorage = options.uploadStorage ?? null;
+    this.canImport = options.canImport ?? false;
+    this.autocompleteFields = [...options.autocompleteFields ?? []];
+    this.inlines = [...options.inlines ?? []];
+    if (this.uploadFields.length > 0 && this.uploadStorage === null) {
+      throw new Error(
+        `AdminModel(${this.model.tablename}).uploadFields requires an uploadStorage (e.g. LocalUploadStorage / S3UploadStorage) \u2014 without one there is nowhere to write the file.`
+      );
+    }
     for (const action of options.actions ?? []) {
       if (this.actions.has(action.name)) {
         throw new Error(
@@ -9541,7 +9659,9 @@ var AdminModel = class {
       ["listFilter", this.listFilter],
       ["searchFields", this.searchFields],
       ["readonlyFields", this.readonlyFields],
-      ["identityField", [this.identityField]]
+      ["identityField", [this.identityField]],
+      ["uploadFields", this.uploadFields],
+      ["autocompleteFields", this.autocompleteFields]
     ]) {
       for (const name of names) {
         if (!known.has(name)) {
@@ -9723,11 +9843,15 @@ function buildFormFields(admin, options = {}) {
   const values = options.values ?? {};
   const errors = options.errors ?? {};
   const foreignKeys = options.foreignKeyOptions ?? {};
+  const autocompleteUrls = options.autocompleteUrls ?? {};
+  const autocompleteLabels = options.autocompleteLabels ?? {};
+  const uploads = new Set(admin.uploadFields);
   return admin.editableFieldNames().flatMap((name) => {
     const column6 = columns[name];
     if (column6 === void 0) return [];
     const related = foreignKeys[name];
-    const spec = related === void 0 ? widgetForColumn(column6) : { widget: "select", step: null, options: related };
+    const autocompleteUrl = autocompleteUrls[name];
+    const spec = uploads.has(name) ? { widget: "file", step: null, options: [] } : autocompleteUrl !== void 0 ? { widget: "autocomplete", step: null, options: [] } : related === void 0 ? widgetForColumn(column6) : { widget: "select", step: null, options: related };
     const raw = name in values ? values[name] : literalDefault(column6);
     return [
       {
@@ -9739,7 +9863,9 @@ function buildFormFields(admin, options = {}) {
         checked: spec.widget === "checkbox" && toBoolean(raw),
         step: spec.step,
         options: spec.options,
-        error: errors[name] ?? null
+        error: errors[name] ?? null,
+        autocompleteUrl: autocompleteUrl ?? null,
+        displayLabel: autocompleteLabels[name] ?? ""
       }
     ];
   });
@@ -9787,13 +9913,17 @@ function coerceValue(column6, widget, raw) {
       return raw;
   }
 }
-function parseFormBody(admin, body) {
+function parseFormBody(admin, body, options = {}) {
   const columns = adminColumns(admin.model);
   const data = {};
   const errors = {};
+  const uploads = options.uploadsAsText === true ? /* @__PURE__ */ new Set() : new Set(admin.uploadFields);
+  const only = options.only === void 0 ? null : new Set(options.only);
   for (const name of admin.editableFieldNames()) {
+    if (only !== null && !only.has(name)) continue;
     const column6 = columns[name];
     if (column6 === void 0) continue;
+    if (uploads.has(name)) continue;
     const { widget } = widgetForColumn(column6);
     if (widget === "checkbox") {
       data[name] = toBoolean(body[name]);
@@ -12079,6 +12209,7 @@ function renderListPage(context, view) {
     </form>
     <div class="tempest-admin-list__actions">
       ${view.newUrl !== null ? `<a class="tempest-admin-list__new" href="${escapeHtml(view.newUrl)}">+ New</a>` : ""}
+      ${view.importUrl !== null ? `<a href="${escapeHtml(view.importUrl)}">Import CSV</a>` : ""}
       <a href="${escapeHtml(view.exportCsvUrl)}">Export CSV</a>
       <a href="${escapeHtml(view.exportJsonUrl)}">Export JSON</a>
     </div>
@@ -12123,10 +12254,97 @@ function renderDetailPage(context, view) {
     </div>
   </header>
   <dl class="tempest-admin-detail__fields">${fields}</dl>
+  ${view.inlines.map((inline) => renderInline(inline, context.session?.csrfToken ?? "", view.inlineError)).join("")}
   ${auditPanel}
 </section>`;
   return renderLayout(context, `${view.title} \xB7 ${view.identity}`, body);
 }
+function renderInlineCell(field) {
+  const required = field.required ? " required" : "";
+  const name = escapeHtml(field.name);
+  const value = escapeHtml(field.value);
+  let control;
+  switch (field.widget) {
+    case "checkbox":
+      control = `<input type="checkbox" name="${name}" value="true"${field.checked ? " checked" : ""}>`;
+      break;
+    case "textarea":
+    case "json":
+      control = `<textarea name="${name}" rows="2"${required}>${value}</textarea>`;
+      break;
+    case "select": {
+      const blank = field.required ? "" : '<option value="">\u2014 none \u2014</option>';
+      const options = field.options.map(
+        (option) => `<option value="${escapeHtml(option.value)}"${option.value === field.value ? " selected" : ""}>${escapeHtml(option.label)}</option>`
+      ).join("");
+      control = `<select name="${name}"${required}>${blank}${options}</select>`;
+      break;
+    }
+    case "number":
+      control = `<input type="number" name="${name}" value="${value}"${field.step !== null ? ` step="${escapeHtml(field.step)}"` : ""}${required}>`;
+      break;
+    case "datetime":
+      control = `<input type="datetime-local" name="${name}" value="${value}"${required}>`;
+      break;
+    case "date":
+      control = `<input type="date" name="${name}" value="${value}"${required}>`;
+      break;
+    case "time":
+      control = `<input type="time" name="${name}" value="${value}"${required}>`;
+      break;
+    default:
+      control = `<input type="text" name="${name}" value="${value}"${required}>`;
+  }
+  const error = field.error !== null ? `<small class="tempest-admin-form__field-error">${escapeHtml(field.error)}</small>` : "";
+  return `${control}${error}`;
+}
+function renderInline(inline, csrfToken, error) {
+  const heading = `<header class="tempest-admin-inline__header">
+      <h2>${escapeHtml(inline.label)}${inline.total > 0 ? ` <span class="tempest-admin-inline__count">(${escapeHtml(inline.total)})</span>` : ""}</h2>
+      ${inline.addUrl !== null ? `<a class="tempest-admin-btn" href="${escapeHtml(inline.addUrl)}">Add</a>` : ""}
+    </header>`;
+  const more = inline.truncated ? `<p class="tempest-admin-inline__more"><em>Showing the first ${escapeHtml(inline.rows.length)} of ${escapeHtml(inline.total)}.</em></p>` : "";
+  if (!inline.editable) {
+    if (inline.rows.length === 0) {
+      return `<section class="tempest-admin-inline">${heading}<p><em>No related records.</em></p></section>`;
+    }
+    const head2 = `<tr>${inline.columns.map((column6) => `<th>${escapeHtml(column6)}</th>`).join("")}<th></th></tr>`;
+    const body = inline.rows.map(
+      (row) => `<tr>${row.cells.map((cell) => `<td>${escapeHtml(cell)}</td>`).join("")}<td>${row.url === null ? "" : `<a href="${escapeHtml(row.url)}">View</a>`}</td></tr>`
+    ).join("");
+    return `<section class="tempest-admin-inline">
+      ${heading}
+      <div class="tempest-admin-inline__scroll">
+        <table class="tempest-admin-inline__table">
+          <thead>${head2}</thead>
+          <tbody>${body}</tbody>
+        </table>
+      </div>
+      ${more}
+    </section>`;
+  }
+  const head = `<tr>${inline.columns.map((column6) => `<th>${escapeHtml(column6)}</th>`).join("")}${inline.canDelete ? "<th>Delete</th>" : ""}</tr>`;
+  const renderRow = (row, isNew) => `<tr${isNew ? ' class="tempest-admin-inline__new"' : ""}>${row.fields.map((field) => `<td>${renderInlineCell(field)}</td>`).join("")}${inline.canDelete ? `<td class="tempest-admin-inline__del">${isNew ? "" : `<input type="checkbox" name="row.${escapeHtml(row.key)}.__delete" value="true">`}</td>` : ""}</tr>`;
+  const rows = inline.rows.map((row) => renderRow(row, false)).join("");
+  const blank = inline.newRow === null ? "" : renderRow(inline.newRow, true);
+  return `<section class="tempest-admin-inline">
+    ${heading}
+    ${error !== null ? `<p class="tempest-admin-form__error">${escapeHtml(error)}</p>` : ""}
+    <form method="post" action="${escapeHtml(inline.formAction)}" class="tempest-admin-inline__form">
+      <input type="hidden" name="csrf_token" value="${escapeHtml(csrfToken)}">
+      <div class="tempest-admin-inline__scroll">
+        <table class="tempest-admin-inline__table">
+          <thead>${head}</thead>
+          <tbody>${rows}${blank}</tbody>
+        </table>
+      </div>
+      <div class="tempest-admin-form__actions">
+        <button type="submit">Save ${escapeHtml(inline.label)}</button>
+      </div>
+    </form>
+    ${more}
+  </section>`;
+}
 function renderAuditPanel(audit) {
   const rows = audit.fields.map(
     (field) => `<dt>${escapeHtml(field.label)}</dt><dd>${field.value === "" ? "<em>\u2014</em>" : escapeHtml(field.value)}</dd>`
@@ -12178,6 +12396,18 @@ function renderFormField(field) {
       control = `<label><span>${label}${field.required ? " *" : ""}</span><select name="${name}"${required}>${blank}${options}</select></label>`;
       break;
     }
+    case "file":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="file" name="${name}"${required}></label>${field.value === "" ? "" : `<small class="tempest-admin-form__hint">Current: ${value} \u2014 choose a file to replace it.</small>`}`;
+      break;
+    case "autocomplete":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span>
+        <div class="tempest-admin-ac" data-ac data-ac-url="${escapeHtml(field.autocompleteUrl)}">
+          <input type="text" class="tempest-admin-ac__search" value="${escapeHtml(field.displayLabel)}" placeholder="Search\u2026" autocomplete="off" data-ac-search>
+          <input type="hidden" name="${name}" value="${value}"${required} data-ac-value>
+          <ul class="tempest-admin-ac__results" data-ac-results hidden></ul>
+        </div>
+      </label>`;
+      break;
     case "number":
       control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="number" name="${name}" value="${value}"${field.step !== null ? ` step="${escapeHtml(field.step)}"` : ""}${required}></label>`;
       break;
@@ -12205,7 +12435,7 @@ function renderFormPage(context, view) {
     <a href="${escapeHtml(view.backUrl)}">\u2190 Back</a>
   </header>
   ${view.error !== null ? `<p class="tempest-admin-form__error">${escapeHtml(view.error)}</p>` : ""}
-  <form method="post" action="${escapeHtml(view.actionUrl)}" class="tempest-admin-form__form">
+  <form method="post" action="${escapeHtml(view.actionUrl)}" class="tempest-admin-form__form"${view.fields.some((field) => field.widget === "file") ? ' enctype="multipart/form-data"' : ""}>
     <input type="hidden" name="csrf_token" value="${escapeHtml(context.session.csrfToken)}">
     ${view.fields.map(renderFormField).join("")}
     <div class="tempest-admin-form__actions">
@@ -12213,10 +12443,98 @@ function renderFormPage(context, view) {
       <a href="${escapeHtml(view.backUrl)}" class="tempest-admin-form__cancel">Cancel</a>
     </div>
   </form>
+  ${view.fields.some((field) => field.widget === "autocomplete") ? AUTOCOMPLETE_SCRIPT : ""}
 </section>`;
   return renderLayout(context, `${heading} \xB7 ${context.site.title}`, body);
 }
+function renderImportPage(context, view) {
+  if (context.session === null) throw new Error("The import page requires a session");
+  const summary = view.created === null ? "" : `<p class="tempest-admin-import__summary">Created ${escapeHtml(view.created)} record${view.created === 1 ? "" : "s"}.</p>`;
+  const failures = view.rowErrors.length > 0 ? `<table class="tempest-admin-import__errors"><thead><tr><th>Row</th><th>Problem</th></tr></thead><tbody>${view.rowErrors.map(
+    (failure) => `<tr><td>${escapeHtml(failure.row)}</td><td>${escapeHtml(failure.message)}</td></tr>`
+  ).join("")}</tbody></table>` : "";
+  const body = `<section class="tempest-admin-import">
+  <header class="tempest-admin-detail__header">
+    <h1>Import ${escapeHtml(view.title)}</h1>
+    <a href="${escapeHtml(view.backUrl)}">\u2190 Back</a>
+  </header>
+  ${view.error !== null ? `<p class="tempest-admin-form__error">${escapeHtml(view.error)}</p>` : ""}
+  ${summary}
+  ${failures}
+  <form method="post" action="${escapeHtml(view.actionUrl)}" class="tempest-admin-form__form" enctype="multipart/form-data">
+    <input type="hidden" name="csrf_token" value="${escapeHtml(context.session.csrfToken)}">
+    <div class="tempest-admin-form__field">
+      <label>
+        <span>CSV file *</span>
+        <input type="file" name="file" accept=".csv,text/csv" required>
+      </label>
+      <small class="tempest-admin-form__hint">
+        UTF-8, comma-separated, with a header row. Recognised columns:
+        <code>${escapeHtml(view.columns.join(", "))}</code>. Unknown columns are ignored.
+      </small>
+    </div>
+    <div class="tempest-admin-form__actions">
+      <button type="submit">Import</button>
+      <a href="${escapeHtml(view.backUrl)}" class="tempest-admin-form__cancel">Cancel</a>
+    </div>
+  </form>
+</section>`;
+  return renderLayout(context, `Import ${view.title} \xB7 ${context.site.title}`, body);
+}
+var AUTOCOMPLETE_SCRIPT = `<script>
+(function () {
+  document.querySelectorAll("[data-ac]").forEach(function (box) {
+    var search = box.querySelector("[data-ac-search]");
+    var value = box.querySelector("[data-ac-value]");
+    var results = box.querySelector("[data-ac-results]");
+    var url = box.getAttribute("data-ac-url");
+    var timer = null;
+
+    function close() {
+      results.hidden = true;
+      results.innerHTML = "";
+    }
+
+    function pick(option) {
+      value.value = option.value;
+      search.value = option.label;
+      close();
+    }
+
+    function run() {
+      var term = search.value.trim();
+      fetch(url + "?q=" + encodeURIComponent(term), { credentials: "same-origin" })
+        .then(function (response) { return response.ok ? response.json() : { options: [] }; })
+        .then(function (payload) {
+          results.innerHTML = "";
+          (payload.options || []).forEach(function (option) {
+            var item = document.createElement("li");
+            item.textContent = option.label;
+            item.setAttribute("role", "option");
+            item.addEventListener("mousedown", function (event) {
+              event.preventDefault();
+              pick(option);
+            });
+            results.appendChild(item);
+          });
+          results.hidden = results.children.length === 0;
+        })
+        .catch(close);
+    }
+
+    search.addEventListener("input", function () {
+      value.value = "";
+      window.clearTimeout(timer);
+      timer = window.setTimeout(run, 250);
+    });
+    search.addEventListener("focus", run);
+    search.addEventListener("blur", function () { window.setTimeout(close, 150); });
+  });
+})();
+</script>`;
 var logger2 = new JSONLogger("tempest_express_sdk.admin.router");
+var INLINE_ROW_LIMIT = 50;
+var AUTOCOMPLETE_LIMIT = 20;
 var AUDIT_HISTORY_LIMIT = 50;
 var FK_OPTION_CAP = 1e3;
 var FLASH_MAX_LENGTH = 300;
@@ -12246,6 +12564,7 @@ function makeAdminRouter(site, options) {
   const theme = resolveAdminTheme(site.theme);
   const showMetrics = options.showMetrics ?? true;
   const exportMaxRows = options.exportMaxRows ?? 5e3;
+  const maxUploadBytes = options.maxUploadBytes ?? 10 * 1024 * 1024;
   const sessions = new AdminSessionStore({
     secret: options.secretKey,
     ...options.cookieName === void 0 ? {} : { cookieName: options.cookieName },
@@ -12503,7 +12822,8 @@ function makeAdminRouter(site, options) {
           mode: "create",
           title: admin.verboseName(),
           fields: buildFormFields(admin, {
-            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession)
+            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession),
+            autocompleteUrls: autocompleteUrlsFor(admin)
           }),
           actionUrl: `${prefix}/m/${admin.slug()}/new`,
           backUrl: `${prefix}/m/${admin.slug()}`,
@@ -12523,10 +12843,28 @@ function makeAdminRouter(site, options) {
         html(res, renderNotFound(context(req, state.session, state.visible)), 404);
         return;
       }
-      if (!checkCsrf(req, res, state)) return;
-      const body = req.body;
+      let uploadError = null;
+      let submission;
+      try {
+        submission = await readSubmission(req);
+      } catch (error) {
+        if (!(error instanceof MultipartLimitError)) throw error;
+        submission = { fields: {}, files: [] };
+        uploadError = error.message;
+      }
+      const body = submission.fields;
+      if (uploadError === null && !csrfTokenMatches(state.session, body.csrf_token)) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 403);
+        return;
+      }
       const parsed = parseFormBody(admin, body);
+      await applyUploads(admin, parsed.data, parsed.errors, submission.files, true);
       const foreignKeyOptions = await foreignKeyOptionsFor(admin, state.dbSession);
+      const autocompleteLabels = await autocompleteLabelsFor(
+        admin,
+        body,
+        state.dbSession
+      );
       const rerender = (error, status) => {
         html(
           res,
@@ -12536,7 +12874,9 @@ function makeAdminRouter(site, options) {
             fields: buildFormFields(admin, {
               values: body,
               errors: parsed.errors,
-              foreignKeyOptions
+              foreignKeyOptions,
+              autocompleteUrls: autocompleteUrlsFor(admin),
+              autocompleteLabels
             }),
             actionUrl: `${prefix}/m/${admin.slug()}/new`,
             backUrl: `${prefix}/m/${admin.slug()}`,
@@ -12545,6 +12885,10 @@ function makeAdminRouter(site, options) {
           status
         );
       };
+      if (uploadError !== null) {
+        rerender(uploadError, 400);
+        return;
+      }
       if (Object.keys(parsed.errors).length > 0) {
         rerender("Please fix the highlighted fields.", 400);
         return;
@@ -12664,6 +13008,129 @@ function makeAdminRouter(site, options) {
       );
     })
   );
+  router.get(
+    `${prefix}/m/:slug/import`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = await resolveAdmin(req, res, state, AdminPermission.CREATE);
+      if (admin === null) return;
+      if (!admin.canImport) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 404);
+        return;
+      }
+      html(res, renderImport(req, state, admin, null, null, []));
+    })
+  );
+  router.post(
+    `${prefix}/m/:slug/import`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = await resolveAdmin(req, res, state, AdminPermission.CREATE);
+      if (admin === null) return;
+      if (!admin.canImport) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 404);
+        return;
+      }
+      let submission;
+      try {
+        submission = await readSubmission(req);
+      } catch (error) {
+        if (!(error instanceof MultipartLimitError)) throw error;
+        html(res, renderImport(req, state, admin, error.message, null, []), 400);
+        return;
+      }
+      if (!csrfTokenMatches(state.session, submission.fields.csrf_token)) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 403);
+        return;
+      }
+      const file = submission.files[0];
+      if (file === void 0) {
+        html(
+          res,
+          renderImport(req, state, admin, "Choose a CSV file to import.", null, []),
+          400
+        );
+        return;
+      }
+      let rows;
+      try {
+        rows = parseCsv(file.data.toString("utf8"));
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Could not read the file as UTF-8 CSV.";
+        html(res, renderImport(req, state, admin, message, null, []), 400);
+        return;
+      }
+      const repository = admin.repository(state.dbSession);
+      const actorId = backend.principalId(state.principal);
+      const rowErrors = [];
+      let created = 0;
+      for (const [index, row] of rows.entries()) {
+        const parsed = parseFormBody(admin, row, { uploadsAsText: true });
+        const failures = Object.entries(parsed.errors);
+        if (failures.length > 0) {
+          rowErrors.push({
+            row: index + 2,
+            message: failures.map(([field, error]) => `${field}: ${error}`).join("; ")
+          });
+          continue;
+        }
+        stampActor(admin, parsed.data, actorId, true);
+        try {
+          await repository.create(parsed.data);
+          created += 1;
+        } catch (error) {
+          rowErrors.push({
+            row: index + 2,
+            message: error instanceof Error ? error.message : String(error)
+          });
+        }
+      }
+      html(res, renderImport(req, state, admin, null, created, rowErrors));
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug/autocomplete/:field`,
+    guarded(async (req, res) => {
+      if (sessions.load(req) === null) {
+        res.status(401).json({ options: [] });
+        return;
+      }
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = site.get(String(req.params.slug));
+      const field = String(req.params.field);
+      if (admin === null || !admin.autocompleteFields.includes(field) || !await allows(state.principal, admin, AdminPermission.VIEW)) {
+        res.status(404).json({ options: [] });
+        return;
+      }
+      const column6 = adminColumns(admin.model)[field];
+      const table = column6 === void 0 ? null : foreignKeyTable(column6);
+      const referenced = table === null ? null : site.get(table);
+      if (referenced === null) {
+        res.json({ options: [] });
+        return;
+      }
+      const term = queryString(req.query.q);
+      const searchable = referenced.searchFields.filter((name) => {
+        const target = adminColumns(referenced.model)[name];
+        return target !== void 0 && isSearchableColumn(target);
+      });
+      const filters = term === "" || searchable.length === 0 ? void 0 : or(...searchable.map((name) => ({ [name]: { ilike: `%${term}%` } })));
+      const page2 = await referenced.repository(state.dbSession).paginate({
+        page: 1,
+        pageSize: AUTOCOMPLETE_LIMIT,
+        ...filters === void 0 ? {} : { filters }
+      });
+      res.json({
+        options: page2.items.map((row) => ({
+          value: String(row[referenced.identityField]),
+          label: foreignKeyLabel(referenced, row)
+        }))
+      });
+    })
+  );
   router.get(
     `${prefix}/m/:slug/:identity`,
     guarded(async (req, res) => {
@@ -12683,6 +13150,8 @@ function makeAdminRouter(site, options) {
           title: admin.verboseName(),
           identity,
           audit: await buildAuditView(admin, row, state.dbSession),
+          inlines: await buildInlines(admin, row, state, identity),
+          inlineError: null,
           fields: admin.detailFieldNames().map((name) => ({ label: name, value: formatCellValue(row[name]) })),
           backUrl: `${prefix}/m/${admin.slug()}`,
           editUrl: await allows(state.principal, admin, AdminPermission.EDIT) ? `${prefix}/m/${admin.slug()}/${identity}/edit` : null,
@@ -12711,7 +13180,9 @@ function makeAdminRouter(site, options) {
           title: admin.verboseName(),
           fields: buildFormFields(admin, {
             values: row,
-            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession)
+            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession),
+            autocompleteUrls: autocompleteUrlsFor(admin),
+            autocompleteLabels: await autocompleteLabelsFor(admin, row, state.dbSession)
           }),
           actionUrl: `${prefix}/m/${admin.slug()}/${identity}/edit`,
           backUrl: `${prefix}/m/${admin.slug()}/${identity}`,
@@ -12732,10 +13203,28 @@ function makeAdminRouter(site, options) {
         html(res, renderNotFound(context(req, state.session, state.visible)), 404);
         return;
       }
-      if (!checkCsrf(req, res, state)) return;
-      const body = req.body;
+      let uploadError = null;
+      let submission;
+      try {
+        submission = await readSubmission(req);
+      } catch (error) {
+        if (!(error instanceof MultipartLimitError)) throw error;
+        submission = { fields: {}, files: [] };
+        uploadError = error.message;
+      }
+      const body = submission.fields;
+      if (uploadError === null && !csrfTokenMatches(state.session, body.csrf_token)) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 403);
+        return;
+      }
       const parsed = parseFormBody(admin, body);
+      await applyUploads(admin, parsed.data, parsed.errors, submission.files, false);
       const foreignKeyOptions = await foreignKeyOptionsFor(admin, state.dbSession);
+      const autocompleteLabels = await autocompleteLabelsFor(
+        admin,
+        body,
+        state.dbSession
+      );
       const rerender = (error, status) => {
         html(
           res,
@@ -12745,7 +13234,9 @@ function makeAdminRouter(site, options) {
             fields: buildFormFields(admin, {
               values: body,
               errors: parsed.errors,
-              foreignKeyOptions
+              foreignKeyOptions,
+              autocompleteUrls: autocompleteUrlsFor(admin),
+              autocompleteLabels
             }),
             actionUrl: `${prefix}/m/${admin.slug()}/${identity}/edit`,
             backUrl: `${prefix}/m/${admin.slug()}/${identity}`,
@@ -12754,6 +13245,10 @@ function makeAdminRouter(site, options) {
           status
         );
       };
+      if (uploadError !== null) {
+        rerender(uploadError, 400);
+        return;
+      }
       if (Object.keys(parsed.errors).length > 0) {
         rerender("Please fix the highlighted fields.", 400);
         return;
@@ -12777,6 +13272,103 @@ function makeAdminRouter(site, options) {
       res.redirect(`${prefix}/m/${admin.slug()}/${identity}?ok=updated`);
     })
   );
+  router.post(
+    `${prefix}/m/:slug/:identity/inlines/:child`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = await resolveAdmin(req, res, state);
+      if (admin === null) return;
+      if (!checkCsrf(req, res, state)) return;
+      const childSlug = String(req.params.child);
+      const inline = admin.inlines.find(
+        (entry) => entry.slug === childSlug && entry.editable
+      );
+      const childAdmin = inline === void 0 ? null : site.get(childSlug);
+      if (inline === void 0 || childAdmin === null || !await allows(state.principal, childAdmin, AdminPermission.EDIT)) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 404);
+        return;
+      }
+      const identity = String(req.params.identity);
+      const parent = await findRow(admin, state.dbSession, identity);
+      if (parent === null) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 404);
+        return;
+      }
+      const parentId = parent[admin.identityField];
+      const { rows: grouped, deletions } = groupInlineSubmission(
+        req.body
+      );
+      const names = inlineFieldNames(childAdmin, inline);
+      const childRepo = childAdmin.repository(state.dbSession);
+      const actorId = backend.principalId(state.principal);
+      const canDelete = inline.canDelete && await allows(state.principal, childAdmin, AdminPermission.DELETE);
+      const failed = [];
+      let formError = null;
+      const owned = async (key) => await childRepo.first({
+        [childAdmin.identityField]: key,
+        [inline.fkField]: parentId
+      });
+      for (const [key, values] of Object.entries(grouped)) {
+        const isNew = key.startsWith("new");
+        if (!isNew && canDelete && deletions.has(key)) {
+          if (await owned(key) !== null) {
+            await childRepo.delete({ [childAdmin.identityField]: key });
+          }
+          continue;
+        }
+        if (isNew && Object.values(values).every((value) => value.trim() === "")) {
+          continue;
+        }
+        const parsed = parseFormBody(childAdmin, values, { only: names });
+        if (Object.keys(parsed.errors).length > 0) {
+          failed.push({ key, values, errors: parsed.errors });
+          continue;
+        }
+        try {
+          if (isNew) {
+            stampActor(childAdmin, parsed.data, actorId, true);
+            await childRepo.create({
+              ...parsed.data,
+              [inline.fkField]: parentId
+            });
+          } else {
+            if (await owned(key) === null) continue;
+            stampActor(childAdmin, parsed.data, actorId, false);
+            await childRepo.update(
+              { [childAdmin.identityField]: key },
+              parsed.data
+            );
+          }
+        } catch (error) {
+          formError = describeWriteFailure(childAdmin, error);
+          failed.push({ key, values, errors: {} });
+        }
+      }
+      if (failed.length > 0) {
+        const fresh = await findRow(admin, state.dbSession, identity) ?? parent;
+        html(
+          res,
+          renderDetailPage(context(req, state.session, state.visible), {
+            title: admin.verboseName(),
+            identity,
+            audit: await buildAuditView(admin, fresh, state.dbSession),
+            inlines: await buildInlines(admin, fresh, state, identity, {
+              [childSlug]: failed
+            }),
+            inlineError: formError ?? "Some inline rows could not be saved.",
+            fields: admin.detailFieldNames().map((name) => ({ label: name, value: formatCellValue(fresh[name]) })),
+            backUrl: `${prefix}/m/${admin.slug()}`,
+            editUrl: await allows(state.principal, admin, AdminPermission.EDIT) ? `${prefix}/m/${admin.slug()}/${identity}/edit` : null,
+            deleteUrl: await allows(state.principal, admin, AdminPermission.DELETE) ? `${prefix}/m/${admin.slug()}/${identity}/delete` : null
+          }),
+          400
+        );
+        return;
+      }
+      res.redirect(`${prefix}/m/${admin.slug()}/${identity}?ok=updated`);
+    })
+  );
   router.post(
     `${prefix}/m/:slug/:identity/delete`,
     guarded(async (req, res) => {
@@ -12798,6 +13390,89 @@ function makeAdminRouter(site, options) {
     const principal = await backend.loadPrincipal(dbSession, String(actor));
     return principal === null ? String(actor) : backend.displayName(principal);
   }
+  async function buildInlines(admin, parent, state, identity, overrides = {}) {
+    const parentId = parent[admin.identityField];
+    const blocks = [];
+    for (const inline of admin.inlines) {
+      const childAdmin = site.get(inline.slug);
+      const repository = childAdmin === null ? new BaseRepository(inline.model, state.dbSession) : childAdmin.repository(state.dbSession);
+      const children = await repository.list({
+        [inline.fkField]: parentId
+      });
+      const columns = inline.listDisplay ?? childAdmin?.listDisplayNames() ?? Object.keys(adminColumns(inline.model));
+      const label = inline.label ?? childAdmin?.verboseNamePlural() ?? humanizeField(inline.slug);
+      const visible = children.slice(0, INLINE_ROW_LIMIT);
+      const editable = inline.editable && childAdmin !== null && await allows(state.principal, childAdmin, AdminPermission.EDIT);
+      const addUrl = childAdmin !== null && await allows(state.principal, childAdmin, AdminPermission.CREATE) ? `${prefix}/m/${inline.slug}/new` : null;
+      if (!editable || childAdmin === null) {
+        blocks.push({
+          label,
+          total: children.length,
+          columns,
+          editable: false,
+          canDelete: false,
+          addUrl,
+          formAction: "",
+          rows: visible.map((child) => ({
+            key: String(child[childAdmin?.identityField ?? "id"]),
+            cells: columns.map((column6) => formatCellValue(child[column6])),
+            fields: [],
+            url: childAdmin === null ? null : `${prefix}/m/${inline.slug}/${String(child[childAdmin.identityField])}`
+          })),
+          newRow: null,
+          truncated: children.length > visible.length
+        });
+        continue;
+      }
+      const names = inlineFieldNames(childAdmin, inline);
+      const submitted = overrides[inline.slug];
+      const rows = [];
+      if (submitted !== void 0) {
+        for (const entry of submitted) {
+          rows.push({
+            key: entry.key,
+            cells: [],
+            fields: inlineFields(
+              childAdmin,
+              names,
+              entry.key,
+              entry.values,
+              entry.errors
+            ),
+            url: null
+          });
+        }
+      } else {
+        for (const child of visible) {
+          const key = String(child[childAdmin.identityField]);
+          rows.push({
+            key,
+            cells: [],
+            fields: inlineFields(childAdmin, names, key, child, {}),
+            url: `${prefix}/m/${inline.slug}/${key}`
+          });
+        }
+      }
+      blocks.push({
+        label,
+        total: children.length,
+        columns: names.map(humanizeField),
+        editable: true,
+        canDelete: inline.canDelete && childAdmin.canDelete,
+        addUrl,
+        formAction: `${prefix}/m/${admin.slug()}/${identity}/inlines/${inline.slug}`,
+        rows,
+        newRow: {
+          key: "new1",
+          cells: [],
+          fields: inlineFields(childAdmin, names, "new1", {}, {}),
+          url: null
+        },
+        truncated: children.length > visible.length
+      });
+    }
+    return blocks;
+  }
   async function buildAuditView(admin, row, dbSession) {
     const fields = [];
     for (const name of admin.auditFieldNames()) {
@@ -12837,6 +13512,44 @@ function makeAdminRouter(site, options) {
     const row = await admin.repository(dbSession).first({ [admin.identityField]: identity });
     return row ?? null;
   }
+  function renderImport(req, state, admin, error, created, rowErrors) {
+    return renderImportPage(context(req, state.session, state.visible), {
+      title: admin.verboseNamePlural(),
+      actionUrl: `${prefix}/m/${admin.slug()}/import`,
+      backUrl: `${prefix}/m/${admin.slug()}`,
+      columns: admin.editableFieldNames(),
+      error,
+      created,
+      rowErrors
+    });
+  }
+  async function readSubmission(req) {
+    if (!isMultipart(req)) {
+      return { fields: req.body ?? {}, files: [] };
+    }
+    const parsed = await parseMultipart(req, { maxFileBytes: maxUploadBytes });
+    return { fields: parsed.fields, files: parsed.files };
+  }
+  async function applyUploads(admin, data, errors, files, creating) {
+    if (admin.uploadFields.length === 0) return;
+    const storage2 = admin.uploadStorage;
+    if (storage2 === null) return;
+    const columns = adminColumns(admin.model);
+    for (const field of admin.uploadFields) {
+      const file = files.find((candidate) => candidate.field === field);
+      if (file === void 0) {
+        const column6 = columns[field];
+        if (creating && column6 !== void 0 && !isColumnOptional(column6)) {
+          errors[field] = "This field is required.";
+        }
+        continue;
+      }
+      const extension = file.filename.includes(".") ? `.${file.filename.split(".").pop()}` : "";
+      const key = `${admin.slug()}/${field}/${randomUUID()}${extension}`;
+      const saved = await storage2.save(key, file.data, { contentType: file.contentType });
+      data[field] = saved.key;
+    }
+  }
   async function permittedBulkActions(admin, principal) {
     const permitted = [];
     for (const option of bulkActionsFor(admin)) {
@@ -12900,6 +13613,7 @@ function makeAdminRouter(site, options) {
       filters: query.filterViews,
       sort,
       newUrl: await allows(state.principal, admin, AdminPermission.CREATE) ? `${prefix}/m/${admin.slug()}/new` : null,
+      importUrl: admin.canImport && await allows(state.principal, admin, AdminPermission.CREATE) ? `${prefix}/m/${admin.slug()}/import` : null,
       bulkActions: await permittedBulkActions(admin, state.principal),
       bulkUrl: `${prefix}/m/${admin.slug()}/bulk`,
       exportCsvUrl: exportUrl("csv"),
@@ -13024,6 +13738,7 @@ function makeAdminRouter(site, options) {
     const columns = adminColumns(admin.model);
     const options2 = {};
     for (const field of Object.keys(foreignKeyFields(admin))) {
+      if (admin.autocompleteFields.includes(field)) continue;
       const column6 = columns[field];
       if (column6 === void 0) continue;
       const related = await relatedOptions(column6, dbSession);
@@ -13031,8 +13746,60 @@ function makeAdminRouter(site, options) {
     }
     return options2;
   }
+  function autocompleteUrlsFor(admin) {
+    const urls = {};
+    for (const field of admin.autocompleteFields) {
+      urls[field] = `${prefix}/m/${admin.slug()}/autocomplete/${field}`;
+    }
+    return urls;
+  }
+  async function autocompleteLabelsFor(admin, row, dbSession) {
+    const labels = {};
+    if (row === null) return labels;
+    const columns = adminColumns(admin.model);
+    for (const field of admin.autocompleteFields) {
+      const value = row[field];
+      if (value === null || value === void 0 || value === "") continue;
+      const column6 = columns[field];
+      const table = column6 === void 0 ? null : foreignKeyTable(column6);
+      const referenced = table === null ? null : site.get(table);
+      if (referenced === null) continue;
+      const related = await referenced.repository(dbSession).first({ [referenced.identityField]: value });
+      if (related !== null) labels[field] = foreignKeyLabel(referenced, related);
+    }
+    return labels;
+  }
   return router;
 }
+function groupInlineSubmission(body) {
+  const rows = {};
+  const deletions = /* @__PURE__ */ new Set();
+  for (const [key, raw] of Object.entries(body)) {
+    if (!key.startsWith("row.")) continue;
+    const parts = key.split(".");
+    if (parts.length !== 3) continue;
+    const [, rowKey, field] = parts;
+    const value = typeof raw === "string" ? raw : "";
+    if (field === "__delete") {
+      if (!["", "false", "off", "0", "no"].includes(value.trim().toLowerCase())) {
+        deletions.add(rowKey);
+      }
+      continue;
+    }
+    const row = rows[rowKey] ?? {};
+    row[field] = value;
+    rows[rowKey] = row;
+  }
+  return { rows, deletions };
+}
+function inlineFieldNames(childAdmin, inline) {
+  return childAdmin.editableFieldNames().filter(
+    (name) => name !== inline.fkField && !childAdmin.uploadFields.includes(name) && !childAdmin.autocompleteFields.includes(name)
+  );
+}
+function inlineFields(childAdmin, names, key, values, errors) {
+  return buildFormFields(childAdmin, { values, errors }).filter((field) => names.includes(field.name)).map((field) => ({ ...field, name: `row.${key}.${field.name}` }));
+}
 function flagAllows(admin, action) {
   if (action === AdminPermission.CREATE) return admin.canCreate;
   if (action === AdminPermission.EDIT) return admin.canEdit;
@@ -13122,6 +13889,55 @@ function bulkActionsFor(admin) {
   }
   return actions;
 }
+function parseCsv(text) {
+  const source = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+  const rows = [];
+  let row = [];
+  let field = "";
+  let quoted = false;
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index];
+    if (quoted) {
+      if (char === '"') {
+        if (source[index + 1] === '"') {
+          field += '"';
+          index += 1;
+        } else {
+          quoted = false;
+        }
+      } else {
+        field += char;
+      }
+      continue;
+    }
+    if (char === '"') {
+      quoted = true;
+    } else if (char === ",") {
+      row.push(field);
+      field = "";
+    } else if (char === "\n" || char === "\r") {
+      if (char === "\r" && source[index + 1] === "\n") index += 1;
+      row.push(field);
+      rows.push(row);
+      row = [];
+      field = "";
+    } else {
+      field += char;
+    }
+  }
+  if (field !== "" || row.length > 0) {
+    row.push(field);
+    rows.push(row);
+  }
+  const header = rows.shift();
+  if (header === void 0 || header.length === 0) {
+    throw new Error("The file has no header row.");
+  }
+  const keys = header.map((name) => name.trim());
+  return rows.filter((entry) => entry.some((value) => value.trim() !== "")).map(
+    (entry) => Object.fromEntries(keys.map((key, position) => [key, entry[position] ?? ""]))
+  );
+}
 function exportValue(value) {
   if (value instanceof Date) return value.toISOString();
   if (typeof value === "bigint") return value.toString();
@@ -15154,6 +15970,6 @@ async function withTestDatabase(models, fn) {
   }
 }
 
-export { ADMIN_CSS, ActivationService, AdminJsonSite, AdminModel, AdminPermission, AdminSessionStore, AdminSite, AppException, AttemptThrottle, AuditAction, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_DOCS_FAVICON, DEFAULT_LOCALE, EmailProvider, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, HTTPClient, HTTP_500_LOG_FILE, HTTP_500_MARKER, HttpMetrics, IDEMPOTENCY_HEADER, InvalidTokenException, JSONLogger, JWTUtils, LEVEL_LOG_FILES, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MessagingHub, MetricsUtils, MfaService, NotFoundException, OAuthError, OIDCProvider, OutboxRelay, OutboxStatus, PHONE_BR_PATTERN, PasswordResetService, REDOC_CDN_URL, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisIdempotencyStore, RedisRateLimitStore, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, S3UploadStorage, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TenantScopedRepository, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, UserModelAuthBackend, UserTokenPurpose, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WebhookSignatureVerifier, WhatsAppProvider, activationSchema, addLogSink, adminAction, adminColumns, adminLens, adminThemeCss, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildFormFields, buildPaginationLinkHeader, cached2 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, csrfTokenMatches, cursorPaginationFilterSchema, cursorPaginationSchema, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, envList, escapeHtml, filterForColumn, foreignKeyFields, foreignKeyLabel, foreignKeyTable, formatCellValue, formatFieldValue, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, humanizeField, idempotencyMiddleware, inboundMessageSchema, isColumnOptional, isSearchableColumn, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, listStates, logEntrySchema, logSettingsShape, loginSchema, makeAdminJsonRouter, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, metricCard, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, parseFormBody, partitionTotal, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderDashboardPage, renderDetailPage, renderFormPage, renderLayout, renderListPage, renderLoginPage, renderMfaPage, renderPasswordResetFormPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveAdminTheme, resolveDownloadPath, resolveRedocBundle, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, trendDirection, trendPercent, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, widgetForColumn, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };
+export { ADMIN_CSS, ActivationService, AdminJsonSite, AdminModel, AdminPermission, AdminSessionStore, AdminSite, AppException, AttemptThrottle, AuditAction, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_DOCS_FAVICON, DEFAULT_LOCALE, EmailProvider, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, HTTPClient, HTTP_500_LOG_FILE, HTTP_500_MARKER, HttpMetrics, IDEMPOTENCY_HEADER, InvalidTokenException, JSONLogger, JWTUtils, LEVEL_LOG_FILES, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MessagingHub, MetricsUtils, MfaService, MultipartLimitError, NotFoundException, OAuthError, OIDCProvider, OutboxRelay, OutboxStatus, PHONE_BR_PATTERN, PasswordResetService, REDOC_CDN_URL, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisIdempotencyStore, RedisRateLimitStore, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, S3UploadStorage, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TenantScopedRepository, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, UserModelAuthBackend, UserTokenPurpose, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WebhookSignatureVerifier, WhatsAppProvider, activationSchema, addLogSink, adminAction, adminColumns, adminInline, adminLens, adminThemeCss, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildFormFields, buildPaginationLinkHeader, cached2 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, csrfTokenMatches, cursorPaginationFilterSchema, cursorPaginationSchema, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, envList, escapeHtml, filterForColumn, foreignKeyFields, foreignKeyLabel, foreignKeyTable, formatCellValue, formatFieldValue, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, groupInlineSubmission, hashOpaqueToken, humanizeField, idempotencyMiddleware, inboundMessageSchema, isColumnOptional, isMultipart, isSearchableColumn, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, listStates, logEntrySchema, logSettingsShape, loginSchema, makeAdminJsonRouter, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, metricCard, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, parseCsv, parseFormBody, parseMultipart, partitionTotal, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderDashboardPage, renderDetailPage, renderFormPage, renderImportPage, renderLayout, renderListPage, renderLoginPage, renderMfaPage, renderPasswordResetFormPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveAdminTheme, resolveDownloadPath, resolveRedocBundle, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, trendDirection, trendPercent, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, widgetForColumn, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map