@ultimat3/admin 1.0.0

package/src/entity-columns.ts

@@ -0,0 +1,95 @@
+// One registered entity → the flat facts the derivation reads, in declaration order.
+//
+// Two things are not one-to-one and are decided here, once. Money stays ONE property: the
+// admin renders rows, and a row carries `{ minor, currency }` where the migration emits two
+// physical columns. And a foreign key is read back from `$describe()`, because the binding
+// that turns `() => orgs.id` into `"orgs.id"` is private to @ultimat3/entity.
+
+import { AdminFieldUnsupportedError } from './errors';
+import type { AdminColumnMeta, AdminEntity } from './registry';
+
+export interface AdminColumnReference {
+  /** The entity the value points at. */
+  readonly entity: string;
+  /** The column the value IS a value of — the honest default label for the reference. */
+  readonly column: string;
+}
+
+/** One column, flattened. Everything `fields.ts` and `resource.ts` decide from. */
+export interface AdminColumnFacts {
+  /** Property key on the row: what a form input, a filter and an MCP argument are named. */
+  readonly name: string;
+  /** The entity's column kind, mapped to a widget by `fields.ts`. */
+  readonly kind: string;
+  readonly nullable: boolean;
+  readonly primaryKey: boolean;
+  readonly unique: boolean;
+  readonly index: boolean;
+  /** Written by the DB or the framework (`id`, `createdAt`): read-only in every form. */
+  readonly generated: boolean;
+  /** Declared max length. Absent on an unbounded text column, which is prose. */
+  readonly length?: number;
+  readonly values?: readonly string[];
+  readonly references?: AdminColumnReference;
+}
+
+const parseReference = (entity: string, property: string, target: string): AdminColumnReference => {
+  const dot = target.lastIndexOf('.');
+  const entityName = dot < 0 ? '' : target.slice(0, dot);
+  const column = dot < 0 ? '' : target.slice(dot + 1);
+  if (entityName === '' || column === '') {
+    throw new AdminFieldUnsupportedError({
+      entity,
+      field: property,
+      cause: `reference target "${target}" is not "<entity>.<column>", so the admin cannot link it`,
+      fix: `references(() => other.id) — pass a column of an entity() result, then: x manifest`,
+    });
+  }
+  return { entity: entityName, column };
+};
+
+/**
+ * Resolved foreign keys by property. `$describe()` splits a money property into its two
+ * physical columns; neither carries a reference, so they simply never match a property here.
+ */
+const referencesOf = (entity: AdminEntity): ReadonlyMap<string, AdminColumnReference> => {
+  const out = new Map<string, AdminColumnReference>();
+  for (const column of entity.$describe().columns) {
+    if (column.references === null) continue;
+    out.set(column.property, parseReference(entity.$name, column.property, column.references));
+  }
+  return out;
+};
+
+const factsFor = (
+  name: string,
+  meta: AdminColumnMeta,
+  primaryKey: boolean,
+  references: AdminColumnReference | undefined,
+): AdminColumnFacts => ({
+  name,
+  kind: meta.kind,
+  nullable: !meta.notNull,
+  primaryKey,
+  unique: meta.unique,
+  index: meta.index,
+  // A value the writer never supplies. `.default('free')` is a starting value the operator
+  // may still change, so it stays writable — only a generated one is read-only.
+  generated: meta.default?.kind === 'generated' || meta.onUpdate !== undefined,
+  ...(meta.length === undefined ? {} : { length: meta.length }),
+  ...(meta.values === undefined ? {} : { values: meta.values }),
+  ...(references === undefined ? {} : { references }),
+});
+
+/**
+ * Declaration order, which is the order every list, form and MCP schema is built in. A
+ * composite key marks each of its members, the way `$describe()` does — the admin then treats
+ * them as it treats any key column: addressable, and never editable.
+ */
+export function adminColumnsOf(entity: AdminEntity): readonly AdminColumnFacts[] {
+  const references = referencesOf(entity);
+  const keys = new Set(entity.$primaryKey);
+  return Object.entries(entity.$columns).map(([name, column]) =>
+    factsFor(name, column.$meta, column.$meta.primaryKey || keys.has(name), references.get(name)),
+  );
+}

package/src/errors.ts

@@ -0,0 +1,145 @@
+// The X_* codes owned by @ultimat3/admin. Every one names the exact edit that fixes it,
+// because the two dashboards fail at boot (bad registry, bad mount) where an agent has no
+// stack trace to reason from — only the message.
+import { registerErrorCodes, UltimateError } from '@ultimat3/core';
+
+/** Codes this package declares and owns. */
+export const ADMIN_OWNED_ERROR_CODES = [
+  'X_ADMIN_ENTITY_UNKNOWN',
+  'X_ADMIN_FIELD_UNSUPPORTED',
+  'X_ADMIN_POLICY_MISSING',
+  'X_DEV_DASHBOARD_IN_PROD',
+  // `mcp.ts` returns these three on `AdminToolResult.error` instead of throwing — a refusal an
+  // agent reads, not a stack an operator reads. They stayed unregistered because of that, so
+  // `x errors explain X_ADMIN_DENIED` refused a code the admin had just answered with. A code
+  // an agent can be handed is a code the package owns, whichever way it travels.
+  'X_ADMIN_DENIED',
+  'X_ADMIN_TOOL_FORBIDDEN',
+  'X_ADMIN_INVALID',
+] as const;
+
+/**
+ * `X_NOT_IMPLEMENTED` is `@ultimat3/core`'s. `DevSourceUnavailableError` throws it; this package
+ * neither titles nor registers it, because the owner's title is the only one that may exist.
+ */
+export const ADMIN_BORROWED_ERROR_CODES = ['X_NOT_IMPLEMENTED'] as const;
+
+/** Every code admin can throw: the ones it owns plus the one it borrows. */
+export const ADMIN_ERROR_CODES = [
+  ...ADMIN_OWNED_ERROR_CODES,
+  ...ADMIN_BORROWED_ERROR_CODES,
+] as const;
+
+export type AdminOwnedErrorCode = (typeof ADMIN_OWNED_ERROR_CODES)[number];
+export type AdminErrorCode = (typeof ADMIN_ERROR_CODES)[number];
+
+export const ADMIN_ERROR_TITLES: Readonly<Record<AdminOwnedErrorCode, string>> = {
+  X_ADMIN_ENTITY_UNKNOWN: 'the admin references an entity that does not exist',
+  X_ADMIN_FIELD_UNSUPPORTED: 'a column type the admin cannot render',
+  X_ADMIN_POLICY_MISSING: 'an admin-exposed subject has no policy',
+  X_DEV_DASHBOARD_IN_PROD: '/_x was mounted outside dev',
+  X_ADMIN_DENIED: 'the actor may not use this admin surface',
+  X_ADMIN_TOOL_FORBIDDEN: 'an admin MCP tool was called without permission',
+  X_ADMIN_INVALID: "an admin tool's arguments failed the resource schema",
+};
+
+// One unconditional call, so a second package claiming one of admin's codes throws
+// X_ERROR_CODE_DUPLICATE instead of losing silently to whichever module imported first.
+registerErrorCodes(
+  Object.fromEntries(Object.entries(ADMIN_ERROR_TITLES).map(([code, title]) => [code, { title }])),
+);
+
+const docsFor = (code: AdminErrorCode): string => `https://ultimate.dev/errors/${code}`;
+
+/** A resource, nav item, or MCP tool named an entity the registry does not have. */
+export class AdminEntityUnknownError extends UltimateError {
+  constructor(input: { entity: string; known: readonly string[]; cause?: string }) {
+    super({
+      code: 'X_ADMIN_ENTITY_UNKNOWN',
+      cause:
+        input.cause ??
+        `entity "${input.entity}" is not registered (registered: ${
+          input.known.length > 0 ? input.known.join(', ') : 'none'
+        })`,
+      fix: `x g entity ${input.entity}   # then: x manifest`,
+      docs: docsFor('X_ADMIN_ENTITY_UNKNOWN'),
+    });
+  }
+}
+
+/**
+ * A column has no widget, or a value cannot be rendered safely in the widget it maps to.
+ * Money arriving as a float and a timestamptz arriving without an IANA zone are the same
+ * class of bug: the admin would render a number that is wrong for somebody.
+ */
+export class AdminFieldUnsupportedError extends UltimateError {
+  constructor(input: { entity: string; field: string; cause: string; fix: string }) {
+    super({
+      code: 'X_ADMIN_FIELD_UNSUPPORTED',
+      cause: `${input.entity}.${input.field}: ${input.cause}`,
+      fix: input.fix,
+      docs: docsFor('X_ADMIN_FIELD_UNSUPPORTED'),
+    });
+  }
+}
+
+/** An action reached the admin without a policy — the button would be an open door. */
+export class AdminPolicyMissingError extends UltimateError {
+  constructor(input: { subject: string; kind: 'action' | 'resource' }) {
+    super({
+      code: 'X_ADMIN_POLICY_MISSING',
+      cause: `${input.kind} "${input.subject}" is exposed in the admin with no policy`,
+      fix: `add policy: can('${input.subject}') to the ${input.kind} definition`,
+      docs: docsFor('X_ADMIN_POLICY_MISSING'),
+    });
+  }
+}
+
+/**
+ * A `/_x` panel needs a fact the framework cannot introspect on its own — request traces,
+ * caught mail, the read-only SQL tool, the committed manifest. Thrown instead of drawing an
+ * empty panel, because an empty panel reads as "nothing happened".
+ */
+export class DevSourceUnavailableError extends UltimateError {
+  constructor(input: { source: string; panel: string; wiring?: string }) {
+    super({
+      code: 'X_NOT_IMPLEMENTED',
+      cause: `the /_x ${input.panel} panel needs the "${input.source}" source, which is not wired in this process`,
+      // `wiring`, when supplied, replaces the whole `defaultDevSources(...)` argument text —
+      // the default `hooks: { <source> }` phrasing is only valid when the source really is a
+      // `DevSources` key. "authz + actors" is not one; it is two `DevSourceOptions` fields, so
+      // that call site passes its own `wiring` rather than render `hooks: { authz + actors }`,
+      // which is not syntax an agent could run.
+      fix: `devDashboard({ sources: defaultDevSources(${input.wiring ?? `{ hooks: { ${input.source} } }`}) })`,
+      docs: docsFor('X_NOT_IMPLEMENTED'),
+    });
+  }
+}
+
+/** `/_x` is a development tool: it prints SQL, policy traces, and caught mail. */
+export class DevDashboardInProdError extends UltimateError {
+  constructor(input: { role: string; env: string }) {
+    super({
+      code: 'X_DEV_DASHBOARD_IN_PROD',
+      cause: `devDashboard() was called with role="${input.role}" env="${input.env}"; /_x exposes SQL, policy traces, and caught mail`,
+      fix: 'delete the /_x mount from the production entrypoint; run `x dev` locally instead',
+      docs: docsFor('X_DEV_DASHBOARD_IN_PROD'),
+    });
+  }
+}
+
+/** The three strings a failed admin request carries to the view. */
+export interface AdminErrorParts {
+  readonly code: string;
+  readonly cause: string;
+  readonly fix: string;
+}
+
+/**
+ * A route hands a view the error as data, because it crossed a wire and lost its class. The
+ * views render it through ui's `<ErrorState>`, which reads an UltimateError — so it is
+ * rehydrated here rather than paraphrased into a second, drifting rendering.
+ */
+export function adminErrorFrom(parts: AdminErrorParts): UltimateError {
+  return new UltimateError({ code: parts.code, cause: parts.cause, fix: parts.fix });
+}

package/src/fields.ts

@@ -0,0 +1,151 @@
+// The one field-type → widget table. Adding a column kind means adding a row here, so
+// there is never a second opinion about how money or a timestamp is rendered — and an
+// unmapped column is a loud X_ADMIN_FIELD_UNSUPPORTED at derive time, not a blank cell.
+
+import type { AdminColumnFacts } from './entity-columns';
+import { AdminFieldUnsupportedError } from './errors';
+
+export type AdminFieldType =
+  | 'text'
+  | 'textarea'
+  | 'number'
+  | 'money'
+  | 'boolean'
+  | 'enum'
+  | 'date'
+  | 'timestamptz'
+  | 'timezone'
+  | 'locale'
+  | 'json'
+  | 'relation'
+  | 'file';
+
+export type AdminWidget =
+  | 'text-input'
+  | 'textarea'
+  | 'number-input'
+  | 'money'
+  | 'checkbox'
+  | 'select'
+  | 'datetime'
+  | 'timezone-picker'
+  | 'locale-picker'
+  | 'json-editor'
+  | 'reference'
+  | 'upload';
+
+/**
+ * A derived field: everything a list cell, a detail row, a form input, a filter, and an MCP
+ * tool schema need, decided once at derive time. `resource.ts` builds these; nothing else
+ * inspects a column.
+ */
+export interface AdminField {
+  readonly entity: string;
+  readonly name: string;
+  readonly type: AdminFieldType;
+  readonly widget: AdminWidget;
+  /** i18n key, never a string. `admin.<entity>.field.<name>`. */
+  readonly labelKey: string;
+  readonly required: boolean;
+  readonly readOnly: boolean;
+  /** Never rendered, redacted in the audit diff. */
+  readonly sensitive: boolean;
+  readonly inList: boolean;
+  readonly filterable: boolean;
+  readonly sortable: boolean;
+  readonly searchable: boolean;
+  readonly values?: readonly string[];
+  readonly currency?: string;
+  readonly relation?: { readonly entity: string; readonly labelField?: string };
+}
+
+/** The table. Money always the Money widget; both date kinds always the DateTime widget. */
+export const WIDGET_BY_FIELD_TYPE: Readonly<Record<AdminFieldType, AdminWidget>> = {
+  text: 'text-input',
+  textarea: 'textarea',
+  number: 'number-input',
+  money: 'money',
+  boolean: 'checkbox',
+  enum: 'select',
+  date: 'datetime',
+  timestamptz: 'datetime',
+  timezone: 'timezone-picker',
+  locale: 'locale-picker',
+  json: 'json-editor',
+  relation: 'reference',
+  file: 'upload',
+};
+
+export function widgetFor(type: AdminFieldType): AdminWidget {
+  return WIDGET_BY_FIELD_TYPE[type];
+}
+
+/**
+ * Every kind `@ultimat3/entity` can put on a column, and nothing else: a name that no column
+ * builder emits would be a widget nobody can reach. `text` is the entry the length rule below
+ * then refines.
+ */
+const FIELD_TYPE_BY_COLUMN_KIND: Readonly<Record<string, AdminFieldType>> = {
+  uuid: 'text',
+  text: 'textarea',
+  char: 'text',
+  boolean: 'boolean',
+  integer: 'number',
+  bigint: 'number',
+  timestamptz: 'timestamptz',
+  jsonb: 'json',
+  money: 'money',
+};
+
+/**
+ * Derivation order matters: a FK is a relation whatever its kind, and declared `values` mean
+ * a select whatever its kind. Only then does the column kind get a vote — and a text column
+ * with a declared max is one line, where an unbounded `text()` is prose.
+ */
+export function fieldTypeFromColumn(
+  entity: string,
+  field: string,
+  column: AdminColumnFacts,
+): AdminFieldType {
+  if (column.references !== undefined) return 'relation';
+  if (column.values !== undefined && column.values.length > 0) return 'enum';
+
+  const mapped = FIELD_TYPE_BY_COLUMN_KIND[column.kind];
+  if (mapped === undefined) {
+    throw new AdminFieldUnsupportedError({
+      entity,
+      field,
+      cause: `column kind "${column.kind}" has no admin widget`,
+      fix: `adminResource(${entity}, { fields: { ${field}: { widget: 'json-editor' } } })  # or { hidden: true }`,
+    });
+  }
+  return mapped === 'textarea' && column.length !== undefined ? 'text' : mapped;
+}
+
+/** `false` for kinds whose value is never worth a list column (blobs, big JSON, prose). */
+export function listable(type: AdminFieldType): boolean {
+  return type !== 'json' && type !== 'file' && type !== 'textarea';
+}
+
+/** Only indexed, unique, enum, boolean, and FK columns are offered as filters. */
+export function filterable(type: AdminFieldType, column: AdminColumnFacts): boolean {
+  if (column.index || column.unique || column.primaryKey) return true;
+  return type === 'enum' || type === 'boolean' || type === 'relation';
+}
+
+/**
+ * Sortable means "usable as the keyset cursor", so it is deliberately narrow: an ordered
+ * scalar, or a text column with an index behind it. Sorting on an unindexed column would
+ * turn every page of the admin into a sort of the whole table.
+ */
+export function sortable(type: AdminFieldType, column: AdminColumnFacts): boolean {
+  if (type === 'number' || type === 'money' || type === 'date' || type === 'timestamptz') {
+    return true;
+  }
+  if (type !== 'text') return false;
+  return column.index || column.unique || column.primaryKey;
+}
+
+export function searchable(type: AdminFieldType): boolean {
+  return type === 'text' || type === 'textarea';
+}

package/src/form.tsx

@@ -0,0 +1,97 @@
+// Create/edit form. Fields, labels, and required flags come from the resource; validation
+// comes from the entity's own schema, so the form rejects exactly what the action would
+// reject. Issues render against the field they name, and the summary is focusable.
+
+import { t } from '@ultimat3/i18n';
+import { Card, ErrorState, Field } from '@ultimat3/ui';
+import type { JSX } from 'solid-js';
+import { type AdminErrorParts, adminErrorFrom } from './errors';
+import type { AdminRow } from './registry';
+import type { AdminResource } from './resource';
+import type { ValidationIssue } from './validate';
+import type { WidgetContext } from './widget-value';
+import { Widget } from './widgets';
+
+export interface AdminFormProps<Row extends AdminRow> {
+  readonly resource: AdminResource<Row>;
+  readonly mode: 'create' | 'edit';
+  /** Current values, controlled by the route. Empty object for create. */
+  readonly values: Readonly<Record<string, unknown>>;
+  readonly issues: readonly ValidationIssue[];
+  readonly submitting: boolean;
+  readonly error: AdminErrorParts | null;
+  readonly ctx: WidgetContext;
+  readonly onInput: (field: string, value: unknown) => void;
+  readonly onSubmit: () => void;
+  readonly onCancel: () => void;
+}
+
+const issuesFor = (issues: readonly ValidationIssue[], field: string): readonly ValidationIssue[] =>
+  issues.filter((issue) => issue.path === field);
+
+export function AdminForm<Row extends AdminRow>(props: AdminFormProps<Row>): JSX.Element {
+  if (props.error !== null) {
+    return <ErrorState error={adminErrorFrom(props.error)} />;
+  }
+
+  const titleKey = props.mode === 'create' ? 'admin.form.create' : 'admin.form.edit';
+
+  return (
+    <Card header={<h2>{t(titleKey, { entity: t(props.resource.titleKey) })}</h2>}>
+      <form
+        onSubmit={(event: SubmitEvent) => {
+          event.preventDefault();
+          props.onSubmit();
+        }}
+      >
+        {props.issues.length === 0 ? null : (
+          <div class="x-admin-issues" role="alert" tabindex={-1}>
+            <h3>{t('admin.form.issues')}</h3>
+            <ul>
+              {props.issues.map((issue) => (
+                <li>
+                  <a href={`#x-admin-field-${issue.path}`}>{issue.path}</a>: {issue.message}
+                </li>
+              ))}
+            </ul>
+          </div>
+        )}
+
+        {props.resource.formFields.map((field) => {
+          const own = issuesFor(props.issues, field.name);
+          return (
+            // The anchor target the issue summary links to. <Field> owns the control's own
+            // id, so the deep link lands on the wrapper and the label still points at the input.
+            <div id={`x-admin-field-${field.name}`}>
+              <Field
+                label={t(field.labelKey)}
+                required={field.required}
+                error={own.length === 0 ? undefined : own.map((issue) => issue.message).join(' ')}
+              >
+                {(control) => (
+                  <Widget
+                    field={field}
+                    value={props.values[field.name]}
+                    ctx={props.ctx}
+                    mode="edit"
+                    control={control}
+                    onInput={props.onInput}
+                  />
+                )}
+              </Field>
+            </div>
+          );
+        })}
+
+        <div class="x-admin-form-actions">
+          <button type="submit" disabled={props.submitting}>
+            {t(props.submitting ? 'admin.form.saving' : 'admin.form.save')}
+          </button>
+          <button type="button" onClick={() => props.onCancel()}>
+            {t('admin.form.cancel')}
+          </button>
+        </div>
+      </form>
+    </Card>
+  );
+}

package/src/index.ts

@@ -0,0 +1,214 @@
+// The public surface of @ultimat3/admin: the generated app admin, and the /_x dev dashboard.
+// Explicit exports only — a barrel that re-exports everything is how internal helpers become
+// someone's dependency.
+
+export {
+  type ActionGateInput,
+  type AdminActionButton,
+  actionButtons,
+  actionDecisions,
+  decideAction,
+  type InvokeInput,
+  type InvokeResult,
+  invokeAdminAction,
+  permissionsForAction,
+} from './action-gate';
+export { AdminActions, type AdminActionsProps } from './actions';
+export {
+  type AdminApp,
+  type AdminAuth,
+  type AdminRoute,
+  type AdminView,
+  type DefineAdminInput,
+  defineAdmin,
+} from './admin';
+export {
+  AI_PANES,
+  type AiPane,
+  type AiPaneFacts,
+  type AiPaneRequest,
+  type AiPaneResult,
+  type AiPaneScope,
+  type AiPanesOptions,
+  type AiRunner,
+  aiPanes,
+  type GatewayAdapter,
+  runAiPane,
+} from './ai-panes';
+export {
+  type AuditDraft,
+  type AuditEntry,
+  type AuditFieldDiff,
+  type AuditLog,
+  type AuditLogOptions,
+  type AuditOutcome,
+  type AuditSink,
+  auditEntry,
+  deniedDraft,
+  diffRows,
+  memoryAuditLog,
+  REDACTED,
+} from './audit';
+export {
+  type AdminActor,
+  type AdminAuthz,
+  type AdminAuthzQuery,
+  type AdminDecision,
+  type AdminSubject,
+  allowed,
+  anonymousAuthz,
+  decideAll,
+  denied,
+  expandPermissions,
+  isAllowed,
+  staticAuthz,
+} from './authz';
+export {
+  adminCreate,
+  adminDestroy,
+  adminDetail,
+  adminList,
+  adminUpdate,
+  type CrudCtx,
+  type CrudResult,
+  canOperate,
+  decideOperation,
+  type ListResult,
+  permissionsForOperation,
+} from './crud';
+export { AdminDetail, type AdminDetailProps } from './detail';
+export {
+  type AdminColumnFacts,
+  type AdminColumnReference,
+  adminColumnsOf,
+} from './entity-columns';
+// The /_x dashboard is NOT re-exported here — it has its own door, `@ultimat3/admin/dev`, so a
+// host that only mounts the dev panels never loads a production admin component.
+export {
+  ADMIN_ERROR_CODES,
+  ADMIN_ERROR_TITLES,
+  AdminEntityUnknownError,
+  type AdminErrorCode,
+  type AdminErrorParts,
+  AdminFieldUnsupportedError,
+  AdminPolicyMissingError,
+  adminErrorFrom,
+  DevDashboardInProdError,
+  DevSourceUnavailableError,
+} from './errors';
+export {
+  type AdminField,
+  type AdminFieldType,
+  type AdminWidget,
+  fieldTypeFromColumn,
+  filterable,
+  listable,
+  searchable,
+  sortable,
+  WIDGET_BY_FIELD_TYPE,
+  widgetFor,
+} from './fields';
+export { AdminForm, type AdminFormProps } from './form';
+export { AdminLayout, type AdminLayoutProps } from './layout';
+export { AdminList, type AdminListProps } from './list';
+export {
+  type AdminMcpOptions,
+  type AdminToolResult,
+  adminMcp,
+  callAdminTool,
+  type McpInput,
+} from './mcp';
+export {
+  type AdminMcpTool,
+  type AdminToolField,
+  type AdminToolKind,
+  adminMcpTools,
+  adminToolCatalog,
+  adminToolDecisions,
+} from './mcp-tools';
+export { adminNav, type NavGroup, type NavItem, type NavOptions, visibleNav } from './nav';
+export {
+  type AdminCursor,
+  type AdminPage,
+  decodeAdminCursor,
+  encodeAdminCursor,
+  fetchPage,
+  listQuery,
+  type PageRequest,
+  pageFrom,
+} from './pagination';
+export {
+  ADMIN_DESTROY,
+  ADMIN_IMPERSONATE,
+  ADMIN_OPERATION_RULES,
+  ADMIN_OPERATIONS,
+  ADMIN_PERMISSION_SPEC,
+  ADMIN_PERMISSIONS,
+  ADMIN_READ,
+  ADMIN_WRITE,
+  type AdminOperation,
+  type AdminPermission,
+  type AdminPermissionRule,
+  adminPermissionFor,
+  CONFIRMATION_REQUIRED_REASON,
+  confirmationToken,
+  entityPermissionFor,
+  isDestructive,
+  ruleFor,
+} from './permissions';
+export { adminPermissions, type PolicyAuthzInput, policyAuthz } from './policy-bridge';
+export {
+  type AdminAction,
+  type AdminActionCtx,
+  type AdminColumn,
+  type AdminColumnDescription,
+  type AdminColumnMeta,
+  type AdminEntity,
+  type AdminEntityDescription,
+  type AdminFilter,
+  type AdminJobSummary,
+  type AdminListQuery,
+  type AdminRepo,
+  type AdminRow,
+  type AdminSort,
+  type FilterOp,
+  type KeysetBound,
+  type RegisteredEntity,
+  type RegisteredRepo,
+  readField,
+  rowId,
+} from './registry';
+export {
+  type AdminFieldOverride,
+  type AdminResource,
+  type AdminResourceOptions,
+  adminResource,
+  repoOf,
+  resourceFor,
+} from './resource';
+export { type AdminRouteConfig, adminRouteConfig, adminRoutes } from './routes';
+export {
+  type AdminSearchHit,
+  type AdminSearchInput,
+  type AdminSearchResult,
+  adminSearch,
+} from './search';
+export {
+  type AdminBranding,
+  adminBranding,
+  defaultBranding,
+  type ThemeAttributes,
+  type ThemeMode,
+  type ThemeTokenRef,
+  themeAttributes,
+} from './theme';
+export { type ValidationIssue, type ValidationResult, validateInput } from './validate';
+export {
+  assertMoney,
+  assertZone,
+  type SelectOption,
+  type WidgetContext,
+  type WidgetProps,
+  widgetProps,
+} from './widget-value';
+export { Widget, type WidgetInput } from './widgets';