tempest-express-sdk 0.23.0 → 0.25.0

package/dist/index.d.cts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 export { z } from 'zod';
 import * as tempest_db_js from 'tempest-db-js';
-import { Model, ModelClass, BaseRepository, WhereInput, InferModel, InferInsert, PaginationFilter as PaginationFilter$1, PaginationResult, AsyncDriver, AsyncEngine, AsyncSession } from 'tempest-db-js';
+import { Model, ModelClass, BaseRepository, WhereInput, InferModel, InferInsert, PaginationFilter as PaginationFilter$1, PaginationResult, AsyncDriver, AsyncSession, Column, AsyncEngine } from 'tempest-db-js';
 export { AsyncDriver, AsyncEngine, AsyncResult, AsyncSession, BaseRepository, BelongsTo, ColType, Column, ColumnFlags, CompiledQuery, CondNode, Condition, DeleteBuilder, DeleteNode, Dialect, EngineOptions, Executable, HasMany, InferInsert, InferModel, InsertBuilder, InsertNode, Model, ModelClass, NoResultError, NodeSqliteDriver, Operator, OrderTerm, PaginationResult, ParsedDatabaseUrl, PostgresDialect, QueryNode, RecordNotFound, Relation, RelationValue, PaginationFilter as RepositoryPaginationFilter, Returning, RowOf, SelectBuilder, SelectNode, SortDirection, SqliteDialect, SyncEngine, SyncSession, UpdateBuilder, UpdateNode, WhereArg, WhereInput, WithRelations, and, belongsTo, column, columnsOf, createEngine, createSyncEngine, del, detectDialect, getDialect, hasMany, insert, join, loadRelations, not, or, parseDatabaseUrl, select, sql, update } from 'tempest-db-js';
 import { Request, Response as Response$1, RequestHandler, Router, ErrorRequestHandler, Express } from 'express';
 import * as ws from 'ws';
@@ -3493,17 +3493,1313 @@ declare class MessagingHub {
 }
 
 /**
- * Admin site + resource registry, mirroring `admin.site` / `admin.config`.
+ * Signed-cookie sessions for the admin panel, mirroring `admin.session`.
  *
- * The FastAPI SDK ships a server-rendered (jinja) admin UI. Here the admin is a
- * typed **JSON API**: register one {@link AdminResource} per managed entity and
- * {@link makeAdminRouter} exposes auto-derived CRUD + introspection endpoints a
- * frontend (React, etc.) renders. Resources are callback-based, so they wire to
- * a `BaseService` — or any store — in a few lines and stay ORM-agnostic.
+ * The panel's session is **stateless**: the principal id, display name, CSRF
+ * token and expiry travel in the cookie itself, signed with HMAC-SHA256 over
+ * the caller's secret. Nothing is kept server-side, so the panel survives a
+ * restart and works across replicas without a shared store — the property that
+ * matters most for an operator tool that is used in bursts and left open.
+ *
+ * The CSRF token lives inside the session payload, so every write form can
+ * carry it and the server compares it against the cookie it already trusts.
+ */
+
+/** The payload carried by the admin session cookie. */
+interface AdminSession {
+    /** Stable id of the authenticated principal. */
+    subject: string;
+    /** Display name shown in the header. */
+    displayName: string;
+    /** Token every write form echoes back for CSRF validation. */
+    csrfToken: string;
+    /** Expiry, in epoch seconds. */
+    expiresAt: number;
+    /**
+     * `true` once the second factor was accepted. Sessions issued for a
+     * principal without MFA are complete from the start.
+     */
+    mfaPassed: boolean;
+}
+/** Options for {@link AdminSessionStore}. */
+interface AdminSessionStoreOptions {
+    /** HMAC key signing the cookie. At least 32 characters. */
+    secret: string;
+    /** Cookie name. Default `tempest_admin_session`. */
+    cookieName?: string;
+    /** Session lifetime in seconds. Default `28800` (8 hours). */
+    maxAgeSeconds?: number;
+    /** Send the cookie with `Secure` (HTTPS only). Default `true`. */
+    cookieSecure?: boolean;
+    /** Cookie `Path`. Default `/`. */
+    cookiePath?: string;
+}
+/**
+ * Issues, verifies and clears the admin session cookie.
+ *
+ * The cookie value is `<base64url payload>.<base64url signature>`; a payload
+ * whose signature does not verify, or whose expiry has passed, resolves to
+ * `null` — an operator with a tampered or stale cookie is simply logged out.
+ */
+declare class AdminSessionStore {
+    private readonly secret;
+    private readonly cookieName;
+    private readonly maxAgeSeconds;
+    private readonly cookieSecure;
+    private readonly cookiePath;
+    /**
+     * Build the store.
+     *
+     * @param options - Secret, cookie name, lifetime and cookie flags.
+     * @throws Error When the secret is shorter than 32 characters.
+     */
+    constructor(options: AdminSessionStoreOptions);
+    /**
+     * Sign a payload.
+     *
+     * @param payload - The base64url payload to sign.
+     * @returns The base64url signature.
+     */
+    private sign;
+    /**
+     * Mint a fresh session for an authenticated principal.
+     *
+     * @param subject - The principal id.
+     * @param displayName - The name shown in the header.
+     * @param mfaPassed - Whether the second factor is already satisfied.
+     * @returns The new session payload (not yet written to a response).
+     */
+    issue(subject: string, displayName: string, mfaPassed?: boolean): AdminSession;
+    /**
+     * Read and verify the session carried by a request.
+     *
+     * @param req - The inbound request.
+     * @returns The session, or `null` when absent, tampered with or expired.
+     */
+    load(req: Request): AdminSession | null;
+    /**
+     * Write a session to the response as a signed cookie.
+     *
+     * @param res - The outbound response.
+     * @param session - The session to persist.
+     */
+    save(res: Response$1, session: AdminSession): void;
+    /**
+     * Drop the session cookie.
+     *
+     * @param res - The outbound response.
+     */
+    clear(res: Response$1): void;
+    /**
+     * Render a `Set-Cookie` value with the configured flags.
+     *
+     * @param value - The cookie value.
+     * @param maxAge - Lifetime in seconds (`0` expires it immediately).
+     * @returns The header value.
+     */
+    private cookie;
+}
+/**
+ * Compare a submitted CSRF token against the session's, in constant time.
+ *
+ * @param session - The active session.
+ * @param submitted - The `csrf_token` field from the form body.
+ * @returns `true` when the tokens match.
+ */
+declare function csrfTokenMatches(session: AdminSession, submitted: unknown): boolean;
+
+/**
+ * Custom admin actions — operator-defined bulk operations, mirroring
+ * `admin.actions`.
+ *
+ * The panel ships three built-in bulk operations (activate / deactivate /
+ * delete). Anything domain-specific — "send welcome email", "mark as shipped",
+ * "recalculate totals" — is a *custom action*: a handler registered on an
+ * {@link AdminModel} through `actions`, which shows up in the list view's
+ * bulk-action dropdown and runs against the checked rows.
+ *
+ * ```ts
+ * const sendWelcome = adminAction(
+ *   { label: "Send welcome email" },
+ *   async ({ ids, repository }) => {
+ *     const users = await repository.list({ id: { in: ids } });
+ *     for (const user of users) await mailer.sendWelcome(user.email);
+ *     return { message: `Sent ${users.length} welcome emails.` };
+ *   },
+ * );
+ *
+ * site.register(new AdminModel({ model: UserModel, actions: [sendWelcome] }));
+ * ```
+ *
+ * The Python SDK attaches this metadata with an `@admin_action` decorator.
+ * Here {@link adminAction} returns the descriptor instead: the handler stays a
+ * plain function you can call and unit-test directly (`action.handler(ctx)`),
+ * and there is no decorator syntax to enable in a consumer's build.
+ */
+
+/** Banner style a custom action's message is flashed with. */
+type AdminActionCategory = "success" | "error" | "warning";
+/** Everything a custom action handler needs to do its work. */
+interface AdminActionContext<C extends ModelClass = ModelClass> {
+    /** Identity values of the rows the operator checked. */
+    ids: string[];
+    /** Repository for this admin's model, bound to the request's DB session. */
+    repository: BaseRepository<C>;
+    /** The request's DB session, for work beyond the repository. */
+    dbSession: AsyncSession;
+    /** The inbound request. */
+    request: Request;
+    /** The authenticated admin session. */
+    session: AdminSession;
+    /** The resolved admin principal that triggered the action. */
+    principal: unknown;
+}
+/** The outcome of a custom action, flashed on the list view. */
+interface AdminActionResult {
+    /** Human-readable result shown to the operator. */
+    message: string;
+    /** Banner style. Default `"success"`. */
+    category?: AdminActionCategory;
+}
+/** The function a custom action runs. Return `null` to flash nothing. */
+type AdminActionHandler<C extends ModelClass = ModelClass> = (context: AdminActionContext<C>) => Promise<AdminActionResult | null>;
+/** A registered custom action: metadata plus handler. */
+interface AdminAction<C extends ModelClass = ModelClass> {
+    /** Stable identifier (the submitted form value); unique per model. */
+    name: string;
+    /** Text shown in the bulk-action dropdown. */
+    label: string;
+    /** The handler to run against the checked rows. */
+    handler: AdminActionHandler<C>;
+    /** Whether the UI marks this as destructive (a stronger confirm prompt). */
+    dangerous: boolean;
+}
+/** Metadata accepted by {@link adminAction}. */
+interface AdminActionOptions {
+    /** Dropdown label shown to the operator. */
+    label: string;
+    /** Stable identifier (the submitted form value). Defaults to a slug of `label`. */
+    name?: string;
+    /** Flag a destructive action, for a stronger confirm prompt. */
+    dangerous?: boolean;
+}
+/**
+ * Describe a custom bulk action.
+ *
+ * @param options - Label, optional stable name and the destructive flag.
+ * @param handler - The async function run against the checked rows.
+ * @returns The action descriptor to pass to `AdminModel({ actions: [...] })`.
+ * @throws Error When the resolved name is empty.
+ */
+declare function adminAction<C extends ModelClass = ModelClass>(options: AdminActionOptions, handler: AdminActionHandler<C>): AdminAction<C>;
+/** A bulk-action option rendered in the list view's dropdown. */
+interface BulkActionOption {
+    /** Submitted form value. Custom actions are namespaced `custom:<name>`. */
+    value: string;
+    /** Dropdown label. */
+    label: string;
+    /** Whether the action is destructive. */
+    dangerous: boolean;
+}
+
+/**
+ * Column introspection for the admin panel, mirroring `admin.forms`' widget
+ * derivation.
+ *
+ * `tempest-db-js` keeps rich runtime metadata on every column — the canonical
+ * type kind, enum members, `varchar` length, the not-null/default/primary-key
+ * flags and the foreign-key reference — so the admin derives its form widgets
+ * and list filters from the model itself instead of asking the project to
+ * restate them. Kept separate from the router so the (fiddly) type handling is
+ * unit-testable in isolation.
+ */
+
+/** The set of form controls the admin knows how to render. */
+type AdminWidget = "text" | "textarea" | "number" | "checkbox" | "datetime" | "date" | "time" | "select" | "json";
+/** A `(value, label)` pair for a `select` widget. */
+interface AdminSelectOption {
+    value: string;
+    label: string;
+}
+/** The widget a column maps to, plus the attributes that render it. */
+interface WidgetSpec {
+    /** The control to render. */
+    widget: AdminWidget;
+    /** `step` attribute for `number` widgets, or `null`. */
+    step: string | null;
+    /** Options for `select` widgets (empty otherwise). */
+    options: AdminSelectOption[];
+}
+/** How a column is surfaced in the list view's filter bar. */
+type AdminFilterKind = "select" | "daterange" | "text";
+/**
+ * Humanize a column key into a form label (`lastLoginAt` → `Last Login At`).
+ *
+ * @param name - The column key.
+ * @returns A title-cased label.
+ */
+declare function humanizeField(name: string): string;
+/**
+ * Return every column of a model, keyed by field name in declaration order.
+ *
+ * @param model - The model class.
+ * @returns The column map (do not mutate).
+ */
+declare function adminColumns(model: ModelClass): Record<string, Column<unknown>>;
+/**
+ * Map a column to the widget that edits it.
+ *
+ * `json` is matched before anything else because a JSON column carries no
+ * useful scalar type, and `enum` is matched before the string kinds so its
+ * members become a dropdown rather than a free-text input.
+ *
+ * @param column - The column to inspect.
+ * @returns The widget, its `number` step (or `null`) and its `select` options.
+ */
+declare function widgetForColumn(column: Column<unknown>): WidgetSpec;
+/**
+ * Whether a column may be left blank on submit — it is nullable, carries a
+ * default, or is the primary key the database fills in.
+ *
+ * @param column - The column to inspect.
+ * @returns `true` when the field is optional.
+ */
+declare function isColumnOptional(column: Column<unknown>): boolean;
+/**
+ * Map a column to the filter control the list view shows for it.
+ *
+ * Booleans and enums become dropdowns, date-like columns become a from/to pair
+ * of date inputs, and anything else falls back to an equality text input.
+ *
+ * @param column - The column to inspect.
+ * @returns The filter kind and, for `select`, its options.
+ */
+declare function filterForColumn(column: Column<unknown>): {
+    kind: AdminFilterKind;
+    options: AdminSelectOption[];
+};
+/**
+ * Return the table a column points at, when it carries a foreign key.
+ *
+ * @param column - The column to inspect.
+ * @returns The referenced table name, or `null` for a plain column.
+ */
+declare function foreignKeyTable(column: Column<unknown>): string | null;
+/**
+ * Whether a column holds free text a `LIKE '%…%'` search can match.
+ *
+ * @param column - The column to inspect.
+ * @returns `true` for `varchar` / `text` / `char` columns.
+ */
+declare function isSearchableColumn(column: Column<unknown>): boolean;
+
+/**
+ * Declarative admin configuration for one model, mirroring `admin.config`.
+ *
+ * Instantiate one {@link AdminModel} per managed model and hand it to
+ * {@link AdminSite.register}. Unlike Django's class-based `ModelAdmin` this is
+ * a plain typed instance — the constructor options are the contract, there is
+ * no metaclass magic, and every default is derived from the model's own column
+ * metadata so an unconfigured model is already browsable.
+ */
+
+/** Configuration accepted by {@link AdminModel}. */
+interface AdminModelOptions<C extends ModelClass> {
+    /** The model class to manage. */
+    model: C;
+    /** URL slug. Defaults to the model's `tablename`, so URLs track tables. */
+    slug?: string;
+    /** Columns shown in the list view. Defaults to every column but the password hash. */
+    listDisplay?: readonly string[];
+    /** Columns surfaced as filter controls above the list. */
+    listFilter?: readonly string[];
+    /** Text columns searched with `LIKE '%value%'` by the search box. */
+    searchFields?: readonly string[];
+    /** Columns shown but never editable in the create/edit form. */
+    readonlyFields?: readonly string[];
+    /** Default ordering: a column key, or `-column` for descending. */
+    ordering?: string;
+    /** Rows per page in the list view. Default `25`. */
+    pageSize?: number;
+    /** Column used to look one row up from the detail URL. Default `"id"`. */
+    identityField?: string;
+    /** Singular display name. Defaults to the humanized class name. */
+    verboseName?: string;
+    /** Plural display name. Defaults to `verboseName` + `"s"`. */
+    verboseNamePlural?: string;
+    /** Whether the create form + POST endpoint are exposed. Default `true`. */
+    canCreate?: boolean;
+    /** Whether the edit form + POST endpoint are exposed. Default `true`. */
+    canEdit?: boolean;
+    /** Whether the delete action is exposed. Default `true`. */
+    canDelete?: boolean;
+    /**
+     * Custom bulk actions, built with `adminAction`. Each one joins the list
+     * view's action dropdown alongside the built-in activate / deactivate /
+     * delete and runs against the checked rows.
+     */
+    actions?: readonly AdminAction<C>[];
+}
+/**
+ * The admin configuration for one model.
+ *
+ * ```ts
+ * new AdminModel({
+ *   model: UserModel,
+ *   listDisplay: ["email", "isAdmin", "isActive", "createdAt"],
+ *   listFilter: ["isActive", "isAdmin"],
+ *   searchFields: ["email"],
+ *   ordering: "-createdAt",
+ * });
+ * ```
+ */
+declare class AdminModel<C extends ModelClass = ModelClass> {
+    /** The managed model class. */
+    readonly model: C;
+    /** Columns surfaced as filter controls. */
+    readonly listFilter: string[];
+    /** Text columns the search box matches against. */
+    readonly searchFields: string[];
+    /** Columns locked in the create/edit form. */
+    readonlyFields: string[];
+    /** Default ordering column, or `null` to leave it to the repository. */
+    readonly orderKey: string | null;
+    /** Whether {@link AdminModel.orderKey} sorts ascending. */
+    readonly orderAscending: boolean;
+    /** Rows per page in the list view. */
+    readonly pageSize: number;
+    /** Column used to look a single row up from the detail URL. */
+    readonly identityField: string;
+    /** Whether the create form is exposed. */
+    readonly canCreate: boolean;
+    /** Whether the edit form is exposed. */
+    readonly canEdit: boolean;
+    /** Whether the delete action is exposed. */
+    readonly canDelete: boolean;
+    private readonly actions;
+    private readonly slugOverride;
+    private readonly listDisplayOverride;
+    private readonly verboseNameOverride;
+    private readonly verboseNamePluralOverride;
+    /**
+     * Build and validate the configuration.
+     *
+     * @param options - The declarative configuration. See {@link AdminModelOptions}.
+     * @throws Error When a referenced column does not exist on the model.
+     */
+    constructor(options: AdminModelOptions<C>);
+    /**
+     * Return the URL slug the model is exposed under.
+     *
+     * @returns The configured slug, or the model's table name.
+     */
+    slug(): string;
+    /**
+     * Return the singular display name.
+     *
+     * @returns The configured name, or the humanized class name without its
+     *   trailing `Model`.
+     */
+    verboseName(): string;
+    /**
+     * Return the plural display name.
+     *
+     * @returns The configured plural, or the singular with an `s`.
+     */
+    verboseNamePlural(): string;
+    /**
+     * Return every column key on the model, in declaration order.
+     *
+     * @returns The column keys.
+     */
+    columnNames(): string[];
+    /**
+     * Return the columns the list view renders.
+     *
+     * @returns The configured `listDisplay`, or every column but the password hash.
+     */
+    listDisplayNames(): string[];
+    /**
+     * Return the columns the detail view renders.
+     *
+     * Unlike {@link AdminModel.listDisplayNames}, this is not narrowed by
+     * `listDisplay`: the list view is a scannable summary, but the detail view is
+     * where an operator goes to see the whole record, so trimming it there would
+     * hide data with nowhere else to read it.
+     *
+     * @returns Every column but the password hash, in declaration order.
+     */
+    detailFieldNames(): string[];
+    /**
+     * Return the columns a create/edit form exposes.
+     *
+     * Excludes the primary key, the managed timestamps, the password hash and
+     * anything listed in `readonlyFields` — none of which a user edits directly
+     * through the generic form.
+     *
+     * @returns The editable column keys, in declaration order.
+     */
+    editableFieldNames(): string[];
+    /**
+     * Return the registered custom actions, in declaration order.
+     *
+     * @returns The actions passed via `actions` (empty when none). The model
+     *   type is erased here, the way {@link AdminSite} erases it when it stores a
+     *   configuration — a registry keyed by slug cannot stay generic.
+     */
+    customActions(): AdminAction[];
+    /**
+     * Look a custom action up by name.
+     *
+     * @param name - The action identifier (its submitted form value).
+     * @returns The action, or `null` when nothing matches.
+     */
+    getAction(name: string): AdminAction | null;
+    /**
+     * Build a repository for this model bound to a session.
+     *
+     * @param session - The session the repository runs its statements on.
+     * @returns A repository over {@link AdminModel.model}.
+     */
+    repository(session: AsyncSession): BaseRepository<C>;
+}
+/** The row type a configured {@link AdminModel} reads and writes. */
+type AdminRow<A> = A extends AdminModel<infer C> ? InferModel<C> : never;
+
+/**
+ * Form building and submission parsing for the admin CRUD views, mirroring
+ * `admin.forms`.
+ *
+ * One direction turns a model's columns into typed widget descriptors the
+ * templates render; the other reads a posted `application/x-www-form-urlencoded`
+ * body back into coerced values ready for the repository. Both live here, away
+ * from the router, so the fiddly per-type handling is unit-testable on its own.
+ */
+
+/** A single rendered form control. */
+interface AdminFormField {
+    /** Column key, used as the form field name. */
+    name: string;
+    /** Human-readable label. */
+    label: string;
+    /** The control to render. */
+    widget: AdminWidget;
+    /** Pre-filled value, already stringified for the control. */
+    value: string;
+    /** Whether the field must be filled in. */
+    required: boolean;
+    /** Checkbox state (`checkbox` widget only). */
+    checked: boolean;
+    /** `step` attribute for `number` widgets. */
+    step: string | null;
+    /** `(value, label)` pairs for `select` widgets. */
+    options: AdminSelectOption[];
+    /** Per-field validation error, or `null`. */
+    error: string | null;
+}
+/** The outcome of parsing a submitted create/edit form. */
+interface ParsedAdminForm {
+    /** Coerced column values, ready to hand to the repository. */
+    data: Record<string, unknown>;
+    /** Per-field error messages, keyed by column. Empty when the form is valid. */
+    errors: Record<string, string>;
+}
+/** Options for {@link buildFormFields}. */
+interface BuildFormFieldsOptions {
+    /** Current values, keyed by column — a row on edit, a re-submission on error. */
+    values?: Record<string, unknown>;
+    /** Per-field errors to surface, keyed by column. */
+    errors?: Record<string, string>;
+    /**
+     * Options for foreign-key columns whose target model is registered, keyed by
+     * column. A field listed here renders as a `<select>` of related rows instead
+     * of a raw identity text input.
+     */
+    foreignKeyOptions?: Record<string, AdminSelectOption[]>;
+}
+/**
+ * Render a stored value into the string a control pre-fills with.
+ *
+ * @param widget - The control the value is rendered for.
+ * @param value - The stored value.
+ * @returns The control's `value` text (empty for `null`/`undefined`).
+ */
+declare function formatFieldValue(widget: AdminWidget, value: unknown): string;
+/**
+ * Build the controls a create/edit form renders.
+ *
+ * A field with no current value falls back to its column's literal default, so
+ * a blank create form arrives pre-filled the way the database would fill it.
+ * Without that, submitting the form untouched would write `false` over a
+ * `default(true)` flag — the panel would silently deactivate every row it
+ * creates.
+ *
+ * @param admin - The model configuration.
+ * @param options - Current values and per-field errors.
+ * @returns One {@link AdminFormField} per editable column, in declaration order.
+ */
+declare function buildFormFields(admin: AdminModel, options?: BuildFormFieldsOptions): AdminFormField[];
+/**
+ * Read a submitted create/edit form back into coerced column values.
+ *
+ * A checkbox that is absent from the body is `false` (that is how browsers
+ * submit an unchecked box), and an empty text field on an optional column
+ * becomes `null` rather than an empty string, so a cleared field really clears
+ * the column.
+ *
+ * @param admin - The model configuration.
+ * @param body - The parsed request body.
+ * @returns The coerced values plus any per-field errors.
+ */
+declare function parseFormBody(admin: AdminModel, body: Record<string, unknown>): ParsedAdminForm;
+/**
+ * Render a stored value for a read-only list or detail cell.
+ *
+ * @param value - The stored value.
+ * @returns A display string (empty for `null`/`undefined`).
+ */
+declare function formatCellValue(value: unknown): string;
+/**
+ * Return the editable foreign-key columns of an admin, as `field → table`.
+ *
+ * @param admin - The model configuration.
+ * @returns One entry per editable column that references another table.
+ */
+declare function foreignKeyFields(admin: AdminModel): Record<string, string>;
+/**
+ * Build a human label for a referenced row — the analog of Django's `__str__`.
+ *
+ * Prefers the referenced admin's first search field, then a conventional
+ * display attribute, then the row's identity, so a dropdown of related rows
+ * reads as names rather than as a column of UUIDs.
+ *
+ * @param admin - The **referenced** model's configuration.
+ * @param row - The referenced row.
+ * @returns A label for the option.
+ */
+declare function foreignKeyLabel(admin: AdminModel, row: Record<string, unknown>): string;
+
+/**
+ * Authentication backends for the admin panel, mirroring `admin.auth`.
+ *
+ * Operators sign in with a row from the project's own database — there is no
+ * separate admin password store. {@link UserModelAuthBackend} covers the
+ * conventional case (a {@link BaseUserModel} subclass gated on `isActive` and
+ * `isAdmin`); anything else — LDAP, an upstream identity provider, a service
+ * account table — implements {@link AdminAuthBackend} directly.
+ */
+
+/** The columns {@link UserModelAuthBackend} reads off a principal row. */
+interface UserPrincipalRow {
+    id: string;
+    email: string;
+    hashedPassword: string;
+    isActive: boolean;
+    isAdmin: boolean;
+}
+/** Verifies a TOTP code for a principal that enrolled a second factor. */
+interface AdminMfaVerifier {
+    /** Whether the principal has a confirmed second factor. */
+    isEnabled(userId: string): Promise<boolean>;
+    /** Whether `code` is a valid current TOTP for the principal. */
+    verify(userId: string, code: string): Promise<boolean>;
+}
+/**
+ * How the panel turns a login form into a principal.
+ *
+ * The interface is generic in the principal so a custom backend can hand its
+ * own row type back to {@link AdminAuthBackend.displayName} and friends.
+ */
+interface AdminAuthBackend<Principal = unknown> {
+    /**
+     * Verify credentials.
+     *
+     * @param session - A DB session for the current request.
+     * @param identifier - The submitted login identifier (typically an email).
+     * @param password - The submitted plaintext password.
+     * @returns The principal, or `null` when the credentials are rejected.
+     */
+    authenticate(session: AsyncSession, identifier: string, password: string): Promise<Principal | null>;
+    /**
+     * Re-load the principal a session points at, so a deactivated operator loses
+     * access on the next request rather than at cookie expiry.
+     *
+     * @param session - A DB session for the current request.
+     * @param subject - The principal id stored in the session.
+     * @returns The principal, or `null` when it no longer qualifies.
+     */
+    loadPrincipal(session: AsyncSession, subject: string): Promise<Principal | null>;
+    /**
+     * Return the stable id stored in the session cookie.
+     *
+     * @param principal - The authenticated principal.
+     * @returns The principal id.
+     */
+    principalId(principal: Principal): string;
+    /**
+     * Return the name shown in the panel header.
+     *
+     * @param principal - The authenticated principal.
+     * @returns A human-readable label.
+     */
+    displayName(principal: Principal): string;
+    /**
+     * Whether this principal must clear a second factor before entering.
+     *
+     * Omit to declare the backend has no MFA — the panel then treats every
+     * successful password check as a complete login.
+     *
+     * @param principal - The authenticated principal.
+     * @returns `true` when a TOTP challenge is required.
+     */
+    mfaEnabled?(principal: Principal): Promise<boolean>;
+    /**
+     * Verify the submitted TOTP code.
+     *
+     * @param principal - The authenticated principal.
+     * @param code - The submitted code.
+     * @returns `true` when the code is valid.
+     */
+    verifyMfa?(principal: Principal, code: string): Promise<boolean>;
+}
+/** Options for {@link UserModelAuthBackend}. */
+interface UserModelAuthBackendOptions {
+    /** Password hasher. Defaults to a stock {@link PasswordUtils}. */
+    passwords?: PasswordUtils;
+    /**
+     * TOTP verifier. When given, a principal with a confirmed secret is sent
+     * through the panel's `/mfa` challenge after the password check, so the
+     * admin panel can never be the weaker door into an MFA-protected account.
+     */
+    mfa?: AdminMfaVerifier;
+    /** Column holding the login identifier. Default `"email"`. */
+    identifierField?: string;
+    /**
+     * Require `isAdmin === true` on the row. Default `true`. Turn it off only
+     * when the model expresses privilege some other way and the panel is already
+     * gated elsewhere.
+     */
+    requireAdmin?: boolean;
+}
+/**
+ * The conventional backend: authenticate against a {@link BaseUserModel}
+ * subclass, admitting only rows that are both active and flagged as admins.
+ *
+ * ```ts
+ * new UserModelAuthBackend(UserModel);
+ * ```
+ */
+declare class UserModelAuthBackend implements AdminAuthBackend<UserPrincipalRow> {
+    private readonly model;
+    private readonly passwords;
+    private readonly mfa;
+    private readonly identifierField;
+    private readonly requireAdmin;
+    /**
+     * Build the backend.
+     *
+     * @param model - The user model class (a `BaseUserModel` subclass).
+     * @param options - Hasher, MFA verifier and gating overrides.
+     */
+    constructor(model: ModelClass, options?: UserModelAuthBackendOptions);
+    /**
+     * Whether a row is allowed into the panel at all.
+     *
+     * @param row - The candidate row.
+     * @returns `true` when the row is active and (when required) an admin.
+     */
+    private admits;
+    /**
+     * Verify an identifier/password pair.
+     *
+     * The identifier is lowercased and trimmed before lookup, matching the
+     * normalization the auth service applies on signup.
+     *
+     * @param session - A DB session for the current request.
+     * @param identifier - The submitted identifier.
+     * @param password - The submitted plaintext password.
+     * @returns The matching row, or `null` when it does not qualify.
+     */
+    authenticate(session: AsyncSession, identifier: string, password: string): Promise<UserPrincipalRow | null>;
+    /**
+     * Re-load the principal a session points at.
+     *
+     * @param session - A DB session for the current request.
+     * @param subject - The principal id from the session cookie.
+     * @returns The row, or `null` when it vanished or lost its privileges.
+     */
+    loadPrincipal(session: AsyncSession, subject: string): Promise<UserPrincipalRow | null>;
+    /**
+     * Return the row's primary key.
+     *
+     * @param principal - The authenticated row.
+     * @returns The principal id.
+     */
+    principalId(principal: UserPrincipalRow): string;
+    /**
+     * Return the label shown in the panel header.
+     *
+     * @param principal - The authenticated row.
+     * @returns The identifier column's value.
+     */
+    displayName(principal: UserPrincipalRow): string;
+    /**
+     * Whether the principal enrolled a second factor.
+     *
+     * @param principal - The authenticated row.
+     * @returns `true` when an MFA verifier is configured and reports a secret.
+     */
+    mfaEnabled(principal: UserPrincipalRow): Promise<boolean>;
+    /**
+     * Verify a submitted TOTP code.
+     *
+     * @param principal - The authenticated row.
+     * @param code - The submitted code.
+     * @returns `true` when the code is valid.
+     */
+    verifyMfa(principal: UserPrincipalRow, code: string): Promise<boolean>;
+}
+
+/**
+ * Typed theming for the server-rendered admin panel, mirroring `admin.theme`.
+ *
+ * The bundled stylesheet is driven entirely by CSS custom properties declared
+ * on `:root`. An {@link AdminTheme} overrides those properties — plus the logo,
+ * favicon, font and footer — through typed, documented fields instead of
+ * forking the stylesheet. The values are injected as a `<style>` block after
+ * the stylesheet (so they win), which means there is no CSS file to maintain on
+ * the project side and every knob is discoverable in the editor.
+ *
+ * For anything the fields do not cover, point `customCssUrl` at your own
+ * stylesheet — it is linked last, so it overrides everything, including this.
+ */
+/**
+ * Appearance overrides for the admin panel. Every field is optional and
+ * defaults to the stock look, so `{}` is a no-op.
+ */
+interface AdminTheme {
+    /** Primary accent — links, primary buttons, active sidebar item. Default `#2563eb`. */
+    accent?: string;
+    /** Hover/active shade of {@link AdminTheme.accent}. Default `#1d4ed8`. */
+    accentHover?: string;
+    /** Color for destructive actions and error messages. Default `#b91c1c`. */
+    danger?: string;
+    /** Background of the top header band. Default `#0f172a`. */
+    headerBg?: string;
+    /** Background of the left sidebar. Falls back to `headerBg` so the chrome reads as one surface. */
+    sidebarBg?: string;
+    /** Main content background. Omitted uses the mode default (light grey, or near-black in dark mode). */
+    pageBg?: string;
+    /** Border radius for buttons, inputs, cards and tables. Default `6px`. */
+    radius?: string;
+    /** CSS `font-family` for the whole panel. Omitted keeps the system stack. */
+    fontFamily?: string;
+    /** URL of an image shown in the header instead of the brand text. */
+    logoUrl?: string;
+    /** `alt` text for the logo image. Default `Logo`. */
+    logoAlt?: string;
+    /** URL of the browser-tab favicon. */
+    faviconUrl?: string;
+    /** Text shown in the page footer. Default `Powered by tempest-express-sdk`. */
+    footerText?: string;
+    /** Switch the content surfaces to a dark palette (the chrome is already dark). */
+    darkMode?: boolean;
+    /** URL of an extra stylesheet linked **after** the theme, so it overrides everything. */
+    customCssUrl?: string;
+}
+/** An {@link AdminTheme} with every default filled in. */
+interface ResolvedAdminTheme {
+    accent: string;
+    accentHover: string;
+    danger: string;
+    headerBg: string;
+    sidebarBg: string;
+    pageBg: string | null;
+    radius: string;
+    fontFamily: string | null;
+    logoUrl: string | null;
+    logoAlt: string;
+    faviconUrl: string | null;
+    footerText: string;
+    darkMode: boolean;
+    customCssUrl: string | null;
+}
+/**
+ * Fill a theme with its defaults, validating every string field.
+ *
+ * @param theme - The partial theme (or nothing, for the stock look).
+ * @returns The theme with every field resolved.
+ * @throws Error When a string field contains a character that would break the markup.
+ */
+declare function resolveAdminTheme(theme?: AdminTheme): ResolvedAdminTheme;
+/**
+ * Render the `<style>` body for a resolved theme.
+ *
+ * Dark mode only overrides the content-area surfaces — the header and sidebar
+ * are already dark via `--tempest-bg` — and is skipped entirely when the
+ * project pinned its own `pageBg`, since an explicit value always wins.
+ *
+ * @param theme - The resolved theme.
+ * @returns CSS text, ready to inject verbatim inside a `<style>` element.
+ */
+declare function adminThemeCss(theme: ResolvedAdminTheme): string;
+
+/**
+ * Admin site registry, mirroring `admin.site` — the analog of Django's
+ * `AdminSite`.
+ *
+ * A project instantiates one site, registers its {@link AdminModel}
+ * configurations (one at a time with {@link AdminSite.register}, or all at
+ * once with {@link AdminSite.automap}), and hands the site to
+ * `makeAdminRouter`.
+ */
+
+/** Branding and appearance options for an {@link AdminSite}. */
+interface AdminSiteOptions {
+    /** Text used in the page `<title>` and the dashboard heading. Default `"Admin"`. */
+    title?: string;
+    /** Centered header brand. Falls back to `title`. */
+    brand?: string;
+    /** Dashboard subtitle. Default `"Site administration"`. */
+    indexSubtitle?: string;
+    /** Optional outbound "View site" link rendered in the header. */
+    siteUrl?: string;
+    /** Typed appearance overrides. Omitted keeps the stock look. */
+    theme?: AdminTheme;
+}
+/** Options accepted by {@link AdminSite.automap}. */
+interface AdminAutomapOptions extends Omit<AdminModelOptions<ModelClass>, "model"> {
+    /** Models to skip — each entry is the model class or its table name. */
+    exclude?: readonly (ModelClass | string)[];
+    /**
+     * When `true` (default), a model whose slug is already registered is left
+     * untouched, so a hand-tuned {@link AdminModel} can be registered first.
+     * When `false`, a collision throws, as {@link AdminSite.register} does.
+     */
+    skipRegistered?: boolean;
+}
+/**
+ * The registry of {@link AdminModel} configurations a panel exposes.
+ *
+ * ```ts
+ * const site = new AdminSite({ title: "MyApp Admin", brand: "myapp-admin" });
+ * site.register({ model: UserModel, searchFields: ["email"] });
+ * site.automap(models);
+ * ```
+ */
+declare class AdminSite {
+    /** Text used in the page `<title>` and the dashboard heading. */
+    readonly title: string;
+    /** Centered header brand, or `null` to fall back to {@link AdminSite.title}. */
+    readonly brand: string | null;
+    /** Dashboard subtitle. */
+    readonly indexSubtitle: string;
+    /** Outbound "View site" link, or `null`. */
+    readonly siteUrl: string | null;
+    /** Typed appearance overrides. */
+    readonly theme: AdminTheme;
+    private readonly registry;
+    /**
+     * Initialize the site.
+     *
+     * @param options - Branding and appearance. See {@link AdminSiteOptions}.
+     */
+    constructor(options?: AdminSiteOptions);
+    /**
+     * Return the centered header brand text.
+     *
+     * @returns {@link AdminSite.brand} when set, otherwise {@link AdminSite.title}.
+     */
+    brandText(): string;
+    /**
+     * Register a model configuration under its slug.
+     *
+     * @param admin - An {@link AdminModel} instance, or the options to build one.
+     * @returns The registered instance, so the call can be chained or assigned.
+     * @throws Error When another configuration already holds the same slug.
+     */
+    register<C extends ModelClass>(admin: AdminModel<C> | AdminModelOptions<C>): AdminModel<C>;
+    /**
+     * Remove a previously registered configuration.
+     *
+     * @param slug - The slug to drop.
+     * @throws Error When no configuration is registered under the slug.
+     */
+    unregister(slug: string): void;
+    /**
+     * Look a configuration up by slug.
+     *
+     * @param slug - The admin slug.
+     * @returns The configuration, or `null` when nothing matches.
+     */
+    get(slug: string): AdminModel | null;
+    /**
+     * Return every registered configuration, ordered by display name.
+     *
+     * @returns The configurations (empty when nothing is registered).
+     */
+    list(): AdminModel[];
+    /**
+     * Register every concrete model found in `source` at once.
+     *
+     * The batch counterpart to {@link AdminSite.register}: instead of one call
+     * per table, hand it the models barrel and every model class declaring a
+     * `tablename` is wrapped in a default {@link AdminModel}.
+     *
+     * ```ts
+     * import * as models from "./db/models";
+     *
+     * site.automap(models);
+     * site.automap([UserModel, OrderModel], { pageSize: 50 });
+     * ```
+     *
+     * @param source - An array of model classes, or a module namespace object
+     *   whose values are swept (non-model entries are ignored).
+     * @param options - `exclude`, `skipRegistered` and any {@link AdminModel}
+     *   option applied uniformly to every model discovered here.
+     * @returns The configurations newly registered by this call.
+     * @throws Error When `skipRegistered` is `false` and a slug collides.
+     */
+    automap(source: readonly unknown[] | Record<string, unknown>, options?: AdminAutomapOptions): AdminModel[];
+}
+
+/**
+ * The bundled admin stylesheet, served at `{prefix}/static/admin.css`.
+ *
+ * Ported verbatim from tempest-fastapi-sdk's `admin/static/admin.css` so both
+ * SDKs render the same panel. Everything is driven by the `--tempest-*` custom
+ * properties an `AdminTheme` overrides, so a project restyles the panel without
+ * touching this file — see `@/admin/theme`.
+ *
+ * It ships as a string rather than an asset because the package publishes only
+ * `dist`: a `.css` file on disk would not survive the build.
+ */
+/** The stylesheet text. */
+declare const ADMIN_CSS: string;
+
+/**
+ * HTML rendering for the admin panel — the analog of the FastAPI SDK's jinja
+ * templates, written as plain typed functions.
+ *
+ * There is no template engine and no external asset: every page is a string
+ * built from a view model the router prepares, and the only stylesheet is the
+ * one this package serves. That keeps the panel dependency-free (a template
+ * engine would be a runtime dependency every consumer inherits) and keeps the
+ * markup type-checked against the data that fills it.
+ *
+ * Every value interpolated into markup goes through {@link escapeHtml}.
+ */
+
+/**
+ * Escape a value for safe interpolation into HTML text or an attribute.
+ *
+ * @param value - The value to escape.
+ * @returns The escaped text.
+ */
+declare function escapeHtml(value: unknown): string;
+/** One entry in the sidebar's model list. */
+interface AdminNavEntry {
+    /** Display label. */
+    label: string;
+    /** Absolute URL of the model's list view. */
+    url: string;
+}
+/** A banner shown above the page content. */
+interface AdminMessage {
+    /** Message text. */
+    text: string;
+    /** Severity, driving the banner color: `success`, `error` or `warning`. */
+    level: "success" | "error" | "warning";
+}
+/** Everything the chrome needs, shared by every page. */
+interface AdminRenderContext {
+    /** The registered site (branding + models). */
+    site: AdminSite;
+    /** The site's theme, with defaults resolved. */
+    theme: ResolvedAdminTheme;
+    /** The router's mount prefix, without a trailing slash. */
+    prefix: string;
+    /** The active session, or `null` on the login and MFA pages. */
+    session: AdminSession | null;
+    /** The current request path, used to highlight the active sidebar item. */
+    currentPath: string;
+    /** Sidebar entries, one per registered model. */
+    navModels: AdminNavEntry[];
+    /** Banners rendered above the content. */
+    messages: AdminMessage[];
+}
+/**
+ * Wrap page content in the panel chrome: header, sidebar, footer and theme.
+ *
+ * The sidebar is off-canvas below 768px, opened by a checkbox the burger label
+ * toggles — pure CSS, so the panel needs no JavaScript to be navigable.
+ *
+ * @param context - The shared chrome data.
+ * @param title - The page `<title>`.
+ * @param body - The already-escaped content markup.
+ * @returns A complete HTML document.
+ */
+declare function renderLayout(context: AdminRenderContext, title: string, body: string): string;
+/**
+ * Render the sign-in page.
+ *
+ * @param context - The shared chrome data (with no session).
+ * @param error - An error to show above the form, or `null`.
+ * @returns The full page.
+ */
+declare function renderLoginPage(context: AdminRenderContext, error: string | null): string;
+/**
+ * Render the TOTP challenge shown between the password check and the panel.
+ *
+ * @param context - The shared chrome data (with no completed session).
+ * @param error - An error to show above the form, or `null`.
+ * @returns The full page.
+ */
+declare function renderMfaPage(context: AdminRenderContext, error: string | null): string;
+/** One model card on the dashboard. */
+interface AdminDashboardCard {
+    /** Plural display name. */
+    label: string;
+    /** Row count, or `null` when counting failed. */
+    count: number | null;
+    /** URL of the list view. */
+    url: string;
+    /** URL of the create form, or `null` when creation is disabled. */
+    newUrl: string | null;
+}
+/** The system metrics panel on the dashboard. */
+interface AdminDashboardMetrics {
+    /** CPU load as a percentage of available cores. */
+    cpuPercent: number;
+    /** Memory used, as a percentage. */
+    memoryPercent: number;
+    /** Memory used, in GB. */
+    memoryUsedGb: string;
+    /** Memory total, in GB. */
+    memoryTotalGb: string;
+}
+/**
+ * Render the dashboard: one card per registered model plus the optional system
+ * metrics panel.
+ *
+ * @param context - The shared chrome data.
+ * @param cards - One entry per registered model.
+ * @param metrics - The system metrics panel, or `null` when disabled.
+ * @returns The full page.
+ */
+declare function renderDashboardPage(context: AdminRenderContext, cards: AdminDashboardCard[], metrics: AdminDashboardMetrics | null): string;
+/** A filter control rendered above the list view. */
+interface AdminFilterView {
+    /** Column key the control filters on. */
+    field: string;
+    /** Human-readable label. */
+    label: string;
+    /** Which control to render. */
+    kind: "select" | "daterange" | "text";
+    /** Current value for `select` and `text` controls. */
+    value: string;
+    /** Lower bound for a `daterange` control. */
+    valueFrom: string;
+    /** Upper bound for a `daterange` control. */
+    valueTo: string;
+    /** Options for a `select` control. */
+    options: {
+        value: string;
+        label: string;
+        selected: boolean;
+    }[];
+}
+/** A clickable column header's sort state. */
+interface AdminSortView {
+    /** URL that applies (or flips) this column's ordering. */
+    url: string;
+    /** Whether the list is currently ordered by this column. */
+    active: boolean;
+    /** Whether the current ordering is ascending. */
+    ascending: boolean;
+}
+/** The view model the list page renders. */
+interface AdminListView {
+    /** Plural display name shown as the heading. */
+    title: string;
+    /** Column keys rendered as table columns. */
+    columns: string[];
+    /** One entry per row: its identity plus the formatted cells. */
+    rows: {
+        identity: string;
+        cells: string[];
+        url: string;
+    }[];
+    /** Total matching rows, across all pages. */
+    total: number;
+    /** Current page number, 1-based. */
+    page: number;
+    /** Total page count. */
+    pages: number;
+    /** URL of the previous page, or `null` on the first page. */
+    prevUrl: string | null;
+    /** URL of the next page, or `null` on the last page. */
+    nextUrl: string | null;
+    /** Whether a search box is rendered. */
+    searchable: boolean;
+    /** Current search text. */
+    searchValue: string;
+    /** Filter controls. */
+    filters: AdminFilterView[];
+    /** Sort state per column key. */
+    sort: Record<string, AdminSortView>;
+    /** URL of the create form, or `null` when creation is disabled. */
+    newUrl: string | null;
+    /** Bulk actions offered above the table. Empty hides the whole bulk UI. */
+    bulkActions: BulkActionOption[];
+    /** URL the bulk form posts to. */
+    bulkUrl: string;
+    /** URL exporting the current result set as CSV. */
+    exportCsvUrl: string;
+    /** URL exporting the current result set as JSON. */
+    exportJsonUrl: string;
+}
+/**
+ * Render the paginated list view, with its search box, filters and sortable
+ * column headers.
+ *
+ * @param context - The shared chrome data.
+ * @param view - The prepared list view model.
+ * @returns The full page.
+ */
+declare function renderListPage(context: AdminRenderContext, view: AdminListView): string;
+/** The view model the detail page renders. */
+interface AdminDetailView {
+    /** Singular display name. */
+    title: string;
+    /** The row's identity, shown next to the title. */
+    identity: string;
+    /** One `(label, value)` pair per column. */
+    fields: {
+        label: string;
+        value: string;
+    }[];
+    /** URL of the list view. */
+    backUrl: string;
+    /** URL of the edit form, or `null` when editing is disabled. */
+    editUrl: string | null;
+    /** URL the delete form posts to, or `null` when deletion is disabled. */
+    deleteUrl: string | null;
+}
+/**
+ * Render the single-record detail view.
+ *
+ * @param context - The shared chrome data (with an active session).
+ * @param view - The prepared detail view model.
+ * @returns The full page.
+ * @throws Error When called without a session, since the write forms need a CSRF token.
+ */
+declare function renderDetailPage(context: AdminRenderContext, view: AdminDetailView): string;
+/** The view model the create/edit form renders. */
+interface AdminFormView {
+    /** Whether the form creates a new record or edits an existing one. */
+    mode: "create" | "edit";
+    /** Singular display name. */
+    title: string;
+    /** The controls to render. */
+    fields: AdminFormField[];
+    /** URL the form posts to. */
+    actionUrl: string;
+    /** URL of the page to return to. */
+    backUrl: string;
+    /** A form-level error shown above the fields, or `null`. */
+    error: string | null;
+}
+/**
+ * Render the create/edit form.
+ *
+ * @param context - The shared chrome data (with an active session).
+ * @param view - The prepared form view model.
+ * @returns The full page.
+ * @throws Error When called without a session, since the form needs a CSRF token.
+ */
+declare function renderFormPage(context: AdminRenderContext, view: AdminFormView): string;
+
+/**
+ * The server-rendered admin panel router, mirroring `admin.router`.
+ *
+ * Mounts a Django-style panel over an {@link AdminSite}: operators sign in with
+ * a row from the project's own database, then browse, search, filter, sort,
+ * create, edit and delete every registered model. Nothing here is JSON — the
+ * responses are HTML pages built by `@/admin/templates` and styled by the one
+ * stylesheet this package serves.
+ *
+ * ```text
+ * GET  {prefix}/static/admin.css       the bundled stylesheet
+ * GET  {prefix}/login                  sign-in form
+ * POST {prefix}/login                  credential check
+ * GET  {prefix}/mfa                    TOTP challenge (backends with MFA)
+ * POST {prefix}/mfa                    TOTP verification
+ * POST {prefix}/logout                 drop the session
+ * GET  {prefix}/                       dashboard: row counts + system metrics
+ * GET  {prefix}/m/:slug                list view: search, filters, sort, pages
+ * GET  {prefix}/m/:slug/new            create form
+ * POST {prefix}/m/:slug/new            create
+ * GET  {prefix}/m/:slug/:identity      detail view
+ * GET  {prefix}/m/:slug/:identity/edit edit form
+ * POST {prefix}/m/:slug/:identity/edit update
+ * POST {prefix}/m/:slug/:identity/delete delete
+ * ```
+ *
+ * Every state-changing POST carries the session's CSRF token and is rejected
+ * with `403` when it does not match.
+ */
+
+/** Options for {@link makeAdminRouter}. */
+interface AdminRouterOptions {
+    /** The engine the panel opens a session on for each request. */
+    engine: AsyncEngine;
+    /** How the login form turns credentials into a principal. */
+    authBackend: AdminAuthBackend;
+    /** HMAC key signing the session cookie. At least 32 characters. */
+    secretKey: string;
+    /** Mount prefix. Default `/admin`. */
+    prefix?: string;
+    /** Send the session cookie with `Secure`. Default `true` — turn it off only in local HTTP dev. */
+    cookieSecure?: boolean;
+    /** Session cookie name. Default `tempest_admin_session`. */
+    cookieName?: string;
+    /** Session lifetime in seconds. Default `28800` (8 hours). */
+    sessionMaxAgeSeconds?: number;
+    /** Show the CPU/memory panel on the dashboard. Default `true`. */
+    showMetrics?: boolean;
+    /**
+     * Hard cap on rows the CSV/JSON export writes. Default `5000`. An export is
+     * a full table scan streamed to a browser, so the cap is what keeps a curious
+     * click on a large table from becoming an outage.
+     */
+    exportMaxRows?: number;
+}
+/**
+ * Build the admin panel router.
+ *
+ * @param site - The registered {@link AdminSite}.
+ * @param options - Engine, auth backend, signing key and cookie/appearance flags.
+ * @returns An Express router serving the whole panel under its prefix.
+ * @throws Error When the signing key is shorter than 32 characters.
+ */
+declare function makeAdminRouter(site: AdminSite, options: AdminRouterOptions): Router;
+
+/**
+ * Headless admin: resource registry for the JSON admin API.
+ *
+ * The counterpart to the server-rendered panel in `@/admin/site`. Register one
+ * {@link AdminJsonResource} per managed entity and {@link makeAdminJsonRouter}
+ * exposes auto-derived CRUD + introspection endpoints your own frontend
+ * (React, etc.) renders. Resources are callback-based, so they wire to a
+ * `BaseService` — or any store — in a few lines and stay ORM-agnostic.
+ *
+ * Reach for this when the UI is yours; reach for {@link AdminSite} +
+ * `makeAdminRouter` when you want the batteries-included HTML panel.
  */
 
 /** A field descriptor a frontend uses to render list columns / form inputs. */
-interface AdminField {
+interface AdminJsonField {
     /** Field name (property key). */
     name: string;
     /** Loose type hint for rendering (`string`, `number`, `boolean`, `date`, …). */
@@ -3513,16 +4809,16 @@ interface AdminField {
     /** Whether the field is read-only (shown, never submitted). */
     readOnly?: boolean;
 }
-/** A paginated list result returned by {@link AdminResource.list}. */
-interface AdminListResult<T = unknown> {
+/** A paginated list result returned by {@link AdminJsonResource.list}. */
+interface AdminJsonListResult<T = unknown> {
     items: T[];
     total: number;
     page: number;
     pageSize: number;
     pages: number;
 }
-/** Query parameters passed to {@link AdminResource.list}. */
-interface AdminListQuery {
+/** Query parameters passed to {@link AdminJsonResource.list}. */
+interface AdminJsonListQuery {
     page: number;
     pageSize: number;
     /** Remaining query-string entries (domain filters). */
@@ -3532,13 +4828,13 @@ interface AdminListQuery {
  * A managed resource. Only `name`, `fields` and `list`/`get` are required;
  * omit a write callback to make that operation unavailable (405).
  */
-interface AdminResource<T = unknown> {
+interface AdminJsonResource<T = unknown> {
     /** URL-safe resource slug (e.g. `users`). */
     name: string;
     /** Field descriptors for list/detail/form rendering. */
-    fields: AdminField[];
+    fields: AdminJsonField[];
     /** Return a page of records. */
-    list(query: AdminListQuery): Promise<AdminListResult<T>>;
+    list(query: AdminJsonListQuery): Promise<AdminJsonListResult<T>>;
     /** Return one record by id, or `null` when absent. */
     get(id: string): Promise<T | null>;
     /** Create a record from validated input. */
@@ -3553,7 +4849,7 @@ interface AdminResource<T = unknown> {
     updateSchema?: z.ZodType;
 }
 /** A registry of admin resources. */
-declare class AdminSite {
+declare class AdminJsonSite {
     readonly brand: string;
     private readonly resources;
     /**
@@ -3566,17 +4862,17 @@ declare class AdminSite {
      * @param resource - The resource config.
      * @returns The same resource (for chaining).
      */
-    register<T>(resource: AdminResource<T>): AdminResource<T>;
+    register<T>(resource: AdminJsonResource<T>): AdminJsonResource<T>;
     /** Look up a resource by slug, or `null`. */
-    get(name: string): AdminResource | null;
+    get(name: string): AdminJsonResource | null;
     /** Every registered resource. */
-    list(): AdminResource[];
+    list(): AdminJsonResource[];
 }
 
 /**
  * Admin JSON router, mirroring `admin.router.make_admin_router`.
  *
- * Exposes auto-derived CRUD + introspection over an {@link AdminSite}:
+ * Exposes auto-derived CRUD + introspection over an {@link AdminJsonSite}:
  *
  * ```text
  * GET    {prefix}/                    site brand + resource list
@@ -3591,8 +4887,8 @@ declare class AdminSite {
  * Pass a `guard` middleware (e.g. JWT + `requireRoles("admin")`) to protect it.
  */
 
-/** Options for {@link makeAdminRouter}. */
-interface AdminRouterOptions {
+/** Options for {@link makeAdminJsonRouter}. */
+interface AdminJsonRouterOptions {
     /** Route prefix. Default `/admin`. */
     prefix?: string;
     /** Guard middleware applied to every admin route (auth). */
@@ -3601,11 +4897,11 @@ interface AdminRouterOptions {
 /**
  * Build the admin router.
  *
- * @param site - The registered {@link AdminSite}.
+ * @param site - The registered {@link AdminJsonSite}.
  * @param options - Prefix and guard middleware.
  * @returns An Express router with the admin endpoints mounted.
  */
-declare function makeAdminRouter(site: AdminSite, options?: AdminRouterOptions): Router;
+declare function makeAdminJsonRouter(site: AdminJsonSite, options?: AdminJsonRouterOptions): Router;
 
 /**
  * Auth DTOs (Zod), mirroring `auth.schemas`.
@@ -5259,6 +6555,6 @@ declare function createTestDatabase(models: readonly ModelClass[]): TestDatabase
 declare function withTestDatabase<T>(models: readonly ModelClass[], fn: (db: TestDatabase) => Promise<T>): Promise<T>;
 
 /** The installed SDK version. Single source of truth for the barrel + CLI. */
-declare const VERSION = "0.23.0";
+declare const VERSION = "0.25.0";
 
-export { type ActivationInput, ActivationService, type ActivationServiceOptions, type ActivationStore, type AdminField, type AdminListQuery, type AdminListResult, type AdminResource, type AdminRouterOptions, AdminSite, AppException, type AppExceptionHandlerOptions, type AppExceptionOptions, type AttachWebSocketOptions, AttemptThrottle, type AttemptThrottleOptions, AuditAction, type AuthResponse, type AuthResultPageOptions, type AuthRouterOptions, type AuthUser, type BackupOptions, type BaseAppSettings, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, type BaseResponse, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, type BodySizeLimitOptions, type BroadcastOptions, type BroadcastResult, type BrokerManager, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, type CPUMetrics, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type CacheManager, type CachedOptions, type CachedResponse, type CatalogData, CircuitOpenError, type ClientIpOptions, CompositeFeatureFlagBackend, ConflictException, type CreateAppOpenApi, type CreateAppOptions, type CsrfOptions, type CursorPaginationFilter, DEFAULT_DOCS_FAVICON, DEFAULT_LOCALE, type DownloadOptions, type EmailMessage, type EmailOptions, EmailProvider, type EmailProviderOptions, EmailUtils, type Enum, type EnumHelpers, type EnumSpec, EnvFeatureFlagBackend, EventStream, type EventStreamOptions, type ExceptionDetails, ExpiredTokenException, type FeatureFlagBackend, FeatureFlags, type FieldChange, type FileLoggingHandle, type FileLoggingOptions, type FlagContext, ForbiddenException, type GPUMetrics, type GenerateOpenApiOptions, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, type GracefulShutdownOptions, HTTPClient, type HTTPClientOptions, HTTP_500_LOG_FILE, HTTP_500_MARKER, type HandshakeInfo, type HealthCheck, type HealthRouterOptions, HttpMetrics, IDEMPOTENCY_HEADER, type IdempotencyOptions, type IdempotencyRedisLike, type IdempotencyStore, type InboundHandler, type InboundMessage, InvalidTokenException, type IssuedSession, JSONLogger, JWTUtils, type JWTUtilsOptions, type JwtAuthOptions, type JwtClaims, type JwtDecoderLike, LEVEL_LOG_FILES, LocalUploadStorage, type LocalUploadStorageOptions, type LogEntry, type LogExtra, type LogLevel, type LogSink, type LogSource, type LoginInput, type LoginResult, type LogsRouterOptions, type MediaKind, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, type MemoryMetrics, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, type MessageHandler, MessagingHub, type MessagingProvider, type MetricsRouterOptions, MetricsUtils, type MfaChallenge, type MfaChallengeInput, type MfaCodeInput, type MfaEnrollment, MfaService, type MfaServiceOptions, type MfaStore, NotFoundException, type OAuthClientOptions, OAuthError, type OAuthTokens, type OAuthUser, OIDCProvider, type OIDCProviderOptions, type OpenApiDocument, type OpenApiInfo, type OutboundMedia, type OutboundResult, type OutboxPublisher, OutboxRelay, type OutboxRelayOptions, OutboxStatus, PHONE_BR_PATTERN, type PaginationFilter, type PaginationLinkOptions, type PasswordResetConfirmInput, type PasswordResetFormOptions, type PasswordResetRequestInput, PasswordResetService, type PasswordResetServiceOptions, type PasswordResetStore, PasswordUtils, REDOC_CDN_URL, REQUEST_ID_HEADER, RabbitBroker, type RabbitBrokerOptions, type RateLimitKeyFunc, type RateLimitOptions, type RateLimitRedisLike, type RateLimitResult, type RateLimitStore, RedisCacheManager, RedisIdempotencyStore, type RedisLike, type RedisPublisherLike, RedisRateLimitStore, RedisSSEBroker, type RedisSSEBrokerOptions, RedisSessionStore, type RedisSubscriberLike, type RedocBundleSource, type RedocOptions, type RefreshInput, Region, type RegionValue, type RegisterExceptionHandlersOptions, type RequestContext, type RequestTracingOptions, type ResponseMapper, RetryPolicy, type RunServerOptions, type S3ClientLike, S3UploadStorage, type S3UploadStorageOptions, SSEBroker, type SaveOptions, type SendOptions, ServerSentEvent, type ServerSentEventInit, type Session, type SessionMiddlewareOptions, type SessionRedisLike, SessionService, type SessionServiceOptions, type SessionStore, type SignupInput, type SlowQueryOptions, type SpecProvider, type StateBR, type SwaggerOptions, type SyncFilter, type SystemMetrics, TOTPHelper, type TOTPOptions, type TaskHandler, TaskManager, type TaskManagerOptions, TelegramProvider, type TelegramProviderOptions, TenantScopedRepository, type TestDatabase, type ThrottleBackend, type ThrottleStatus, type ToDictOptions, type TokenPair, TooManyRequestsException, type TooManyRequestsOptions, type ToolSpecOptions, TwilioSmsProvider, type TwilioSmsProviderOptions, type TwilioWebhookOptions, UF, type UFValue, UnauthorizedException, type UnhandledExceptionHandlerOptions, type UploadResult, type UploadStorage, UserAuthService, type UserAuthServiceOptions, type UserPublic, type UserStore, UserTokenPurpose, VERSION, ValidationException, type WSEnvelope, WebPushDispatcher, type WebPushDispatcherOptions, WebPushError, WebPushGoneError, type WebPushKeys, type WebPushPayload, type WebPushSubscription, type WebSocketConnection, WebSocketHub, type WebSocketHubOptions, type WebSocketLike, type WebhookSignatureOptions, WebhookSignatureVerifier, WhatsAppProvider, type WhatsAppProviderOptions, type WhatsAppWebhookOptions, activationSchema, addLogSink, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildPaginationLinkHeader, cached, centsField, cepField, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, looseBoolean as envBoolean, envList, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, hexColorField, idempotencyMiddleware, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, latitudeField, listStates, loadSettings, logEntrySchema, logSettingsShape, loginSchema, longitudeField, looseBoolean, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, passwordResetConfirmSchema, passwordResetRequestSchema, percentField, phoneBrField, portField, positiveFloatField, positiveIntField, priceField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, ratingField, ratioField, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderPasswordResetFormPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveDownloadPath, resolveRedocBundle, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, serverSettingsShape, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, slugField, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };
+export { ADMIN_CSS, type ActivationInput, ActivationService, type ActivationServiceOptions, type ActivationStore, type AdminAction, type AdminActionCategory, type AdminActionContext, type AdminActionHandler, type AdminActionOptions, type AdminActionResult, type AdminAuthBackend, type AdminAutomapOptions, type AdminDashboardCard, type AdminDashboardMetrics, type AdminDetailView, type AdminFilterKind, type AdminFilterView, type AdminFormField, type AdminFormView, type AdminJsonField, type AdminJsonListQuery, type AdminJsonListResult, type AdminJsonResource, type AdminJsonRouterOptions, AdminJsonSite, type AdminListView, type AdminMessage, type AdminMfaVerifier, AdminModel, type AdminModelOptions, type AdminNavEntry, type AdminRenderContext, type AdminRouterOptions, type AdminRow, type AdminSelectOption, type AdminSession, AdminSessionStore, type AdminSessionStoreOptions, AdminSite, type AdminSiteOptions, type AdminSortView, type AdminTheme, type AdminWidget, AppException, type AppExceptionHandlerOptions, type AppExceptionOptions, type AttachWebSocketOptions, AttemptThrottle, type AttemptThrottleOptions, AuditAction, type AuthResponse, type AuthResultPageOptions, type AuthRouterOptions, type AuthUser, type BackupOptions, type BaseAppSettings, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, type BaseResponse, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, type BodySizeLimitOptions, type BroadcastOptions, type BroadcastResult, type BrokerManager, type BuildFormFieldsOptions, type BulkActionOption, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, type CPUMetrics, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type CacheManager, type CachedOptions, type CachedResponse, type CatalogData, CircuitOpenError, type ClientIpOptions, CompositeFeatureFlagBackend, ConflictException, type CreateAppOpenApi, type CreateAppOptions, type CsrfOptions, type CursorPaginationFilter, DEFAULT_DOCS_FAVICON, DEFAULT_LOCALE, type DownloadOptions, type EmailMessage, type EmailOptions, EmailProvider, type EmailProviderOptions, EmailUtils, type Enum, type EnumHelpers, type EnumSpec, EnvFeatureFlagBackend, EventStream, type EventStreamOptions, type ExceptionDetails, ExpiredTokenException, type FeatureFlagBackend, FeatureFlags, type FieldChange, type FileLoggingHandle, type FileLoggingOptions, type FlagContext, ForbiddenException, type GPUMetrics, type GenerateOpenApiOptions, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, type GracefulShutdownOptions, HTTPClient, type HTTPClientOptions, HTTP_500_LOG_FILE, HTTP_500_MARKER, type HandshakeInfo, type HealthCheck, type HealthRouterOptions, HttpMetrics, IDEMPOTENCY_HEADER, type IdempotencyOptions, type IdempotencyRedisLike, type IdempotencyStore, type InboundHandler, type InboundMessage, InvalidTokenException, type IssuedSession, JSONLogger, JWTUtils, type JWTUtilsOptions, type JwtAuthOptions, type JwtClaims, type JwtDecoderLike, LEVEL_LOG_FILES, LocalUploadStorage, type LocalUploadStorageOptions, type LogEntry, type LogExtra, type LogLevel, type LogSink, type LogSource, type LoginInput, type LoginResult, type LogsRouterOptions, type MediaKind, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, type MemoryMetrics, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, type MessageHandler, MessagingHub, type MessagingProvider, type MetricsRouterOptions, MetricsUtils, type MfaChallenge, type MfaChallengeInput, type MfaCodeInput, type MfaEnrollment, MfaService, type MfaServiceOptions, type MfaStore, NotFoundException, type OAuthClientOptions, OAuthError, type OAuthTokens, type OAuthUser, OIDCProvider, type OIDCProviderOptions, type OpenApiDocument, type OpenApiInfo, type OutboundMedia, type OutboundResult, type OutboxPublisher, OutboxRelay, type OutboxRelayOptions, OutboxStatus, PHONE_BR_PATTERN, type PaginationFilter, type PaginationLinkOptions, type ParsedAdminForm, type PasswordResetConfirmInput, type PasswordResetFormOptions, type PasswordResetRequestInput, PasswordResetService, type PasswordResetServiceOptions, type PasswordResetStore, PasswordUtils, REDOC_CDN_URL, REQUEST_ID_HEADER, RabbitBroker, type RabbitBrokerOptions, type RateLimitKeyFunc, type RateLimitOptions, type RateLimitRedisLike, type RateLimitResult, type RateLimitStore, RedisCacheManager, RedisIdempotencyStore, type RedisLike, type RedisPublisherLike, RedisRateLimitStore, RedisSSEBroker, type RedisSSEBrokerOptions, RedisSessionStore, type RedisSubscriberLike, type RedocBundleSource, type RedocOptions, type RefreshInput, Region, type RegionValue, type RegisterExceptionHandlersOptions, type RequestContext, type RequestTracingOptions, type ResolvedAdminTheme, type ResponseMapper, RetryPolicy, type RunServerOptions, type S3ClientLike, S3UploadStorage, type S3UploadStorageOptions, SSEBroker, type SaveOptions, type SendOptions, ServerSentEvent, type ServerSentEventInit, type Session, type SessionMiddlewareOptions, type SessionRedisLike, SessionService, type SessionServiceOptions, type SessionStore, type SignupInput, type SlowQueryOptions, type SpecProvider, type StateBR, type SwaggerOptions, type SyncFilter, type SystemMetrics, TOTPHelper, type TOTPOptions, type TaskHandler, TaskManager, type TaskManagerOptions, TelegramProvider, type TelegramProviderOptions, TenantScopedRepository, type TestDatabase, type ThrottleBackend, type ThrottleStatus, type ToDictOptions, type TokenPair, TooManyRequestsException, type TooManyRequestsOptions, type ToolSpecOptions, TwilioSmsProvider, type TwilioSmsProviderOptions, type TwilioWebhookOptions, UF, type UFValue, UnauthorizedException, type UnhandledExceptionHandlerOptions, type UploadResult, type UploadStorage, UserAuthService, type UserAuthServiceOptions, UserModelAuthBackend, type UserModelAuthBackendOptions, type UserPublic, type UserStore, UserTokenPurpose, VERSION, ValidationException, type WSEnvelope, WebPushDispatcher, type WebPushDispatcherOptions, WebPushError, WebPushGoneError, type WebPushKeys, type WebPushPayload, type WebPushSubscription, type WebSocketConnection, WebSocketHub, type WebSocketHubOptions, type WebSocketLike, type WebhookSignatureOptions, WebhookSignatureVerifier, WhatsAppProvider, type WhatsAppProviderOptions, type WhatsAppWebhookOptions, type WidgetSpec, activationSchema, addLogSink, adminAction, adminColumns, adminThemeCss, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildFormFields, buildPaginationLinkHeader, cached, centsField, cepField, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, csrfTokenMatches, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, looseBoolean as envBoolean, envList, escapeHtml, filterForColumn, foreignKeyFields, foreignKeyLabel, foreignKeyTable, formatCellValue, formatFieldValue, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, hexColorField, humanizeField, idempotencyMiddleware, inboundMessageSchema, isColumnOptional, isSearchableColumn, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, latitudeField, listStates, loadSettings, logEntrySchema, logSettingsShape, loginSchema, longitudeField, looseBoolean, makeAdminJsonRouter, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, parseFormBody, passwordResetConfirmSchema, passwordResetRequestSchema, percentField, phoneBrField, portField, positiveFloatField, positiveIntField, priceField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, ratingField, ratioField, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderDashboardPage, renderDetailPage, renderFormPage, renderLayout, renderListPage, renderLoginPage, renderMfaPage, renderPasswordResetFormPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveAdminTheme, resolveDownloadPath, resolveRedocBundle, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, serverSettingsShape, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, slugField, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, widgetForColumn, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };