tempest-express-sdk 0.24.0 → 0.26.0

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 export { z } from 'zod';
 import * as tempest_db_js from 'tempest-db-js';
-import { Model, ModelClass, BaseRepository, WhereInput, InferModel, InferInsert, PaginationFilter as PaginationFilter$1, PaginationResult, AsyncDriver, Column, AsyncSession, AsyncEngine } from 'tempest-db-js';
+import { Model, ModelClass, BaseRepository, WhereInput, InferModel, InferInsert, PaginationFilter as PaginationFilter$1, PaginationResult, AsyncDriver, AsyncSession, Column, AsyncEngine } from 'tempest-db-js';
 export { AsyncDriver, AsyncEngine, AsyncResult, AsyncSession, BaseRepository, BelongsTo, ColType, Column, ColumnFlags, CompiledQuery, CondNode, Condition, DeleteBuilder, DeleteNode, Dialect, EngineOptions, Executable, HasMany, InferInsert, InferModel, InsertBuilder, InsertNode, Model, ModelClass, NoResultError, NodeSqliteDriver, Operator, OrderTerm, PaginationResult, ParsedDatabaseUrl, PostgresDialect, QueryNode, RecordNotFound, Relation, RelationValue, PaginationFilter as RepositoryPaginationFilter, Returning, RowOf, SelectBuilder, SelectNode, SortDirection, SqliteDialect, SyncEngine, SyncSession, UpdateBuilder, UpdateNode, WhereArg, WhereInput, WithRelations, and, belongsTo, column, columnsOf, createEngine, createSyncEngine, del, detectDialect, getDialect, hasMany, insert, join, loadRelations, not, or, parseDatabaseUrl, select, sql, update } from 'tempest-db-js';
 import { Request, Response as Response$1, RequestHandler, Router, ErrorRequestHandler, Express } from 'express';
 import * as ws from 'ws';
@@ -3493,88 +3493,352 @@ declare class MessagingHub {
 }
 
 /**
- * Column introspection for the admin panel, mirroring `admin.forms`' widget
- * derivation.
+ * Business-metric cards for the admin dashboard, mirroring `admin.dashboard`.
  *
- * `tempest-db-js` keeps rich runtime metadata on every column — the canonical
- * type kind, enum members, `varchar` length, the not-null/default/primary-key
- * flags and the foreign-key reference — so the admin derives its form widgets
- * and list filters from the model itself instead of asking the project to
- * restate them. Kept separate from the router so the (fiddly) type handling is
- * unit-testable in isolation.
+ * Distinct from the system panel (CPU/memory): these are value / trend /
+ * partition cards computed from the application's own data — "orders today",
+ * "revenue vs last week", "users by plan". Register them on the
+ * {@link AdminSite} and they render above the model cards.
+ *
+ * ```ts
+ * const site = new AdminSite({
+ *   title: "Shop",
+ *   dashboardCards: [
+ *     metricCard("Orders today", async (session) => ({
+ *       kind: "value",
+ *       value: await new BaseRepository(OrderModel, session).count(),
+ *       unit: "orders",
+ *     })),
+ *   ],
+ * });
+ * ```
  */
 
-/** The set of form controls the admin knows how to render. */
-type AdminWidget = "text" | "textarea" | "number" | "checkbox" | "datetime" | "date" | "time" | "select" | "json";
-/** A `(value, label)` pair for a `select` widget. */
-interface AdminSelectOption {
-    value: string;
-    label: string;
+/** A single headline number. */
+interface MetricValue {
+    kind: "value";
+    /** The value to show — a number, or a preformatted string. */
+    value: number | string;
+    /** Optional unit suffix (`"orders"`, `"BRL"`). */
+    unit?: string;
+}
+/** A number compared against a previous period. */
+interface MetricTrend {
+    kind: "trend";
+    /** The current value. */
+    value: number;
+    /** The value for the comparison period. */
+    previous: number;
+    /** Optional unit suffix. */
+    unit?: string;
+}
+/** A breakdown of a total across labeled segments. */
+interface MetricPartition {
+    kind: "partition";
+    /** `(label, value)` pairs. */
+    segments: {
+        label: string;
+        value: number;
+    }[];
 }
-/** The widget a column maps to, plus the attributes that render it. */
-interface WidgetSpec {
-    /** The control to render. */
-    widget: AdminWidget;
-    /** `step` attribute for `number` widgets, or `null`. */
-    step: string | null;
-    /** Options for `select` widgets (empty otherwise). */
-    options: AdminSelectOption[];
+/** What a card's `compute` returns. */
+type CardData = MetricValue | MetricTrend | MetricPartition;
+/** Async function computing one card from a DB session. */
+type CardCompute = (session: AsyncSession) => Promise<CardData>;
+/** A dashboard business-metric card. */
+interface MetricCard {
+    /** The card heading. */
+    label: string;
+    /** Async function returning the card data. */
+    compute: CardCompute;
+    /** Optional sub-label shown under the value. */
+    helpText?: string;
 }
-/** How a column is surfaced in the list view's filter bar. */
-type AdminFilterKind = "select" | "daterange" | "text";
 /**
- * Humanize a column key into a form label (`lastLoginAt` → `Last Login At`).
+ * Describe a dashboard card.
  *
- * @param name - The column key.
- * @returns A title-cased label.
+ * @param label - The card heading.
+ * @param compute - Async function returning the card data.
+ * @param helpText - Optional sub-label.
+ * @returns The card descriptor to pass to `new AdminSite({ dashboardCards })`.
  */
-declare function humanizeField(name: string): string;
+declare function metricCard(label: string, compute: CardCompute, helpText?: string): MetricCard;
 /**
- * Return every column of a model, keyed by field name in declaration order.
+ * Return the percentage change a trend represents.
  *
- * @param model - The model class.
- * @returns The column map (do not mutate).
+ * @param trend - The computed trend.
+ * @returns `delta / previous * 100`, or `null` when there is no baseline to
+ *   divide by — a percentage against zero is undefined, not infinite.
  */
-declare function adminColumns(model: ModelClass): Record<string, Column<unknown>>;
+declare function trendPercent(trend: MetricTrend): number | null;
 /**
- * Map a column to the widget that edits it.
+ * Return which way a trend moved.
  *
- * `json` is matched before anything else because a JSON column carries no
- * useful scalar type, and `enum` is matched before the string kinds so its
- * members become a dropdown rather than a free-text input.
+ * @param trend - The computed trend.
+ * @returns `"up"`, `"down"` or `"flat"`.
+ */
+declare function trendDirection(trend: MetricTrend): "up" | "down" | "flat";
+/**
+ * Return the sum of a partition's segment values.
  *
- * @param column - The column to inspect.
- * @returns The widget, its `number` step (or `null`) and its `select` options.
+ * @param partition - The computed partition.
+ * @returns The total across segments.
  */
-declare function widgetForColumn(column: Column<unknown>): WidgetSpec;
+declare function partitionTotal(partition: MetricPartition): number;
+
 /**
- * Whether a column may be left blank on submit — it is nullable, carries a
- * default, or is the primary key the database fills in.
+ * Named, saved list-view presets — Laravel Nova's "lenses", mirroring
+ * `admin.config.Lens`.
  *
- * @param column - The column to inspect.
- * @returns `true` when the field is optional.
+ * A lens bundles a set of filters and an optional ordering under a label. On
+ * the list view lenses render as tabs; clicking one applies its filters (ANDed
+ * with whatever the operator typed) and its ordering. A "support triage" lens
+ * pinning `{ status: "open", priority: { gte: 3 } }` sorted oldest-first gets
+ * an operator to the working set in one click instead of re-entering filters
+ * every morning.
  */
-declare function isColumnOptional(column: Column<unknown>): boolean;
+
+/** Options accepted by {@link adminLens}. */
+interface AdminLensOptions {
+    /** Lens identifier; its slug is the `?lens=` value. */
+    name: string;
+    /** Conditions merged into the query, in repository `where` shape. */
+    filters?: WhereInput<Record<string, unknown>>;
+    /** Ordering column; prefix with `-` for descending. */
+    orderBy?: string;
+    /** Tab label. Defaults to `name`. */
+    label?: string;
+}
+/** A registered lens. */
+interface AdminLens {
+    /** Lens identifier. */
+    name: string;
+    /** URL slug — the `?lens=` value. */
+    slug: string;
+    /** Tab label. */
+    label: string;
+    /** Conditions merged into the query. */
+    filters: WhereInput<Record<string, unknown>>;
+    /** Ordering column, or `null`. `-column` means descending. */
+    orderBy: string | null;
+}
 /**
- * Map a column to the filter control the list view shows for it.
+ * Describe a saved list-view preset.
  *
- * Booleans and enums become dropdowns, date-like columns become a from/to pair
- * of date inputs, and anything else falls back to an equality text input.
+ * @param options - Name, filters, ordering and label.
+ * @returns The lens descriptor to pass to `AdminModel({ lenses: [...] })`.
+ */
+declare function adminLens(options: AdminLensOptions): AdminLens;
+
+/**
+ * Signed-cookie sessions for the admin panel, mirroring `admin.session`.
  *
- * @param column - The column to inspect.
- * @returns The filter kind and, for `select`, its options.
+ * The panel's session is **stateless**: the principal id, display name, CSRF
+ * token and expiry travel in the cookie itself, signed with HMAC-SHA256 over
+ * the caller's secret. Nothing is kept server-side, so the panel survives a
+ * restart and works across replicas without a shared store — the property that
+ * matters most for an operator tool that is used in bursts and left open.
+ *
+ * The CSRF token lives inside the session payload, so every write form can
+ * carry it and the server compares it against the cookie it already trusts.
  */
-declare function filterForColumn(column: Column<unknown>): {
-    kind: AdminFilterKind;
-    options: AdminSelectOption[];
-};
+
+/** The payload carried by the admin session cookie. */
+interface AdminSession {
+    /** Stable id of the authenticated principal. */
+    subject: string;
+    /** Display name shown in the header. */
+    displayName: string;
+    /** Token every write form echoes back for CSRF validation. */
+    csrfToken: string;
+    /** Expiry, in epoch seconds. */
+    expiresAt: number;
+    /**
+     * `true` once the second factor was accepted. Sessions issued for a
+     * principal without MFA are complete from the start.
+     */
+    mfaPassed: boolean;
+}
+/** Options for {@link AdminSessionStore}. */
+interface AdminSessionStoreOptions {
+    /** HMAC key signing the cookie. At least 32 characters. */
+    secret: string;
+    /** Cookie name. Default `tempest_admin_session`. */
+    cookieName?: string;
+    /** Session lifetime in seconds. Default `28800` (8 hours). */
+    maxAgeSeconds?: number;
+    /** Send the cookie with `Secure` (HTTPS only). Default `true`. */
+    cookieSecure?: boolean;
+    /** Cookie `Path`. Default `/`. */
+    cookiePath?: string;
+}
 /**
- * Whether a column holds free text a `LIKE '%…%'` search can match.
+ * Issues, verifies and clears the admin session cookie.
  *
- * @param column - The column to inspect.
- * @returns `true` for `varchar` / `text` / `char` columns.
+ * The cookie value is `<base64url payload>.<base64url signature>`; a payload
+ * whose signature does not verify, or whose expiry has passed, resolves to
+ * `null` — an operator with a tampered or stale cookie is simply logged out.
  */
-declare function isSearchableColumn(column: Column<unknown>): boolean;
+declare class AdminSessionStore {
+    private readonly secret;
+    private readonly cookieName;
+    private readonly maxAgeSeconds;
+    private readonly cookieSecure;
+    private readonly cookiePath;
+    /**
+     * Build the store.
+     *
+     * @param options - Secret, cookie name, lifetime and cookie flags.
+     * @throws Error When the secret is shorter than 32 characters.
+     */
+    constructor(options: AdminSessionStoreOptions);
+    /**
+     * Sign a payload.
+     *
+     * @param payload - The base64url payload to sign.
+     * @returns The base64url signature.
+     */
+    private sign;
+    /**
+     * Mint a fresh session for an authenticated principal.
+     *
+     * @param subject - The principal id.
+     * @param displayName - The name shown in the header.
+     * @param mfaPassed - Whether the second factor is already satisfied.
+     * @returns The new session payload (not yet written to a response).
+     */
+    issue(subject: string, displayName: string, mfaPassed?: boolean): AdminSession;
+    /**
+     * Read and verify the session carried by a request.
+     *
+     * @param req - The inbound request.
+     * @returns The session, or `null` when absent, tampered with or expired.
+     */
+    load(req: Request): AdminSession | null;
+    /**
+     * Write a session to the response as a signed cookie.
+     *
+     * @param res - The outbound response.
+     * @param session - The session to persist.
+     */
+    save(res: Response$1, session: AdminSession): void;
+    /**
+     * Drop the session cookie.
+     *
+     * @param res - The outbound response.
+     */
+    clear(res: Response$1): void;
+    /**
+     * Render a `Set-Cookie` value with the configured flags.
+     *
+     * @param value - The cookie value.
+     * @param maxAge - Lifetime in seconds (`0` expires it immediately).
+     * @returns The header value.
+     */
+    private cookie;
+}
+/**
+ * Compare a submitted CSRF token against the session's, in constant time.
+ *
+ * @param session - The active session.
+ * @param submitted - The `csrf_token` field from the form body.
+ * @returns `true` when the tokens match.
+ */
+declare function csrfTokenMatches(session: AdminSession, submitted: unknown): boolean;
+
+/**
+ * Custom admin actions — operator-defined bulk operations, mirroring
+ * `admin.actions`.
+ *
+ * The panel ships three built-in bulk operations (activate / deactivate /
+ * delete). Anything domain-specific — "send welcome email", "mark as shipped",
+ * "recalculate totals" — is a *custom action*: a handler registered on an
+ * {@link AdminModel} through `actions`, which shows up in the list view's
+ * bulk-action dropdown and runs against the checked rows.
+ *
+ * ```ts
+ * const sendWelcome = adminAction(
+ *   { label: "Send welcome email" },
+ *   async ({ ids, repository }) => {
+ *     const users = await repository.list({ id: { in: ids } });
+ *     for (const user of users) await mailer.sendWelcome(user.email);
+ *     return { message: `Sent ${users.length} welcome emails.` };
+ *   },
+ * );
+ *
+ * site.register(new AdminModel({ model: UserModel, actions: [sendWelcome] }));
+ * ```
+ *
+ * The Python SDK attaches this metadata with an `@admin_action` decorator.
+ * Here {@link adminAction} returns the descriptor instead: the handler stays a
+ * plain function you can call and unit-test directly (`action.handler(ctx)`),
+ * and there is no decorator syntax to enable in a consumer's build.
+ */
+
+/** Banner style a custom action's message is flashed with. */
+type AdminActionCategory = "success" | "error" | "warning";
+/** Everything a custom action handler needs to do its work. */
+interface AdminActionContext<C extends ModelClass = ModelClass> {
+    /** Identity values of the rows the operator checked. */
+    ids: string[];
+    /** Repository for this admin's model, bound to the request's DB session. */
+    repository: BaseRepository<C>;
+    /** The request's DB session, for work beyond the repository. */
+    dbSession: AsyncSession;
+    /** The inbound request. */
+    request: Request;
+    /** The authenticated admin session. */
+    session: AdminSession;
+    /** The resolved admin principal that triggered the action. */
+    principal: unknown;
+}
+/** The outcome of a custom action, flashed on the list view. */
+interface AdminActionResult {
+    /** Human-readable result shown to the operator. */
+    message: string;
+    /** Banner style. Default `"success"`. */
+    category?: AdminActionCategory;
+}
+/** The function a custom action runs. Return `null` to flash nothing. */
+type AdminActionHandler<C extends ModelClass = ModelClass> = (context: AdminActionContext<C>) => Promise<AdminActionResult | null>;
+/** A registered custom action: metadata plus handler. */
+interface AdminAction<C extends ModelClass = ModelClass> {
+    /** Stable identifier (the submitted form value); unique per model. */
+    name: string;
+    /** Text shown in the bulk-action dropdown. */
+    label: string;
+    /** The handler to run against the checked rows. */
+    handler: AdminActionHandler<C>;
+    /** Whether the UI marks this as destructive (a stronger confirm prompt). */
+    dangerous: boolean;
+}
+/** Metadata accepted by {@link adminAction}. */
+interface AdminActionOptions {
+    /** Dropdown label shown to the operator. */
+    label: string;
+    /** Stable identifier (the submitted form value). Defaults to a slug of `label`. */
+    name?: string;
+    /** Flag a destructive action, for a stronger confirm prompt. */
+    dangerous?: boolean;
+}
+/**
+ * Describe a custom bulk action.
+ *
+ * @param options - Label, optional stable name and the destructive flag.
+ * @param handler - The async function run against the checked rows.
+ * @returns The action descriptor to pass to `AdminModel({ actions: [...] })`.
+ * @throws Error When the resolved name is empty.
+ */
+declare function adminAction<C extends ModelClass = ModelClass>(options: AdminActionOptions, handler: AdminActionHandler<C>): AdminAction<C>;
+/** A bulk-action option rendered in the list view's dropdown. */
+interface BulkActionOption {
+    /** Submitted form value. Custom actions are namespaced `custom:<name>`. */
+    value: string;
+    /** Dropdown label. */
+    label: string;
+    /** Whether the action is destructive. */
+    dangerous: boolean;
+}
 
 /**
  * Declarative admin configuration for one model, mirroring `admin.config`.
@@ -3616,6 +3880,22 @@ interface AdminModelOptions<C extends ModelClass> {
     canEdit?: boolean;
     /** Whether the delete action is exposed. Default `true`. */
     canDelete?: boolean;
+    /**
+     * Custom bulk actions, built with `adminAction`. Each one joins the list
+     * view's action dropdown alongside the built-in activate / deactivate /
+     * delete and runs against the checked rows.
+     */
+    actions?: readonly AdminAction<C>[];
+    /**
+     * Audit-log model backing the detail view's change timeline. Pair it with a
+     * repository that actually writes the rows — the panel only reads them.
+     */
+    auditModel?: ModelClass;
+    /**
+     * Saved list-view presets rendered as tabs above the table, each applying
+     * its filters and ordering through `?lens=<slug>`.
+     */
+    lenses?: readonly AdminLens[];
 }
 /**
  * The admin configuration for one model.
@@ -3653,6 +3933,11 @@ declare class AdminModel<C extends ModelClass = ModelClass> {
     readonly canEdit: boolean;
     /** Whether the delete action is exposed. */
     readonly canDelete: boolean;
+    /** Audit-log model backing the detail timeline, or `null`. */
+    readonly auditModel: ModelClass | null;
+    /** Saved list-view presets, in declaration order. */
+    readonly lenses: AdminLens[];
+    private readonly actions;
     private readonly slugOverride;
     private readonly listDisplayOverride;
     private readonly verboseNameOverride;
@@ -3695,6 +3980,20 @@ declare class AdminModel<C extends ModelClass = ModelClass> {
      * @returns The configured `listDisplay`, or every column but the password hash.
      */
     listDisplayNames(): string[];
+    /**
+     * Look a lens up by its slug.
+     *
+     * @param slug - The `?lens=` value.
+     * @returns The lens, or `null` when nothing matches.
+     */
+    getLens(slug: string): AdminLens | null;
+    /**
+     * Return the audit/timestamp columns the model actually declares.
+     *
+     * @returns The subset of `createdAt` / `updatedAt` / `createdBy` /
+     *   `updatedBy` present on the model, in that order.
+     */
+    auditFieldNames(): string[];
     /**
      * Return the columns the detail view renders.
      *
@@ -3703,7 +4002,11 @@ declare class AdminModel<C extends ModelClass = ModelClass> {
      * where an operator goes to see the whole record, so trimming it there would
      * hide data with nowhere else to read it.
      *
-     * @returns Every column but the password hash, in declaration order.
+     * The audit/timestamp columns are held back too — they render in the detail
+     * view's own audit panel, next to the change history, rather than scattered
+     * among the domain fields.
+     *
+     * @returns Every domain column, in declaration order.
      */
     detailFieldNames(): string[];
     /**
@@ -3716,6 +4019,21 @@ declare class AdminModel<C extends ModelClass = ModelClass> {
      * @returns The editable column keys, in declaration order.
      */
     editableFieldNames(): string[];
+    /**
+     * Return the registered custom actions, in declaration order.
+     *
+     * @returns The actions passed via `actions` (empty when none). The model
+     *   type is erased here, the way {@link AdminSite} erases it when it stores a
+     *   configuration — a registry keyed by slug cannot stay generic.
+     */
+    customActions(): AdminAction[];
+    /**
+     * Look a custom action up by name.
+     *
+     * @param name - The action identifier (its submitted form value).
+     * @returns The action, or `null` when nothing matches.
+     */
+    getAction(name: string): AdminAction | null;
     /**
      * Build a repository for this model bound to a session.
      *
@@ -3727,6 +4045,138 @@ declare class AdminModel<C extends ModelClass = ModelClass> {
 /** The row type a configured {@link AdminModel} reads and writes. */
 type AdminRow<A> = A extends AdminModel<infer C> ? InferModel<C> : never;
 
+/**
+ * Granular per-model, per-action access control, mirroring
+ * `admin.permissions`.
+ *
+ * Out of the box every operator who can sign in (`isAdmin`) can do everything
+ * the {@link AdminModel} flags allow. To narrow a principal to a subset of
+ * models or actions — a "support" role that may view orders but never delete
+ * them, an "editor" who may touch content models only — hand an
+ * {@link AdminAccessPolicy} to `makeAdminRouter`.
+ *
+ * ```ts
+ * const policy: AdminAccessPolicy = (user, admin, action) => {
+ *   if (user.role === "superadmin") return true;
+ *   if (user.role === "support") return action === AdminPermission.VIEW;
+ *   return false;
+ * };
+ *
+ * makeAdminRouter(site, { ..., accessPolicy: policy });
+ * ```
+ *
+ * The policy **composes with** the `canCreate` / `canEdit` / `canDelete` flags
+ * rather than replacing them: both have to allow an action. A denied `VIEW`
+ * also hides the model from the dashboard and the sidebar, so an operator is
+ * never shown a door that will answer `403`.
+ */
+
+/** An admin action gated by an {@link AdminAccessPolicy}. */
+declare const AdminPermission: {
+    readonly VIEW: "view";
+    readonly CREATE: "create";
+    readonly EDIT: "edit";
+    readonly DELETE: "delete";
+};
+/** An {@link AdminPermission} value. */
+type AdminPermission = (typeof AdminPermission)[keyof typeof AdminPermission];
+/**
+ * Decides whether `principal` may perform `action` on the model behind
+ * `admin`. Sync or async; return truthy to allow.
+ */
+type AdminAccessPolicy = (principal: unknown, admin: AdminModel, action: AdminPermission) => boolean | Promise<boolean>;
+
+/**
+ * Column introspection for the admin panel, mirroring `admin.forms`' widget
+ * derivation.
+ *
+ * `tempest-db-js` keeps rich runtime metadata on every column — the canonical
+ * type kind, enum members, `varchar` length, the not-null/default/primary-key
+ * flags and the foreign-key reference — so the admin derives its form widgets
+ * and list filters from the model itself instead of asking the project to
+ * restate them. Kept separate from the router so the (fiddly) type handling is
+ * unit-testable in isolation.
+ */
+
+/** The set of form controls the admin knows how to render. */
+type AdminWidget = "text" | "textarea" | "number" | "checkbox" | "datetime" | "date" | "time" | "select" | "json";
+/** A `(value, label)` pair for a `select` widget. */
+interface AdminSelectOption {
+    value: string;
+    label: string;
+}
+/** The widget a column maps to, plus the attributes that render it. */
+interface WidgetSpec {
+    /** The control to render. */
+    widget: AdminWidget;
+    /** `step` attribute for `number` widgets, or `null`. */
+    step: string | null;
+    /** Options for `select` widgets (empty otherwise). */
+    options: AdminSelectOption[];
+}
+/** How a column is surfaced in the list view's filter bar. */
+type AdminFilterKind = "select" | "daterange" | "text";
+/**
+ * Humanize a column key into a form label (`lastLoginAt` → `Last Login At`).
+ *
+ * @param name - The column key.
+ * @returns A title-cased label.
+ */
+declare function humanizeField(name: string): string;
+/**
+ * Return every column of a model, keyed by field name in declaration order.
+ *
+ * @param model - The model class.
+ * @returns The column map (do not mutate).
+ */
+declare function adminColumns(model: ModelClass): Record<string, Column<unknown>>;
+/**
+ * Map a column to the widget that edits it.
+ *
+ * `json` is matched before anything else because a JSON column carries no
+ * useful scalar type, and `enum` is matched before the string kinds so its
+ * members become a dropdown rather than a free-text input.
+ *
+ * @param column - The column to inspect.
+ * @returns The widget, its `number` step (or `null`) and its `select` options.
+ */
+declare function widgetForColumn(column: Column<unknown>): WidgetSpec;
+/**
+ * Whether a column may be left blank on submit — it is nullable, carries a
+ * default, or is the primary key the database fills in.
+ *
+ * @param column - The column to inspect.
+ * @returns `true` when the field is optional.
+ */
+declare function isColumnOptional(column: Column<unknown>): boolean;
+/**
+ * Map a column to the filter control the list view shows for it.
+ *
+ * Booleans and enums become dropdowns, date-like columns become a from/to pair
+ * of date inputs, and anything else falls back to an equality text input.
+ *
+ * @param column - The column to inspect.
+ * @returns The filter kind and, for `select`, its options.
+ */
+declare function filterForColumn(column: Column<unknown>): {
+    kind: AdminFilterKind;
+    options: AdminSelectOption[];
+};
+/**
+ * Return the table a column points at, when it carries a foreign key.
+ *
+ * @param column - The column to inspect.
+ * @returns The referenced table name, or `null` for a plain column.
+ */
+declare function foreignKeyTable(column: Column<unknown>): string | null;
+/**
+ * Whether a column holds free text a `LIKE '%…%'` search can match.
+ *
+ * @param column - The column to inspect.
+ * @returns `true` for `varchar` / `text` / `char` columns.
+ */
+declare function isSearchableColumn(column: Column<unknown>): boolean;
+
 /**
  * Form building and submission parsing for the admin CRUD views, mirroring
  * `admin.forms`.
@@ -3771,6 +4221,12 @@ interface BuildFormFieldsOptions {
     values?: Record<string, unknown>;
     /** Per-field errors to surface, keyed by column. */
     errors?: Record<string, string>;
+    /**
+     * Options for foreign-key columns whose target model is registered, keyed by
+     * column. A field listed here renders as a `<select>` of related rows instead
+     * of a raw identity text input.
+     */
+    foreignKeyOptions?: Record<string, AdminSelectOption[]>;
 }
 /**
  * Render a stored value into the string a control pre-fills with.
@@ -3814,6 +4270,25 @@ declare function parseFormBody(admin: AdminModel, body: Record<string, unknown>)
  * @returns A display string (empty for `null`/`undefined`).
  */
 declare function formatCellValue(value: unknown): string;
+/**
+ * Return the editable foreign-key columns of an admin, as `field → table`.
+ *
+ * @param admin - The model configuration.
+ * @returns One entry per editable column that references another table.
+ */
+declare function foreignKeyFields(admin: AdminModel): Record<string, string>;
+/**
+ * Build a human label for a referenced row — the analog of Django's `__str__`.
+ *
+ * Prefers the referenced admin's first search field, then a conventional
+ * display attribute, then the row's identity, so a dropdown of related rows
+ * reads as names rather than as a column of UUIDs.
+ *
+ * @param admin - The **referenced** model's configuration.
+ * @param row - The referenced row.
+ * @returns A label for the option.
+ */
+declare function foreignKeyLabel(admin: AdminModel, row: Record<string, unknown>): string;
 
 /**
  * Authentication backends for the admin panel, mirroring `admin.auth`.
@@ -3996,122 +4471,6 @@ declare class UserModelAuthBackend implements AdminAuthBackend<UserPrincipalRow>
     verifyMfa(principal: UserPrincipalRow, code: string): Promise<boolean>;
 }
 
-/**
- * Signed-cookie sessions for the admin panel, mirroring `admin.session`.
- *
- * The panel's session is **stateless**: the principal id, display name, CSRF
- * token and expiry travel in the cookie itself, signed with HMAC-SHA256 over
- * the caller's secret. Nothing is kept server-side, so the panel survives a
- * restart and works across replicas without a shared store — the property that
- * matters most for an operator tool that is used in bursts and left open.
- *
- * The CSRF token lives inside the session payload, so every write form can
- * carry it and the server compares it against the cookie it already trusts.
- */
-
-/** The payload carried by the admin session cookie. */
-interface AdminSession {
-    /** Stable id of the authenticated principal. */
-    subject: string;
-    /** Display name shown in the header. */
-    displayName: string;
-    /** Token every write form echoes back for CSRF validation. */
-    csrfToken: string;
-    /** Expiry, in epoch seconds. */
-    expiresAt: number;
-    /**
-     * `true` once the second factor was accepted. Sessions issued for a
-     * principal without MFA are complete from the start.
-     */
-    mfaPassed: boolean;
-}
-/** Options for {@link AdminSessionStore}. */
-interface AdminSessionStoreOptions {
-    /** HMAC key signing the cookie. At least 32 characters. */
-    secret: string;
-    /** Cookie name. Default `tempest_admin_session`. */
-    cookieName?: string;
-    /** Session lifetime in seconds. Default `28800` (8 hours). */
-    maxAgeSeconds?: number;
-    /** Send the cookie with `Secure` (HTTPS only). Default `true`. */
-    cookieSecure?: boolean;
-    /** Cookie `Path`. Default `/`. */
-    cookiePath?: string;
-}
-/**
- * Issues, verifies and clears the admin session cookie.
- *
- * The cookie value is `<base64url payload>.<base64url signature>`; a payload
- * whose signature does not verify, or whose expiry has passed, resolves to
- * `null` — an operator with a tampered or stale cookie is simply logged out.
- */
-declare class AdminSessionStore {
-    private readonly secret;
-    private readonly cookieName;
-    private readonly maxAgeSeconds;
-    private readonly cookieSecure;
-    private readonly cookiePath;
-    /**
-     * Build the store.
-     *
-     * @param options - Secret, cookie name, lifetime and cookie flags.
-     * @throws Error When the secret is shorter than 32 characters.
-     */
-    constructor(options: AdminSessionStoreOptions);
-    /**
-     * Sign a payload.
-     *
-     * @param payload - The base64url payload to sign.
-     * @returns The base64url signature.
-     */
-    private sign;
-    /**
-     * Mint a fresh session for an authenticated principal.
-     *
-     * @param subject - The principal id.
-     * @param displayName - The name shown in the header.
-     * @param mfaPassed - Whether the second factor is already satisfied.
-     * @returns The new session payload (not yet written to a response).
-     */
-    issue(subject: string, displayName: string, mfaPassed?: boolean): AdminSession;
-    /**
-     * Read and verify the session carried by a request.
-     *
-     * @param req - The inbound request.
-     * @returns The session, or `null` when absent, tampered with or expired.
-     */
-    load(req: Request): AdminSession | null;
-    /**
-     * Write a session to the response as a signed cookie.
-     *
-     * @param res - The outbound response.
-     * @param session - The session to persist.
-     */
-    save(res: Response$1, session: AdminSession): void;
-    /**
-     * Drop the session cookie.
-     *
-     * @param res - The outbound response.
-     */
-    clear(res: Response$1): void;
-    /**
-     * Render a `Set-Cookie` value with the configured flags.
-     *
-     * @param value - The cookie value.
-     * @param maxAge - Lifetime in seconds (`0` expires it immediately).
-     * @returns The header value.
-     */
-    private cookie;
-}
-/**
- * Compare a submitted CSRF token against the session's, in constant time.
- *
- * @param session - The active session.
- * @param submitted - The `csrf_token` field from the form body.
- * @returns `true` when the tokens match.
- */
-declare function csrfTokenMatches(session: AdminSession, submitted: unknown): boolean;
-
 /**
  * Typed theming for the server-rendered admin panel, mirroring `admin.theme`.
  *
@@ -4218,6 +4577,11 @@ interface AdminSiteOptions {
     siteUrl?: string;
     /** Typed appearance overrides. Omitted keeps the stock look. */
     theme?: AdminTheme;
+    /**
+     * Business-metric cards rendered at the top of the dashboard, each computed
+     * from the database on load. Distinct from the system CPU/memory panel.
+     */
+    dashboardCards?: readonly MetricCard[];
 }
 /** Options accepted by {@link AdminSite.automap}. */
 interface AdminAutomapOptions extends Omit<AdminModelOptions<ModelClass>, "model"> {
@@ -4250,6 +4614,8 @@ declare class AdminSite {
     readonly siteUrl: string | null;
     /** Typed appearance overrides. */
     readonly theme: AdminTheme;
+    /** Business-metric cards rendered at the top of the dashboard. */
+    readonly dashboardCards: MetricCard[];
     private readonly registry;
     /**
      * Initialize the site.
@@ -4419,6 +4785,33 @@ interface AdminDashboardCard {
     /** URL of the create form, or `null` when creation is disabled. */
     newUrl: string | null;
 }
+/** One business-metric card, already computed and formatted for rendering. */
+interface AdminBusinessCardView {
+    /** The card heading. */
+    label: string;
+    /** Which shape to render. */
+    kind: "value" | "trend" | "partition";
+    /** Headline value (`value` and `trend` cards). */
+    value: string;
+    /** Optional unit suffix. */
+    unit: string | null;
+    /** Trend direction (`trend` cards). */
+    direction: "up" | "down" | "flat";
+    /** Formatted percentage change, or `null` when there is no baseline. */
+    percent: string | null;
+    /** Previous-period value, as text (`trend` cards). */
+    previous: string;
+    /** Segments with their share of the total (`partition` cards). */
+    segments: {
+        label: string;
+        value: string;
+        percent: number;
+    }[];
+    /** Optional sub-label. */
+    helpText: string | null;
+    /** Set when the card's compute threw, so the dashboard still renders. */
+    error: string | null;
+}
 /** The system metrics panel on the dashboard. */
 interface AdminDashboardMetrics {
     /** CPU load as a percentage of available cores. */
@@ -4439,7 +4832,7 @@ interface AdminDashboardMetrics {
  * @param metrics - The system metrics panel, or `null` when disabled.
  * @returns The full page.
  */
-declare function renderDashboardPage(context: AdminRenderContext, cards: AdminDashboardCard[], metrics: AdminDashboardMetrics | null): string;
+declare function renderDashboardPage(context: AdminRenderContext, cards: AdminDashboardCard[], metrics: AdminDashboardMetrics | null, businessCards?: AdminBusinessCardView[]): string;
 /** A filter control rendered above the list view. */
 interface AdminFilterView {
     /** Column key the control filters on. */
@@ -4502,6 +4895,20 @@ interface AdminListView {
     sort: Record<string, AdminSortView>;
     /** URL of the create form, or `null` when creation is disabled. */
     newUrl: string | null;
+    /** Bulk actions offered above the table. Empty hides the whole bulk UI. */
+    bulkActions: BulkActionOption[];
+    /** URL the bulk form posts to. */
+    bulkUrl: string;
+    /** URL exporting the current result set as CSV. */
+    exportCsvUrl: string;
+    /** URL exporting the current result set as JSON. */
+    exportJsonUrl: string;
+    /** Saved-preset tabs rendered above the table. Empty hides the strip. */
+    lenses: {
+        label: string;
+        url: string;
+        active: boolean;
+    }[];
 }
 /**
  * Render the paginated list view, with its search box, filters and sortable
@@ -4512,6 +4919,33 @@ interface AdminListView {
  * @returns The full page.
  */
 declare function renderListPage(context: AdminRenderContext, view: AdminListView): string;
+/** One entry in the detail view's change timeline. */
+interface AdminAuditEntryView {
+    /** The mutation kind (`create` / `update` / `delete`). */
+    action: string;
+    /** When it happened, already formatted. */
+    at: string;
+    /** Who did it — a resolved display name, or the raw actor id. */
+    actor: string;
+    /** The per-field diff. */
+    changes: {
+        field: string;
+        before: string;
+        after: string;
+    }[];
+    /** Extra metadata the writer recorded, as JSON text, or `null`. */
+    context: string | null;
+}
+/** The "who and when" panel below a record's fields. */
+interface AdminAuditView {
+    /** Timestamp and actor rows, already resolved and formatted. */
+    fields: {
+        label: string;
+        value: string;
+    }[];
+    /** The change timeline, newest first. Empty when there is none to show. */
+    history: AdminAuditEntryView[];
+}
 /** The view model the detail page renders. */
 interface AdminDetailView {
     /** Singular display name. */
@@ -4529,6 +4963,8 @@ interface AdminDetailView {
     editUrl: string | null;
     /** URL the delete form posts to, or `null` when deletion is disabled. */
     deleteUrl: string | null;
+    /** The audit panel, or `null` when the model carries no audit columns. */
+    audit: AdminAuditView | null;
 }
 /**
  * Render the single-record detail view.
@@ -4612,6 +5048,17 @@ interface AdminRouterOptions {
     sessionMaxAgeSeconds?: number;
     /** Show the CPU/memory panel on the dashboard. Default `true`. */
     showMetrics?: boolean;
+    /**
+     * Hard cap on rows the CSV/JSON export writes. Default `5000`. An export is
+     * a full table scan streamed to a browser, so the cap is what keeps a curious
+     * click on a large table from becoming an outage.
+     */
+    exportMaxRows?: number;
+    /**
+     * Granular access control layered on top of the `AdminModel` flags. Omitted
+     * lets every signed-in operator do whatever those flags allow.
+     */
+    accessPolicy?: AdminAccessPolicy;
 }
 /**
  * Build the admin panel router.
@@ -6393,6 +6840,6 @@ declare function createTestDatabase(models: readonly ModelClass[]): TestDatabase
 declare function withTestDatabase<T>(models: readonly ModelClass[], fn: (db: TestDatabase) => Promise<T>): Promise<T>;
 
 /** The installed SDK version. Single source of truth for the barrel + CLI. */
-declare const VERSION = "0.24.0";
+declare const VERSION = "0.26.0";
 
-export { ADMIN_CSS, type ActivationInput, ActivationService, type ActivationServiceOptions, type ActivationStore, type AdminAuthBackend, type AdminAutomapOptions, type AdminDashboardCard, type AdminDashboardMetrics, type AdminDetailView, type AdminFilterKind, type AdminFilterView, type AdminFormField, type AdminFormView, type AdminJsonField, type AdminJsonListQuery, type AdminJsonListResult, type AdminJsonResource, type AdminJsonRouterOptions, AdminJsonSite, type AdminListView, type AdminMessage, type AdminMfaVerifier, AdminModel, type AdminModelOptions, type AdminNavEntry, type AdminRenderContext, type AdminRouterOptions, type AdminRow, type AdminSelectOption, type AdminSession, AdminSessionStore, type AdminSessionStoreOptions, AdminSite, type AdminSiteOptions, type AdminSortView, type AdminTheme, type AdminWidget, AppException, type AppExceptionHandlerOptions, type AppExceptionOptions, type AttachWebSocketOptions, AttemptThrottle, type AttemptThrottleOptions, AuditAction, type AuthResponse, type AuthResultPageOptions, type AuthRouterOptions, type AuthUser, type BackupOptions, type BaseAppSettings, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, type BaseResponse, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, type BodySizeLimitOptions, type BroadcastOptions, type BroadcastResult, type BrokerManager, type BuildFormFieldsOptions, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, type CPUMetrics, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type CacheManager, type CachedOptions, type CachedResponse, type CatalogData, CircuitOpenError, type ClientIpOptions, CompositeFeatureFlagBackend, ConflictException, type CreateAppOpenApi, type CreateAppOptions, type CsrfOptions, type CursorPaginationFilter, DEFAULT_DOCS_FAVICON, DEFAULT_LOCALE, type DownloadOptions, type EmailMessage, type EmailOptions, EmailProvider, type EmailProviderOptions, EmailUtils, type Enum, type EnumHelpers, type EnumSpec, EnvFeatureFlagBackend, EventStream, type EventStreamOptions, type ExceptionDetails, ExpiredTokenException, type FeatureFlagBackend, FeatureFlags, type FieldChange, type FileLoggingHandle, type FileLoggingOptions, type FlagContext, ForbiddenException, type GPUMetrics, type GenerateOpenApiOptions, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, type GracefulShutdownOptions, HTTPClient, type HTTPClientOptions, HTTP_500_LOG_FILE, HTTP_500_MARKER, type HandshakeInfo, type HealthCheck, type HealthRouterOptions, HttpMetrics, IDEMPOTENCY_HEADER, type IdempotencyOptions, type IdempotencyRedisLike, type IdempotencyStore, type InboundHandler, type InboundMessage, InvalidTokenException, type IssuedSession, JSONLogger, JWTUtils, type JWTUtilsOptions, type JwtAuthOptions, type JwtClaims, type JwtDecoderLike, LEVEL_LOG_FILES, LocalUploadStorage, type LocalUploadStorageOptions, type LogEntry, type LogExtra, type LogLevel, type LogSink, type LogSource, type LoginInput, type LoginResult, type LogsRouterOptions, type MediaKind, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, type MemoryMetrics, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, type MessageHandler, MessagingHub, type MessagingProvider, type MetricsRouterOptions, MetricsUtils, type MfaChallenge, type MfaChallengeInput, type MfaCodeInput, type MfaEnrollment, MfaService, type MfaServiceOptions, type MfaStore, NotFoundException, type OAuthClientOptions, OAuthError, type OAuthTokens, type OAuthUser, OIDCProvider, type OIDCProviderOptions, type OpenApiDocument, type OpenApiInfo, type OutboundMedia, type OutboundResult, type OutboxPublisher, OutboxRelay, type OutboxRelayOptions, OutboxStatus, PHONE_BR_PATTERN, type PaginationFilter, type PaginationLinkOptions, type ParsedAdminForm, type PasswordResetConfirmInput, type PasswordResetFormOptions, type PasswordResetRequestInput, PasswordResetService, type PasswordResetServiceOptions, type PasswordResetStore, PasswordUtils, REDOC_CDN_URL, REQUEST_ID_HEADER, RabbitBroker, type RabbitBrokerOptions, type RateLimitKeyFunc, type RateLimitOptions, type RateLimitRedisLike, type RateLimitResult, type RateLimitStore, RedisCacheManager, RedisIdempotencyStore, type RedisLike, type RedisPublisherLike, RedisRateLimitStore, RedisSSEBroker, type RedisSSEBrokerOptions, RedisSessionStore, type RedisSubscriberLike, type RedocBundleSource, type RedocOptions, type RefreshInput, Region, type RegionValue, type RegisterExceptionHandlersOptions, type RequestContext, type RequestTracingOptions, type ResolvedAdminTheme, type ResponseMapper, RetryPolicy, type RunServerOptions, type S3ClientLike, S3UploadStorage, type S3UploadStorageOptions, SSEBroker, type SaveOptions, type SendOptions, ServerSentEvent, type ServerSentEventInit, type Session, type SessionMiddlewareOptions, type SessionRedisLike, SessionService, type SessionServiceOptions, type SessionStore, type SignupInput, type SlowQueryOptions, type SpecProvider, type StateBR, type SwaggerOptions, type SyncFilter, type SystemMetrics, TOTPHelper, type TOTPOptions, type TaskHandler, TaskManager, type TaskManagerOptions, TelegramProvider, type TelegramProviderOptions, TenantScopedRepository, type TestDatabase, type ThrottleBackend, type ThrottleStatus, type ToDictOptions, type TokenPair, TooManyRequestsException, type TooManyRequestsOptions, type ToolSpecOptions, TwilioSmsProvider, type TwilioSmsProviderOptions, type TwilioWebhookOptions, UF, type UFValue, UnauthorizedException, type UnhandledExceptionHandlerOptions, type UploadResult, type UploadStorage, UserAuthService, type UserAuthServiceOptions, UserModelAuthBackend, type UserModelAuthBackendOptions, type UserPublic, type UserStore, UserTokenPurpose, VERSION, ValidationException, type WSEnvelope, WebPushDispatcher, type WebPushDispatcherOptions, WebPushError, WebPushGoneError, type WebPushKeys, type WebPushPayload, type WebPushSubscription, type WebSocketConnection, WebSocketHub, type WebSocketHubOptions, type WebSocketLike, type WebhookSignatureOptions, WebhookSignatureVerifier, WhatsAppProvider, type WhatsAppProviderOptions, type WhatsAppWebhookOptions, type WidgetSpec, activationSchema, addLogSink, adminColumns, adminThemeCss, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildFormFields, buildPaginationLinkHeader, cached, centsField, cepField, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, csrfTokenMatches, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, looseBoolean as envBoolean, envList, escapeHtml, filterForColumn, formatCellValue, formatFieldValue, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, hexColorField, humanizeField, idempotencyMiddleware, inboundMessageSchema, isColumnOptional, isSearchableColumn, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, latitudeField, listStates, loadSettings, logEntrySchema, logSettingsShape, loginSchema, longitudeField, looseBoolean, makeAdminJsonRouter, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, parseFormBody, passwordResetConfirmSchema, passwordResetRequestSchema, percentField, phoneBrField, portField, positiveFloatField, positiveIntField, priceField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, ratingField, ratioField, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderDashboardPage, renderDetailPage, renderFormPage, renderLayout, renderListPage, renderLoginPage, renderMfaPage, renderPasswordResetFormPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveAdminTheme, resolveDownloadPath, resolveRedocBundle, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, serverSettingsShape, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, slugField, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, widgetForColumn, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };
+export { ADMIN_CSS, type ActivationInput, ActivationService, type ActivationServiceOptions, type ActivationStore, type AdminAccessPolicy, type AdminAction, type AdminActionCategory, type AdminActionContext, type AdminActionHandler, type AdminActionOptions, type AdminActionResult, type AdminAuditEntryView, type AdminAuditView, type AdminAuthBackend, type AdminAutomapOptions, type AdminBusinessCardView, type AdminDashboardCard, type AdminDashboardMetrics, type AdminDetailView, type AdminFilterKind, type AdminFilterView, type AdminFormField, type AdminFormView, type AdminJsonField, type AdminJsonListQuery, type AdminJsonListResult, type AdminJsonResource, type AdminJsonRouterOptions, AdminJsonSite, type AdminLens, type AdminLensOptions, type AdminListView, type AdminMessage, type AdminMfaVerifier, AdminModel, type AdminModelOptions, type AdminNavEntry, AdminPermission, type AdminRenderContext, type AdminRouterOptions, type AdminRow, type AdminSelectOption, type AdminSession, AdminSessionStore, type AdminSessionStoreOptions, AdminSite, type AdminSiteOptions, type AdminSortView, type AdminTheme, type AdminWidget, AppException, type AppExceptionHandlerOptions, type AppExceptionOptions, type AttachWebSocketOptions, AttemptThrottle, type AttemptThrottleOptions, AuditAction, type AuthResponse, type AuthResultPageOptions, type AuthRouterOptions, type AuthUser, type BackupOptions, type BaseAppSettings, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, type BaseResponse, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, type BodySizeLimitOptions, type BroadcastOptions, type BroadcastResult, type BrokerManager, type BuildFormFieldsOptions, type BulkActionOption, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, type CPUMetrics, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type CacheManager, type CachedOptions, type CachedResponse, type CardCompute, type CardData, type CatalogData, CircuitOpenError, type ClientIpOptions, CompositeFeatureFlagBackend, ConflictException, type CreateAppOpenApi, type CreateAppOptions, type CsrfOptions, type CursorPaginationFilter, DEFAULT_DOCS_FAVICON, DEFAULT_LOCALE, type DownloadOptions, type EmailMessage, type EmailOptions, EmailProvider, type EmailProviderOptions, EmailUtils, type Enum, type EnumHelpers, type EnumSpec, EnvFeatureFlagBackend, EventStream, type EventStreamOptions, type ExceptionDetails, ExpiredTokenException, type FeatureFlagBackend, FeatureFlags, type FieldChange, type FileLoggingHandle, type FileLoggingOptions, type FlagContext, ForbiddenException, type GPUMetrics, type GenerateOpenApiOptions, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, type GracefulShutdownOptions, HTTPClient, type HTTPClientOptions, HTTP_500_LOG_FILE, HTTP_500_MARKER, type HandshakeInfo, type HealthCheck, type HealthRouterOptions, HttpMetrics, IDEMPOTENCY_HEADER, type IdempotencyOptions, type IdempotencyRedisLike, type IdempotencyStore, type InboundHandler, type InboundMessage, InvalidTokenException, type IssuedSession, JSONLogger, JWTUtils, type JWTUtilsOptions, type JwtAuthOptions, type JwtClaims, type JwtDecoderLike, LEVEL_LOG_FILES, LocalUploadStorage, type LocalUploadStorageOptions, type LogEntry, type LogExtra, type LogLevel, type LogSink, type LogSource, type LoginInput, type LoginResult, type LogsRouterOptions, type MediaKind, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, type MemoryMetrics, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, type MessageHandler, MessagingHub, type MessagingProvider, type MetricCard, type MetricPartition, type MetricTrend, type MetricValue, type MetricsRouterOptions, MetricsUtils, type MfaChallenge, type MfaChallengeInput, type MfaCodeInput, type MfaEnrollment, MfaService, type MfaServiceOptions, type MfaStore, NotFoundException, type OAuthClientOptions, OAuthError, type OAuthTokens, type OAuthUser, OIDCProvider, type OIDCProviderOptions, type OpenApiDocument, type OpenApiInfo, type OutboundMedia, type OutboundResult, type OutboxPublisher, OutboxRelay, type OutboxRelayOptions, OutboxStatus, PHONE_BR_PATTERN, type PaginationFilter, type PaginationLinkOptions, type ParsedAdminForm, type PasswordResetConfirmInput, type PasswordResetFormOptions, type PasswordResetRequestInput, PasswordResetService, type PasswordResetServiceOptions, type PasswordResetStore, PasswordUtils, REDOC_CDN_URL, REQUEST_ID_HEADER, RabbitBroker, type RabbitBrokerOptions, type RateLimitKeyFunc, type RateLimitOptions, type RateLimitRedisLike, type RateLimitResult, type RateLimitStore, RedisCacheManager, RedisIdempotencyStore, type RedisLike, type RedisPublisherLike, RedisRateLimitStore, RedisSSEBroker, type RedisSSEBrokerOptions, RedisSessionStore, type RedisSubscriberLike, type RedocBundleSource, type RedocOptions, type RefreshInput, Region, type RegionValue, type RegisterExceptionHandlersOptions, type RequestContext, type RequestTracingOptions, type ResolvedAdminTheme, type ResponseMapper, RetryPolicy, type RunServerOptions, type S3ClientLike, S3UploadStorage, type S3UploadStorageOptions, SSEBroker, type SaveOptions, type SendOptions, ServerSentEvent, type ServerSentEventInit, type Session, type SessionMiddlewareOptions, type SessionRedisLike, SessionService, type SessionServiceOptions, type SessionStore, type SignupInput, type SlowQueryOptions, type SpecProvider, type StateBR, type SwaggerOptions, type SyncFilter, type SystemMetrics, TOTPHelper, type TOTPOptions, type TaskHandler, TaskManager, type TaskManagerOptions, TelegramProvider, type TelegramProviderOptions, TenantScopedRepository, type TestDatabase, type ThrottleBackend, type ThrottleStatus, type ToDictOptions, type TokenPair, TooManyRequestsException, type TooManyRequestsOptions, type ToolSpecOptions, TwilioSmsProvider, type TwilioSmsProviderOptions, type TwilioWebhookOptions, UF, type UFValue, UnauthorizedException, type UnhandledExceptionHandlerOptions, type UploadResult, type UploadStorage, UserAuthService, type UserAuthServiceOptions, UserModelAuthBackend, type UserModelAuthBackendOptions, type UserPublic, type UserStore, UserTokenPurpose, VERSION, ValidationException, type WSEnvelope, WebPushDispatcher, type WebPushDispatcherOptions, WebPushError, WebPushGoneError, type WebPushKeys, type WebPushPayload, type WebPushSubscription, type WebSocketConnection, WebSocketHub, type WebSocketHubOptions, type WebSocketLike, type WebhookSignatureOptions, WebhookSignatureVerifier, WhatsAppProvider, type WhatsAppProviderOptions, type WhatsAppWebhookOptions, type WidgetSpec, activationSchema, addLogSink, adminAction, adminColumns, adminLens, adminThemeCss, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildFormFields, buildPaginationLinkHeader, cached, centsField, cepField, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, csrfTokenMatches, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, looseBoolean as envBoolean, envList, escapeHtml, filterForColumn, foreignKeyFields, foreignKeyLabel, foreignKeyTable, formatCellValue, formatFieldValue, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, hexColorField, humanizeField, idempotencyMiddleware, inboundMessageSchema, isColumnOptional, isSearchableColumn, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, latitudeField, listStates, loadSettings, logEntrySchema, logSettingsShape, loginSchema, longitudeField, looseBoolean, makeAdminJsonRouter, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, metricCard, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, parseFormBody, partitionTotal, passwordResetConfirmSchema, passwordResetRequestSchema, percentField, phoneBrField, portField, positiveFloatField, positiveIntField, priceField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, ratingField, ratioField, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderDashboardPage, renderDetailPage, renderFormPage, renderLayout, renderListPage, renderLoginPage, renderMfaPage, renderPasswordResetFormPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveAdminTheme, resolveDownloadPath, resolveRedocBundle, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, serverSettingsShape, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, slugField, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, trendDirection, trendPercent, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, widgetForColumn, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };