tempest-express-sdk 0.28.0 → 0.29.0

package/dist/index.d.cts

@@ -3586,6 +3586,231 @@ declare function trendDirection(trend: MetricTrend): "up" | "down" | "flat";
  */
 declare function partitionTotal(partition: MetricPartition): number;
 
+/**
+ * The admin panel's log reader and exporters, mirroring `admin.router`'s logs
+ * page and `admin` log export helpers.
+ *
+ * Reads the structured JSON records `configureFileLogging` writes, filters them
+ * the way the page does, and renders the same selection as markdown or JSON so
+ * an export never disagrees with the page it was taken from.
+ *
+ * The page is **opt-in**: the payload carries tracebacks and request metadata,
+ * so it only exists when a project passes a log directory to `makeAdminRouter`.
+ */
+/** A parsed log record, as the panel reads it. */
+interface AdminLogEntry {
+    /** Severity, when the record carries one. */
+    level: string;
+    /** The logger name. */
+    logger: string;
+    /** The message text. */
+    message: string;
+    /** ISO timestamp, when present. */
+    timestamp: string;
+    /** The stack trace, when the record carries one. */
+    stack: string | null;
+    /** Correlation fields worth showing next to the message. */
+    context: Record<string, unknown>;
+    /** Everything the record carried, verbatim. */
+    raw: Record<string, unknown>;
+}
+/**
+ * Normalize a raw JSON log line into the shape the page renders.
+ *
+ * @param raw - The parsed record.
+ * @returns The normalized entry.
+ */
+declare function toLogEntry(raw: Record<string, unknown>): AdminLogEntry;
+/**
+ * Filter entries by a free-text term.
+ *
+ * Matches the message, the logger and the stack, because an operator hunting a
+ * 500 usually has a fragment of the traceback, not of the message.
+ *
+ * @param entries - The entries to filter.
+ * @param term - The search term; empty returns everything.
+ * @returns The matching entries.
+ */
+declare function filterLogEntries(entries: AdminLogEntry[], term: string): AdminLogEntry[];
+/**
+ * Render entries as markdown, ready to paste into an issue.
+ *
+ * Each stack goes in a fenced block so it survives the paste with its
+ * indentation intact, and the header declares the source, the filter and — when
+ * the cap truncated the selection — how many records matched in total, so a
+ * partial export never reads as a complete one.
+ *
+ * @param entries - The entries to render, newest first.
+ * @param options - The source and search term the page had applied, and the
+ *   total number of matches before the cap.
+ * @returns The markdown document.
+ */
+declare function renderLogEntriesMarkdown(entries: AdminLogEntry[], options: {
+    source: string;
+    query: string;
+    total: number;
+}): string;
+/**
+ * Render entries as JSON, verbatim.
+ *
+ * @param entries - The entries to render, newest first.
+ * @returns The JSON document, carrying every field the application logged.
+ */
+declare function renderLogEntriesJson(entries: AdminLogEntry[]): string;
+
+/**
+ * A SQL console for the admin, with a policy in front of it — mirroring
+ * `admin.sql_shell`.
+ *
+ * Every serious admin panel grows one of these, because eventually someone
+ * needs an answer the list view cannot give. This is that console, plus the
+ * guard rails to make it survivable.
+ *
+ * ## Read this before enabling it
+ *
+ * **A SQL filter in the application is defence in depth, not a security
+ * boundary.** The analyser here parses statements properly (via
+ * `node-sql-parser`) rather than matching strings, which stops the ordinary
+ * mistakes: a `DROP` typed by someone who meant to `SELECT`, an `UPDATE` with
+ * no `WHERE`, a query against a table holding card data. It will not stop a
+ * determined operator with time — SQL has CTEs, subqueries, functions, dialect
+ * extensions and comment tricks, and any parser-based allowlist is a game of
+ * coverage.
+ *
+ * The boundary that actually holds is the **database user**. A role granted
+ * only `SELECT` on three tables cannot `DROP` anything, whatever reaches it:
+ *
+ * ```sql
+ * CREATE ROLE admin_console LOGIN PASSWORD '…';
+ * GRANT CONNECT ON DATABASE app TO admin_console;
+ * GRANT SELECT ON orders, customers, invoices TO admin_console;
+ * ```
+ *
+ * Point the console's `run` at *that* connection, then use the policy to narrow
+ * further and to produce a readable refusal instead of a database error. Used
+ * that way the two layers complement each other. Used alone, the policy is a
+ * speed bump.
+ *
+ * The console is **off by default**, and every attempt — allowed or refused —
+ * reaches the audit hook.
+ */
+/**
+ * What a console may do, one statement family per member.
+ *
+ * Split the way an operator thinks about risk rather than the way SQL groups
+ * keywords: `DELETE` is separate from `UPDATE` because losing rows and
+ * corrupting them are different incidents, and `DROP` is separate from the rest
+ * of DDL because it is the one nobody undoes.
+ */
+declare const SqlCapability: {
+    /** `SELECT`, `WITH … SELECT`, `EXPLAIN`, `SHOW`. */
+    readonly READ: "read";
+    /** Adds rows. */
+    readonly INSERT: "insert";
+    /** Changes rows. */
+    readonly UPDATE: "update";
+    /** Removes rows. */
+    readonly DELETE: "delete";
+    /** `CREATE` / `ALTER` / `COMMENT`. */
+    readonly DDL: "ddl";
+    /** `DROP` and `TRUNCATE`: irreversible structure loss. */
+    readonly DROP: "drop";
+    /**
+     * `GRANT` / `REVOKE` / `SET`, and anything the analyser cannot classify.
+     * Unknown statements land here on purpose, so a construct nobody anticipated
+     * needs the most privileged capability rather than the least.
+     */
+    readonly ADMIN: "admin";
+};
+/** A {@link SqlCapability} value. */
+type SqlCapability = (typeof SqlCapability)[keyof typeof SqlCapability];
+/** What the analyser concluded about a submitted statement. */
+interface SqlAnalysis {
+    /** How many statements the text carries. */
+    statements: number;
+    /** The capabilities the text needs, deduplicated. */
+    capabilities: SqlCapability[];
+    /** Tables the parser could name, lowercased. */
+    tables: string[];
+    /** Whether the parser understood the text at all. */
+    parsed: boolean;
+    /** Whether any statement mutates rows without a `WHERE`. */
+    unscopedWrite: boolean;
+}
+/** The rules a console enforces before running anything. */
+interface SqlConsolePolicy {
+    /** Capabilities the console may use. Default `["read"]`. */
+    capabilities?: readonly SqlCapability[];
+    /** When set, only these tables may be touched (lowercased comparison). */
+    allowTables?: readonly string[];
+    /** Tables that may never be touched, whatever `allowTables` says. */
+    denyTables?: readonly string[];
+    /** Refuse an `UPDATE`/`DELETE` with no `WHERE`. Default `true`. */
+    requireWhereOnWrites?: boolean;
+    /** Rows returned to the browser. Default `200`. */
+    maxRows?: number;
+}
+/** One console attempt, handed to the audit hook whether or not it ran. */
+interface SqlAuditEntry {
+    /** The submitted text, verbatim. */
+    sql: string;
+    /** The operator's display name. */
+    principal: string;
+    /** Whether the policy let it run. */
+    allowed: boolean;
+    /** Why it was refused, or `null` when it ran. */
+    reason: string | null;
+    /** What the analyser concluded. */
+    analysis: SqlAnalysis;
+    /** Wall-clock duration in milliseconds, or `null` when it never ran. */
+    durationMs: number | null;
+    /** Rows returned, or `null` when it never ran or returned none. */
+    rowCount: number | null;
+}
+/** Called for every attempt, allowed or refused. */
+type SqlAuditHook = (entry: SqlAuditEntry) => void | Promise<void>;
+/** The subset of `node-sql-parser` this module uses. */
+interface SqlParser {
+    astify(sql: string, options: {
+        database: string;
+    }): unknown;
+    tableList(sql: string, options: {
+        database: string;
+    }): string[];
+}
+/**
+ * Load `node-sql-parser`, or throw an error naming the install command.
+ *
+ * @returns A parser instance.
+ * @throws Error When the optional peer is not installed.
+ */
+declare function loadSqlParser(): Promise<SqlParser>;
+/**
+ * Classify a submitted statement.
+ *
+ * Text the parser cannot understand is not rejected here — it comes back as
+ * `parsed: false` needing {@link SqlCapability.ADMIN}, so an unanticipated
+ * construct requires the most privileged capability instead of slipping through
+ * as the least.
+ *
+ * @param sql - The submitted text.
+ * @param dialect - The parser dialect (`postgresql`, `sqlite`, `mysql`, …).
+ * @param parser - The loaded parser.
+ * @returns What the text needs and touches.
+ */
+declare function analyzeSql(sql: string, dialect: string, parser: SqlParser): SqlAnalysis;
+/**
+ * Decide whether a policy lets an analysed statement run.
+ *
+ * @param analysis - What the analyser concluded.
+ * @param policy - The console's rules.
+ * @returns The verdict and, on refusal, a reason the operator can act on.
+ */
+declare function checkSqlPolicy(analysis: SqlAnalysis, policy: SqlConsolePolicy): {
+    allowed: boolean;
+    reason: string | null;
+};
+
 /**
  * Related child models surfaced on a parent's detail view — Django's
  * `TabularInline` analog, mirroring `admin.config.Inline`.
@@ -4938,6 +5163,8 @@ interface AdminRenderContext {
     currentPath: string;
     /** Sidebar entries, one per registered model. */
     navModels: AdminNavEntry[];
+    /** Sidebar entries for the system tools (logs, SQL console). */
+    navSystem: AdminNavEntry[];
     /** Banners rendered above the content. */
     messages: AdminMessage[];
 }
@@ -5234,6 +5461,93 @@ interface AdminFormView {
  * @throws Error When called without a session, since the form needs a CSRF token.
  */
 declare function renderFormPage(context: AdminRenderContext, view: AdminFormView): string;
+/** One row of the logs page. */
+interface AdminLogRowView {
+    /** Severity, lowercased, driving the badge colour. */
+    level: string;
+    /** ISO timestamp, or `""`. */
+    timestamp: string;
+    /** Logger name. */
+    logger: string;
+    /** Message text. */
+    message: string;
+    /** Stack trace, or `null` when the record carries none. */
+    stack: string | null;
+    /** Correlation fields, already formatted as `key: value` pairs. */
+    context: {
+        key: string;
+        value: string;
+    }[];
+}
+/** The view model the logs page renders. */
+interface AdminLogsView {
+    /** Available source selectors. */
+    sources: {
+        value: string;
+        label: string;
+        selected: boolean;
+    }[];
+    /** The current search term. */
+    query: string;
+    /** The rows on this page, newest first. */
+    rows: AdminLogRowView[];
+    /** Total matching records. */
+    total: number;
+    /** Current page, 1-based. */
+    page: number;
+    /** Total pages. */
+    pages: number;
+    /** URL of the previous page, or `null`. */
+    prevUrl: string | null;
+    /** URL of the next page, or `null`. */
+    nextUrl: string | null;
+    /** URL exporting the current selection as markdown. */
+    exportMarkdownUrl: string;
+    /** URL exporting the current selection as JSON. */
+    exportJsonUrl: string;
+    /** Cap the export applies. */
+    exportMax: number;
+}
+/**
+ * Render the application-logs page.
+ *
+ * A record carrying a stack becomes a `<details>` whose summary is the message
+ * itself, collapsed by default: a page full of 500s has to stay scannable, and
+ * that needs no JavaScript.
+ *
+ * @param context - The shared chrome data.
+ * @param view - The prepared logs view model.
+ * @returns The full page.
+ */
+declare function renderLogsPage(context: AdminRenderContext, view: AdminLogsView): string;
+/** The view model the SQL console renders. */
+interface AdminSqlView {
+    /** The submitted statement, echoed back into the textarea. */
+    sql: string;
+    /** Capabilities this console is allowed to use. */
+    capabilities: string[];
+    /** A refusal or execution error, or `null`. */
+    error: string | null;
+    /** Column names of the result, when one ran. */
+    columns: string[];
+    /** Result rows, already formatted. */
+    rows: string[][];
+    /** Rows returned, or `null` when nothing ran. */
+    rowCount: number | null;
+    /** Whether the result was truncated by the row cap. */
+    truncated: boolean;
+    /** Wall-clock duration in milliseconds, or `null`. */
+    durationMs: number | null;
+}
+/**
+ * Render the SQL console.
+ *
+ * @param context - The shared chrome data (with an active session).
+ * @param view - The prepared console view model.
+ * @returns The full page.
+ * @throws Error When called without a session, since the form needs a CSRF token.
+ */
+declare function renderSqlPage(context: AdminRenderContext, view: AdminSqlView): string;
 /** The outcome of a CSV import, as the page renders it. */
 interface AdminImportView {
     /** Plural display name of the model being imported into. */
@@ -5328,6 +5642,33 @@ interface AdminRouterOptions {
     accessPolicy?: AdminAccessPolicy;
     /** Largest upload the panel accepts, in bytes. Default `10485760` (10 MB). */
     maxUploadBytes?: number;
+    /**
+     * Expose the application-logs page, reading the JSON files
+     * `configureFileLogging` writes to this directory. Omitted keeps the page
+     * off: the payload carries tracebacks and request metadata.
+     */
+    logDir?: string;
+    /**
+     * Expose the SQL console. Omitted keeps it off. Read the guard rails in
+     * `@/admin/sqlConsole` before enabling it: the policy is defence in depth,
+     * and the boundary that holds is the database user behind `run`.
+     */
+    sqlConsole?: AdminSqlConsoleOptions;
+}
+/** Configuration for the optional SQL console. */
+interface AdminSqlConsoleOptions {
+    /** The rules enforced before anything runs. Defaults to read-only. */
+    policy?: SqlConsolePolicy;
+    /**
+     * Executes an approved statement. Omitted runs it on the request's own
+     * session — point this at a restricted database role instead whenever the
+     * console can do more than read.
+     */
+    run?: (sql: string, session: AsyncSession) => Promise<Record<string, unknown>[]>;
+    /** Parser dialect. Default `"postgresql"`. */
+    dialect?: string;
+    /** Called for every attempt, allowed or refused. */
+    onAudit?: SqlAuditHook;
 }
 /**
  * Build the admin panel router.
@@ -7073,6 +7414,18 @@ interface LogsRouterOptions {
     /** Middlewares run before the handler (e.g. a token guard). */
     guards?: RequestHandler[];
 }
+/**
+ * Read and parse the structured log records a source selector covers.
+ *
+ * Shared by the JSON logs endpoint and the admin panel's logs page so the two
+ * never disagree about what "the error log" contains. A corrupt line is skipped
+ * rather than failing the read: one bad write should not hide the rest.
+ *
+ * @param dir - The log directory.
+ * @param source - Which file(s) to read.
+ * @returns The parsed records, in file order (oldest first).
+ */
+declare function readLogEntries(dir: string, source: LogSource): Promise<Record<string, unknown>[]>;
 /**
  * Build a router serving `GET <path>` with query params `source`, `page` and
  * `pageSize`. Returns `{ items, total, page, pageSize, pages }`, newest first.
@@ -7137,6 +7490,6 @@ declare function createTestDatabase(models: readonly ModelClass[]): TestDatabase
 declare function withTestDatabase<T>(models: readonly ModelClass[], fn: (db: TestDatabase) => Promise<T>): Promise<T>;
 
 /** The installed SDK version. Single source of truth for the barrel + CLI. */
-declare const VERSION = "0.28.0";
+declare const VERSION = "0.29.0";
 
-export { ADMIN_CSS, type ActivationInput, ActivationService, type ActivationServiceOptions, type ActivationStore, type AdminAccessPolicy, type AdminAction, type AdminActionCategory, type AdminActionContext, type AdminActionHandler, type AdminActionOptions, type AdminActionResult, type AdminAuditEntryView, type AdminAuditView, type AdminAuthBackend, type AdminAutomapOptions, type AdminBusinessCardView, type AdminDashboardCard, type AdminDashboardMetrics, type AdminDetailView, type AdminFilterKind, type AdminFilterView, type AdminFormField, type AdminFormView, type AdminImportView, type AdminInline, type AdminInlineOptions, type AdminInlineRowView, type AdminInlineView, type AdminJsonField, type AdminJsonListQuery, type AdminJsonListResult, type AdminJsonResource, type AdminJsonRouterOptions, AdminJsonSite, type AdminLens, type AdminLensOptions, type AdminListView, type AdminMessage, type AdminMfaVerifier, AdminModel, type AdminModelOptions, type AdminNavEntry, AdminPermission, type AdminRenderContext, type AdminRouterOptions, type AdminRow, type AdminSelectOption, type AdminSession, AdminSessionStore, type AdminSessionStoreOptions, AdminSite, type AdminSiteOptions, type AdminSortView, type AdminTheme, type AdminWidget, AppException, type AppExceptionHandlerOptions, type AppExceptionOptions, type AttachWebSocketOptions, AttemptThrottle, type AttemptThrottleOptions, AuditAction, type AuthResponse, type AuthResultPageOptions, type AuthRouterOptions, type AuthUser, type BackupOptions, type BaseAppSettings, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, type BaseResponse, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, type BodySizeLimitOptions, type BroadcastOptions, type BroadcastResult, type BrokerManager, type BuildFormFieldsOptions, type BulkActionOption, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, type CPUMetrics, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type CacheManager, type CachedOptions, type CachedResponse, type CardCompute, type CardData, type CatalogData, CircuitOpenError, type ClientIpOptions, CompositeFeatureFlagBackend, ConflictException, type CreateAppOpenApi, type CreateAppOptions, type CsrfOptions, type CursorPaginationFilter, DEFAULT_DOCS_FAVICON, DEFAULT_LOCALE, type DownloadOptions, type EmailMessage, type EmailOptions, EmailProvider, type EmailProviderOptions, EmailUtils, type Enum, type EnumHelpers, type EnumSpec, EnvFeatureFlagBackend, EventStream, type EventStreamOptions, type ExceptionDetails, ExpiredTokenException, type FeatureFlagBackend, FeatureFlags, type FieldChange, type FileLoggingHandle, type FileLoggingOptions, type FlagContext, ForbiddenException, type GPUMetrics, type GenerateOpenApiOptions, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, type GracefulShutdownOptions, HTTPClient, type HTTPClientOptions, HTTP_500_LOG_FILE, HTTP_500_MARKER, type HandshakeInfo, type HealthCheck, type HealthRouterOptions, HttpMetrics, IDEMPOTENCY_HEADER, type IdempotencyOptions, type IdempotencyRedisLike, type IdempotencyStore, type InboundHandler, type InboundMessage, InvalidTokenException, type IssuedSession, JSONLogger, JWTUtils, type JWTUtilsOptions, type JwtAuthOptions, type JwtClaims, type JwtDecoderLike, LEVEL_LOG_FILES, LocalUploadStorage, type LocalUploadStorageOptions, type LogEntry, type LogExtra, type LogLevel, type LogSink, type LogSource, type LoginInput, type LoginResult, type LogsRouterOptions, type MediaKind, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, type MemoryMetrics, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, type MessageHandler, MessagingHub, type MessagingProvider, type MetricCard, type MetricPartition, type MetricTrend, type MetricValue, type MetricsRouterOptions, MetricsUtils, type MfaChallenge, type MfaChallengeInput, type MfaCodeInput, type MfaEnrollment, MfaService, type MfaServiceOptions, type MfaStore, MultipartLimitError, NotFoundException, type OAuthClientOptions, OAuthError, type OAuthTokens, type OAuthUser, OIDCProvider, type OIDCProviderOptions, type OpenApiDocument, type OpenApiInfo, type OutboundMedia, type OutboundResult, type OutboxPublisher, OutboxRelay, type OutboxRelayOptions, OutboxStatus, PHONE_BR_PATTERN, type PaginationFilter, type PaginationLinkOptions, type ParseFormBodyOptions, type ParseMultipartOptions, type ParsedAdminForm, type ParsedMultipart, type PasswordResetConfirmInput, type PasswordResetFormOptions, type PasswordResetRequestInput, PasswordResetService, type PasswordResetServiceOptions, type PasswordResetStore, PasswordUtils, REDOC_CDN_URL, REQUEST_ID_HEADER, RabbitBroker, type RabbitBrokerOptions, type RateLimitKeyFunc, type RateLimitOptions, type RateLimitRedisLike, type RateLimitResult, type RateLimitStore, RedisCacheManager, RedisIdempotencyStore, type RedisLike, type RedisPublisherLike, RedisRateLimitStore, RedisSSEBroker, type RedisSSEBrokerOptions, RedisSessionStore, type RedisSubscriberLike, type RedocBundleSource, type RedocOptions, type RefreshInput, Region, type RegionValue, type RegisterExceptionHandlersOptions, type RequestContext, type RequestTracingOptions, type ResolvedAdminTheme, type ResponseMapper, RetryPolicy, type RunServerOptions, type S3ClientLike, S3UploadStorage, type S3UploadStorageOptions, SSEBroker, type SaveOptions, type SendOptions, ServerSentEvent, type ServerSentEventInit, type Session, type SessionMiddlewareOptions, type SessionRedisLike, SessionService, type SessionServiceOptions, type SessionStore, type SignupInput, type SlowQueryOptions, type SpecProvider, type StateBR, type SwaggerOptions, type SyncFilter, type SystemMetrics, TOTPHelper, type TOTPOptions, type TaskHandler, TaskManager, type TaskManagerOptions, TelegramProvider, type TelegramProviderOptions, TenantScopedRepository, type TestDatabase, type ThrottleBackend, type ThrottleStatus, type ToDictOptions, type TokenPair, TooManyRequestsException, type TooManyRequestsOptions, type ToolSpecOptions, TwilioSmsProvider, type TwilioSmsProviderOptions, type TwilioWebhookOptions, UF, type UFValue, UnauthorizedException, type UnhandledExceptionHandlerOptions, type UploadResult, type UploadStorage, type UploadedFile, UserAuthService, type UserAuthServiceOptions, UserModelAuthBackend, type UserModelAuthBackendOptions, type UserPublic, type UserStore, UserTokenPurpose, VERSION, ValidationException, type WSEnvelope, WebPushDispatcher, type WebPushDispatcherOptions, WebPushError, WebPushGoneError, type WebPushKeys, type WebPushPayload, type WebPushSubscription, type WebSocketConnection, WebSocketHub, type WebSocketHubOptions, type WebSocketLike, type WebhookSignatureOptions, WebhookSignatureVerifier, WhatsAppProvider, type WhatsAppProviderOptions, type WhatsAppWebhookOptions, type WidgetSpec, activationSchema, addLogSink, adminAction, adminColumns, adminInline, adminLens, adminThemeCss, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildFormFields, buildPaginationLinkHeader, cached, centsField, cepField, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, csrfTokenMatches, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, looseBoolean as envBoolean, envList, escapeHtml, filterForColumn, foreignKeyFields, foreignKeyLabel, foreignKeyTable, formatCellValue, formatFieldValue, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, groupInlineSubmission, hashOpaqueToken, hexColorField, humanizeField, idempotencyMiddleware, inboundMessageSchema, isColumnOptional, isMultipart, isSearchableColumn, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, latitudeField, listStates, loadSettings, logEntrySchema, logSettingsShape, loginSchema, longitudeField, looseBoolean, makeAdminJsonRouter, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, metricCard, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, parseCsv, parseFormBody, parseMultipart, partitionTotal, passwordResetConfirmSchema, passwordResetRequestSchema, percentField, phoneBrField, portField, positiveFloatField, positiveIntField, priceField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, ratingField, ratioField, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderDashboardPage, renderDetailPage, renderFormPage, renderImportPage, renderLayout, renderListPage, renderLoginPage, renderMfaPage, renderPasswordResetFormPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveAdminTheme, resolveDownloadPath, resolveRedocBundle, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, serverSettingsShape, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, slugField, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, trendDirection, trendPercent, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, widgetForColumn, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };
+export { ADMIN_CSS, type ActivationInput, ActivationService, type ActivationServiceOptions, type ActivationStore, type AdminAccessPolicy, type AdminAction, type AdminActionCategory, type AdminActionContext, type AdminActionHandler, type AdminActionOptions, type AdminActionResult, type AdminAuditEntryView, type AdminAuditView, type AdminAuthBackend, type AdminAutomapOptions, type AdminBusinessCardView, type AdminDashboardCard, type AdminDashboardMetrics, type AdminDetailView, type AdminFilterKind, type AdminFilterView, type AdminFormField, type AdminFormView, type AdminImportView, type AdminInline, type AdminInlineOptions, type AdminInlineRowView, type AdminInlineView, type AdminJsonField, type AdminJsonListQuery, type AdminJsonListResult, type AdminJsonResource, type AdminJsonRouterOptions, AdminJsonSite, type AdminLens, type AdminLensOptions, type AdminListView, type AdminLogEntry, type AdminLogRowView, type AdminLogsView, type AdminMessage, type AdminMfaVerifier, AdminModel, type AdminModelOptions, type AdminNavEntry, AdminPermission, type AdminRenderContext, type AdminRouterOptions, type AdminRow, type AdminSelectOption, type AdminSession, AdminSessionStore, type AdminSessionStoreOptions, AdminSite, type AdminSiteOptions, type AdminSortView, type AdminSqlConsoleOptions, type AdminSqlView, type AdminTheme, type AdminWidget, AppException, type AppExceptionHandlerOptions, type AppExceptionOptions, type AttachWebSocketOptions, AttemptThrottle, type AttemptThrottleOptions, AuditAction, type AuthResponse, type AuthResultPageOptions, type AuthRouterOptions, type AuthUser, type BackupOptions, type BaseAppSettings, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, type BaseResponse, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, type BodySizeLimitOptions, type BroadcastOptions, type BroadcastResult, type BrokerManager, type BuildFormFieldsOptions, type BulkActionOption, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, type CPUMetrics, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type CacheManager, type CachedOptions, type CachedResponse, type CardCompute, type CardData, type CatalogData, CircuitOpenError, type ClientIpOptions, CompositeFeatureFlagBackend, ConflictException, type CreateAppOpenApi, type CreateAppOptions, type CsrfOptions, type CursorPaginationFilter, DEFAULT_DOCS_FAVICON, DEFAULT_LOCALE, type DownloadOptions, type EmailMessage, type EmailOptions, EmailProvider, type EmailProviderOptions, EmailUtils, type Enum, type EnumHelpers, type EnumSpec, EnvFeatureFlagBackend, EventStream, type EventStreamOptions, type ExceptionDetails, ExpiredTokenException, type FeatureFlagBackend, FeatureFlags, type FieldChange, type FileLoggingHandle, type FileLoggingOptions, type FlagContext, ForbiddenException, type GPUMetrics, type GenerateOpenApiOptions, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, type GracefulShutdownOptions, HTTPClient, type HTTPClientOptions, HTTP_500_LOG_FILE, HTTP_500_MARKER, type HandshakeInfo, type HealthCheck, type HealthRouterOptions, HttpMetrics, IDEMPOTENCY_HEADER, type IdempotencyOptions, type IdempotencyRedisLike, type IdempotencyStore, type InboundHandler, type InboundMessage, InvalidTokenException, type IssuedSession, JSONLogger, JWTUtils, type JWTUtilsOptions, type JwtAuthOptions, type JwtClaims, type JwtDecoderLike, LEVEL_LOG_FILES, LocalUploadStorage, type LocalUploadStorageOptions, type LogEntry, type LogExtra, type LogLevel, type LogSink, type LogSource, type LoginInput, type LoginResult, type LogsRouterOptions, type MediaKind, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, type MemoryMetrics, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, type MessageHandler, MessagingHub, type MessagingProvider, type MetricCard, type MetricPartition, type MetricTrend, type MetricValue, type MetricsRouterOptions, MetricsUtils, type MfaChallenge, type MfaChallengeInput, type MfaCodeInput, type MfaEnrollment, MfaService, type MfaServiceOptions, type MfaStore, MultipartLimitError, NotFoundException, type OAuthClientOptions, OAuthError, type OAuthTokens, type OAuthUser, OIDCProvider, type OIDCProviderOptions, type OpenApiDocument, type OpenApiInfo, type OutboundMedia, type OutboundResult, type OutboxPublisher, OutboxRelay, type OutboxRelayOptions, OutboxStatus, PHONE_BR_PATTERN, type PaginationFilter, type PaginationLinkOptions, type ParseFormBodyOptions, type ParseMultipartOptions, type ParsedAdminForm, type ParsedMultipart, type PasswordResetConfirmInput, type PasswordResetFormOptions, type PasswordResetRequestInput, PasswordResetService, type PasswordResetServiceOptions, type PasswordResetStore, PasswordUtils, REDOC_CDN_URL, REQUEST_ID_HEADER, RabbitBroker, type RabbitBrokerOptions, type RateLimitKeyFunc, type RateLimitOptions, type RateLimitRedisLike, type RateLimitResult, type RateLimitStore, RedisCacheManager, RedisIdempotencyStore, type RedisLike, type RedisPublisherLike, RedisRateLimitStore, RedisSSEBroker, type RedisSSEBrokerOptions, RedisSessionStore, type RedisSubscriberLike, type RedocBundleSource, type RedocOptions, type RefreshInput, Region, type RegionValue, type RegisterExceptionHandlersOptions, type RequestContext, type RequestTracingOptions, type ResolvedAdminTheme, type ResponseMapper, RetryPolicy, type RunServerOptions, type S3ClientLike, S3UploadStorage, type S3UploadStorageOptions, SSEBroker, type SaveOptions, type SendOptions, ServerSentEvent, type ServerSentEventInit, type Session, type SessionMiddlewareOptions, type SessionRedisLike, SessionService, type SessionServiceOptions, type SessionStore, type SignupInput, type SlowQueryOptions, type SpecProvider, type SqlAnalysis, type SqlAuditEntry, type SqlAuditHook, SqlCapability, type SqlConsolePolicy, type StateBR, type SwaggerOptions, type SyncFilter, type SystemMetrics, TOTPHelper, type TOTPOptions, type TaskHandler, TaskManager, type TaskManagerOptions, TelegramProvider, type TelegramProviderOptions, TenantScopedRepository, type TestDatabase, type ThrottleBackend, type ThrottleStatus, type ToDictOptions, type TokenPair, TooManyRequestsException, type TooManyRequestsOptions, type ToolSpecOptions, TwilioSmsProvider, type TwilioSmsProviderOptions, type TwilioWebhookOptions, UF, type UFValue, UnauthorizedException, type UnhandledExceptionHandlerOptions, type UploadResult, type UploadStorage, type UploadedFile, UserAuthService, type UserAuthServiceOptions, UserModelAuthBackend, type UserModelAuthBackendOptions, type UserPublic, type UserStore, UserTokenPurpose, VERSION, ValidationException, type WSEnvelope, WebPushDispatcher, type WebPushDispatcherOptions, WebPushError, WebPushGoneError, type WebPushKeys, type WebPushPayload, type WebPushSubscription, type WebSocketConnection, WebSocketHub, type WebSocketHubOptions, type WebSocketLike, type WebhookSignatureOptions, WebhookSignatureVerifier, WhatsAppProvider, type WhatsAppProviderOptions, type WhatsAppWebhookOptions, type WidgetSpec, activationSchema, addLogSink, adminAction, adminColumns, adminInline, adminLens, adminThemeCss, analyzeSql, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildFormFields, buildPaginationLinkHeader, cached, centsField, cepField, checkSqlPolicy, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, csrfTokenMatches, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, looseBoolean as envBoolean, envList, escapeHtml, filterForColumn, filterLogEntries, foreignKeyFields, foreignKeyLabel, foreignKeyTable, formatCellValue, formatFieldValue, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, groupInlineSubmission, hashOpaqueToken, hexColorField, humanizeField, idempotencyMiddleware, inboundMessageSchema, isColumnOptional, isMultipart, isSearchableColumn, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, latitudeField, listStates, loadSettings, loadSqlParser, logEntrySchema, logSettingsShape, loginSchema, longitudeField, looseBoolean, makeAdminJsonRouter, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, metricCard, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, parseCsv, parseFormBody, parseMultipart, partitionTotal, passwordResetConfirmSchema, passwordResetRequestSchema, percentField, phoneBrField, portField, positiveFloatField, positiveIntField, priceField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, ratingField, ratioField, readLogEntries, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderDashboardPage, renderDetailPage, renderFormPage, renderImportPage, renderLayout, renderListPage, renderLogEntriesJson, renderLogEntriesMarkdown, renderLoginPage, renderLogsPage, renderMfaPage, renderPasswordResetFormPage, renderSqlPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveAdminTheme, resolveDownloadPath, resolveRedocBundle, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, serverSettingsShape, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, slugField, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toDict, toLogEntry, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, trendDirection, trendPercent, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, widgetForColumn, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };