import { Knex } from 'knex';
export { Knex } from 'knex';
import { Request, Response } from 'express';
export { CookieOptions, NextFunction, Request, RequestHandler, Response, Router } from 'express';
export { Context, Hono, MiddlewareHandler, Next } from 'hono';
export { stream, streamSSE, streamText } from 'hono/streaming';
import { C as ConfirmConfig, P as PostActionPipeline, a as Category, E as EntityType, D as DisplayMode, R as RealtimeMode, W as WorkflowDTO, b as PageDefinitionDTO, c as ComputedEntityDefinition, d as CollectionEntityDefinition, e as EventEntityDefinition, V as ViewEntityDefinition, T as TreeEntityDefinition, f as DagEntityDefinition, g as EntityDefinition, S as SingleEntityDefinition, A as ActionDefinition, M as ModuleContext } from './entity-DocS_76e.js';
export { h as AbilityLike, i as ActionEntityService, j as ActionInjection, k as AdaptersContext, l as AppManifest, m as AttachableConfig, n as AuthRequest, B as BaseAuthRequest, o as BaseEntityService, p as BaseMailService, q as BaseRolesService, r as BaseUser, s as BaseUsersService, t as BridgeRule, u as BridgeTarget, v as CATEGORIES, w as CATEGORY_ORDER, x as CacheManagerContract, y as CacheOptions, z as CacheStats, F as CapabilitiesRegistry, G as CaslAction, H as CategoryMeta, I as CollectionEntityService, J as ComputedEntityService, K as ConfigContext, L as ConfigEntityDefinition, N as ConfigEntityService, O as ConfirmationType, Q as ContextCrypto, U as ContextEvents, X as ContextEventsHub, Y as ContextHelpers, Z as ContextSocket, _ as CoreContext, $ as CoreServices, a0 as CreateEntityServiceOptions, a1 as CustomRouteDefinition, a2 as DEFAULT_TENANT_ID, a3 as DagEntityService, a4 as DatabaseAdapter, a5 as DbContext, a6 as EngineContext, a7 as EntityAction, a8 as EntityCaslConfig, a9 as EntityChangePayload, aa as EntityController, ab as EntityHandler, ac as EntityQuery, ad as EntityRealtimeEmits, ae as EntityRealtimeEvents, af as EntityServiceHooks, ag as EnvDefaults, ah as EnvFieldMapping, ai as EnvMapping, aj as EventEmitterLike, ak as EventEntityService, al as ExternalEntityDefinition, am as ExternalEntityService, an as FilterOperators, ao as FilterValue, ap as ForbiddenErrorConstructor, aq as ForbiddenErrorInstance, ar as HttpMethod, as as LoggerReporter, at as ManagedCache, au as ModuleAbilities, av as ModuleManifest, aw as ModuleMiddlewares, ax as ModuleRequirements, ay as PageDefinition, az as PageType, aA as PaginatedResult, aB as PaginationParams, aC as PaginationParamsWithOffset, aD as PluginConfigField, aE as PluginConfigSchema, aF as PluginEnvVar, aG as PluginManifest, aH as PluginSetupInfo, aI as PostAction, aJ as RateLimitOptions, aK as ReferenceEntityDefinition, aL as ReferenceEntityService, aM as RegisterPluginOptions, aN as RetentionPolicy, aO as RolePermission, aP as RouteParameterDefinition, aQ as RouteResponseDefinition, aR as RuntimeContext, aS as SchemaAdapter, aT as SchemaAlterTableBuilder, aU as SchemaColumnBuilder, aV as SchemaColumnInfo, aW as SchemaForeignKeyBuilder, aX as SchemaTableBuilder, aY as ScopedCacheManager, aZ as SeedConfig, a_ as SeedContext, a$ as SendMailOptions, b0 as SendMailResult, b1 as ServerEntityQuery, b2 as ServicesContext, b3 as SharedEntityProperties, b4 as SingleEntityService, b5 as SocketIOBroadcastOperator, b6 as SocketIOServer, b7 as TempEntityDefinition, b8 as TempEntityService, b9 as TempRetentionPolicy, ba as TreeEntityService, bb as TreeNode, bc as TypedEntityQuery, bd as ValidateSchemas, be as ValidationDetail, bf as ValidationSchema, bg as ViewEntityService, bh as VirtualEntityDefinition, bi as VirtualEntityService, bj as WidgetDefinition, bk as WidgetLayout, bl as WorkflowConfig, bm as WorkflowState, bn as WorkflowStateDTO, bo as WorkflowTransition, bp as WorkflowTransitionDTO, bq as entityRoom } from './entity-DocS_76e.js';
import { L as LocalizedString, F as FieldCondition, I as InputType, a as FieldMeta, b as FieldAccessConfig, c as FieldDefinition } from './field-DtWJTIA9.js';
export { A as AuthProviderInfo, d as AuthProviderService, C as ConditionalBoolean, D as DEFAULT_LOCALES, e as DbType, E as EntityIndex, f as FieldDbConfig, g as FieldOptions, h as FieldRelation, i as FieldStorageConfig, j as FieldValidationConfig, k as LocaleConfig, l as getCountLabel, m as getFallbackLocale, r as refOptions, n as resolveLocalized } from './field-DtWJTIA9.js';
import 'pino';

/**
 * Server-Sent Events (SSE) types
 * @module sse
 */
/**
 * SSE helper for streaming responses
 */
interface SSEHelper {
    /**
     * Start an SSE stream
     * @param res - Express response object
     * @param handler - Async function that sends events
     * @param options - Stream options
     */
    stream(res: unknown, // Response type from Express, kept generic to avoid dependency
    handler: (send: SSESender) => Promise<void>, options?: SSEOptions): Promise<void>;
}
/**
 * Sender object for emitting SSE events
 */
interface SSESender {
    /**
     * Send a data event
     * @param data - Data to send (will be JSON stringified)
     * @param event - Optional event name (client listens with addEventListener)
     * @param id - Optional event ID (for reconnection with Last-Event-ID)
     */
    send(data: unknown, event?: string, id?: string): void;
    /**
     * Send a comment (useful for keep-alive)
     * @param text - Comment text
     */
    comment(text: string): void;
    /**
     * Close the stream
     */
    close(): void;
}
/**
 * Options for SSE stream
 */
interface SSEOptions {
    /**
     * Retry interval in ms for client reconnection (default: 3000)
     */
    retry?: number;
    /**
     * Keep-alive interval in ms (default: 30000, 0 to disable)
     */
    keepAlive?: number;
    /**
     * Callback when client disconnects
     */
    onClose?: () => void;
}
/**
 * Progress event sent via SSE during batch action execution.
 * Events are sent with the named event 'batch'.
 */
interface BatchProgressEvent {
    /** Current status of the batch process */
    status: 'started' | 'progress' | 'completed' | 'error';
    /** Progress percentage 0-100 */
    percent?: number;
    /** Current step number */
    step?: number;
    /** Total number of steps */
    totalSteps?: number;
    /** Human-readable message for the current operation */
    message?: string;
    /** Log entries (warnings, info, partial results) */
    logs?: BatchLogEntry[];
    /** Final result data (only on 'completed') */
    result?: unknown;
    /** Error details (only on 'error') */
    error?: {
        code: string;
        message: string;
    };
}
/**
 * Individual log entry emitted during batch processing
 */
interface BatchLogEntry {
    level: 'info' | 'warn' | 'error';
    message: string;
    timestamp?: string;
}

/** Webhook configuration record */
interface Webhook {
    id: string;
    name: string;
    url: string;
    events: string[];
    enabled: boolean;
    created_at: string;
    updated_at: string;
}
/** Response from creating a webhook — includes secret (shown only once) */
interface CreateWebhookResponse extends Webhook {
    secret: string;
}
/** Webhook delivery log record */
interface WebhookDelivery {
    id: string;
    webhook_id: string;
    event: string;
    url: string;
    request_body: string;
    response_status: number | null;
    response_body: string | null;
    duration_ms: number;
    attempt: number;
    status: 'success' | 'failed' | 'circuit_open';
    error: string | null;
    created_at: string;
}
/** Input for creating a webhook */
interface CreateWebhookInput {
    name: string;
    url: string;
    events: string[];
    enabled?: boolean;
}
/** Input for updating a webhook */
interface UpdateWebhookInput {
    name?: string;
    url?: string;
    events?: string[];
    enabled?: boolean;
}

/**
 * API DTOs (serializable versions for frontend consumption)
 */

/**
 * Serializable field definition for API responses.
 */
interface FieldDefinitionDTO {
    name: string;
    label: LocalizedString;
    input: InputType;
    placeholder?: LocalizedString;
    hint?: LocalizedString;
    hidden?: boolean | FieldCondition;
    disabled?: boolean | FieldCondition;
    required?: boolean | FieldCondition;
    defaultValue?: unknown;
    localized?: boolean;
    db?: {
        type: string;
        nullable?: boolean;
        default?: unknown;
        unique?: boolean;
        index?: boolean;
    };
    relation?: {
        table?: string;
        column?: string;
        labelField?: string;
        onDelete?: string;
    };
    validation?: {
        min?: number;
        max?: number;
        pattern?: string;
        format?: string;
        enum?: string[];
    };
    options?: {
        endpoint?: string;
        valueField?: string;
        labelField?: string;
        static?: Array<{
            value: string;
            label: LocalizedString;
            icon?: string;
        }>;
        allowCreate?: boolean;
    };
    storage?: {
        accept?: string;
        maxSize?: number;
        maxFiles?: number;
        folder?: string;
        thumbnails?: Array<{
            width: number;
            height: number;
        }>;
        dedupe?: boolean;
        visibility?: 'public' | 'internal' | 'private';
    };
    meta?: FieldMeta;
    /** Field-level access control (allowlist). UI uses it for client-side hints; enforcement is server-side. */
    access?: FieldAccessConfig;
    inputProps?: Record<string, unknown>;
    displayProps?: Record<string, unknown>;
}
/**
 * Serializable action definition for API responses.
 */
interface ActionDefinitionDTO {
    key: string;
    label: LocalizedString;
    icon?: string;
    scope?: 'module' | 'entity' | 'row';
    /** Group label for visual grouping */
    group?: LocalizedString;
    /** Whether this action is currently disabled (boolean or FieldCondition for client-side evaluation) */
    disabled?: boolean | FieldCondition;
    /** Reason shown as tooltip when disabled */
    disabledReason?: LocalizedString;
    /** Condition for per-row visibility. When false, action is hidden (not just disabled). */
    visible?: FieldCondition;
    /** Visual variant for the action button */
    variant?: 'default' | 'primary' | 'danger';
    method?: 'GET' | 'POST' | 'DELETE' | 'PUT' | 'PATCH';
    input?: Record<string, FieldDefinitionDTO>;
    order?: number;
    /** Whether this is a batch action with SSE progress */
    batch?: boolean;
    /** Timeout in ms for action execution */
    timeout?: number;
    /** Output field definitions for displaying result in read-only modal */
    output?: Record<string, FieldDefinitionDTO>;
    /** Reference to a PageDefinition id for rich result rendering */
    outputPage?: string;
    /** Confirmation dialog config (pure UI metadata) */
    confirm?: ConfirmConfig;
    /** Declarative post-execution behavior */
    postAction?: PostActionPipeline;
}
/**
 * Serializable entity definition for API responses.
 */
interface EntityDefinitionDTO {
    id: string;
    table?: string;
    key?: string;
    type: EntityType;
    label: LocalizedString;
    labelPlural?: LocalizedString;
    labelField?: string;
    icon?: string;
    routePrefix?: string;
    order?: number;
    fields: Record<string, FieldDefinitionDTO>;
    fieldsCount: number;
    hasTimestamps: boolean;
    hasAudit: boolean;
    caslSubject?: string;
    isSingle?: boolean;
    displayMode?: DisplayMode;
    defaultDisplayMode?: DisplayMode;
    availableDisplayModes?: DisplayMode[];
    hasSearchableFields?: boolean;
    hasSortableFields?: boolean;
    sortableFieldOptions?: Array<{
        value: string;
        label: string;
    }>;
    /** Fields eligible for grouping (select, boolean, relation, tags) */
    groupableFields?: string[];
    /** Subset of groupableFields where drag between board columns is allowed (default: all) */
    columnDragFields?: string[];
    /** Default groupBy field from entity definition */
    groupBy?: string;
    /** Default subgroupBy field from entity definition */
    subgroupBy?: string;
    /** Date field for calendar start */
    calendarFrom?: string;
    /** Date field for calendar end */
    calendarTo?: string;
    defaultSort?: {
        field: string;
        order: 'asc' | 'desc';
    };
    allowCreate?: boolean;
    allowEdit?: boolean;
    allowDelete?: boolean;
    allowDragDrop?: boolean;
    hidden?: boolean;
    actions?: ActionDefinitionDTO[];
    /** Real-time mode: 'live' (push), 'sync' (bidirectional), or false */
    realtime?: RealtimeMode;
    /** Socket.IO entity key for real-time subscriptions ({module}.{table}) */
    socketKey?: string;
    /** Tables that trigger live recomputation (view/computed entities) */
    liveOn?: string[];
    /** Auto-refresh interval in ms. Frontend polls data at this rate. */
    refreshInterval?: number;
    /** Entity supports taxonomy tagging (tag_assignments pivot) */
    taggeable?: boolean;
    /** Entity supports file attachments (file_attachments pivot). true = all types, config = restrictions. */
    attachable?: boolean | {
        accept?: string;
        maxFiles?: number;
    };
    /** Workflow configuration: states, transitions, CASL actions */
    workflow?: WorkflowDTO;
}
/**
 * Serializable module for API responses.
 */
interface ModuleDTO {
    name: string;
    label: LocalizedString;
    labelPlural?: LocalizedString;
    icon?: string;
    description?: LocalizedString;
    type: string;
    category?: Category;
    dependencies: string[];
    routePrefix: string;
    subjects: string[];
    definitions: EntityDefinitionDTO[];
    /** Count of exposed definitions (filtered by expose!==false) */
    definitionsCount?: number;
    /** Standalone action definitions (module-scope operations) */
    actions?: ActionDefinitionDTO[];
    pages?: PageDefinitionDTO[];
    hasRoutes: boolean;
    hasMigrate: boolean;
    hasSeed: boolean;
    hasInit: boolean;
}
/**
 * Setup information DTO (without postInstall function).
 */
interface PluginSetupInfoDTO {
    steps?: LocalizedString[];
    docsUrl?: string;
    prerequisites?: LocalizedString[];
    caveats?: LocalizedString[];
}
/**
 * Serializable plugin for API responses.
 */
interface PluginDTO {
    name: string;
    code: string;
    label: LocalizedString;
    labelPlural?: LocalizedString;
    icon?: string;
    /** URL to plugin image (served by backend) */
    image?: string;
    /** LLM-oriented documentation from llms.txt */
    llms?: string;
    category?: Category;
    version: string;
    description: LocalizedString;
    /** Whether the plugin package is installed in node_modules */
    installed: boolean;
    /** Whether the plugin is enabled in nexus.plugins.json (null if not configured) */
    enabled: boolean | null;
    modules: ModuleDTO[];
    envVars?: Array<{
        name: string;
        description: LocalizedString;
        required: boolean;
        default?: string;
        example?: string;
        pattern?: string;
        sensitive?: boolean;
    }>;
    peerDependencies?: Record<string, string>;
    setup?: PluginSetupInfoDTO;
}
/**
 * Plugin state persisted in database
 */
interface PluginStateDTO {
    name: string;
    enabled: boolean;
    installed_at: string;
    enabled_at: string | null;
    disabled_at: string | null;
    installed_version: string;
    installed_by: string | null;
    config: Record<string, unknown>;
}
/**
 * Result of install/uninstall action
 */
interface PluginActionResult {
    success: boolean;
    message: string;
    restarting?: boolean;
}
/**
 * Application manifest DTO (core or user app).
 */
interface ManifestDTO {
    name: string;
    version: string;
    modules: ModuleDTO[];
    plugins?: PluginDTO[];
}
/**
 * Combined manifest DTO with both core and user manifests.
 */
interface CombinedManifestDTO {
    core: ManifestDTO;
    user: ManifestDTO | null;
    hasUserApp: boolean;
    /** Current tenant ID for this server instance */
    tenantId: string;
}
/**
 * Public capabilities response.
 *
 * Exposed without authentication so clients can discover
 * which plugins are available before the user logs in.
 *
 * @remarks
 * Returned by `GET /system/capabilities` (public, no auth required).
 * The `plugins` array contains 3-char plugin codes (e.g. `'ntf'`, `'cpl'`).
 * Extensible — future fields (locales, feature flags) can be added
 * without breaking changes.
 *
 * @example
 * ```json
 * { "version": "0.14.0", "plugins": ["ntf", "cpl", "cht", "sch"] }
 * ```
 */
interface CapabilitiesDTO {
    /** Backend package version (semver) */
    version: string;
    /** 3-char codes of registered plugins */
    plugins: string[];
    /** Supported locales for the platform */
    locales: Array<{
        code: string;
        label: string;
        fallback?: boolean;
    }>;
    /** Plugin-contributed capabilities (extensible) */
    [key: string]: unknown;
}

/** Status of a ticket as seen by the end user */
type TicketStatus = 'pending' | 'in_progress' | 'resolved' | 'rejected';
/** Data submitted by a user to create a new ticket */
interface TicketSubmission {
    title: string;
    description: string;
    category?: string;
    priority?: string;
    submitter?: string;
}
/** Ticket as returned to the submitter (simplified view) */
interface TicketItem {
    id: string;
    title: string;
    status: TicketStatus;
    category: string;
    created_at: string;
    updated_at: string;
}
/** Result of a successful ticket submission */
interface TicketResult {
    id: string;
    status: TicketStatus;
}
/**
 * Generic ticket provider interface.
 * Plugins implement this to bridge Nexus with an external task tracker.
 */
interface TicketProvider {
    /** Submit a new ticket */
    submit(data: TicketSubmission): Promise<TicketResult>;
    /** List tickets for a specific submitter */
    list(submitter: string): Promise<TicketItem[]>;
    /** Verify the connection to the external service */
    testConnection(): Promise<boolean>;
    /** Whether the provider is currently available */
    isAvailable(): boolean;
}

/**
 * Type guards and utilities for EntityDefinitions
 */

/**
 * Entities that persist in the local DB with their own table (or SQL view).
 * Excludes: external, virtual, computed, single/config (uses shared table).
 */
type PersistentEntityDefinition = CollectionEntityDefinition | EventEntityDefinition | ViewEntityDefinition | TreeEntityDefinition | DagEntityDefinition;
/**
 * Entities without local persistence (read-only or without DB)
 */
type NonPersistentEntityDefinition = ComputedEntityDefinition;
/**
 * Type guard to check whether an entity persists in the local DB with its own table
 */
declare function isPersistentEntity(entity: EntityDefinition): entity is PersistentEntityDefinition;
/**
 * Type guard to check whether it is a singleton (uses shared sys_settings table)
 */
declare function isSingletonEntity(entity: EntityDefinition): entity is SingleEntityDefinition;
/**
 * Type guard to check whether an entity has its own table (for migrations)
 */
declare function hasTable(entity: EntityDefinition): entity is PersistentEntityDefinition;
/**
 * Gets an entity name in singular PascalCase.
 * 'cms_posts' → 'Post', 'rol_role_permissions' → 'RolePermission'
 */
declare function getEntityName(entity: EntityDefinition): string;
/**
 * Gets the CASL subject for an entity
 */
declare function getEntitySubject(entity: PersistentEntityDefinition): string;

/**
 * OIDC Types for Authentication Plugins
 *
 * Shared types for OpenID Connect authentication providers.
 * Used by plugins like @gzl10/nexus-plugin-pocketid and @gzl10/nexus-plugin-google-auth.
 */
/**
 * OIDC Discovery Document
 * @see https://openid.net/specs/openid-connect-discovery-1_0.html
 */
interface OidcDiscoveryDocument {
    issuer: string;
    authorization_endpoint: string;
    token_endpoint: string;
    userinfo_endpoint: string;
    jwks_uri: string;
    end_session_endpoint?: string;
    scopes_supported?: string[];
    response_types_supported?: string[];
    grant_types_supported?: string[];
    subject_types_supported?: string[];
    id_token_signing_alg_values_supported?: string[];
}
/**
 * OIDC Tokens from token endpoint
 */
interface OidcTokens {
    access_token: string;
    token_type: string;
    expires_in?: number;
    refresh_token?: string;
    id_token?: string;
    scope?: string;
}
/**
 * ID Token claims after validation
 */
interface IdTokenClaims {
    iss: string;
    sub: string;
    aud: string | string[];
    exp: number;
    iat: number;
    nonce?: string;
    auth_time?: number;
    azp?: string;
    at_hash?: string;
    email?: string;
    email_verified?: boolean;
    name?: string;
    /** Google Workspace hosted domain */
    hd?: string;
}
/**
 * OIDC UserInfo response
 */
interface OidcUserInfo {
    sub: string;
    name?: string;
    given_name?: string;
    family_name?: string;
    preferred_username?: string;
    email?: string;
    email_verified?: boolean;
    picture?: string;
    locale?: string;
    updated_at?: number;
}
/**
 * Authorization URL parameters
 */
interface AuthorizationParams {
    clientId: string;
    redirectUri: string;
    scopes: string[];
    state: string;
    nonce: string;
    responseType?: string;
    /** Google Workspace hosted domain (hd parameter) */
    hostedDomain?: string;
}
/**
 * Token exchange parameters
 */
interface TokenExchangeParams {
    tokenEndpoint: string;
    clientId: string;
    clientSecret: string;
    code: string;
    redirectUri: string;
}
/**
 * ID Token validation config
 */
interface TokenValidationConfig {
    jwksUri: string;
    issuer: string;
    clientId: string;
    nonce?: string;
}
/**
 * OIDC state stored temporarily during auth flow
 */
interface OidcState {
    state: string;
    /** Nonce for OIDC ID token validation. Optional for pure OAuth 2.0 providers. */
    nonce?: string;
    redirectUri: string;
    createdAt: number;
    /** User ID if linking existing account */
    linkUserId?: string;
}
/**
 * Session result after successful authentication
 */
interface SessionResult {
    accessToken: string;
    refreshToken: string;
    expiresIn: number;
    user: {
        id: string;
        email: string;
        name?: string;
    };
}

/**
 * OIDC Client interface
 */
interface OidcClient {
    /** Discover OIDC endpoints from issuer */
    discover(issuerUrl: string): Promise<OidcDiscoveryDocument>;
    /** Build authorization URL for redirect */
    buildAuthorizationUrl(authorizationEndpoint: string, params: AuthorizationParams): string;
    /** Exchange authorization code for tokens */
    exchangeCode(params: TokenExchangeParams): Promise<OidcTokens>;
    /** Get user info from access token */
    getUserInfo(accessToken: string, userInfoEndpoint: string): Promise<OidcUserInfo>;
    /** Validate ID token using JWKS */
    validateIdToken(idToken: string, config: TokenValidationConfig): Promise<IdTokenClaims>;
}
/**
 * Create OIDC client instance
 */
declare function createOidcClient(): OidcClient;
/**
 * Get shared OIDC client instance (singleton)
 */
declare function getOidcClient(): OidcClient;

/**
 * OIDC State Manager
 *
 * Manages OIDC state/nonce storage with TTL expiration.
 * Used for CSRF protection during authentication flows.
 *
 * Note: In-memory implementation. For production with multiple
 * instances, consider Redis or database storage.
 */

/**
 * State manager interface
 */
interface StateManager<T extends OidcState = OidcState> {
    /** Store state data */
    store(state: string, data: T): void;
    /** Verify and retrieve state (returns null if expired/invalid) */
    verify(state: string): T | null;
    /** Clear state after use */
    clear(state: string): void;
    /** Get TTL in milliseconds */
    getTtl(): number;
}
/**
 * Create in-memory state manager
 *
 * @param ttlMs - Time-to-live in milliseconds (default: 10 minutes)
 */
declare function createStateManager<T extends OidcState = OidcState>(ttlMs?: number): StateManager<T>;

/**
 * Domain Filter for OIDC Authentication
 *
 * Validates email domains against an allowlist.
 * Used to restrict authentication to specific domains.
 */
/**
 * Domain filter options
 */
interface DomainFilterOptions {
    /** Throw error if domain not allowed (default: true) */
    throwOnForbidden?: boolean;
}
/**
 * Domain filter result
 */
interface DomainFilterResult {
    allowed: boolean;
    domain: string;
}
/**
 * Check if email domain is in allowed list
 *
 * @param email - User email address
 * @param allowedDomainsJson - JSON array of allowed domains (null = all allowed)
 * @returns Domain filter result
 *
 * @example
 * // Allow specific domains
 * const result = checkAllowedDomain('user@example.com', '["example.com", "test.com"]')
 * // result: { allowed: true, domain: 'example.com' }
 *
 * @example
 * // Allow all domains
 * const result = checkAllowedDomain('user@any.com', null)
 * // result: { allowed: true, domain: 'any.com' }
 */
declare function checkAllowedDomain(email: string, allowedDomainsJson: string | null): DomainFilterResult;
/**
 * Assert email domain is allowed (throws if not)
 *
 * @param email - User email address
 * @param allowedDomainsJson - JSON array of allowed domains
 * @param errorClass - Error class to throw (default: Error)
 * @throws Error if domain is not allowed
 */
declare function assertAllowedDomain(email: string, allowedDomainsJson: string | null, errorClass?: new (message: string) => Error): void;

/**
 * Official Nexus plugins maintained by the core team.
 * Used by the backend to populate the plugin store.
 */
declare const OFFICIAL_PLUGINS: readonly ["@gzl10/nexus-plugin-ai", "@gzl10/nexus-plugin-auth-providers", "@gzl10/nexus-plugin-baserow", "@gzl10/nexus-plugin-charts", "@gzl10/nexus-plugin-cms", "@gzl10/nexus-plugin-compliance", "@gzl10/nexus-plugin-docker", "@gzl10/nexus-plugin-dropbox", "@gzl10/nexus-plugin-feeds", "@gzl10/nexus-plugin-google-drive", "@gzl10/nexus-plugin-headscale", "@gzl10/nexus-plugin-importer", "@gzl10/nexus-plugin-bookmarks", "@gzl10/nexus-plugin-n8n", "@gzl10/nexus-plugin-notifications", "@gzl10/nexus-plugin-notion", "@gzl10/nexus-plugin-oidc-server", "@gzl10/nexus-plugin-opnsense", "@gzl10/nexus-plugin-plane", "@gzl10/nexus-plugin-remote", "@gzl10/nexus-plugin-scim", "@gzl10/nexus-plugin-scraper", "@gzl10/nexus-plugin-secrets", "@gzl10/nexus-plugin-uptime", "@gzl10/nexus-plugin-webhooks"];
type OfficialPluginName = typeof OFFICIAL_PLUGINS[number];

/**
 * Exhaustive check helper for discriminated unions.
 * Use in `default` case of switch statements to get compile-time errors
 * when new variants are added.
 *
 * @example
 * switch (entity.type) {
 *   case 'collection': ...
 *   case 'single': ...
 *   default: assertNever(entity.type)
 * }
 */
/**
 * Format bytes to human-readable string (B, KB, MB, GB, TB)
 */
declare function formatBytes(bytes: number): string;
declare function assertNever(value: never, message?: string): never;
/**
 * Compose multiple field definition records into one.
 * Later records override earlier ones (last-write-wins per field name).
 *
 * @example
 * const fields = composeFields(
 *   timestampFields,
 *   { name: useTextField({ label: 'Name' }) },
 *   conditionalFields
 * )
 */
declare function composeFields(...fieldSets: Record<string, FieldDefinition>[]): Record<string, FieldDefinition>;
/**
 * Define an action with typed input and output.
 * Provides type safety for the handler while returning a standard ActionDefinition
 * that is assignable to ActionDefinition[] arrays.
 *
 * @example
 * interface SendEmailInput { to: string; subject: string; body: string }
 * interface SendEmailOutput { messageId: string }
 *
 * const sendEmail = defineAction<SendEmailInput, SendEmailOutput>({
 *   key: 'send-email',
 *   label: 'Send Email',
 *   handler: async (ctx, input) => {
 *     // input is typed as SendEmailInput
 *     return { messageId: '123' }
 *   }
 * })
 */
declare function defineAction<TInput = unknown, TOutput = unknown>(action: Omit<ActionDefinition, 'handler'> & {
    handler?: (ctx: ModuleContext, input: TInput, req?: Request, res?: Response) => Promise<TOutput>;
}): ActionDefinition;

interface ValidationError {
    field: string;
    message: string;
}
interface ValidationResult {
    valid: boolean;
    errors: ValidationError[];
}
/**
 * Validate an entity definition at design time.
 * Returns all validation errors (does not throw).
 */
declare function validateEntityDefinition(def: EntityDefinition): ValidationResult;

/**
 * @module mime
 * @description Centralized MIME type lookup by extension.
 *
 * Single source of truth — used by backend, desktop, mobile and any client
 * that needs to infer a MIME type from a filename without depending on
 * `mime-types` or platform-specific APIs.
 */
declare const FALLBACK_MIME = "application/octet-stream";
/**
 * Resolves a MIME type from a filename or path by its extension.
 * Returns {@link FALLBACK_MIME} when the extension is unknown.
 *
 * @example
 *   mimeFromFilename('photo.jpg') // 'image/jpeg'
 *   mimeFromFilename('archive.unknown') // 'application/octet-stream'
 */
declare function mimeFromFilename(filename: string): string;
/**
 * Returns the provided MIME type when it is meaningful, otherwise infers it
 * from the filename extension. Useful for HTTP uploads where some clients
 * (curl without `;type=`, raw fetch, scripts) omit the per-part Content-Type
 * and the server receives `application/octet-stream`.
 *
 * @example
 *   refineMime('application/octet-stream', 'video.mp4') // 'video/mp4'
 *   refineMime('image/png', 'photo.jpg') // 'image/png' (caller wins)
 */
declare function refineMime(provided: string | undefined, filename: string): string;
/** Generic fallback when nothing matches. */
declare const FALLBACK_ICON = "mdi:file";
/**
 * Resolves a Material Design Icon name (Iconify form, e.g. `mdi:file-pdf-box`)
 * for a given MIME type. Tries an exact match first, then a prefix match,
 * then {@link FALLBACK_ICON}.
 *
 * @example
 *   iconForMime('application/pdf')  // 'mdi:file-pdf-box'
 *   iconForMime('image/heic')       // 'mdi:file-image' (prefix fallback)
 *   iconForMime('application/x-foo')// 'mdi:file-outline'
 *   iconForMime(undefined)          // 'mdi:file'
 */
declare function iconForMime(mime: string | null | undefined): string;

/**
 * @module nexus-sdk
 * @description SDK types for creating Nexus plugins and modules without full backend dependency
 *
 * @gzl10/nexus-sdk
 *
 * Use this package to define plugin/module manifests without
 * depending on the full @gzl10/nexus-backend package.
 *
 * @remarks
 * Types are organized in submodules under ./types/ for maintainability.
 * This barrel file re-exports everything for backwards compatibility.
 */

type KnexCreateTableBuilder = Knex.CreateTableBuilder;
type KnexAlterTableBuilder = Knex.AlterTableBuilder;
type KnexTransaction = Knex.Transaction;

export { ActionDefinition, type ActionDefinitionDTO, type AuthorizationParams, type BatchLogEntry, type BatchProgressEvent, type CapabilitiesDTO, Category, CollectionEntityDefinition, type CombinedManifestDTO, ComputedEntityDefinition, ConfirmConfig, type CreateWebhookInput, type CreateWebhookResponse, DagEntityDefinition, DisplayMode, type DomainFilterOptions, type DomainFilterResult, EntityDefinition, type EntityDefinitionDTO, EntityType, EventEntityDefinition, FALLBACK_ICON, FALLBACK_MIME, FieldAccessConfig, FieldCondition, FieldDefinition, type FieldDefinitionDTO, FieldMeta, type IdTokenClaims, InputType, type KnexAlterTableBuilder, type KnexCreateTableBuilder, type KnexTransaction, LocalizedString, type ManifestDTO, ModuleContext, type ModuleDTO, type NonPersistentEntityDefinition, OFFICIAL_PLUGINS, type OfficialPluginName, type OidcClient, type OidcDiscoveryDocument, type OidcState, type OidcTokens, type OidcUserInfo, PageDefinitionDTO, type PersistentEntityDefinition, type PluginActionResult, type PluginDTO, type PluginSetupInfoDTO, type PluginStateDTO, PostActionPipeline, RealtimeMode, type SSEHelper, type SSEOptions, type SSESender, type SessionResult, SingleEntityDefinition, type StateManager, type TicketItem, type TicketProvider, type TicketResult, type TicketStatus, type TicketSubmission, type TokenExchangeParams, type TokenValidationConfig, TreeEntityDefinition, type UpdateWebhookInput, type ValidationError, type ValidationResult, ViewEntityDefinition, type Webhook, type WebhookDelivery, WorkflowDTO, assertAllowedDomain, assertNever, checkAllowedDomain, composeFields, createOidcClient, createStateManager, defineAction, formatBytes, getEntityName, getEntitySubject, getOidcClient, hasTable, iconForMime, isPersistentEntity, isSingletonEntity, mimeFromFilename, refineMime, validateEntityDefinition };