@nest-admin/nestjs 0.11.0

package/dist/index.js

@@ -0,0 +1,2901 @@
+import {
+  AdapterError,
+  ConstraintError,
+  FieldNotFoundError,
+  ForbiddenError,
+  InvalidQueryError,
+  ModelNotFoundError,
+  NestAdminError,
+  RecordNotFoundError,
+  UnauthorizedError,
+  ValidationError,
+  __name,
+  applyOverrides,
+  createdFieldFor,
+  detachBlockedReason,
+  displayFieldFor,
+  fieldOverride,
+  inverseRelationField,
+  isNestAdminError,
+  isReadOnly,
+  relationShape,
+  selectModels,
+  summarise,
+  unknownOverrideNames,
+  unknownSelectionNames,
+  unwritableHiddenFields
+} from "./chunk-7IXLRGGQ.js";
+
+// src/module.ts
+import { Logger as Logger6, Module } from "@nestjs/common";
+import { RouterModule } from "@nestjs/core";
+
+// src/admin/controller.ts
+import { Body, Controller, Delete, Get, Param, Patch, Post, Query, UseFilters, UseGuards } from "@nestjs/common";
+
+// src/auth/guard.ts
+import { Inject, Injectable } from "@nestjs/common";
+
+// src/tokens.ts
+var ADMIN_ADAPTER = /* @__PURE__ */ Symbol("NEST_ADMIN_ADAPTER");
+var ADMIN_AUTH = /* @__PURE__ */ Symbol("NEST_ADMIN_AUTH");
+var ADMIN_RESOURCE_AUTH = /* @__PURE__ */ Symbol("NEST_ADMIN_RESOURCE_AUTH");
+var ADMIN_UI_ROOT = /* @__PURE__ */ Symbol("NEST_ADMIN_UI_ROOT");
+var ADMIN_MOUNT_PATH = /* @__PURE__ */ Symbol("NEST_ADMIN_MOUNT_PATH");
+var ADMIN_RESOURCES = /* @__PURE__ */ Symbol("NEST_ADMIN_RESOURCES");
+var ADMIN_OPTIONS = /* @__PURE__ */ Symbol("NEST_ADMIN_OPTIONS");
+var ADMIN_MODELS = /* @__PURE__ */ Symbol("NEST_ADMIN_MODELS");
+var ADMIN_HOOKS = /* @__PURE__ */ Symbol("NEST_ADMIN_HOOKS");
+var ADMIN_ACTIONS = /* @__PURE__ */ Symbol("NEST_ADMIN_ACTIONS");
+var ADMIN_DASHBOARD = /* @__PURE__ */ Symbol("NEST_ADMIN_DASHBOARD");
+var ADMIN_THEME = /* @__PURE__ */ Symbol("NEST_ADMIN_THEME");
+
+// src/auth/guard.ts
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var AdminAuthGuard = class {
+  static {
+    __name(this, "AdminAuthGuard");
+  }
+  auth;
+  constructor(auth) {
+    this.auth = auth;
+  }
+  async canActivate(context) {
+    const decision = await this.auth.authorize(context);
+    if (decision === false) {
+      throw new ForbiddenError();
+    }
+    return true;
+  }
+};
+AdminAuthGuard = _ts_decorate([
+  Injectable(),
+  _ts_param(0, Inject(ADMIN_AUTH)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof AdminAuth === "undefined" ? Object : AdminAuth
+  ])
+], AdminAuthGuard);
+
+// src/http/execution-context.ts
+import { createParamDecorator } from "@nestjs/common";
+var AdminContext = createParamDecorator((_data, context) => context);
+
+// src/http/exception.filter.ts
+import { Catch, HttpException, HttpStatus, Logger } from "@nestjs/common";
+
+// src/http/response.ts
+function success(data) {
+  return {
+    success: true,
+    data
+  };
+}
+__name(success, "success");
+function successPage(data, meta) {
+  return {
+    success: true,
+    data,
+    meta
+  };
+}
+__name(successPage, "successPage");
+function failure(code, message, details) {
+  return {
+    success: false,
+    error: {
+      code,
+      message,
+      ...details ? {
+        details
+      } : {}
+    }
+  };
+}
+__name(failure, "failure");
+
+// src/http/exception.filter.ts
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+var INTERNAL = {
+  status: HttpStatus.INTERNAL_SERVER_ERROR,
+  code: "INTERNAL_ERROR",
+  message: "An internal error occurred while handling the request."
+};
+function mapError(error) {
+  if (!isNestAdminError(error)) return INTERNAL;
+  switch (error.kind) {
+    // Auth first. No `details` on either: echoing anything about why a request
+    // was refused hands a prober information it did not have.
+    case "unauthorized":
+      return {
+        status: HttpStatus.UNAUTHORIZED,
+        code: "UNAUTHORIZED",
+        message: error.message
+      };
+    case "forbidden":
+      return {
+        status: HttpStatus.FORBIDDEN,
+        code: "FORBIDDEN",
+        message: error.message
+      };
+    case "model-not-found":
+      return {
+        status: HttpStatus.NOT_FOUND,
+        code: "MODEL_NOT_FOUND",
+        message: error.message,
+        details: {
+          model: error.model
+        }
+      };
+    case "record-not-found":
+      return {
+        status: HttpStatus.NOT_FOUND,
+        code: "RECORD_NOT_FOUND",
+        message: error.message,
+        details: {
+          model: error.model,
+          id: error.id
+        }
+      };
+    case "field-not-found":
+      return {
+        status: HttpStatus.BAD_REQUEST,
+        code: "FIELD_NOT_FOUND",
+        message: error.message,
+        details: {
+          model: error.model,
+          field: error.field
+        }
+      };
+    // Raised by application code to refuse an input. The message is
+    // forwarded, which is what it is for.
+    case "validation": {
+      const refusal = error;
+      return {
+        status: HttpStatus.BAD_REQUEST,
+        code: "VALIDATION_ERROR",
+        message: error.message,
+        // Only when it named them. An empty list would tell a client the
+        // refusal is about no field in particular, which is not the same as
+        // not saying - and the interface treats the two differently.
+        ...refusal.fields.length > 0 ? {
+          details: {
+            fields: refusal.fields
+          }
+        } : {}
+      };
+    }
+    // The database refused the write for a reason the caller can act on. The
+    // message is built from field names rather than taken from the ORM, so it
+    // carries no paths or query fragments and is safe to forward.
+    case "constraint": {
+      const failure2 = error;
+      return {
+        // A unique clash or a reference still in use is a conflict with data
+        // that already exists; a missing required value is a bad request.
+        status: failure2.constraint === "required" ? HttpStatus.BAD_REQUEST : HttpStatus.CONFLICT,
+        code: "CONSTRAINT_VIOLATION",
+        message: error.message,
+        details: {
+          constraint: failure2.constraint,
+          fields: failure2.fields
+        }
+      };
+    }
+    case "invalid-query":
+      return {
+        status: HttpStatus.BAD_REQUEST,
+        code: "INVALID_QUERY",
+        message: error.message
+      };
+    // 'adapter', 'unknown', and any kind added later without a mapping. The
+    // default stays generic so a new internal error cannot start leaking.
+    default:
+      return INTERNAL;
+  }
+}
+__name(mapError, "mapError");
+function clientMessage(error) {
+  return mapError(error).message;
+}
+__name(clientMessage, "clientMessage");
+var AdminExceptionFilter = class {
+  static {
+    __name(this, "AdminExceptionFilter");
+  }
+  logger = new Logger("NestAdmin");
+  catch(exception, host) {
+    if (exception instanceof HttpException) {
+      throw exception;
+    }
+    const mapped = mapError(exception);
+    if (mapped.status >= HttpStatus.INTERNAL_SERVER_ERROR) {
+      this.logger.error(isNestAdminError(exception) && exception.kind === "adapter" ? `Adapter failure: ${exception.message}` : "Unhandled error while handling an admin request", exception instanceof Error ? exception.stack : String(exception));
+    }
+    const body = failure(mapped.code, mapped.message, mapped.details);
+    const response = host.switchToHttp().getResponse();
+    response.status(mapped.status).json(body);
+  }
+};
+AdminExceptionFilter = _ts_decorate2([
+  Catch()
+], AdminExceptionFilter);
+
+// src/admin/service.ts
+import { Inject as Inject2, Injectable as Injectable2, Logger as Logger4 } from "@nestjs/common";
+
+// src/auth/built-in.ts
+import { Logger as Logger2 } from "@nestjs/common";
+
+// src/auth/password.ts
+import { randomBytes, scrypt, timingSafeEqual } from "crypto";
+import { promisify } from "util";
+var derive = promisify(scrypt);
+var PARAMS = {
+  N: 2 ** 15,
+  r: 8,
+  p: 1
+};
+var MAXMEM = 128 * PARAMS.N * PARAMS.r * 2;
+var KEY_LENGTH = 64;
+var SALT_BYTES = 16;
+var SEP = String.fromCharCode(36);
+async function hashAdminPassword(password) {
+  if (typeof password !== "string" || password.length === 0) {
+    throw new Error("A password is required.");
+  }
+  const salt = randomBytes(SALT_BYTES).toString("hex");
+  const key = await derive(password, salt, KEY_LENGTH, {
+    ...PARAMS,
+    maxmem: MAXMEM
+  });
+  return [
+    "scrypt",
+    PARAMS.N,
+    PARAMS.r,
+    PARAMS.p,
+    salt,
+    key.toString("hex")
+  ].join(SEP);
+}
+__name(hashAdminPassword, "hashAdminPassword");
+async function verifyAdminPassword(password, stored) {
+  const parsed = parse(stored);
+  if (!parsed) return false;
+  try {
+    const key = await derive(password, parsed.salt, parsed.hash.length / 2, {
+      N: parsed.N,
+      r: parsed.r,
+      p: parsed.p,
+      maxmem: 128 * parsed.N * parsed.r * 2
+    });
+    const expected = Buffer.from(parsed.hash, "hex");
+    return key.length === expected.length && timingSafeEqual(key, expected);
+  } catch {
+    return false;
+  }
+}
+__name(verifyAdminPassword, "verifyAdminPassword");
+function parse(stored) {
+  if (typeof stored !== "string") return void 0;
+  const [scheme, n, r, p, salt, hash] = stored.split(SEP);
+  if (scheme !== "scrypt" || salt === void 0 || hash === void 0) return void 0;
+  const N = Number(n);
+  const rounds = Number(r);
+  const parallel = Number(p);
+  const usable = Number.isInteger(N) && N >= 2 ** 12 && N <= 2 ** 20 && (N & N - 1) === 0 && Number.isInteger(rounds) && rounds > 0 && rounds <= 32 && Number.isInteger(parallel) && parallel > 0 && parallel <= 16 && /^[0-9a-f]+$/i.test(salt) && /^[0-9a-f]+$/i.test(hash) && hash.length % 2 === 0;
+  return usable ? {
+    N,
+    r: rounds,
+    p: parallel,
+    salt,
+    hash
+  } : void 0;
+}
+__name(parse, "parse");
+var NO_SUCH_ACCOUNT = hashAdminPassword(randomBytes(32).toString("hex"));
+
+// src/auth/session.ts
+import { createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var VERSION = "v1";
+var encode = /* @__PURE__ */ __name((value) => Buffer.from(value).toString("base64url"), "encode");
+function signSession(accountId, secret, lifetime) {
+  const payload = {
+    sub: accountId,
+    exp: Math.floor(Date.now() / 1e3) + lifetime
+  };
+  const body = `${VERSION}.${encode(JSON.stringify(payload))}`;
+  return `${body}.${sign(body, secret)}`;
+}
+__name(signSession, "signSession");
+function readSession(token, secret) {
+  if (typeof token !== "string") return void 0;
+  const cut = token.lastIndexOf(".");
+  if (cut < 1) return void 0;
+  const body = token.slice(0, cut);
+  const presented = token.slice(cut + 1);
+  if (!body.startsWith(`${VERSION}.`)) return void 0;
+  if (!matches(presented, sign(body, secret))) return void 0;
+  try {
+    const payload = JSON.parse(Buffer.from(body.slice(VERSION.length + 1), "base64url").toString("utf8"));
+    if (typeof payload.sub !== "string" || payload.sub === "") return void 0;
+    if (typeof payload.exp !== "number" || payload.exp * 1e3 <= Date.now()) return void 0;
+    return payload.sub;
+  } catch {
+    return void 0;
+  }
+}
+__name(readSession, "readSession");
+function shouldRenew(token, secret, lifetime) {
+  const cut = token.lastIndexOf(".");
+  if (cut < 1 || !matches(token.slice(cut + 1), sign(token.slice(0, cut), secret))) return false;
+  try {
+    const payload = JSON.parse(Buffer.from(token.slice(VERSION.length + 1, cut), "base64url").toString("utf8"));
+    const remaining = payload.exp - Math.floor(Date.now() / 1e3);
+    return remaining < lifetime / 2;
+  } catch {
+    return false;
+  }
+}
+__name(shouldRenew, "shouldRenew");
+function sign(body, secret) {
+  return createHmac("sha256", secret).update(body).digest("base64url");
+}
+__name(sign, "sign");
+function matches(presented, expected) {
+  const a = Buffer.from(presented);
+  const b = Buffer.from(expected);
+  return a.length === b.length && timingSafeEqual2(a, b);
+}
+__name(matches, "matches");
+var MIN_SECRET_LENGTH = 32;
+function generateSessionSecret() {
+  return randomBytes2(32).toString("base64url");
+}
+__name(generateSessionSecret, "generateSessionSecret");
+
+// src/auth/built-in.ts
+var logger = new Logger2("NestAdmin");
+var DEFAULT_MAX_AGE = 12 * 60 * 60;
+var RUNTIME = /* @__PURE__ */ Symbol.for("nest-admin.built-in-auth");
+function builtInRuntimeOf(auth) {
+  return typeof auth === "object" && auth !== null ? auth[RUNTIME] ?? void 0 : void 0;
+}
+__name(builtInRuntimeOf, "builtInRuntimeOf");
+function adminAccountOf(context) {
+  const request = context.switchToHttp().getRequest();
+  return request?.adminAccount;
+}
+__name(adminAccountOf, "adminAccountOf");
+function builtInAuth(options) {
+  const secret = options.session?.secret;
+  if (typeof secret !== "string" || secret.length < MIN_SECRET_LENGTH) {
+    throw new Error(`builtInAuth() requires \`session.secret\` of at least ${MIN_SECRET_LENGTH} characters. A short secret can be guessed, and a guessed one mints a session for any account. Read it from the environment rather than writing it here.`);
+  }
+  if (!options.store || typeof options.store.findByEmail !== "function") {
+    throw new Error("builtInAuth() requires a `store`. Use `prismaAccountStore({ client })` from `@nest-admin/nestjs/prisma`, or supply your own AdminAccountStore.");
+  }
+  const maxAge = options.session.maxAge ?? DEFAULT_MAX_AGE;
+  const cookieName = options.session.cookieName ?? "nest_admin_session";
+  const attempts = new Attempts(options.maxAttempts ?? 10, options.lockoutSeconds ?? 15 * 60);
+  const runtime = {
+    store: options.store,
+    secret,
+    maxAge,
+    cookieName,
+    secure: options.session.secure,
+    async signIn(email, password, from) {
+      if (typeof email !== "string" || typeof password !== "string") return void 0;
+      if (attempts.lockedOut(from)) return void 0;
+      const account = await options.store.findByEmail(email.trim().toLowerCase());
+      const stored = account?.passwordHash ?? await NO_SUCH_ACCOUNT;
+      const correct = await verifyAdminPassword(password, stored);
+      if (!correct || !account || account.disabled === true) {
+        attempts.failed(from);
+        return void 0;
+      }
+      attempts.succeeded(from);
+      void options.store.recordLogin?.(account.id).catch((cause) => {
+        logger.warn(`Could not record a login: ${String(cause)}`);
+      });
+      return account;
+    }
+  };
+  const auth = {
+    async authorize(context) {
+      const request = context.switchToHttp().getRequest();
+      const token = cookieFrom(request?.headers?.cookie, cookieName);
+      const id = token === void 0 ? void 0 : readSession(token, secret);
+      if (id === void 0) throw new UnauthorizedError("Sign in to continue.");
+      const account = await options.store.findById(id);
+      if (!account || account.disabled === true) {
+        throw new UnauthorizedError("Sign in to continue.");
+      }
+      request.adminAccount = summarise(account);
+      if (token !== void 0 && shouldRenew(token, secret, maxAge)) {
+        setSessionCookie(context.switchToHttp().getResponse(), signSession(account.id, secret, maxAge), runtime, request);
+      }
+    }
+  };
+  Object.defineProperty(auth, RUNTIME, {
+    value: runtime,
+    enumerable: false
+  });
+  return auth;
+}
+__name(builtInAuth, "builtInAuth");
+function cookieFrom(header2, name) {
+  if (typeof header2 !== "string") return void 0;
+  for (const part of header2.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    if (part.slice(0, eq).trim() !== name) continue;
+    const value = part.slice(eq + 1).trim();
+    try {
+      return decodeURIComponent(value);
+    } catch {
+      return value;
+    }
+  }
+  return void 0;
+}
+__name(cookieFrom, "cookieFrom");
+function setSessionCookie(response, token, runtime, request) {
+  writeCookie(response, [
+    `${runtime.cookieName}=${token}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    `Max-Age=${runtime.maxAge}`,
+    ...isSecure(runtime.secure, request) ? [
+      "Secure"
+    ] : []
+  ].join("; "));
+}
+__name(setSessionCookie, "setSessionCookie");
+function clearSessionCookie(response, runtime, request) {
+  writeCookie(response, [
+    `${runtime.cookieName}=`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    "Max-Age=0",
+    ...isSecure(runtime.secure, request) ? [
+      "Secure"
+    ] : []
+  ].join("; "));
+}
+__name(clearSessionCookie, "clearSessionCookie");
+function isSecure(configured, request) {
+  if (configured !== void 0) return configured;
+  const host = String(request?.headers?.["host"] ?? "");
+  const local = /^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/.test(host);
+  return !local;
+}
+__name(isSecure, "isSecure");
+function writeCookie(response, value) {
+  const target = response;
+  if (typeof target?.setHeader === "function") return target.setHeader("Set-Cookie", value);
+  if (typeof target?.header === "function") target.header("Set-Cookie", value);
+}
+__name(writeCookie, "writeCookie");
+function attemptKey(request, email) {
+  const address = (typeof request?.ip === "string" ? request.ip : void 0) ?? request?.socket?.remoteAddress ?? "unknown";
+  return `${address}|${typeof email === "string" ? email.trim().toLowerCase() : ""}`;
+}
+__name(attemptKey, "attemptKey");
+var Attempts = class Attempts2 {
+  static {
+    __name(this, "Attempts");
+  }
+  max;
+  seconds;
+  #failures = /* @__PURE__ */ new Map();
+  constructor(max, seconds) {
+    this.max = max;
+    this.seconds = seconds;
+  }
+  lockedOut(key) {
+    const entry = this.#failures.get(key);
+    if (!entry) return false;
+    if (entry.until === 0) return false;
+    if (entry.until > Date.now()) return true;
+    this.#failures.delete(key);
+    return false;
+  }
+  failed(key) {
+    const now = Date.now();
+    const existing = this.#failures.get(key);
+    const entry = existing && now - existing.since < this.seconds * 1e3 ? existing : {
+      count: 0,
+      since: now,
+      until: 0
+    };
+    entry.count += 1;
+    if (entry.count >= this.max) entry.until = now + this.seconds * 1e3;
+    this.#failures.set(key, entry);
+    if (this.#failures.size > 1e4) this.#prune();
+  }
+  succeeded(key) {
+    this.#failures.delete(key);
+  }
+  #prune() {
+    const now = Date.now();
+    for (const [key, entry] of this.#failures) {
+      const locked = entry.until > now;
+      const recent = now - entry.since < this.seconds * 1e3;
+      if (!locked && !recent) this.#failures.delete(key);
+    }
+  }
+};
+
+// src/dashboard/service.ts
+import { Logger as Logger3 } from "@nestjs/common";
+
+// src/http/query-parser.ts
+var FILTER_OPERATORS = [
+  "eq",
+  "ne",
+  "contains",
+  "startsWith",
+  "endsWith",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "in"
+];
+var SORT_DIRECTIONS = /* @__PURE__ */ new Set([
+  "asc",
+  "desc"
+]);
+function rejectStructuredValue(name, value) {
+  if (value === void 0 || value === null) return;
+  if (typeof value === "string") return;
+  if (Array.isArray(value) && value.every((item) => typeof item === "string")) return;
+  throw new InvalidQueryError(`"${name}" must be a plain value, not a nested structure. This API uses colon syntax - for example "?filter=age:gte:18" and "?sort=email:asc", not "?filter[age][gte]=18".`);
+}
+__name(rejectStructuredValue, "rejectStructuredValue");
+var KNOWN_PARAMETERS = /* @__PURE__ */ new Set([
+  "page",
+  "perPage",
+  "search",
+  "sort",
+  "filter"
+]);
+function rejectUnknownParameters(raw) {
+  const unknown = Object.keys(raw).filter((key) => !KNOWN_PARAMETERS.has(key));
+  if (unknown.length === 0) return;
+  const looksBracketed = unknown.some((key) => key.includes("["));
+  const hint = looksBracketed ? ' This API uses colon syntax: "?filter=age:gte:18", not "?filter[age][gte]=18".' : "";
+  throw new InvalidQueryError(`Unknown query parameter${unknown.length > 1 ? "s" : ""}: ${unknown.join(", ")}. Supported: ${[
+    ...KNOWN_PARAMETERS
+  ].join(", ")}.${hint}`);
+}
+__name(rejectUnknownParameters, "rejectUnknownParameters");
+function toStringList(name, value) {
+  rejectStructuredValue(name, value);
+  if (value === void 0 || value === null) return [];
+  if (Array.isArray(value)) return value.filter((item) => typeof item === "string");
+  return typeof value === "string" ? [
+    value
+  ] : [];
+}
+__name(toStringList, "toStringList");
+function toSingleString(name, value) {
+  rejectStructuredValue(name, value);
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) {
+    const strings = value.filter((item) => typeof item === "string");
+    return strings.at(-1);
+  }
+  return void 0;
+}
+__name(toSingleString, "toSingleString");
+function parsePositiveInteger(raw, name) {
+  if (raw === void 0 || raw === "") return void 0;
+  if (!/^\d+$/.test(raw)) {
+    throw new InvalidQueryError(`"${name}" must be a positive integer, received ${JSON.stringify(raw)}.`);
+  }
+  const parsed = Number(raw);
+  if (parsed < 1) {
+    throw new InvalidQueryError(`"${name}" must be >= 1, received ${JSON.stringify(raw)}.`);
+  }
+  return parsed;
+}
+__name(parsePositiveInteger, "parsePositiveInteger");
+function parseSort(raw) {
+  const entries = toStringList("sort", raw).filter((entry) => entry.trim() !== "");
+  if (entries.length === 0) return void 0;
+  return entries.map((entry) => {
+    const separator = entry.lastIndexOf(":");
+    if (separator <= 0 || separator === entry.length - 1) {
+      throw new InvalidQueryError(`Invalid sort "${entry}". Expected "field:asc" or "field:desc".`);
+    }
+    const field = entry.slice(0, separator);
+    const direction = entry.slice(separator + 1);
+    if (!SORT_DIRECTIONS.has(direction)) {
+      throw new InvalidQueryError(`Invalid sort direction "${direction}" in "${entry}". Expected "asc" or "desc".`);
+    }
+    return {
+      field,
+      direction
+    };
+  });
+}
+__name(parseSort, "parseSort");
+function coerceScalar(raw, field, context) {
+  if (!field) return raw;
+  switch (field.kind) {
+    case "number": {
+      const parsed = Number(raw);
+      if (raw.trim() === "" || !Number.isFinite(parsed)) {
+        throw new InvalidQueryError(`${context}: "${raw}" is not a valid number.`);
+      }
+      return parsed;
+    }
+    case "boolean": {
+      if (raw === "true") return true;
+      if (raw === "false") return false;
+      throw new InvalidQueryError(`${context}: "${raw}" is not a valid boolean (use true or false).`);
+    }
+    case "datetime": {
+      const parsed = new Date(raw);
+      if (Number.isNaN(parsed.getTime())) {
+        throw new InvalidQueryError(`${context}: "${raw}" is not a valid date.`);
+      }
+      return parsed;
+    }
+    default:
+      return raw;
+  }
+}
+__name(coerceScalar, "coerceScalar");
+function coerceList(raw, field, context) {
+  if (raw === "") return [];
+  return raw.split(",").map((part) => coerceScalar(part, field, context));
+}
+__name(coerceList, "coerceList");
+function parseFilters(raw, model) {
+  const entries = toStringList("filter", raw).filter((entry) => entry.trim() !== "");
+  if (entries.length === 0) return void 0;
+  return entries.map((entry) => {
+    const firstSeparator = entry.indexOf(":");
+    const secondSeparator = firstSeparator === -1 ? -1 : entry.indexOf(":", firstSeparator + 1);
+    if (firstSeparator <= 0 || secondSeparator === -1) {
+      throw new InvalidQueryError(`Invalid filter "${entry}". Expected "field:operator:value", for example "email:contains:example.com".`);
+    }
+    const fieldName = entry.slice(0, firstSeparator);
+    const operator = entry.slice(firstSeparator + 1, secondSeparator);
+    const rawValue = entry.slice(secondSeparator + 1);
+    if (!FILTER_OPERATORS.includes(operator)) {
+      throw new InvalidQueryError(`Unknown filter operator "${operator}" in "${entry}". Supported operators: ${FILTER_OPERATORS.join(", ")}.`);
+    }
+    const field = model.fields.find((candidate) => candidate.name === fieldName);
+    const context = `Filter "${entry}"`;
+    const value = operator === "in" ? coerceList(rawValue, field, context) : coerceScalar(rawValue, field, context);
+    return {
+      field: fieldName,
+      operator,
+      value
+    };
+  });
+}
+__name(parseFilters, "parseFilters");
+function parseFilterExpression(entry, model) {
+  const rules = parseFilters(entry, model);
+  const rule = rules?.[0];
+  if (rule === void 0) {
+    throw new InvalidQueryError(`Expected a filter of the form "field:operator:value", got "${entry}".`);
+  }
+  return rule;
+}
+__name(parseFilterExpression, "parseFilterExpression");
+function parseListQuery(raw, model) {
+  rejectUnknownParameters(raw);
+  const page = parsePositiveInteger(toSingleString("page", raw["page"]), "page");
+  const perPage = parsePositiveInteger(toSingleString("perPage", raw["perPage"]), "perPage");
+  const sort = parseSort(raw["sort"]);
+  const filters = parseFilters(raw["filter"], model);
+  const search = toSingleString("search", raw["search"]);
+  return {
+    ...page !== void 0 ? {
+      page
+    } : {},
+    ...perPage !== void 0 ? {
+      perPage
+    } : {},
+    ...sort ? {
+      sort
+    } : {},
+    ...filters ? {
+      filters
+    } : {},
+    ...search !== void 0 && search !== "" ? {
+      search
+    } : {}
+  };
+}
+__name(parseListQuery, "parseListQuery");
+
+// src/dashboard/contract.ts
+function modelOf(widget) {
+  return widget.kind === "stat" ? void 0 : widget.model;
+}
+__name(modelOf, "modelOf");
+function defaultSpan(widget) {
+  switch (widget.kind) {
+    // A number is small; a chart needs room to be read; a list is a column of
+    // rows and looks thin at a quarter width.
+    case "chart":
+      return 2;
+    case "list":
+      return 2;
+    default:
+      return 1;
+  }
+}
+__name(defaultSpan, "defaultSpan");
+
+// src/dashboard/service.ts
+var logger2 = new Logger3("NestAdmin");
+var MAX_BUCKETS = 90;
+var DAY = 864e5;
+async function buildDashboard(input) {
+  const declared = input.declared;
+  const generated = declared === void 0 || declared.length === 0;
+  const widgets = generated ? generateFrom(input.models, input.labels ?? {}) : declared;
+  const visible = new Set(input.models.map((model) => model.name));
+  const resolved = await Promise.all(widgets.filter((widget) => {
+    const model = modelOf(widget);
+    return model === void 0 || visible.has(model);
+  }).map((widget, index) => resolve(widget, index, input)));
+  return {
+    widgets: resolved,
+    generated
+  };
+}
+__name(buildDashboard, "buildDashboard");
+function generateFrom(models, labels) {
+  const labelOf = /* @__PURE__ */ __name((model) => labels[model.name] ?? model.name, "labelOf");
+  const widgets = models.map((model) => ({
+    kind: "count",
+    title: labelOf(model),
+    model: model.name
+  }));
+  const dated = models.filter((model) => createdFieldFor(model) !== void 0);
+  const first = dated[0];
+  if (first) {
+    widgets.push({
+      kind: "chart",
+      title: `New ${labelOf(first)}`,
+      description: "Over the last 30 days.",
+      model: first.name,
+      span: 2
+    });
+  }
+  for (const model of dated.slice(0, 2)) {
+    widgets.push({
+      kind: "list",
+      title: `Recent ${labelOf(model)}`,
+      model: model.name,
+      span: 2
+    });
+  }
+  return widgets;
+}
+__name(generateFrom, "generateFrom");
+async function resolve(widget, index, input) {
+  const base = {
+    // Stable within one document, and only used as a React key: a title is not
+    // unique and a position changes when a widget above it is dropped.
+    id: `${widget.kind}-${index}`,
+    kind: widget.kind,
+    title: widget.title,
+    span: widget.span ?? defaultSpan(widget),
+    ...widget.description !== void 0 ? {
+      description: widget.description
+    } : {},
+    ...widget.kind !== "stat" ? {
+      model: widget.model
+    } : {},
+    ...widget.kind !== "stat" && widget.filter !== void 0 ? {
+      filter: widget.filter
+    } : {}
+  };
+  try {
+    return {
+      ...base,
+      data: await dataFor(widget, input)
+    };
+  } catch (cause) {
+    logger2.warn(`Dashboard widget "${widget.title}" failed: ${String(cause)}`);
+    return {
+      ...base,
+      failed: true
+    };
+  }
+}
+__name(resolve, "resolve");
+async function dataFor(widget, input) {
+  switch (widget.kind) {
+    case "stat":
+      return widget.load({
+        context: input.context
+      });
+    case "count":
+      return countOf(widget, input);
+    case "list":
+      return listOf(widget, input);
+    case "chart":
+      return chartOf(widget, input);
+  }
+}
+__name(dataFor, "dataFor");
+async function countOf(widget, input) {
+  const model = modelFor(widget.model, input);
+  const declared = filtersFor(widget.filter, model);
+  const page = await input.adapter.list(widget.model, {
+    perPage: 1,
+    ...declared.length > 0 ? {
+      filters: declared
+    } : {}
+  });
+  if (widget.compareDays === void 0) return {
+    value: page.total
+  };
+  const created = createdFieldFor(model);
+  if (created === void 0) return {
+    value: page.total
+  };
+  const since = new Date(Date.now() - widget.compareDays * DAY).toISOString();
+  const recent = await input.adapter.list(widget.model, {
+    perPage: 1,
+    filters: [
+      ...declared,
+      {
+        field: created,
+        operator: "gte",
+        value: since
+      }
+    ]
+  });
+  const before = page.total - recent.total;
+  return {
+    value: page.total,
+    // Everything is new when there was nothing before, and dividing by zero to
+    // say so would produce Infinity on a brand-new install.
+    ...before > 0 ? {
+      delta: Math.round(recent.total / before * 100)
+    } : {},
+    hint: `${recent.total} in the last ${widget.compareDays} days`
+  };
+}
+__name(countOf, "countOf");
+async function listOf(widget, input) {
+  const model = modelFor(widget.model, input);
+  const created = createdFieldFor(model);
+  const label = displayFieldFor(model);
+  const key = model.primaryKey[0] ?? "id";
+  const declared = filtersFor(widget.filter, model);
+  const page = await input.adapter.list(widget.model, {
+    perPage: Math.min(widget.limit ?? 5, 10),
+    // Newest first where the model says which those are; otherwise whatever
+    // order the adapter returns, which is better than refusing to show a list.
+    ...created ? {
+      sort: [
+        {
+          field: created,
+          direction: "desc"
+        }
+      ]
+    } : {},
+    ...declared.length > 0 ? {
+      filters: declared
+    } : {}
+  });
+  return {
+    total: page.total,
+    records: page.data.map((record) => ({
+      id: String(record[key] ?? ""),
+      label: readable(record[label]) ?? String(record[key] ?? "")
+    }))
+  };
+}
+__name(listOf, "listOf");
+async function chartOf(widget, input) {
+  const model = modelFor(widget.model, input);
+  const created = createdFieldFor(model);
+  if (created === void 0) {
+    throw new Error(`${widget.model} has no creation timestamp, so it cannot be charted.`);
+  }
+  const bucket = widget.bucket ?? "day";
+  const count = Math.min(widget.buckets ?? 30, MAX_BUCKETS);
+  const size = bucket === "day" ? DAY : bucket === "week" ? 7 * DAY : 30 * DAY;
+  const declared = filtersFor(widget.filter, model);
+  const now = Date.now();
+  const starts = Array.from({
+    length: count
+  }, (_, index) => now - (count - index) * size);
+  const points = await Promise.all(starts.map(async (start) => {
+    const page = await input.adapter.list(widget.model, {
+      perPage: 1,
+      filters: [
+        ...declared,
+        {
+          field: created,
+          operator: "gte",
+          value: new Date(start).toISOString()
+        },
+        {
+          field: created,
+          operator: "lt",
+          value: new Date(start + size).toISOString()
+        }
+      ]
+    });
+    return {
+      at: new Date(start).toISOString(),
+      value: page.total
+    };
+  }));
+  return {
+    points,
+    total: points.reduce((sum, point) => sum + point.value, 0)
+  };
+}
+__name(chartOf, "chartOf");
+function modelFor(name, input) {
+  const model = input.models.find((candidate) => candidate.name === name);
+  if (model === void 0) throw new Error(`${name} is not an exposed model.`);
+  return model;
+}
+__name(modelFor, "modelFor");
+function filtersFor(filter, model) {
+  return filter === void 0 ? [] : [
+    parseFilterExpression(filter, model)
+  ];
+}
+__name(filtersFor, "filtersFor");
+function readable(value) {
+  if (typeof value === "string" && value !== "") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  return void 0;
+}
+__name(readable, "readable");
+
+// src/admin/metadata.dto.ts
+var ALL_PERMITTED = {
+  list: true,
+  read: true,
+  create: true,
+  update: true,
+  delete: true
+};
+function targetForeignKeyOf(field, models) {
+  if (relationShape(field, models) !== "one-to-many") return void 0;
+  return inverseRelationField(field, models)?.relation?.from;
+}
+__name(targetForeignKeyOf, "targetForeignKeyOf");
+function byOrder(items, orderOf) {
+  return [
+    ...items
+  ].map((item, index) => ({
+    item,
+    index,
+    order: orderOf(item)
+  })).sort((a, b) => {
+    if (a.order === b.order) return a.index - b.index;
+    if (a.order === void 0) return 1;
+    if (b.order === void 0) return -1;
+    return a.order - b.order;
+  }).map((entry) => entry.item);
+}
+__name(byOrder, "byOrder");
+function toFieldDto(field, modelName, models, overrides) {
+  const override = fieldOverride(overrides, modelName, field.name);
+  return {
+    name: field.name,
+    kind: field.kind,
+    isId: field.isId,
+    isRequired: field.isRequired,
+    isUnique: field.isUnique,
+    isList: field.isList,
+    isGenerated: field.isGenerated,
+    readOnly: isReadOnly(overrides, modelName, field),
+    ...field.writeOnly === true ? {
+      writeOnly: true
+    } : {},
+    ...override?.label !== void 0 ? {
+      label: override.label
+    } : {},
+    ...override?.widget !== void 0 ? {
+      widget: override.widget
+    } : {},
+    ...field.defaultValue !== void 0 ? {
+      defaultValue: field.defaultValue
+    } : {},
+    ...field.enumValues ? {
+      enumValues: [
+        ...field.enumValues
+      ]
+    } : {},
+    ...field.relation ? {
+      relation: {
+        targetModel: field.relation.targetModel,
+        cardinality: field.relation.cardinality,
+        ...field.relation.from !== void 0 ? {
+          from: field.relation.from
+        } : {},
+        ...field.relation.to !== void 0 ? {
+          to: field.relation.to
+        } : {},
+        ...relationShape(field, models) !== void 0 ? {
+          shape: relationShape(field, models)
+        } : {},
+        ...detachBlockedReason(field, models) !== void 0 ? {
+          detachBlocked: detachBlockedReason(field, models)
+        } : {},
+        ...targetForeignKeyOf(field, models) !== void 0 ? {
+          targetForeignKey: targetForeignKeyOf(field, models)
+        } : {}
+      }
+    } : {}
+  };
+}
+__name(toFieldDto, "toFieldDto");
+function toMetadataDto(models, overrides, permissions, actions) {
+  const present = new Set(models.map((model) => model.name));
+  return {
+    models: byOrder(models, (model) => overrides?.[model.name]?.order).map((model) => ({
+      name: model.name,
+      primaryKey: [
+        ...model.primaryKey
+      ],
+      displayField: displayFieldFor(model),
+      can: permissions?.get(model.name) ?? ALL_PERMITTED,
+      actions: actions?.get(model.name) ?? [],
+      ...overrides?.[model.name]?.label !== void 0 ? {
+        label: overrides[model.name]?.label
+      } : {},
+      ...overrides?.[model.name]?.icon !== void 0 ? {
+        icon: overrides[model.name]?.icon
+      } : {},
+      fields: byOrder(model.fields.filter((field) => !field.relation || present.has(field.relation.targetModel)), (field) => fieldOverride(overrides, model.name, field.name)?.order).map((field) => toFieldDto(field, model.name, models, overrides))
+    }))
+  };
+}
+__name(toMetadataDto, "toMetadataDto");
+
+// src/admin/service.ts
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata2(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+function readableFields(model) {
+  return model.fields.filter((field) => field.writeOnly !== true);
+}
+__name(readableFields, "readableFields");
+var MAX_BULK_DELETE = 200;
+var AdminService = class {
+  static {
+    __name(this, "AdminService");
+  }
+  adapter;
+  resourceAuth;
+  resources;
+  overrides;
+  hooks;
+  actions;
+  auth;
+  dashboard;
+  constructor(adapter, resourceAuth, resources, overrides, hooks, actions, auth, dashboard) {
+    this.adapter = adapter;
+    this.resourceAuth = resourceAuth;
+    this.resources = resources;
+    this.overrides = overrides;
+    this.hooks = hooks;
+    this.actions = actions;
+    this.auth = auth;
+    this.dashboard = dashboard;
+  }
+  logger = new Logger4("NestAdmin");
+  /**
+  * Fail at boot on a selection that names a model the schema does not have.
+  *
+  * A typo in `exclude` leaves the model exposed - the opposite of what was
+  * asked for, and invisible until someone finds the table in the admin. It
+  * cannot be checked in `forRoot`, because the model list comes from the
+  * adapter and asking for it is asynchronous; this is the first moment it can
+  * be known, and it is still before the first request.
+  */
+  async onModuleInit() {
+    const schema = await this.adapter.getModels();
+    const known = schema.map((model) => model.name);
+    const missingResources = unknownSelectionNames(schema, this.resources);
+    if (missingResources.length > 0) {
+      throw new Error(`AdminModule \`resources\` names ${missingResources.length === 1 ? "a model" : "models"} that the schema does not have: ${missingResources.join(", ")}. Known models: ${known.join(", ")}.`);
+    }
+    const missingOverrides = unknownOverrideNames(selectModels(schema, this.resources), this.overrides);
+    if (missingOverrides.length > 0) {
+      throw new Error(`AdminModule \`models\` names ${missingOverrides.length === 1 ? "a model or field" : "models or fields"} this admin does not have: ${missingOverrides.join(", ")}. A typo in \`hidden\` leaves the real column exposed, so this is an error rather than a warning.`);
+    }
+    await this.checkBuiltInAuth(selectModels(schema, this.resources));
+    const unwritable = unwritableHiddenFields(selectModels(schema, this.resources), this.overrides);
+    if (unwritable.length > 0) {
+      const one = unwritable.length === 1;
+      throw new Error(`AdminModule \`models\` hides ${unwritable.join(", ")}, ${one ? "which is a required field" : "which are required fields"} with no default. Hiding ${one ? "it" : "them"} leaves no way to supply a value, so every create would fail. Give the column a default, make it optional, or leave it visible.`);
+    }
+  }
+  /**
+  * Two things about the built-in authentication that are only knowable here.
+  *
+  * Warnings rather than boot failures, and the distinction is deliberate.
+  * Both describe a *deployment* that is wrong rather than a configuration
+  * that cannot work - and an admin that refuses to start because its account
+  * table is empty is an admin nobody can seed, because the seed script
+  * imports the module.
+  */
+  async checkBuiltInAuth(exposed) {
+    const runtime = builtInRuntimeOf(this.auth);
+    if (!runtime) return;
+    const accountModel = runtime.store.describes;
+    if (accountModel !== void 0 && exposed.some((model) => model.name === accountModel)) {
+      this.logger.warn(`AdminModule exposes "${accountModel}" as a resource, and it is also where the admin keeps its own accounts. Anyone who may edit it can grant themselves anything the admin can do. Exclude it with resources: { exclude: ["${accountModel}"] }.`);
+    }
+    try {
+      if (await runtime.store.count() === 0) {
+        this.logger.warn("AdminModule is using builtInAuth() and the account store is empty, so nobody can sign in. Create the first account with hashAdminPassword().");
+      }
+    } catch (cause) {
+      this.logger.warn(`Could not read the admin account store: ${String(cause)}`);
+    }
+  }
+  /**
+  * What the dashboard shows this principal.
+  *
+  * Authorized the way everything else is, and *before* anything is queried: a
+  * widget over a model this principal may not list is absent from the
+  * document, so a dashboard cannot become a way to count rows of a table
+  * nobody would let you open.
+  *
+  * The exposed model list is passed in rather than looked up again inside, so
+  * "which models does this person see" is answered once, here, by the same
+  * code that answers it for the metadata document.
+  */
+  async getDashboard(context) {
+    const models = await this.exposedModels();
+    const permitted = [];
+    for (const model of models) {
+      if (await this.permits(context, model.name, "list")) permitted.push(model);
+    }
+    return buildDashboard({
+      adapter: this.adapter,
+      models: permitted,
+      declared: this.dashboard,
+      context,
+      labels: Object.fromEntries(Object.entries(this.overrides ?? {}).map(([name, override]) => [
+        name,
+        override?.label
+      ]))
+    });
+  }
+  /**
+  * The public metadata document a frontend renders resources from.
+  *
+  * Models the principal may not see are filtered out **before** mapping, so a
+  * denied model never reaches the DTO at all - not its name, fields, relations,
+  * primary key or enum values. The response is not "everything, minus some";
+  * it is a description of the schema this principal has.
+  */
+  async getMetadata(context) {
+    const models = await this.exposedModels();
+    const visible = [];
+    for (const model of models) {
+      if (await this.isVisible(context, model.name)) visible.push(model);
+    }
+    return toMetadataDto(visible, this.overrides, await this.permissionsFor(context, visible), await this.actionsFor(context, visible));
+  }
+  /**
+  * List records.
+  *
+  * Metadata is resolved first - it decides whether the model is part of this
+  * admin at all - and authorization second, so a denied model still never
+  * reaches `adapter.list`. Query parsing needs that metadata anyway: only the
+  * schema knows whether `price` should arrive as a number or a string.
+  */
+  async list(context, model, rawQuery) {
+    const metadata = await this.requireModel(model);
+    await this.assertAllowed(context, model, "list");
+    return this.projectPage(metadata, await this.adapter.list(model, this.scopeToFields(metadata, parseListQuery(rawQuery, metadata))));
+  }
+  /**
+  * Fetch one record.
+  *
+  * The adapter returns `null` for a missing record; over HTTP that is a 404,
+  * so it is turned into an error here rather than in the controller.
+  */
+  async findOne(context, model, id) {
+    const metadata = await this.requireModel(model);
+    await this.assertAllowed(context, model, "read");
+    const record = await this.adapter.findOne(model, id);
+    if (record === null) throw new RecordNotFoundError(model, id);
+    return this.project(metadata, record);
+  }
+  async create(context, model, data) {
+    const metadata = await this.requireModel(model);
+    await this.assertAllowed(context, model, "create");
+    this.assertWritable(metadata, data);
+    const prepared = await this.runBefore(context, metadata, "beforeCreate", data);
+    const created = await this.adapter.create(model, prepared);
+    await this.runAfter(context, model, "afterCreate", {
+      record: created
+    });
+    return this.project(metadata, created);
+  }
+  async update(context, model, id, data) {
+    const metadata = await this.requireModel(model);
+    await this.assertAllowed(context, model, "update");
+    this.assertWritable(metadata, data);
+    const prepared = await this.runBefore(context, metadata, "beforeUpdate", data, id);
+    const updated = await this.adapter.update(model, id, prepared);
+    await this.runAfter(context, model, "afterUpdate", {
+      id,
+      record: updated
+    });
+    return this.project(metadata, updated);
+  }
+  /**
+  * Delete several records, and say what happened to each.
+  *
+  * ## Why this is a loop and not a `deleteMany`
+  *
+  * The adapter contract has no bulk delete, and giving it one would mean
+  * every adapter had to have one. More to the point, hooks are per-record: an
+  * application that refuses to delete a pinned post must still refuse it when
+  * the post is one of forty checkboxes. A single `deleteMany` would step past
+  * every one of those refusals at once, which is the opposite of what a
+  * confirmation dialog leads someone to expect.
+  *
+  * ## Why a partial result is a success
+  *
+  * Deleting thirty records where two are still referenced is not a failed
+  * request - twenty-eight rows are gone, and an error response would say
+  * nothing about which. So the response is a 200 carrying both lists, and the
+  * interface reports them. Nothing is rolled back, and `§ Known Limitations`
+  * says so: this is not a transaction, exactly as hooks are not.
+  */
+  async deleteMany(context, model, ids) {
+    await this.requireModel(model);
+    await this.assertAllowed(context, model, "delete");
+    if (ids.length === 0) {
+      throw new InvalidQueryError('Deleting records requires a body of the form { "ids": [...] }.');
+    }
+    if (ids.length > MAX_BULK_DELETE) {
+      throw new InvalidQueryError(`Refusing to delete ${ids.length} records in one request. The limit is ${MAX_BULK_DELETE}.`);
+    }
+    const before = this.hooks?.[model]?.beforeDelete;
+    const deleted = [];
+    const failed = [];
+    for (const id of ids) {
+      try {
+        if (before) await before({
+          context,
+          model,
+          id
+        });
+        await this.adapter.delete(model, id);
+        await this.runAfter(context, model, "afterDelete", {
+          id
+        });
+        deleted.push(id);
+      } catch (cause) {
+        failed.push({
+          id,
+          message: clientMessage(cause)
+        });
+      }
+    }
+    return {
+      deleted,
+      failed
+    };
+  }
+  async delete(context, model, id) {
+    await this.requireModel(model);
+    await this.assertAllowed(context, model, "delete");
+    const before = this.hooks?.[model]?.beforeDelete;
+    if (before) await before({
+      context,
+      model,
+      id
+    });
+    await this.adapter.delete(model, id);
+    await this.runAfter(context, model, "afterDelete", {
+      id
+    });
+  }
+  /**
+  * A page of the records on the far side of a to-many relation.
+  *
+  * Authorized against **both** models, and the distinction matters. Reading
+  * `/User/u1/posts` returns Post records, so a principal who may read a User
+  * but not list Posts must not receive them through the back door of a
+  * relation. The parent decides whether this record may be opened at all; the
+  * target decides whether its records may be listed.
+  */
+  async listRelated(context, model, id, relationField, rawQuery) {
+    const parent = await this.requireModel(model);
+    await this.assertAllowed(context, model, "read");
+    const target = await this.requireRelationTarget(parent, relationField);
+    await this.assertAllowed(context, target.name, "list");
+    return this.projectPage(target, await this.adapter.listRelated(model, id, relationField, this.scopeToFields(target, parseListQuery(rawQuery, target))));
+  }
+  /**
+  * Link an existing record to this one.
+  *
+  * Requires `update` on both models. Across a one-to-many the child's foreign
+  * key is what actually changes, so permitting this with rights over the
+  * parent alone would let someone edit records they cannot otherwise touch.
+  */
+  async attachRelated(context, model, id, relationField, targetId) {
+    const target = await this.assertMayRelink(context, model, relationField);
+    await this.assertAllowed(context, target.name, "update");
+    await this.adapter.attachRelated(model, id, relationField, targetId);
+  }
+  /**
+  * Unlink a record from this one, leaving both in place.
+  *
+  * Refused up front when the relation cannot be broken - a child whose foreign
+  * key is required cannot exist without a parent, so there is nothing to
+  * detach it to. Saying so is better than forwarding a constraint violation.
+  */
+  async detachRelated(context, model, id, relationField, targetId) {
+    const target = await this.assertMayRelink(context, model, relationField);
+    await this.assertAllowed(context, target.name, "update");
+    const parent = await this.requireModel(model);
+    const field = parent.fields.find((candidate) => candidate.name === relationField);
+    const blocked = field ? detachBlockedReason(field, await this.exposedModels()) : void 0;
+    if (blocked) throw new InvalidQueryError(blocked);
+    await this.adapter.detachRelated(model, id, relationField, targetId);
+  }
+  /** Shared preamble for attach and detach: the parent must be updatable. */
+  async assertMayRelink(context, model, relationField) {
+    const parent = await this.requireModel(model);
+    await this.assertAllowed(context, model, "update");
+    return this.requireRelationTarget(parent, relationField);
+  }
+  /**
+  * The model on the far side of a to-many relation field.
+  *
+  * Resolved through the exposed set, so a relation pointing at a model this
+  * admin does not expose reads as an unknown field rather than as a route
+  * into it.
+  */
+  async requireRelationTarget(parent, relationField) {
+    const field = parent.fields.find((candidate) => candidate.name === relationField);
+    if (!field?.relation || field.relation.cardinality !== "many") {
+      throw new FieldNotFoundError(parent.name, relationField, "Only a to-many relation can be listed this way.");
+    }
+    const target = (await this.exposedModels()).find((candidate) => candidate.name === field.relation?.targetModel);
+    if (!target) throw new FieldNotFoundError(parent.name, relationField);
+    return target;
+  }
+  /**
+  * A record as this admin is allowed to return it.
+  *
+  * A whitelist against the effective metadata, which is what makes `hidden`
+  * a guarantee rather than a request. The adapter reads whole rows - it knows
+  * nothing about admin configuration - so a hidden column arrives here and is
+  * dropped before anything can serialise it.
+  *
+  * Whitelisting rather than deleting the hidden names also covers a column the
+  * adapter reports that the metadata does not describe: if it is not part of
+  * this admin, it does not leave it.
+  */
+  project(model, record) {
+    const allowed = new Set(readableFields(model).map((field) => field.name));
+    const projected = {};
+    for (const [key, value] of Object.entries(record)) {
+      if (allowed.has(key)) projected[key] = value;
+    }
+    return projected;
+  }
+  /**
+  * Tell the adapter which fields this admin exposes.
+  *
+  * The adapter reads a schema, not a configuration, so without this a hidden
+  * column would still be searched by free text, sorted and filtered on, and
+  * read from the database - each of them a way to learn a value nobody is
+  * meant to see. `project` would still keep it out of the response, but
+  * "you cannot read it" is a weaker promise than "it was never fetched".
+  */
+  /**
+  * Which columns the adapter is allowed to return.
+  *
+  * Not every field the model has: a `writeOnly` one is accepted on a write and
+  * must never come back, so it is left out of the query itself rather than
+  * removed from the answer afterwards. The projection below removes it a
+  * second time, which is deliberate - see `FieldMetadata.writeOnly`.
+  */
+  scopeToFields(model, query) {
+    return {
+      ...query,
+      fields: readableFields(model).map((field) => field.name)
+    };
+  }
+  projectPage(model, page) {
+    return {
+      ...page,
+      data: page.data.map((record) => this.project(model, record))
+    };
+  }
+  /**
+  * Reject a write that names a field this admin will not write.
+  *
+  * The adapter validates too, but against the *schema* - it would accept a
+  * hidden or read-only column, because from where it stands those are ordinary
+  * writable ones. This is the only layer that knows the difference.
+  */
+  assertWritable(model, data) {
+    for (const key of Object.keys(data)) {
+      const field = model.fields.find((candidate) => candidate.name === key);
+      if (!field) throw new FieldNotFoundError(model.name, key);
+      if (isReadOnly(this.overrides, model.name, field)) {
+        throw new FieldNotFoundError(model.name, key, field.isGenerated ? "This value is produced by the database." : "This field is configured as read-only.");
+      }
+    }
+  }
+  /**
+  * What this principal may do with each visible model.
+  *
+  * Asked of the same policy the requests go through, so the document and the
+  * enforcement cannot disagree. A policy that throws `ForbiddenError` is read
+  * as a denial, exactly as `isVisible` reads it; anything else it throws is a
+  * bug and propagates.
+  *
+  * Without this the interface offers `New`, `Edit` and `Delete` to a
+  * principal for whom every one of them would be refused - a button that
+  * exists only to produce a 403 is worse than no button.
+  */
+  async permissionsFor(context, models) {
+    const permissions = /* @__PURE__ */ new Map();
+    for (const model of models) {
+      const permits = /* @__PURE__ */ __name(async (operation) => this.permits(context, model.name, operation), "permits");
+      permissions.set(model.name, {
+        list: await permits("list"),
+        read: await permits("read"),
+        create: await permits("create"),
+        update: await permits("update"),
+        delete: await permits("delete")
+      });
+    }
+    return permissions;
+  }
+  /** The policy's answer for one operation, with a thrown denial read as `false`. */
+  async permits(context, model, operation) {
+    try {
+      return await this.resourceAuth.authorize({
+        context,
+        model,
+        operation
+      }) !== false;
+    } catch (error) {
+      if (isNestAdminError(error) && error.kind === "forbidden") return false;
+      throw error;
+    }
+  }
+  /**
+  * Run a `before` hook, if the model has one.
+  *
+  * The result is validated again rather than trusted: a hook is application
+  * code, and the rule that a hidden or read-only field cannot be written is
+  * not one it should be able to step around by accident.
+  */
+  async runBefore(context, metadata, hook, data, id) {
+    const handler = this.hooks?.[metadata.name]?.[hook];
+    if (!handler) return data;
+    const result = await (hook === "beforeCreate" ? handler({
+      context,
+      model: metadata.name,
+      data
+    }) : handler({
+      context,
+      model: metadata.name,
+      id,
+      data
+    }));
+    this.assertWritable(metadata, result);
+    return result;
+  }
+  /**
+  * Run an `after` hook, if the model has one.
+  *
+  * Nothing is rolled back if it throws - the write already happened - so the
+  * failure is reported as it is rather than dressed up as a failed write.
+  */
+  async runAfter(context, model, hook, args) {
+    const handler = this.hooks?.[model]?.[hook];
+    if (!handler) return;
+    await handler({
+      context,
+      model,
+      ...args
+    });
+  }
+  /**
+  * The actions this principal may run, per model.
+  *
+  * Filtered by the policy before it reaches the document, so an action that
+  * would be refused is simply not there - the interface cannot draw a button
+  * for something it was never told about.
+  */
+  async actionsFor(context, models) {
+    const byModel = /* @__PURE__ */ new Map();
+    for (const model of models) {
+      const declared = this.actions?.[model.name] ?? [];
+      if (declared.length === 0) continue;
+      if (!await this.permits(context, model.name, "action")) continue;
+      byModel.set(model.name, declared.map((action) => ({
+        name: action.name,
+        label: action.label ?? action.name,
+        scope: action.scope,
+        ...action.confirm !== void 0 ? {
+          confirm: action.confirm
+        } : {},
+        ...action.danger !== void 0 ? {
+          danger: action.danger
+        } : {}
+      })));
+    }
+    return byModel;
+  }
+  /**
+  * Run one application-defined action.
+  *
+  * Authorized as `'action'` rather than as the operation it resembles: an
+  * action can do anything, so a policy should be able to decide about it on
+  * its own terms.
+  *
+  * A `'record'` action is given the id; a `'list'` one is not, and passing an
+  * id to it - or omitting one from a record action - is a request that does
+  * not match the action that was declared.
+  */
+  async runAction(context, model, name, id) {
+    await this.requireModel(model);
+    await this.assertAllowed(context, model, "action");
+    const action = (this.actions?.[model] ?? []).find((candidate) => candidate.name === name);
+    if (!action) {
+      throw new FieldNotFoundError(model, name, "No such action.");
+    }
+    if (action.scope === "record" && id === void 0) {
+      throw new InvalidQueryError(`Action "${name}" applies to one record and needs an id.`);
+    }
+    if (action.scope === "list" && id !== void 0) {
+      throw new InvalidQueryError(`Action "${name}" applies to the whole model, not to a record.`);
+    }
+    return await action.run({
+      context,
+      model,
+      ...id === void 0 ? {} : {
+        id
+      }
+    }) ?? {};
+  }
+  // ------------------------------------------------------- resource policy
+  /**
+  * Deny the request unless the policy permits this operation on this model.
+  *
+  * Called before any adapter operation. Both a `false` return and a thrown
+  * `ForbiddenError` mean the same thing here, so a host may use whichever
+  * reads better. Anything else the policy throws propagates untouched and the
+  * exception filter turns it into a generic 500 - a broken policy fails the
+  * request rather than quietly allowing it.
+  */
+  async assertAllowed(context, model, operation) {
+    const decision = await this.resourceAuth.authorize({
+      context,
+      model,
+      operation
+    });
+    if (decision === false) throw new ForbiddenError();
+  }
+  /**
+  * Is this model visible in the metadata document?
+  *
+  * Same policy, different consequence. A denial here must **hide** the model
+  * rather than fail the request: surfacing a 403 from `GET /admin/meta` would
+  * tell the caller that a model they cannot see exists, which is the side
+  * channel this whole phase is meant to close.
+  *
+  * A `ForbiddenError` is therefore caught and read as "not visible". Any other
+  * error is rethrown - a bug in the policy must surface as a 500, not silently
+  * reshape the schema a client is shown.
+  */
+  async isVisible(context, model) {
+    try {
+      const decision = await this.resourceAuth.authorize({
+        context,
+        model,
+        operation: "metadata"
+      });
+      return decision !== false;
+    } catch (error) {
+      if (isNestAdminError(error) && error.kind === "forbidden") return false;
+      throw error;
+    }
+  }
+  /**
+  * The models this admin exposes, after the configured selection.
+  *
+  * Every path goes through here, so an excluded model is absent from the
+  * metadata document and unknown to every route.
+  */
+  async exposedModels() {
+    return applyOverrides(selectModels(await this.adapter.getModels(), this.resources), this.overrides);
+  }
+  /**
+  * Resolve a model name to its metadata, or fail with 404.
+  *
+  * Called before the policy on every operation, and that order is deliberate.
+  * Whether a model exists is structural - the same answer for everyone - so an
+  * excluded model answers 404 rather than 403, and does so identically for
+  * every principal. Asking the policy first would make a model that is not
+  * part of this admin look like one the caller merely lacks access to.
+  */
+  async requireModel(model) {
+    const models = await this.exposedModels();
+    const found = models.find((candidate) => candidate.name === model);
+    if (!found) {
+      throw new ModelNotFoundError(model, models.map((candidate) => candidate.name));
+    }
+    return found;
+  }
+};
+AdminService = _ts_decorate3([
+  Injectable2(),
+  _ts_param2(0, Inject2(ADMIN_ADAPTER)),
+  _ts_param2(1, Inject2(ADMIN_RESOURCE_AUTH)),
+  _ts_param2(2, Inject2(ADMIN_RESOURCES)),
+  _ts_param2(3, Inject2(ADMIN_MODELS)),
+  _ts_param2(4, Inject2(ADMIN_HOOKS)),
+  _ts_param2(5, Inject2(ADMIN_ACTIONS)),
+  _ts_param2(6, Inject2(ADMIN_AUTH)),
+  _ts_param2(7, Inject2(ADMIN_DASHBOARD)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof OrmAdapter === "undefined" ? Object : OrmAdapter,
+    typeof AdminResourceAuth === "undefined" ? Object : AdminResourceAuth,
+    Object,
+    Object,
+    Object,
+    Object,
+    typeof AdminAuth === "undefined" ? Object : AdminAuth,
+    Object
+  ])
+], AdminService);
+
+// src/admin/controller.ts
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var AdminController = class {
+  static {
+    __name(this, "AdminController");
+  }
+  service;
+  constructor(service) {
+    this.service = service;
+  }
+  /**
+  * Declared before `:model` so the literal segment wins. A model named
+  * exactly `meta` would be shadowed; Prisma model names are conventionally
+  * capitalised (`Meta`) and matching is case-sensitive, so this is a narrow
+  * and documented corner.
+  */
+  /**
+  * `POST /admin/actions/:model/:action[/:id]` - run an application action.
+  *
+  * Under a reserved first segment, and declared before every `:model` route,
+  * so `actions` is matched literally. The same arrangement already reserves
+  * `meta` here and `assets` in the UI controller; the cost is that a model
+  * called `actions` would be unreachable, which is documented rather than
+  * guarded against.
+  */
+  async runListAction(context, model, action) {
+    return success(await this.service.runAction(context, model, action));
+  }
+  async runRecordAction(context, model, action, id) {
+    return success(await this.service.runAction(context, model, action, id));
+  }
+  async meta(context) {
+    return success(await this.service.getMetadata(context));
+  }
+  /**
+  * `GET /admin/dashboard` - what the landing page shows.
+  *
+  * Declared before `:model` so the literal segment wins, as `meta` and
+  * `actions` already are. The cost is the same and is documented with them: a
+  * model named `dashboard` would be unreachable.
+  */
+  async dashboard(context) {
+    return success(await this.service.getDashboard(context));
+  }
+  async list(context, model, query) {
+    const page = await this.service.list(context, model, query);
+    return successPage(page.data, {
+      total: page.total,
+      page: page.page,
+      perPage: page.perPage
+    });
+  }
+  async findOne(context, model, id) {
+    return success(await this.service.findOne(context, model, id));
+  }
+  async create(context, model, body) {
+    return success(await this.service.create(context, model, body));
+  }
+  async update(context, model, id, body) {
+    return success(await this.service.update(context, model, id, body));
+  }
+  /**
+  * Returns 200 with a `null` payload rather than 204, so every admin endpoint
+  * answers with the same envelope and a client needs one response shape.
+  */
+  async remove(context, model, id) {
+    await this.service.delete(context, model, id);
+    return success(null);
+  }
+  /**
+  * `DELETE /admin/:model` with `{ "ids": [...] }` - delete several records.
+  *
+  * One segment, so it cannot be confused with `/:model/:id`. The ids are in
+  * the body rather than the query string because a selection of two hundred
+  * would not survive a URL length limit, and a request that silently deletes
+  * the first N of what was asked for is worse than one that fails.
+  *
+  * Answers 200 with both lists even when some records survived; see
+  * `deleteMany` for why a partial result is not an error.
+  */
+  async removeMany(context, model, body) {
+    const ids = body?.ids;
+    if (!Array.isArray(ids) || ids.some((id) => typeof id !== "string" && typeof id !== "number")) {
+      throw new InvalidQueryError('Deleting records requires a body of the form { "ids": ["...", "..."] }.');
+    }
+    return success(await this.service.deleteMany(context, model, ids));
+  }
+  /**
+  * `GET /admin/:model/:id/:relation` - a page of related records.
+  *
+  * Three segments, so it cannot be confused with `/:model/:id`. The query
+  * string is the ordinary list query and describes the records being returned,
+  * not the record they hang off.
+  */
+  async listRelated(context, model, id, relation, query) {
+    const page = await this.service.listRelated(context, model, id, relation, query);
+    return successPage(page.data, {
+      total: page.total,
+      page: page.page,
+      perPage: page.perPage
+    });
+  }
+  /**
+  * `POST /admin/:model/:id/:relation` with `{ "id": "..." }` - link a record.
+  *
+  * The body carries only an id: this attaches something that already exists.
+  * Creating a record and linking it in one request is a different operation
+  * and is not this one.
+  */
+  async attachRelated(context, model, id, relation, body) {
+    const targetId = body?.id;
+    if (typeof targetId !== "string" && typeof targetId !== "number") {
+      throw new InvalidQueryError('Attaching a related record requires a body of the form { "id": "..." }.');
+    }
+    await this.service.attachRelated(context, model, id, relation, targetId);
+    return success(null);
+  }
+  /** `DELETE /admin/:model/:id/:relation/:targetId` - unlink, without deleting. */
+  async detachRelated(context, model, id, relation, targetId) {
+    await this.service.detachRelated(context, model, id, relation, targetId);
+    return success(null);
+  }
+};
+_ts_decorate4([
+  Post("actions/:model/:action"),
+  _ts_param3(0, AdminContext()),
+  _ts_param3(1, Param("model")),
+  _ts_param3(2, Param("action")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof ExecutionContext === "undefined" ? Object : ExecutionContext,
+    String,
+    String
+  ]),
+  _ts_metadata3("design:returntype", Promise)
+], AdminController.prototype, "runListAction", null);
+_ts_decorate4([
+  Post("actions/:model/:action/:id"),
+  _ts_param3(0, AdminContext()),
+  _ts_param3(1, Param("model")),
+  _ts_param3(2, Param("action")),
+  _ts_param3(3, Param("id")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof ExecutionContext === "undefined" ? Object : ExecutionContext,
+    String,
+    String,
+    String
+  ]),
+  _ts_metadata3("design:returntype", Promise)
+], AdminController.prototype, "runRecordAction", null);
+_ts_decorate4([
+  Get("meta"),
+  _ts_param3(0, AdminContext()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof ExecutionContext === "undefined" ? Object : ExecutionContext
+  ]),
+  _ts_metadata3("design:returntype", Promise)
+], AdminController.prototype, "meta", null);
+_ts_decorate4([
+  Get("dashboard"),
+  _ts_param3(0, AdminContext()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof ExecutionContext === "undefined" ? Object : ExecutionContext
+  ]),
+  _ts_metadata3("design:returntype", Promise)
+], AdminController.prototype, "dashboard", null);
+_ts_decorate4([
+  Get(":model"),
+  _ts_param3(0, AdminContext()),
+  _ts_param3(1, Param("model")),
+  _ts_param3(2, Query()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof ExecutionContext === "undefined" ? Object : ExecutionContext,
+    String,
+    typeof RawQuery === "undefined" ? Object : RawQuery
+  ]),
+  _ts_metadata3("design:returntype", Promise)
+], AdminController.prototype, "list", null);
+_ts_decorate4([
+  Get(":model/:id"),
+  _ts_param3(0, AdminContext()),
+  _ts_param3(1, Param("model")),
+  _ts_param3(2, Param("id")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof ExecutionContext === "undefined" ? Object : ExecutionContext,
+    String,
+    String
+  ]),
+  _ts_metadata3("design:returntype", Promise)
+], AdminController.prototype, "findOne", null);
+_ts_decorate4([
+  Post(":model"),
+  _ts_param3(0, AdminContext()),
+  _ts_param3(1, Param("model")),
+  _ts_param3(2, Body()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof ExecutionContext === "undefined" ? Object : ExecutionContext,
+    String,
+    typeof RecordData === "undefined" ? Object : RecordData
+  ]),
+  _ts_metadata3("design:returntype", Promise)
+], AdminController.prototype, "create", null);
+_ts_decorate4([
+  Patch(":model/:id"),
+  _ts_param3(0, AdminContext()),
+  _ts_param3(1, Param("model")),
+  _ts_param3(2, Param("id")),
+  _ts_param3(3, Body()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof ExecutionContext === "undefined" ? Object : ExecutionContext,
+    String,
+    String,
+    typeof RecordData === "undefined" ? Object : RecordData
+  ]),
+  _ts_metadata3("design:returntype", Promise)
+], AdminController.prototype, "update", null);
+_ts_decorate4([
+  Delete(":model/:id"),
+  _ts_param3(0, AdminContext()),
+  _ts_param3(1, Param("model")),
+  _ts_param3(2, Param("id")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof ExecutionContext === "undefined" ? Object : ExecutionContext,
+    String,
+    String
+  ]),
+  _ts_metadata3("design:returntype", Promise)
+], AdminController.prototype, "remove", null);
+_ts_decorate4([
+  Delete(":model"),
+  _ts_param3(0, AdminContext()),
+  _ts_param3(1, Param("model")),
+  _ts_param3(2, Body()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof ExecutionContext === "undefined" ? Object : ExecutionContext,
+    String,
+    Object
+  ]),
+  _ts_metadata3("design:returntype", Promise)
+], AdminController.prototype, "removeMany", null);
+_ts_decorate4([
+  Get(":model/:id/:relation"),
+  _ts_param3(0, AdminContext()),
+  _ts_param3(1, Param("model")),
+  _ts_param3(2, Param("id")),
+  _ts_param3(3, Param("relation")),
+  _ts_param3(4, Query()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof ExecutionContext === "undefined" ? Object : ExecutionContext,
+    String,
+    String,
+    String,
+    typeof RawQuery === "undefined" ? Object : RawQuery
+  ]),
+  _ts_metadata3("design:returntype", Promise)
+], AdminController.prototype, "listRelated", null);
+_ts_decorate4([
+  Post(":model/:id/:relation"),
+  _ts_param3(0, AdminContext()),
+  _ts_param3(1, Param("model")),
+  _ts_param3(2, Param("id")),
+  _ts_param3(3, Param("relation")),
+  _ts_param3(4, Body()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof ExecutionContext === "undefined" ? Object : ExecutionContext,
+    String,
+    String,
+    String,
+    Object
+  ]),
+  _ts_metadata3("design:returntype", Promise)
+], AdminController.prototype, "attachRelated", null);
+_ts_decorate4([
+  Delete(":model/:id/:relation/:targetId"),
+  _ts_param3(0, AdminContext()),
+  _ts_param3(1, Param("model")),
+  _ts_param3(2, Param("id")),
+  _ts_param3(3, Param("relation")),
+  _ts_param3(4, Param("targetId")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof ExecutionContext === "undefined" ? Object : ExecutionContext,
+    String,
+    String,
+    String,
+    String
+  ]),
+  _ts_metadata3("design:returntype", Promise)
+], AdminController.prototype, "detachRelated", null);
+AdminController = _ts_decorate4([
+  Controller(),
+  UseGuards(AdminAuthGuard),
+  UseFilters(AdminExceptionFilter),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof AdminService === "undefined" ? Object : AdminService
+  ])
+], AdminController);
+
+// src/auth/controller.ts
+import { Body as Body2, Controller as Controller2, Get as Get2, HttpCode, Inject as Inject3, NotFoundException, Post as Post2, Req, Res, UseFilters as UseFilters2 } from "@nestjs/common";
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata4(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
+var AdminAuthController = class {
+  static {
+    __name(this, "AdminAuthController");
+  }
+  auth;
+  constructor(auth) {
+    this.auth = auth;
+  }
+  /**
+  * `GET /admin/auth/session` - who is signed in, if anyone.
+  *
+  * Answers `200` with `account: null` rather than `401` for an absent
+  * session. The interface asks this before it has any reason to think anybody
+  * is signed in, and an error is the wrong shape for "no, and that is fine" -
+  * it would put a failure in the console on every visit to the login page.
+  */
+  async session(request) {
+    const runtime = this.runtime();
+    const token = cookieFrom(request?.headers?.cookie, runtime.cookieName);
+    const id = token === void 0 ? void 0 : readSession(token, runtime.secret);
+    if (id === void 0) return success({
+      account: null
+    });
+    const account = await runtime.store.findById(id);
+    return success({
+      account: !account || account.disabled === true ? null : summarise(account)
+    });
+  }
+  /**
+  * `POST /admin/auth/login` with `{ email, password }`.
+  *
+  * `200` and a cookie, or `401` and nothing. There is exactly one failure
+  * message: an unknown address, a wrong password, a disabled account and a
+  * locked-out one are indistinguishable from outside. Telling them apart is
+  * convenient for the person signing in perhaps twice a year, and a list of
+  * which addresses are registered for everyone else.
+  */
+  async login(request, response, body) {
+    const runtime = this.runtime();
+    assertSameOrigin(request);
+    if (typeof body?.email !== "string" || typeof body?.password !== "string") {
+      throw new InvalidQueryError("Signing in requires an email and a password.");
+    }
+    const account = await runtime.signIn(body.email, body.password, attemptKey(request, body.email));
+    if (!account) {
+      throw new UnauthorizedError("Those details do not match an account.");
+    }
+    setSessionCookie(response, signSession(account.id, runtime.secret, runtime.maxAge), runtime, request);
+    return success({
+      account: summarise(account)
+    });
+  }
+  /**
+  * `POST /admin/auth/logout`.
+  *
+  * A POST rather than a GET, so a link or an image somewhere else cannot sign
+  * someone out by being loaded. Always `200`: signing out when you were not
+  * signed in is not a failure, it is the state you asked for.
+  */
+  logout(request, response) {
+    const runtime = this.runtime();
+    assertSameOrigin(request);
+    clearSessionCookie(response, runtime, request);
+    return success({
+      account: null
+    });
+  }
+  /**
+  * The built-in auth's runtime, or a 404.
+  *
+  * Not a 500: an application using its own `AdminAuth` has no login routes,
+  * and "this endpoint does not exist here" is exactly true.
+  */
+  runtime() {
+    const runtime = builtInRuntimeOf(this.auth);
+    if (!runtime) {
+      throw new NotFoundException("This admin is not using the built-in authentication, so it has no login routes.");
+    }
+    return runtime;
+  }
+};
+_ts_decorate5([
+  Get2("session"),
+  _ts_param4(0, Req()),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof RawRequest === "undefined" ? Object : RawRequest
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], AdminAuthController.prototype, "session", null);
+_ts_decorate5([
+  Post2("login"),
+  HttpCode(200),
+  _ts_param4(0, Req()),
+  _ts_param4(1, Res({
+    passthrough: true
+  })),
+  _ts_param4(2, Body2()),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof RawRequest === "undefined" ? Object : RawRequest,
+    Object,
+    Object
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], AdminAuthController.prototype, "login", null);
+_ts_decorate5([
+  Post2("logout"),
+  HttpCode(200),
+  _ts_param4(0, Req()),
+  _ts_param4(1, Res({
+    passthrough: true
+  })),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof RawRequest === "undefined" ? Object : RawRequest,
+    Object
+  ]),
+  _ts_metadata4("design:returntype", typeof SuccessResponse === "undefined" ? Object : SuccessResponse)
+], AdminAuthController.prototype, "logout", null);
+AdminAuthController = _ts_decorate5([
+  Controller2("auth"),
+  UseFilters2(AdminExceptionFilter),
+  _ts_param4(0, Inject3(ADMIN_AUTH)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof AdminAuth === "undefined" ? Object : AdminAuth
+  ])
+], AdminAuthController);
+function assertSameOrigin(request) {
+  const origin = header(request, "origin");
+  if (origin === void 0) return;
+  const host = header(request, "host");
+  if (host === void 0) return;
+  let sent;
+  try {
+    sent = new URL(origin).host;
+  } catch {
+    throw new UnauthorizedError("This request did not come from the admin.");
+  }
+  if (sent !== host) {
+    throw new UnauthorizedError("This request did not come from the admin.");
+  }
+}
+__name(assertSameOrigin, "assertSameOrigin");
+function header(request, name) {
+  const value = request?.headers?.[name];
+  return typeof value === "string" ? value : void 0;
+}
+__name(header, "header");
+
+// src/auth/contract.ts
+import { Logger as Logger5 } from "@nestjs/common";
+var logger3 = new Logger5("NestAdmin");
+function unsafeAllowAllRequests() {
+  const auth = {
+    authorize() {
+    }
+  };
+  unsafeInstances.add(auth);
+  return auth;
+}
+__name(unsafeAllowAllRequests, "unsafeAllowAllRequests");
+var unsafeInstances = /* @__PURE__ */ new WeakSet();
+function warnIfUnsafe(auth) {
+  if (unsafeInstances.has(auth)) {
+    logger3.warn("AdminModule is running with unsafeAllowAllRequests(): every admin route, including /admin/meta, is public. Do not deploy this.");
+  }
+}
+__name(warnIfUnsafe, "warnIfUnsafe");
+
+// src/auth/resource.ts
+function allowAllResources() {
+  return {
+    authorize() {
+      return true;
+    }
+  };
+}
+__name(allowAllResources, "allowAllResources");
+
+// src/mount-path.ts
+var DEFAULT_MOUNT_PATH = "/admin";
+function normaliseMountPath(path) {
+  if (path === void 0) return DEFAULT_MOUNT_PATH;
+  if (typeof path !== "string") {
+    throw new TypeError(`AdminModule \`path\` must be a string, received ${typeof path}.`);
+  }
+  const segments = path.split("/").filter((segment) => segment.length > 0);
+  if (segments.length === 0) {
+    throw new Error('AdminModule `path` cannot be empty or "/". The admin routes end in `:model`, so mounting them at the root would capture every unmatched request in the application. Choose a path such as "/admin".');
+  }
+  for (const segment of segments) {
+    if (!/^[A-Za-z0-9._~-]+$/.test(segment)) {
+      throw new Error(`AdminModule \`path\` segment "${segment}" is not a plain path segment. Use letters, digits, and any of . _ ~ - : the admin builds both URLs and HTML from this value, so it cannot contain patterns or markup.`);
+    }
+  }
+  return `/${segments.join("/")}`;
+}
+__name(normaliseMountPath, "normaliseMountPath");
+
+// src/ui/assets.ts
+import { existsSync, readFileSync, statSync } from "fs";
+import { dirname, join, resolve as resolve2, sep } from "path";
+import { fileURLToPath } from "url";
+
+// src/ui/colour.ts
+var READABLE = 4.5;
+var VISIBLE = 3;
+function channels(hex) {
+  const value = hex.length === 4 ? hex.slice(1).split("").map((part) => part + part).join("") : hex.slice(1);
+  return [
+    Number.parseInt(value.slice(0, 2), 16) / 255,
+    Number.parseInt(value.slice(2, 4), 16) / 255,
+    Number.parseInt(value.slice(4, 6), 16) / 255
+  ];
+}
+__name(channels, "channels");
+function toHex([r, g, b]) {
+  const part = /* @__PURE__ */ __name((value) => Math.round(Math.min(1, Math.max(0, value)) * 255).toString(16).padStart(2, "0"), "part");
+  return `#${part(r)}${part(g)}${part(b)}`;
+}
+__name(toHex, "toHex");
+function luminance(rgb) {
+  const [r, g, b] = rgb.map((channel) => channel <= 0.04045 ? channel / 12.92 : ((channel + 0.055) / 1.055) ** 2.4);
+  return 0.2126 * r + 0.7152 * g + 0.0722 * b;
+}
+__name(luminance, "luminance");
+function contrast(a, b) {
+  const [lighter, darker] = [
+    luminance(a),
+    luminance(b)
+  ].sort((x, y) => y - x);
+  return (lighter + 0.05) / (darker + 0.05);
+}
+__name(contrast, "contrast");
+var LIGHT_INK = [
+  0.985,
+  0.985,
+  0.99
+];
+var DARK_INK = [
+  0.09,
+  0.1,
+  0.12
+];
+var LIGHT_PAGE = [
+  0.976,
+  0.98,
+  0.984
+];
+var DARK_PAGE = [
+  0.09,
+  0.1,
+  0.12
+];
+function readableInk(hex) {
+  const brand = channels(hex);
+  return contrast(brand, LIGHT_INK) >= contrast(brand, DARK_INK) ? toHex(LIGHT_INK) : toHex(DARK_INK);
+}
+__name(readableInk, "readableInk");
+function mix(rgb, towards, amount) {
+  return rgb.map((channel) => channel + (towards - channel) * amount);
+}
+__name(mix, "mix");
+function visibleOn(hex, page, role = "text") {
+  const background = page === "dark" ? DARK_PAGE : LIGHT_PAGE;
+  const towards = page === "dark" ? 1 : 0;
+  const floor = role === "fill" ? VISIBLE : READABLE;
+  let colour = channels(hex);
+  for (let step = 0; step < 16; step++) {
+    if (contrast(colour, background) >= floor) break;
+    colour = mix(colour, towards, 0.05);
+  }
+  return toHex(colour);
+}
+__name(visibleOn, "visibleOn");
+
+// src/ui/theme.ts
+var HEX_COLOUR = /^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/;
+var SAFE_TEXT = /^[^<>&"'`\\]{1,64}$/;
+var SAFE_URL = /^(?:https?:\/\/[^\s<>"'`\\]+|data:image\/[a-z+]+;base64,[A-Za-z0-9+/=]+)$/;
+var APPEARANCES = /* @__PURE__ */ new Set([
+  "system",
+  "light",
+  "dark"
+]);
+var THEME_KEYS = /* @__PURE__ */ new Set([
+  "brandColor",
+  "title",
+  "logoUrl",
+  "appearance"
+]);
+function assertUsableTheme(theme) {
+  if (!theme) return;
+  if (theme.brandColor !== void 0 && !HEX_COLOUR.test(theme.brandColor)) {
+    throw new Error(`AdminModule \`theme.brandColor\` must be a hex colour such as "#0b6e6e", received ${JSON.stringify(theme.brandColor)}.`);
+  }
+  if (theme.title !== void 0 && !SAFE_TEXT.test(theme.title)) {
+    throw new Error(`AdminModule \`theme.title\` must be plain text of at most 64 characters, without < > & " ' \` or backslashes. It is written into the served page.`);
+  }
+  if (theme.logoUrl !== void 0 && !SAFE_URL.test(theme.logoUrl)) {
+    throw new Error(`AdminModule \`theme.logoUrl\` must be an http(s) URL or a data:image URI, received ${JSON.stringify(theme.logoUrl)}.`);
+  }
+  if (theme.appearance !== void 0 && !APPEARANCES.has(theme.appearance)) {
+    throw new Error(`AdminModule \`theme.appearance\` must be "system", "light" or "dark", received ${JSON.stringify(theme.appearance)}.`);
+  }
+  const unknown = Object.keys(theme).filter((key) => !THEME_KEYS.has(key));
+  if (unknown.length > 0) {
+    throw new Error(`AdminModule \`theme\` has no option${unknown.length === 1 ? "" : "s"} called ${unknown.join(", ")}. Known options: ${[
+      ...THEME_KEYS
+    ].join(", ")}.`);
+  }
+}
+__name(assertUsableTheme, "assertUsableTheme");
+function renderTheme(theme) {
+  if (!theme || !theme.brandColor && !theme.title && !theme.logoUrl && !theme.appearance) {
+    return "";
+  }
+  const style = theme.brandColor ? `<style>${brandRules(theme.brandColor)}</style>` : "";
+  const globals = JSON.stringify({
+    ...theme.title !== void 0 ? {
+      title: theme.title
+    } : {},
+    ...theme.logoUrl !== void 0 ? {
+      logoUrl: theme.logoUrl
+    } : {},
+    ...theme.appearance !== void 0 ? {
+      appearance: theme.appearance
+    } : {}
+  });
+  return `${style}<script>window.__NEST_ADMIN_THEME__ = ${globals}</script>`;
+}
+__name(renderTheme, "renderTheme");
+function brandRules(brand) {
+  const rules = /* @__PURE__ */ __name((page) => {
+    const fill = visibleOn(brand, page, "fill");
+    const text = visibleOn(brand, page, "text");
+    return `--primary:${fill};--primary-foreground:${readableInk(fill)};--link:${text}`;
+  }, "rules");
+  return `:root{${rules("light")}}.dark{${rules("dark")}}`;
+}
+__name(brandRules, "brandRules");
+
+// src/ui/assets.ts
+function moduleDirectory() {
+  return dirname(fileURLToPath(import.meta.url));
+}
+__name(moduleDirectory, "moduleDirectory");
+function uiRoot() {
+  return join(moduleDirectory(), "admin-ui");
+}
+__name(uiRoot, "uiRoot");
+function uiAvailable(root = uiRoot()) {
+  return existsSync(join(root, "index.html"));
+}
+__name(uiAvailable, "uiAvailable");
+var CONTENT_TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".map": "application/json; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".ico": "image/x-icon",
+  ".webp": "image/webp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf"
+};
+function contentTypeFor(fileName) {
+  const dot = fileName.lastIndexOf(".");
+  const extension = dot === -1 ? "" : fileName.slice(dot).toLowerCase();
+  return CONTENT_TYPES[extension] ?? "application/octet-stream";
+}
+__name(contentTypeFor, "contentTypeFor");
+function readAsset(fileName, root = uiRoot()) {
+  if (!/^[\w.-]+$/.test(fileName) || fileName.includes("..")) return void 0;
+  const assetsDirectory = join(root, "assets");
+  const candidate = resolve2(assetsDirectory, fileName);
+  if (!candidate.startsWith(assetsDirectory + sep)) return void 0;
+  if (!existsSync(candidate) || !statSync(candidate).isFile()) return void 0;
+  return readFileSync(candidate);
+}
+__name(readAsset, "readAsset");
+function readIndexHtml(root = uiRoot()) {
+  const indexPath = join(root, "index.html");
+  return existsSync(indexPath) ? readFileSync(indexPath) : void 0;
+}
+__name(readIndexHtml, "readIndexHtml");
+var UI_BASE_PLACEHOLDER = "/__nest-admin-base__";
+function renderShell(mountPath, root = uiRoot(), theme) {
+  const shell = readIndexHtml(root);
+  if (!shell) return void 0;
+  const injected = `  <script>window.__NEST_ADMIN_BASE__ = "${mountPath}"</script>
+  ${renderTheme(theme)}
+  </head>`;
+  let html = shell.toString("utf8").split(`${UI_BASE_PLACEHOLDER}/`).join(`${mountPath}/`).replace("</head>", injected);
+  if (theme?.title !== void 0) {
+    html = html.replace(/<title>[^<]*<\/title>/, `<title>${theme.title}</title>`);
+  }
+  return Buffer.from(html, "utf8");
+}
+__name(renderShell, "renderShell");
+
+// src/ui/controller.ts
+import { Controller as Controller3, Get as Get3, Header, Inject as Inject4, NotFoundException as NotFoundException2, Param as Param2, StreamableFile } from "@nestjs/common";
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata5(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param5, "_ts_param");
+var AdminUiController = class {
+  static {
+    __name(this, "AdminUiController");
+  }
+  root;
+  mountPath;
+  theme;
+  /**
+  * The rendered shell, built on first use.
+  *
+  * It depends only on the bundled file and the mount path, and neither changes
+  * while the application runs. Held on the instance rather than in a
+  * module-level cache: the package ships two bundles that each inline their
+  * own copy of a module, so module-level state is not shared between them.
+  */
+  shell;
+  constructor(root, mountPath, theme) {
+    this.root = root;
+    this.mountPath = mountPath;
+    this.theme = theme;
+  }
+  /**
+  * `GET /admin` - the SPA shell.
+  *
+  * `no-cache` rather than a long max-age: the HTML names hashed asset files,
+  * so a cached shell would keep pointing at a previous deployment's bundle.
+  */
+  index() {
+    this.shell ??= renderShell(this.mountPath, this.root, this.theme);
+    const html = this.shell;
+    if (!html) {
+      throw new NotFoundException2("The admin UI was not bundled with this package. This build is missing dist/admin-ui - see docs/publishing.md.");
+    }
+    return new StreamableFile(html, {
+      type: "text/html; charset=utf-8"
+    });
+  }
+  /**
+  * `GET /admin/assets/:file`
+  *
+  * A single path segment, so a nested path cannot be requested at all; the
+  * reader in `assets.ts` re-checks the name and the resolved location anyway.
+  *
+  * Vite emits content-hashed filenames, so these are immutable and safe to
+  * cache for a long time.
+  */
+  asset(file) {
+    const contents = readAsset(file, this.root);
+    if (!contents) throw new NotFoundException2(`No admin UI asset named "${file}".`);
+    return new StreamableFile(contents, {
+      type: contentTypeFor(file)
+    });
+  }
+};
+_ts_decorate6([
+  Get3(),
+  Header("Cache-Control", "no-cache"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
+], AdminUiController.prototype, "index", null);
+_ts_decorate6([
+  Get3("assets/:file"),
+  Header("Cache-Control", "public, max-age=31536000, immutable"),
+  _ts_param5(0, Param2("file")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata5("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
+], AdminUiController.prototype, "asset", null);
+AdminUiController = _ts_decorate6([
+  Controller3(),
+  _ts_param5(0, Inject4(ADMIN_UI_ROOT)),
+  _ts_param5(1, Inject4(ADMIN_MOUNT_PATH)),
+  _ts_param5(2, Inject4(ADMIN_THEME)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    String,
+    String,
+    Object
+  ])
+], AdminUiController);
+
+// src/module.ts
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate7, "_ts_decorate");
+function assertUsableOptions(options, caller) {
+  if (!options?.adapter) {
+    throw new Error(`AdminModule.${caller}() requires an \`adapter\`. Construct one in your application, for example \`new PrismaAdapter({ client: prisma })\`.`);
+  }
+  if (!options.auth || typeof options.auth.authorize !== "function") {
+    throw new Error(`AdminModule.${caller}() requires an \`auth\` implementation with an \`authorize(context)\` method. The admin API exposes every record and the whole schema, so it is never public by default. For local development only, pass \`unsafeAllowAllRequests()\`.`);
+  }
+  if (options.resourceAuth && typeof options.resourceAuth.authorize !== "function") {
+    throw new Error(`AdminModule.${caller}() was given a \`resourceAuth\` without an \`authorize(resource)\` method. Omit it to allow every model, or supply an implementation.`);
+  }
+  warnIfUnsafe(options.auth);
+}
+__name(assertUsableOptions, "assertUsableOptions");
+function warnIfUiMissing(resolvedUiRoot, mountPath) {
+  if (uiAvailable(resolvedUiRoot)) return;
+  new Logger6("NestAdmin").warn(`The admin UI was not found in this build; ${mountPath} will return 404. The API under ${mountPath} is unaffected.`);
+}
+__name(warnIfUiMissing, "warnIfUiMissing");
+function defineModule(mountPath, resolvedUiRoot, theme, optionProviders, extraImports = []) {
+  return {
+    module: AdminModule,
+    imports: [
+      ...extraImports,
+      // The mount path is applied here, not on the controllers: `@Controller()`
+      // is evaluated when the class is defined, long before either entry point
+      // sees any options. `RouterModule` prefixes the module's routes and
+      // preserves controller order, which the collision rule below depends on.
+      RouterModule.register([
+        {
+          path: mountPath,
+          module: AdminModule
+        }
+      ])
+    ],
+    // Order matters and is the whole answer to the route collision. The UI
+    // controller binds exactly two paths - the mount path itself and
+    // `assets/:file` - and is matched first, so `assets` can never be read as a
+    // model name. The auth controller claims `auth/*` next, for the same
+    // reason and at the same cost: a model named `auth` is unreachable, as one
+    // named `assets` or `actions` already was. Everything else falls through to
+    // the API controller.
+    controllers: [
+      AdminUiController,
+      AdminAuthController,
+      AdminController
+    ],
+    providers: [
+      ...optionProviders,
+      {
+        provide: ADMIN_UI_ROOT,
+        useValue: resolvedUiRoot
+      },
+      {
+        provide: ADMIN_MOUNT_PATH,
+        useValue: mountPath
+      },
+      {
+        provide: ADMIN_THEME,
+        useValue: theme
+      },
+      AdminService,
+      // Provided so Nest can resolve them for `@UseGuards` / `@UseFilters` on
+      // the controller. Deliberately not APP_GUARD or APP_FILTER: either would
+      // take over behaviour for the whole host application rather than just the
+      // admin routes.
+      AdminAuthGuard,
+      AdminExceptionFilter
+    ],
+    exports: [
+      AdminService
+    ]
+  };
+}
+__name(defineModule, "defineModule");
+var STRUCTURAL_OPTIONS = [
+  "path",
+  "uiRoot",
+  "theme"
+];
+function assertNoStructuralOptions(resolved) {
+  const misplaced = STRUCTURAL_OPTIONS.filter((key) => key in resolved);
+  if (misplaced.length === 0) return;
+  const one = misplaced.length === 1;
+  throw new Error(`AdminModule.forRootAsync() received ${misplaced.join(", ")} from its factory. ${one ? "That option is" : "Those options are"} structural: routes are registered before any provider exists, so ${one ? "it" : "they"} must be passed to forRootAsync() itself, beside \`imports\` and \`inject\`, rather than returned from \`useFactory\`.`);
+}
+__name(assertNoStructuralOptions, "assertNoStructuralOptions");
+function optionsProviders(options) {
+  const validate = /* @__PURE__ */ __name((resolved) => {
+    assertNoStructuralOptions(resolved);
+    assertUsableOptions(resolved, "forRootAsync");
+    return resolved;
+  }, "validate");
+  if (options.useFactory) {
+    return [
+      {
+        provide: ADMIN_OPTIONS,
+        useFactory: /* @__PURE__ */ __name(async (...args) => validate(await options.useFactory(...args)), "useFactory"),
+        inject: options.inject ?? []
+      }
+    ];
+  }
+  const factoryClass = options.useExisting ?? options.useClass;
+  return [
+    // `useClass` has to be instantiated by Nest before it can be asked;
+    // `useExisting` is already provided by the application.
+    ...options.useClass ? [
+      {
+        provide: options.useClass,
+        useClass: options.useClass
+      }
+    ] : [],
+    {
+      provide: ADMIN_OPTIONS,
+      useFactory: /* @__PURE__ */ __name(async (factory) => validate(await factory.createAdminOptions()), "useFactory"),
+      inject: [
+        factoryClass
+      ]
+    }
+  ];
+}
+__name(optionsProviders, "optionsProviders");
+var AdminModule = class {
+  static {
+    __name(this, "AdminModule");
+  }
+  static forRoot(options) {
+    assertUsableOptions(options, "forRoot");
+    const mountPath = normaliseMountPath(options.path);
+    const resolvedUiRoot = options.uiRoot ?? uiRoot();
+    warnIfUiMissing(resolvedUiRoot, mountPath);
+    assertUsableTheme(options.theme);
+    return defineModule(mountPath, resolvedUiRoot, options.theme, [
+      {
+        provide: ADMIN_ADAPTER,
+        useValue: options.adapter
+      },
+      {
+        provide: ADMIN_RESOURCES,
+        useValue: options.resources
+      },
+      {
+        provide: ADMIN_MODELS,
+        useValue: options.models
+      },
+      {
+        provide: ADMIN_HOOKS,
+        useValue: options.hooks
+      },
+      {
+        provide: ADMIN_ACTIONS,
+        useValue: options.actions
+      },
+      {
+        provide: ADMIN_DASHBOARD,
+        useValue: options.dashboard
+      },
+      {
+        provide: ADMIN_AUTH,
+        useValue: options.auth
+      },
+      // Always provided, so injection resolves whether or not the consumer
+      // supplied a policy. The default permits every model.
+      {
+        provide: ADMIN_RESOURCE_AUTH,
+        useValue: options.resourceAuth ?? allowAllResources()
+      }
+    ]);
+  }
+  /**
+  * The same module, with the adapter and the auth policy resolved through DI.
+  *
+  * For the ordinary case where those things are not available when the module
+  * is declared: a `PrismaService` that belongs to another module, a connection
+  * string that comes from `ConfigService`.
+  *
+  * ```ts
+  * AdminModule.forRootAsync({
+  *   imports: [PrismaModule, ConfigModule],
+  *   inject: [PrismaService, ConfigService],
+  *   useFactory: (prisma: PrismaService, config: ConfigService) => ({
+  *     adapter: new PrismaAdapter({ client: prisma }),
+  *     auth: new SessionAdminAuth(config.get('ADMIN_ROLE')),
+  *   }),
+  * })
+  * ```
+  *
+  * `path` stays on this object rather than coming from the factory. Routes are
+  * registered when the module is defined, which is before any provider has
+  * been instantiated, so the mount path cannot wait for an injection - and a
+  * `path` returned from the factory would be silently ignored, which is worse
+  * than not offering it.
+  */
+  static forRootAsync(options) {
+    if (!options?.useFactory && !options?.useClass && !options?.useExisting) {
+      throw new Error("AdminModule.forRootAsync() requires one of `useFactory`, `useClass` or `useExisting`. To configure the admin directly, use forRoot().");
+    }
+    const mountPath = normaliseMountPath(options.path);
+    const resolvedUiRoot = options.uiRoot ?? uiRoot();
+    warnIfUiMissing(resolvedUiRoot, mountPath);
+    assertUsableTheme(options.theme);
+    const derive2 = /* @__PURE__ */ __name((token, read) => ({
+      provide: token,
+      useFactory: read,
+      inject: [
+        ADMIN_OPTIONS
+      ]
+    }), "derive");
+    return defineModule(mountPath, resolvedUiRoot, options.theme, [
+      ...optionsProviders(options),
+      derive2(ADMIN_ADAPTER, (resolved) => resolved.adapter),
+      derive2(ADMIN_RESOURCES, (resolved) => resolved.resources),
+      derive2(ADMIN_MODELS, (resolved) => resolved.models),
+      derive2(ADMIN_HOOKS, (resolved) => resolved.hooks),
+      derive2(ADMIN_ACTIONS, (resolved) => resolved.actions),
+      derive2(ADMIN_DASHBOARD, (resolved) => resolved.dashboard),
+      derive2(ADMIN_AUTH, (resolved) => resolved.auth),
+      derive2(ADMIN_RESOURCE_AUTH, (resolved) => resolved.resourceAuth ?? allowAllResources())
+    ], options.imports ?? []);
+  }
+};
+AdminModule = _ts_decorate7([
+  Module({})
+], AdminModule);
+export {
+  AdapterError,
+  AdminModule,
+  ConstraintError,
+  FieldNotFoundError,
+  ForbiddenError,
+  InvalidQueryError,
+  ModelNotFoundError,
+  NestAdminError,
+  RecordNotFoundError,
+  UnauthorizedError,
+  ValidationError,
+  adminAccountOf,
+  builtInAuth,
+  generateSessionSecret,
+  hashAdminPassword,
+  isNestAdminError,
+  unsafeAllowAllRequests,
+  verifyAdminPassword
+};
+//# sourceMappingURL=index.js.map