@strapi-community/plugin-better-auth-dashboard 1.0.0-beta.1 → 1.0.0-beta.2

package/dist/admin/index-BV-4M_Fp.js

@@ -1,1970 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const jsxRuntime = require("react/jsx-runtime");
-const designSystem = require("@strapi/design-system");
-const icons = require("@strapi/icons");
-const admin = require("@strapi/strapi/admin");
-const react = require("react");
-const reactQuery = require("react-query");
-const styled = require("styled-components");
-const index = require("./index-BHfYu0uA.js");
-const Avatar = require("./Avatar-Cvk89aMx.js");
-const useModelSchema = require("./useModelSchema-CqOTI7P1.js");
-const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
-const styled__default = /* @__PURE__ */ _interopDefault(styled);
-function useUsers(options = {}) {
-  const { limit = 25, offset = 0, search } = options;
-  return reactQuery.useQuery({
-    queryKey: ["dash-users", limit, offset, search],
-    queryFn: async () => {
-      const whereClause = search ? JSON.stringify([
-        {
-          field: "email",
-          operator: "contains",
-          value: search,
-          connector: "OR"
-        },
-        {
-          field: "name",
-          operator: "contains",
-          value: search,
-          connector: "OR"
-        }
-      ]) : void 0;
-      const result = await index.client.dash.listUsers({
-        query: {
-          limit,
-          offset,
-          sortBy: "createdAt",
-          sortOrder: "desc",
-          ...whereClause ? { where: whereClause } : {}
-        }
-      });
-      if (result.error) {
-        throw new Error(result.error.message ?? "Failed to load users");
-      }
-      return result.data;
-    },
-    keepPreviousData: true
-  });
-}
-function CreateUserDialog({ onClose }) {
-  const qc = reactQuery.useQueryClient();
-  const { toggleNotification } = admin.useNotification();
-  const [name, setName] = react.useState("");
-  const [email, setEmail] = react.useState("");
-  const [image, setImage] = react.useState("");
-  const [password, setPassword] = react.useState("");
-  const [generatePassword, setGeneratePassword] = react.useState(false);
-  const [emailVerified, setEmailVerified] = react.useState(false);
-  const [sendVerificationEmail, setSendVerificationEmail] = react.useState(false);
-  const createMutation = reactQuery.useMutation({
-    mutationFn: async () => {
-      const result = await index.client.dash.createUser({
-        name,
-        email,
-        ...image ? { image } : {},
-        ...generatePassword ? { generatePassword: true } : password ? { password } : {},
-        emailVerified,
-        sendVerificationEmail
-      });
-      if (result.error)
-        throw new Error(result.error.message ?? "Create failed");
-      return result.data;
-    },
-    onSuccess: () => {
-      qc.invalidateQueries({ queryKey: ["dash-users"] });
-      qc.invalidateQueries({ queryKey: ["dash-user-stats"] });
-      toggleNotification({
-        type: "success",
-        message: "User created successfully"
-      });
-      onClose();
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Failed to create user"
-      });
-    }
-  });
-  const footer = /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
-    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Button, { variant: "tertiary", onClick: onClose, children: "Cancel" }),
-    /* @__PURE__ */ jsxRuntime.jsx(
-      designSystem.Button,
-      {
-        loading: createMutation.isLoading,
-        onClick: () => createMutation.mutate(),
-        disabled: !name || !email,
-        "data-testid": "create-user-submit",
-        children: "Create user"
-      }
-    )
-  ] });
-  return /* @__PURE__ */ jsxRuntime.jsx(
-    useModelSchema.Drawer,
-    {
-      title: "Create user",
-      footer,
-      onClose,
-      "data-testid": "create-user-drawer",
-      children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 5, children: [
-        /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
-          /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: "Personal information" }),
-          /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { style: { width: "100%" }, required: true, children: [
-            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Full name" }),
-            /* @__PURE__ */ jsxRuntime.jsx(
-              designSystem.TextInput,
-              {
-                name: "name",
-                value: name,
-                onChange: (e) => setName(e.target.value),
-                placeholder: "Jane Smith",
-                "data-testid": "new-user-name"
-              }
-            )
-          ] }),
-          /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { style: { width: "100%" }, required: true, children: [
-            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Email address" }),
-            /* @__PURE__ */ jsxRuntime.jsx(
-              designSystem.TextInput,
-              {
-                name: "email",
-                type: "email",
-                value: email,
-                onChange: (e) => setEmail(e.target.value),
-                placeholder: "jane@example.com",
-                "data-testid": "new-user-email"
-              }
-            )
-          ] }),
-          /* @__PURE__ */ jsxRuntime.jsx(
-            useModelSchema.MediaPickerField,
-            {
-              label: "Avatar URL",
-              name: "image",
-              value: image,
-              onChange: setImage,
-              placeholder: "https://example.com/avatar.png",
-              hint: "Optional — publicly accessible image URL"
-            }
-          )
-        ] }),
-        /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
-          /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: "Password" }),
-          /* @__PURE__ */ jsxRuntime.jsx(
-            designSystem.Checkbox,
-            {
-              name: "generatePassword",
-              checked: generatePassword,
-              onCheckedChange: (checked) => {
-                setGeneratePassword(checked);
-                if (checked) setPassword("");
-              },
-              children: "Generate a random password"
-            }
-          ),
-          !generatePassword && /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { style: { width: "100%" }, children: [
-            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Password" }),
-            /* @__PURE__ */ jsxRuntime.jsx(
-              designSystem.TextInput,
-              {
-                name: "password",
-                type: "password",
-                value: password,
-                onChange: (e) => setPassword(e.target.value),
-                placeholder: "Leave blank for a passwordless account"
-              }
-            )
-          ] })
-        ] }),
-        /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
-          /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: "Email verification" }),
-          /* @__PURE__ */ jsxRuntime.jsx(
-            designSystem.Checkbox,
-            {
-              name: "emailVerified",
-              checked: emailVerified,
-              onCheckedChange: (checked) => {
-                setEmailVerified(checked);
-                if (checked) setSendVerificationEmail(false);
-              },
-              children: "Mark email as already verified"
-            }
-          ),
-          !emailVerified && /* @__PURE__ */ jsxRuntime.jsx(
-            designSystem.Checkbox,
-            {
-              name: "sendVerificationEmail",
-              checked: sendVerificationEmail,
-              onCheckedChange: (checked) => setSendVerificationEmail(checked),
-              children: "Send a verification email to the user"
-            }
-          ),
-          emailVerified && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "success600", children: "The user will be able to sign in immediately without verifying their email." }) })
-        ] })
-      ] })
-    }
-  );
-}
-function usePluginSettings() {
-  const { get } = admin.useFetchClient();
-  return reactQuery.useQuery({
-    queryKey: ["dash-plugin-settings"],
-    queryFn: async () => {
-      const { data } = await get(
-        "/better-auth-dashboard/settings"
-      );
-      return data;
-    },
-    staleTime: 5 * 60 * 1e3
-  });
-}
-const TwoFaChip = styled__default.default.span`
-  display: inline-flex;
-  align-items: center;
-  gap: 5px;
-  padding: 3px 10px;
-  border-radius: 20px;
-  font-size: 11px;
-  font-weight: 700;
-  background: ${(p) => p.$enabled ? "#eafbe7" : "#f0f0ff"};
-  color: ${(p) => p.$enabled ? "#5cb176" : "#8e8ea9"};
-  &::before {
-    content: '';
-    display: inline-block;
-    width: 5px;
-    height: 5px;
-    border-radius: 50%;
-    background: ${(p) => p.$enabled ? "#5cb176" : "#b8b8c7"};
-  }
-`;
-const BackupCodeGrid = styled__default.default.div`
-  display: grid;
-  grid-template-columns: repeat(2, 1fr);
-  gap: 6px;
-`;
-const BackupCodeItem = styled__default.default.span`
-  font-family: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
-  font-size: 12px;
-  font-weight: 600;
-  padding: 6px 10px;
-  background: white;
-  border: 1px solid #eaeaef;
-  border-radius: 6px;
-  color: #32324d;
-  letter-spacing: 0.05em;
-  text-align: center;
-`;
-const ReadOnlyCodeInput = styled__default.default.div`
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  padding: 8px 12px;
-  background: white;
-  border: 1px solid #eaeaef;
-  border-radius: 6px;
-  font-family: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
-  font-size: 11px;
-  color: #32324d;
-  word-break: break-all;
-  overflow-wrap: anywhere;
-`;
-const SessionCard = styled__default.default.div`
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 12px;
-  padding: 10px 14px;
-  background: white;
-  border: 1px solid #eaeaef;
-  border-radius: 8px;
-`;
-const SessionMeta = styled__default.default.div`
-  display: flex;
-  flex-direction: column;
-  gap: 3px;
-  flex: 1;
-  min-width: 0;
-`;
-const IpChip = styled__default.default.span`
-  display: inline-block;
-  background: #f0f0ff;
-  color: #4945ff;
-  border-radius: 5px;
-  padding: 2px 6px;
-  font-family: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
-  font-size: 11px;
-  font-weight: 600;
-`;
-const TimestampText = styled__default.default.span`
-  font-size: 11px;
-  color: #8e8ea9;
-`;
-const AgentText = styled__default.default.span`
-  font-size: 11px;
-  color: #b8b8c7;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-  display: block;
-`;
-const STANDARD_FIELDS = /* @__PURE__ */ new Set([
-  "id",
-  "name",
-  "email",
-  "emailVerified",
-  "image",
-  "banned",
-  "banReason",
-  "banExpires",
-  "createdAt",
-  "updatedAt"
-]);
-function UserDetailDrawer({
-  userId,
-  banEnabled,
-  emailVerificationEnabled,
-  twoFactorEnabled,
-  onClose
-}) {
-  const qc = reactQuery.useQueryClient();
-  const { toggleNotification } = admin.useNotification();
-  const { get, put } = admin.useFetchClient();
-  const schemaQuery = useModelSchema.useModelSchema("user");
-  const settingsQuery = usePluginSettings();
-  const emailCallbackUrl = settingsQuery.data?.email_callback_url ?? null;
-  const userQuery = reactQuery.useQuery({
-    queryKey: ["dash-user", userId],
-    queryFn: async () => {
-      const result = await index.client.dash.user(
-        {},
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (result.error)
-        throw new Error(result.error.message ?? "Failed to load user");
-      return result.data;
-    }
-  });
-  const orgsQuery = reactQuery.useQuery({
-    queryKey: ["dash-user-orgs", userId],
-    queryFn: async () => {
-      const result = await index.client.dash.userOrganizations(
-        {},
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (result.error) throw new Error(result.error.message ?? "Failed");
-      return result.data?.organizations ?? [];
-    }
-  });
-  const sessionsQuery = reactQuery.useQuery({
-    queryKey: ["dash-user-sessions", userId],
-    queryFn: async () => {
-      const { data } = await get(
-        `/better-auth-dashboard/db?uid=plugin::better-auth.session&filters[userId][$eq]=${userId}&sort[0]=createdAt:desc&pagination[pageSize]=50`
-      );
-      return data.results ?? [];
-    }
-  });
-  const strapiUserQuery = reactQuery.useQuery({
-    queryKey: ["dash-strapi-user", userId],
-    enabled: !!schemaQuery.data,
-    queryFn: async () => {
-      const relationFields = Object.entries(schemaQuery.data).filter(([, attr]) => attr.type === "relation").map(([fieldName]) => fieldName);
-      const populateParam = relationFields.length > 0 ? `&populate=${encodeURIComponent(relationFields.join(","))}` : "";
-      const { data } = await get(
-        `/better-auth-dashboard/db?uid=plugin::better-auth.user&filters[id][$eq]=${userId}&pagination[pageSize]=1${populateParam}`
-      );
-      return data.results?.[0] ?? null;
-    }
-  });
-  const [activeTab, setActiveTab] = react.useState("profile");
-  const [editName, setEditName] = react.useState(void 0);
-  const [editEmail, setEditEmail] = react.useState(void 0);
-  const [editEmailVerified, setEditEmailVerified] = react.useState(void 0);
-  const [editImage, setEditImage] = react.useState(void 0);
-  const [editExtra, setEditExtra] = react.useState({});
-  const [newPassword, setNewPassword] = react.useState("");
-  const [banReason, setBanReason] = react.useState("");
-  const [banExpiresDays, setBanExpiresDays] = react.useState("");
-  const [confirmRevokeAll, setConfirmRevokeAll] = react.useState(false);
-  const [confirmRevokeSessionId, setConfirmRevokeSessionId] = react.useState(null);
-  const [confirmBan, setConfirmBan] = react.useState(false);
-  const [confirmUnban, setConfirmUnban] = react.useState(false);
-  const [confirmUnlinkAccountId, setConfirmUnlinkAccountId] = react.useState(null);
-  const [confirmDisable2FA, setConfirmDisable2FA] = react.useState(false);
-  const [showTotpModal, setShowTotpModal] = react.useState(false);
-  const [showBackupCodesModal, setShowBackupCodesModal] = react.useState(false);
-  const [confirmRegenerateBackupCodes, setConfirmRegenerateBackupCodes] = react.useState(false);
-  const [twoFactorData, setTwoFactorData] = react.useState(null);
-  const [totpUriData, setTotpUriData] = react.useState(null);
-  const [backupCodesData, setBackupCodesData] = react.useState(null);
-  const user = userQuery.data;
-  const displayName = editName ?? user?.name ?? "";
-  const displayEmail = editEmail ?? user?.email ?? "";
-  const displayEmailVerified = editEmailVerified ?? user?.emailVerified ?? false;
-  const displayImage = editImage ?? user?.image ?? "";
-  const handleExtraChange = (name, value) => {
-    setEditExtra((prev) => ({ ...prev, [name]: value }));
-  };
-  const extraData = {
-    ...strapiUserQuery.data ?? {},
-    ...editExtra
-  };
-  const updateMutation = reactQuery.useMutation({
-    mutationFn: async () => {
-      const body = {};
-      if (editName !== void 0) body.name = editName;
-      if (editEmail !== void 0) body.email = editEmail;
-      if (editEmailVerified !== void 0)
-        body.emailVerified = editEmailVerified;
-      if (editImage !== void 0) body.image = editImage;
-      const documentId = strapiUserQuery.data?.documentId;
-      if (!documentId) throw new Error("Could not resolve documentId for user");
-      const updateUser = await index.client.dash.updateUser(
-        { userId, ...body },
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (!updateUser.data) throw new Error("Update failed");
-      if (Object.keys(editExtra).length > 0) {
-        await put(
-          `/better-auth-dashboard/db/${documentId}?uid=plugin::better-auth.user`,
-          editExtra
-        );
-      }
-    },
-    onSuccess: async () => {
-      await qc.invalidateQueries({ queryKey: ["dash-strapi-user", userId] });
-      qc.invalidateQueries({ queryKey: ["dash-user", userId] });
-      qc.invalidateQueries({ queryKey: ["dash-users"] });
-      setEditName(void 0);
-      setEditEmail(void 0);
-      setEditEmailVerified(void 0);
-      setEditImage(void 0);
-      setEditExtra({});
-      toggleNotification({
-        type: "success",
-        message: "User updated successfully"
-      });
-      onClose();
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Update failed"
-      });
-    }
-  });
-  const revokeSessionMutation = reactQuery.useMutation({
-    mutationFn: async (sessionId) => {
-      const result = await index.client.dash.sessions.revoke(
-        {},
-        useModelSchema.withContext({ sessionId, userId }, index.getAuthHeaders())
-      );
-      if (result.error)
-        throw new Error(result.error.message ?? "Revoke failed");
-    },
-    onSuccess: () => {
-      setConfirmRevokeSessionId(null);
-      qc.invalidateQueries({ queryKey: ["dash-user-sessions", userId] });
-      toggleNotification({ type: "success", message: "Session revoked" });
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Failed to revoke session"
-      });
-    }
-  });
-  const passwordMutation = reactQuery.useMutation({
-    mutationFn: async () => {
-      const result = await index.client.dash.setPassword(
-        { password: newPassword },
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (result.error)
-        throw new Error(result.error.message ?? "Password update failed");
-      return result.data;
-    },
-    onSuccess: () => {
-      setNewPassword("");
-      toggleNotification({
-        type: "success",
-        message: "Password updated successfully"
-      });
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Password update failed"
-      });
-    }
-  });
-  const banMutation = reactQuery.useMutation({
-    mutationFn: async () => {
-      const body = {};
-      if (banReason) body.banReason = banReason;
-      if (banExpiresDays) {
-        const days = parseInt(banExpiresDays, 10);
-        if (!Number.isNaN(days)) body.banExpires = Date.now() + days * 864e5;
-      }
-      const result = await index.client.dash.banUser(
-        body,
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (result.error) throw new Error(result.error.message ?? "Ban failed");
-      return result.data;
-    },
-    onSuccess: () => {
-      setConfirmBan(false);
-      qc.invalidateQueries({ queryKey: ["dash-user", userId] });
-      qc.invalidateQueries({ queryKey: ["dash-users"] });
-      setBanReason("");
-      setBanExpiresDays("");
-      toggleNotification({ type: "success", message: "User has been banned" });
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Ban failed"
-      });
-    }
-  });
-  const unbanMutation = reactQuery.useMutation({
-    mutationFn: async () => {
-      const result = await index.client.dash.unbanUser(
-        {},
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (result.error) throw new Error(result.error.message ?? "Unban failed");
-      return result.data;
-    },
-    onSuccess: () => {
-      setConfirmUnban(false);
-      qc.invalidateQueries({ queryKey: ["dash-user", userId] });
-      qc.invalidateQueries({ queryKey: ["dash-users"] });
-      toggleNotification({ type: "success", message: "Ban has been lifted" });
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Unban failed"
-      });
-    }
-  });
-  const unlinkAccountMutation = reactQuery.useMutation({
-    mutationFn: async (providerId) => {
-      const result = await index.client.dash.unlinkAccount(
-        { providerId },
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (result.error)
-        throw new Error(result.error.message ?? "Failed to unlink account");
-    },
-    onSuccess: () => {
-      setConfirmUnlinkAccountId(null);
-      qc.invalidateQueries({ queryKey: ["dash-user", userId] });
-      toggleNotification({ type: "success", message: "Account unlinked" });
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Failed to unlink account"
-      });
-    }
-  });
-  const revokeAllMutation = reactQuery.useMutation({
-    mutationFn: async () => {
-      const result = await index.client.dash.sessions.revokeAll(
-        { userId },
-        useModelSchema.withContext({}, index.getAuthHeaders())
-      );
-      if (result.error)
-        throw new Error(result.error.message ?? "Revoke failed");
-      return result.data;
-    },
-    onSuccess: () => {
-      setConfirmRevokeAll(false);
-      toggleNotification({ type: "success", message: "All sessions revoked" });
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Failed to revoke sessions"
-      });
-    }
-  });
-  const sendVerificationMutation = reactQuery.useMutation({
-    mutationFn: async () => {
-      if (!emailCallbackUrl) {
-        throw new Error(
-          "Set `email_callback_url` in the better-auth-dashboard plugin config to enable this action."
-        );
-      }
-      const result = await index.client.dash.sendVerificationEmail(
-        { callbackUrl: emailCallbackUrl },
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (result.error) throw new Error(result.error.message ?? "Failed");
-      return result.data;
-    },
-    onSuccess: () => {
-      toggleNotification({
-        type: "success",
-        message: "Verification email sent"
-      });
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Failed to send email"
-      });
-    }
-  });
-  const sendResetPasswordMutation = reactQuery.useMutation({
-    mutationFn: async () => {
-      if (!emailCallbackUrl) {
-        throw new Error(
-          "Set `email_callback_url` in the better-auth-dashboard plugin config to enable this action."
-        );
-      }
-      const result = await index.client.dash.sendResetPasswordEmail(
-        { callbackUrl: emailCallbackUrl },
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (result.error) throw new Error(result.error.message ?? "Failed");
-      return result.data;
-    },
-    onSuccess: () => {
-      toggleNotification({
-        type: "success",
-        message: "Password reset email sent"
-      });
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Failed to send email"
-      });
-    }
-  });
-  const enableTwoFactorMutation = reactQuery.useMutation({
-    mutationFn: async () => {
-      const result = await index.client.dash.enableTwoFactor(
-        {},
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (result.error)
-        throw new Error(result.error.message ?? "Failed to enable 2FA");
-      return result.data;
-    },
-    onSuccess: (data) => {
-      if (data) setTwoFactorData(data);
-      qc.invalidateQueries({ queryKey: ["dash-user", userId] });
-      toggleNotification({
-        type: "success",
-        message: "Two-factor authentication enabled"
-      });
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Failed to enable 2FA"
-      });
-    }
-  });
-  const disableTwoFactorMutation = reactQuery.useMutation({
-    mutationFn: async () => {
-      const result = await index.client.dash.disableTwoFactor(
-        {},
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (result.error)
-        throw new Error(result.error.message ?? "Failed to disable 2FA");
-      return result.data;
-    },
-    onSuccess: () => {
-      setConfirmDisable2FA(false);
-      setTwoFactorData(null);
-      setTotpUriData(null);
-      setBackupCodesData(null);
-      qc.invalidateQueries({ queryKey: ["dash-user", userId] });
-      toggleNotification({
-        type: "success",
-        message: "Two-factor authentication disabled"
-      });
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Failed to disable 2FA"
-      });
-    }
-  });
-  const viewTotpUriMutation = reactQuery.useMutation({
-    mutationFn: async () => {
-      const result = await index.client.dash.viewTwoFactorTotpUri(
-        {},
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (result.error)
-        throw new Error(result.error.message ?? "Failed to load TOTP URI");
-      return result.data;
-    },
-    onSuccess: (data) => {
-      if (data) {
-        setTotpUriData(data);
-        setShowTotpModal(true);
-      }
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Failed to load TOTP URI"
-      });
-    }
-  });
-  const viewBackupCodesMutation = reactQuery.useMutation({
-    mutationFn: async () => {
-      const result = await index.client.dash.viewBackupCodes(
-        {},
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (result.error)
-        throw new Error(result.error.message ?? "Failed to load backup codes");
-      return result.data;
-    },
-    onSuccess: (data) => {
-      if (data) {
-        setBackupCodesData(data.backupCodes);
-        setShowBackupCodesModal(true);
-      }
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Failed to load backup codes"
-      });
-    }
-  });
-  const generateBackupCodesMutation = reactQuery.useMutation({
-    mutationFn: async () => {
-      const result = await index.client.dash.generateBackupCodes(
-        {},
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (result.error)
-        throw new Error(
-          result.error.message ?? "Failed to generate backup codes"
-        );
-      return result.data;
-    },
-    onSuccess: (data) => {
-      setConfirmRegenerateBackupCodes(false);
-      if (data) {
-        setBackupCodesData(data.backupCodes);
-        setShowBackupCodesModal(true);
-      }
-      toggleNotification({
-        type: "success",
-        message: "New backup codes generated"
-      });
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Failed to generate backup codes"
-      });
-    }
-  });
-  const hasEdits = editName !== void 0 || editEmail !== void 0 || editEmailVerified !== void 0 || editImage !== void 0 || Object.keys(editExtra).length > 0;
-  const customFields = Object.entries(schemaQuery.data ?? {}).filter(([name]) => !STANDARD_FIELDS.has(name)).map(([name, attribute]) => ({ name, attribute }));
-  const banExpiryPreview = banExpiresDays && !Number.isNaN(parseInt(banExpiresDays, 10)) ? new Date(
-    Date.now() + parseInt(banExpiresDays, 10) * 864e5
-  ).toLocaleDateString(void 0, {
-    weekday: "long",
-    year: "numeric",
-    month: "long",
-    day: "numeric"
-  }) : null;
-  const drawerTitle = /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 2, alignItems: "center", children: [
-    /* @__PURE__ */ jsxRuntime.jsx(Avatar.Avatar, { name: user?.name ?? "?", src: user?.image, size: 30 }),
-    /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { children: [
-      /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "beta", tag: "span", children: user?.name ?? "User" }),
-      user?.email && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: user.email }) })
-    ] }),
-    user?.banned && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { backgroundColor: "danger100", textColor: "danger600", children: "Banned" })
-  ] });
-  const profileFooter = activeTab === "profile" ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
-    /* @__PURE__ */ jsxRuntime.jsx(
-      designSystem.Button,
-      {
-        variant: "tertiary",
-        onClick: () => {
-          setEditName(void 0);
-          setEditEmail(void 0);
-          setEditEmailVerified(void 0);
-          setEditImage(void 0);
-          setEditExtra({});
-        },
-        children: "Discard"
-      }
-    ),
-    /* @__PURE__ */ jsxRuntime.jsx(
-      designSystem.Button,
-      {
-        disabled: !hasEdits,
-        loading: updateMutation.isLoading,
-        onClick: () => updateMutation.mutate(),
-        "data-testid": "save-user-btn",
-        children: "Save changes"
-      }
-    )
-  ] }) : void 0;
-  return /* @__PURE__ */ jsxRuntime.jsxs(
-    useModelSchema.Drawer,
-    {
-      title: drawerTitle,
-      footer: profileFooter,
-      onClose,
-      "data-testid": "user-detail-drawer",
-      children: [
-        userQuery.isLoading ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { justifyContent: "center", padding: 8, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { textColor: "neutral500", children: "Loading user…" }) }) : userQuery.isError ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Alert, { closeLabel: "Close", title: "Failed to load user", variant: "danger", children: userQuery.error instanceof Error ? userQuery.error.message : "An error occurred" }) : /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Tabs.Root, { defaultValue: "profile", onValueChange: setActiveTab, children: [
-          /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Tabs.List, { children: [
-            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Trigger, { value: "profile", children: "Profile" }),
-            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Trigger, { value: "security", children: "Security" }),
-            banEnabled && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Trigger, { value: "ban", children: "Ban" }),
-            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Trigger, { value: "sessions", children: "Sessions" }),
-            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Trigger, { value: "organizations", children: "Organizations" })
-          ] }),
-          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Content, { value: "profile", children: /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.EditLayout, { children: [
-            /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 5, children: [
-              /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
-                /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: "Personal information" }),
-                /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { style: { width: "100%" }, children: [
-                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Full name" }),
-                  /* @__PURE__ */ jsxRuntime.jsx(
-                    designSystem.TextInput,
-                    {
-                      value: displayName,
-                      onChange: (e) => setEditName(e.target.value),
-                      "data-testid": "user-name-input"
-                    }
-                  )
-                ] }),
-                /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { style: { width: "100%" }, children: [
-                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Email address" }),
-                  /* @__PURE__ */ jsxRuntime.jsx(
-                    designSystem.TextInput,
-                    {
-                      type: "email",
-                      value: displayEmail,
-                      onChange: (e) => setEditEmail(e.target.value)
-                    }
-                  )
-                ] }),
-                /* @__PURE__ */ jsxRuntime.jsx(
-                  designSystem.Checkbox,
-                  {
-                    checked: displayEmailVerified,
-                    onCheckedChange: (checked) => setEditEmailVerified(checked),
-                    children: "Mark email as verified"
-                  }
-                ),
-                /* @__PURE__ */ jsxRuntime.jsx(
-                  useModelSchema.MediaPickerField,
-                  {
-                    label: "Avatar URL",
-                    name: "image",
-                    value: displayImage,
-                    onChange: setEditImage,
-                    placeholder: "https://example.com/avatar.png",
-                    hint: "Optional — publicly accessible image URL"
-                  }
-                )
-              ] }),
-              /* @__PURE__ */ jsxRuntime.jsx(
-                useModelSchema.CustomFieldsSection,
-                {
-                  fields: customFields,
-                  data: extraData,
-                  onChange: handleExtraChange
-                }
-              )
-            ] }),
-            /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.EditSidebar, { children: [
-              /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
-                /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: "Details" }),
-                /* @__PURE__ */ jsxRuntime.jsxs(
-                  "div",
-                  {
-                    style: {
-                      display: "grid",
-                      gridTemplateColumns: "1fr 1fr",
-                      gap: 12
-                    },
-                    children: [
-                      /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.MetaItem, { style: { gridColumn: "1 / -1" }, children: [
-                        /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.MetaKey, { children: "User ID" }),
-                        /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.MonoChip, { children: user?.id })
-                      ] }),
-                      /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.MetaItem, { children: [
-                        /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.MetaKey, { children: "Created" }),
-                        /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.MetaVal, { children: user?.createdAt ? new Date(user.createdAt).toLocaleString() : "—" })
-                      ] }),
-                      /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.MetaItem, { children: [
-                        /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.MetaKey, { children: "Last updated" }),
-                        /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.MetaVal, { children: user?.updatedAt ? new Date(user.updatedAt).toLocaleString() : "—" })
-                      ] })
-                    ]
-                  }
-                )
-              ] }),
-              emailVerificationEnabled && /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { children: [
-                /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { style: { marginBottom: 10 }, children: "Email actions" }),
-                /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 2, children: [
-                  /* @__PURE__ */ jsxRuntime.jsx(
-                    designSystem.Button,
-                    {
-                      variant: "secondary",
-                      size: "S",
-                      loading: sendVerificationMutation.isLoading,
-                      disabled: !emailCallbackUrl || user?.emailVerified,
-                      onClick: () => sendVerificationMutation.mutate(),
-                      style: { width: "100%" },
-                      children: "Send verification email"
-                    }
-                  ),
-                  /* @__PURE__ */ jsxRuntime.jsx(
-                    designSystem.Button,
-                    {
-                      variant: "secondary",
-                      size: "S",
-                      loading: sendResetPasswordMutation.isLoading,
-                      disabled: !emailCallbackUrl,
-                      onClick: () => sendResetPasswordMutation.mutate(),
-                      style: { width: "100%" },
-                      children: "Send password reset"
-                    }
-                  ),
-                  !settingsQuery.isLoading && !emailCallbackUrl && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: "Set `email_callback_url` in the better-auth-dashboard plugin config to enable these actions." })
-                ] })
-              ] }),
-              /* @__PURE__ */ jsxRuntime.jsx(
-                useModelSchema.EditViewSidePanels,
-                {
-                  model: "plugin::better-auth.user",
-                  documentId: strapiUserQuery.data?.documentId,
-                  document: strapiUserQuery.data ?? void 0
-                }
-              )
-            ] })
-          ] }) }),
-          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Content, { value: "security", children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 5, paddingTop: 6, children: [
-            /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
-              /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: "Password" }),
-              /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { hint: "The user will be able to sign in with this new password", children: [
-                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "New password" }),
-                /* @__PURE__ */ jsxRuntime.jsx(
-                  designSystem.TextInput,
-                  {
-                    type: "password",
-                    value: newPassword,
-                    onChange: (e) => setNewPassword(e.target.value),
-                    placeholder: "Enter a strong password…"
-                  }
-                ),
-                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Hint, {})
-              ] }),
-              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { children: /* @__PURE__ */ jsxRuntime.jsx(
-                designSystem.Button,
-                {
-                  disabled: !newPassword,
-                  loading: passwordMutation.isLoading,
-                  onClick: () => passwordMutation.mutate(),
-                  children: "Set password"
-                }
-              ) })
-            ] }),
-            /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
-              /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: "Linked accounts" }),
-              user?.account && user.account.length > 0 ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { direction: "column", gap: 2, children: user.account.map((acc) => /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.AccountRow, { children: [
-                /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.ProviderBadge, { children: acc.providerId }),
-                /* @__PURE__ */ jsxRuntime.jsx(
-                  designSystem.Button,
-                  {
-                    variant: "danger-light",
-                    size: "S",
-                    onClick: () => setConfirmUnlinkAccountId(acc.providerId),
-                    children: "Unlink"
-                  }
-                )
-              ] }, acc.id)) }) : /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: "No linked OAuth accounts." })
-            ] }),
-            twoFactorEnabled && /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
-              /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { justifyContent: "space-between", alignItems: "center", children: [
-                /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { style: { margin: 0 }, children: "Two-factor authentication" }),
-                /* @__PURE__ */ jsxRuntime.jsx(
-                  TwoFaChip,
-                  {
-                    $enabled: !!user?.twoFactorEnabled,
-                    children: user?.twoFactorEnabled ? "Enabled" : "Not enabled"
-                  }
-                )
-              ] }),
-              user?.twoFactorEnabled ? /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 2, children: [
-                /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.AccountRow, { children: [
-                  /* @__PURE__ */ jsxRuntime.jsxs(
-                    designSystem.Flex,
-                    {
-                      direction: "column",
-                      gap: 1,
-                      alignItems: "flex-start",
-                      children: [
-                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", fontWeight: "semiBold", children: "TOTP authenticator" }),
-                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: "View the URI and secret for this user's authenticator app." })
-                      ]
-                    }
-                  ),
-                  /* @__PURE__ */ jsxRuntime.jsx(
-                    designSystem.Button,
-                    {
-                      variant: "secondary",
-                      size: "S",
-                      loading: viewTotpUriMutation.isLoading,
-                      onClick: () => viewTotpUriMutation.mutate(),
-                      children: totpUriData ? "Refresh" : "View"
-                    }
-                  )
-                ] }),
-                /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.AccountRow, { children: [
-                  /* @__PURE__ */ jsxRuntime.jsxs(
-                    designSystem.Flex,
-                    {
-                      direction: "column",
-                      gap: 1,
-                      alignItems: "flex-start",
-                      children: [
-                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", fontWeight: "semiBold", children: "Backup codes" }),
-                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: "View or regenerate the user's recovery codes." })
-                      ]
-                    }
-                  ),
-                  /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 2, children: [
-                    /* @__PURE__ */ jsxRuntime.jsx(
-                      designSystem.Button,
-                      {
-                        variant: "secondary",
-                        size: "S",
-                        loading: viewBackupCodesMutation.isLoading,
-                        onClick: () => viewBackupCodesMutation.mutate(),
-                        children: backupCodesData ? "Refresh" : "View"
-                      }
-                    ),
-                    /* @__PURE__ */ jsxRuntime.jsx(
-                      designSystem.Button,
-                      {
-                        variant: "secondary",
-                        size: "S",
-                        onClick: () => setConfirmRegenerateBackupCodes(true),
-                        children: "Regenerate"
-                      }
-                    )
-                  ] })
-                ] }),
-                /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.DangerRow, { children: [
-                  /* @__PURE__ */ jsxRuntime.jsxs(
-                    designSystem.Flex,
-                    {
-                      direction: "column",
-                      gap: 1,
-                      alignItems: "flex-start",
-                      children: [
-                        /* @__PURE__ */ jsxRuntime.jsx(
-                          designSystem.Typography,
-                          {
-                            variant: "omega",
-                            fontWeight: "semiBold",
-                            textColor: "danger600",
-                            children: "Disable two-factor authentication"
-                          }
-                        ),
-                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "danger500", children: "The user will no longer need a second factor to sign in." })
-                      ]
-                    }
-                  ),
-                  /* @__PURE__ */ jsxRuntime.jsx(
-                    designSystem.Button,
-                    {
-                      variant: "danger-light",
-                      size: "S",
-                      onClick: () => setConfirmDisable2FA(true),
-                      children: "Disable 2FA"
-                    }
-                  )
-                ] })
-              ] }) : /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 2, children: [
-                twoFactorData && /* @__PURE__ */ jsxRuntime.jsxs(
-                  designSystem.Flex,
-                  {
-                    direction: "column",
-                    gap: 3,
-                    style: { padding: "2px 4px" },
-                    children: [
-                      /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: "Scan the TOTP URI with an authenticator app, or enter the secret key manually." }),
-                      /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { children: [
-                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "TOTP URI" }),
-                        /* @__PURE__ */ jsxRuntime.jsx(ReadOnlyCodeInput, { children: twoFactorData.totpURI })
-                      ] }),
-                      /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { children: [
-                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Secret key" }),
-                        /* @__PURE__ */ jsxRuntime.jsx(ReadOnlyCodeInput, { children: twoFactorData.secret })
-                      ] }),
-                      /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 2, children: [
-                        /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: "Backup codes" }),
-                        /* @__PURE__ */ jsxRuntime.jsx(BackupCodeGrid, { children: twoFactorData.backupCodes.map((code) => /* @__PURE__ */ jsxRuntime.jsx(BackupCodeItem, { children: code }, code)) })
-                      ] })
-                    ]
-                  }
-                ),
-                /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.AccountRow, { children: [
-                  /* @__PURE__ */ jsxRuntime.jsxs(
-                    designSystem.Flex,
-                    {
-                      direction: "column",
-                      gap: 1,
-                      alignItems: "flex-start",
-                      children: [
-                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", fontWeight: "semiBold", children: "Enable two-factor authentication" }),
-                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: "Add an extra layer of security to this account." })
-                      ]
-                    }
-                  ),
-                  /* @__PURE__ */ jsxRuntime.jsx(
-                    designSystem.Button,
-                    {
-                      size: "S",
-                      loading: enableTwoFactorMutation.isLoading,
-                      onClick: () => enableTwoFactorMutation.mutate(),
-                      children: "Enable 2FA"
-                    }
-                  )
-                ] })
-              ] })
-            ] })
-          ] }) }),
-          banEnabled && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Content, { value: "ban", children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { direction: "column", gap: 5, paddingTop: 6, children: user?.banned ? /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
-            /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: "Ban status" }),
-            /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.WarnCard, { children: [
-              /* @__PURE__ */ jsxRuntime.jsx(
-                designSystem.Typography,
-                {
-                  variant: "omega",
-                  fontWeight: "semiBold",
-                  textColor: "danger600",
-                  children: "This user is currently banned"
-                }
-              ),
-              user.banReason && /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Typography, { variant: "pi", textColor: "danger600", children: [
-                "Reason: ",
-                user.banReason
-              ] }),
-              user.banExpires ? /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Typography, { variant: "pi", textColor: "danger600", children: [
-                "Expires:",
-                " ",
-                new Date(user.banExpires).toLocaleDateString(
-                  void 0,
-                  {
-                    weekday: "long",
-                    year: "numeric",
-                    month: "long",
-                    day: "numeric"
-                  }
-                )
-              ] }) : /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "danger600", children: "Duration: Permanent" })
-            ] }),
-            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { children: /* @__PURE__ */ jsxRuntime.jsx(
-              designSystem.Button,
-              {
-                variant: "secondary",
-                onClick: () => setConfirmUnban(true),
-                children: "Lift ban"
-              }
-            ) })
-          ] }) : /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
-            /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: "Apply ban" }),
-            /* @__PURE__ */ jsxRuntime.jsxs(
-              designSystem.Field.Root,
-              {
-                hint: "Optional — will be shown to the user",
-                style: { width: "100%" },
-                children: [
-                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Reason" }),
-                  /* @__PURE__ */ jsxRuntime.jsx(
-                    designSystem.TextInput,
-                    {
-                      value: banReason,
-                      onChange: (e) => setBanReason(e.target.value),
-                      placeholder: "e.g. Violated terms of service"
-                    }
-                  ),
-                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Hint, {})
-                ]
-              }
-            ),
-            /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Grid.Root, { gap: 4, children: [
-              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 6, children: /* @__PURE__ */ jsxRuntime.jsxs(
-                designSystem.Field.Root,
-                {
-                  hint: "Leave empty for a permanent ban",
-                  style: { width: "100%" },
-                  children: [
-                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Duration (days)" }),
-                    /* @__PURE__ */ jsxRuntime.jsx(
-                      designSystem.TextInput,
-                      {
-                        type: "number",
-                        value: banExpiresDays,
-                        onChange: (e) => setBanExpiresDays(e.target.value),
-                        placeholder: "e.g. 30"
-                      }
-                    ),
-                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Hint, {})
-                  ]
-                }
-              ) }),
-              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 6, children: /* @__PURE__ */ jsxRuntime.jsx(
-                designSystem.Flex,
-                {
-                  direction: "column",
-                  justifyContent: "flex-end",
-                  style: { height: "100%", paddingBottom: 4 },
-                  children: /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.PreviewPill, { children: banExpiryPreview ? `⏱ Expires ${banExpiryPreview}` : "♾ Permanent ban" })
-                }
-              ) })
-            ] }),
-            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { children: /* @__PURE__ */ jsxRuntime.jsx(
-              designSystem.Button,
-              {
-                variant: "danger",
-                onClick: () => setConfirmBan(true),
-                children: "Ban user"
-              }
-            ) })
-          ] }) }) }),
-          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Content, { value: "sessions", children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 5, paddingTop: 6, children: [
-            /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
-              /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: "Session management" }),
-              /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.AccountRow, { children: [
-                /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 1, alignItems: "flex-start", children: [
-                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", fontWeight: "semiBold", children: "Revoke all sessions" }),
-                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: "Signs the user out immediately on all devices." })
-                ] }),
-                /* @__PURE__ */ jsxRuntime.jsx(
-                  designSystem.Button,
-                  {
-                    variant: "danger-light",
-                    size: "S",
-                    onClick: () => setConfirmRevokeAll(true),
-                    style: { flexShrink: 0 },
-                    children: "Revoke all"
-                  }
-                )
-              ] })
-            ] }),
-            /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
-              /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: "Active sessions" }),
-              sessionsQuery.isLoading ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { justifyContent: "center", padding: 4, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Loader, { children: "Loading sessions…" }) }) : (sessionsQuery.data ?? []).length === 0 ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: "No active sessions." }) : /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { direction: "column", gap: 2, alignItems: "stretch", children: (sessionsQuery.data ?? []).map((session) => /* @__PURE__ */ jsxRuntime.jsxs(SessionCard, { children: [
-                /* @__PURE__ */ jsxRuntime.jsxs(SessionMeta, { children: [
-                  /* @__PURE__ */ jsxRuntime.jsxs(
-                    designSystem.Flex,
-                    {
-                      gap: 2,
-                      alignItems: "center",
-                      style: { flexWrap: "wrap" },
-                      children: [
-                        session.ipAddress && /* @__PURE__ */ jsxRuntime.jsx(IpChip, { children: session.ipAddress }),
-                        /* @__PURE__ */ jsxRuntime.jsxs(TimestampText, { children: [
-                          "Created",
-                          " ",
-                          new Date(session.createdAt).toLocaleString(),
-                          " · Expires",
-                          " ",
-                          new Date(session.expiresAt).toLocaleString()
-                        ] })
-                      ]
-                    }
-                  ),
-                  session.userAgent && /* @__PURE__ */ jsxRuntime.jsx(AgentText, { children: session.userAgent })
-                ] }),
-                /* @__PURE__ */ jsxRuntime.jsx(
-                  designSystem.IconButton,
-                  {
-                    label: "Revoke session",
-                    onClick: () => setConfirmRevokeSessionId(String(session.id)),
-                    style: { flexShrink: 0 },
-                    children: /* @__PURE__ */ jsxRuntime.jsx(icons.Trash, {})
-                  }
-                )
-              ] }, session.documentId)) })
-            ] })
-          ] }) }),
-          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Content, { value: "organizations", children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { direction: "column", gap: 5, paddingTop: 6, children: /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
-            /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: "Memberships" }),
-            orgsQuery.isLoading ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { textColor: "neutral500", children: "Loading…" }) : (orgsQuery.data ?? []).length === 0 ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: "Not a member of any organizations." }) : /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { direction: "column", gap: 2, children: (orgsQuery.data ?? []).map(
-              (org) => org ? /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.AccountRow, { children: /* @__PURE__ */ jsxRuntime.jsxs(
-                designSystem.Flex,
-                {
-                  direction: "column",
-                  gap: 1,
-                  alignItems: "flex-start",
-                  children: [
-                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", fontWeight: "semiBold", children: org.name }),
-                    /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 2, alignItems: "center", children: [
-                      /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.RoleBadge, { $role: org.role, children: org.role }),
-                      org.teams.length > 0 && /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: [
-                        org.teams.length,
-                        " team",
-                        org.teams.length !== 1 ? "s" : ""
-                      ] })
-                    ] })
-                  ]
-                }
-              ) }, org.id) : null
-            ) })
-          ] }) }) })
-        ] }),
-        confirmRevokeAll && /* @__PURE__ */ jsxRuntime.jsx(
-          useModelSchema.ConfirmDialog,
-          {
-            title: "Revoke all sessions",
-            message: "Are you sure you want to revoke all sessions for this user? They will be signed out on all devices.",
-            confirmLabel: "Revoke all",
-            loading: revokeAllMutation.isLoading,
-            onConfirm: () => revokeAllMutation.mutate(),
-            onCancel: () => setConfirmRevokeAll(false)
-          }
-        ),
-        confirmRevokeSessionId && /* @__PURE__ */ jsxRuntime.jsx(
-          useModelSchema.ConfirmDialog,
-          {
-            title: "Revoke session",
-            message: "Are you sure you want to revoke this session? The user will be signed out on this device.",
-            confirmLabel: "Revoke",
-            loading: revokeSessionMutation.isLoading,
-            onConfirm: () => revokeSessionMutation.mutate(confirmRevokeSessionId),
-            onCancel: () => setConfirmRevokeSessionId(null)
-          }
-        ),
-        confirmBan && /* @__PURE__ */ jsxRuntime.jsx(
-          useModelSchema.ConfirmDialog,
-          {
-            title: "Ban user",
-            message: banReason ? `Ban this user for the following reason: "${banReason}"? They will be prevented from signing in.` : "Are you sure you want to ban this user? They will be prevented from signing in.",
-            confirmLabel: "Ban user",
-            variant: "danger",
-            loading: banMutation.isLoading,
-            onConfirm: () => banMutation.mutate(),
-            onCancel: () => setConfirmBan(false)
-          }
-        ),
-        confirmUnban && /* @__PURE__ */ jsxRuntime.jsx(
-          useModelSchema.ConfirmDialog,
-          {
-            title: "Lift ban",
-            message: "Are you sure you want to lift the ban on this user? They will be able to sign in again.",
-            confirmLabel: "Lift ban",
-            variant: "default",
-            loading: unbanMutation.isLoading,
-            onConfirm: () => unbanMutation.mutate(),
-            onCancel: () => setConfirmUnban(false)
-          }
-        ),
-        confirmUnlinkAccountId && /* @__PURE__ */ jsxRuntime.jsx(
-          useModelSchema.ConfirmDialog,
-          {
-            title: "Unlink account",
-            message: `Are you sure you want to unlink the "${confirmUnlinkAccountId}" provider from this user?`,
-            confirmLabel: "Unlink",
-            loading: unlinkAccountMutation.isLoading,
-            onConfirm: () => unlinkAccountMutation.mutate(confirmUnlinkAccountId),
-            onCancel: () => setConfirmUnlinkAccountId(null)
-          }
-        ),
-        confirmDisable2FA && /* @__PURE__ */ jsxRuntime.jsx(
-          useModelSchema.ConfirmDialog,
-          {
-            title: "Disable two-factor authentication",
-            message: "Are you sure you want to disable 2FA for this user? They will no longer need a second factor to sign in.",
-            confirmLabel: "Disable 2FA",
-            loading: disableTwoFactorMutation.isLoading,
-            onConfirm: () => disableTwoFactorMutation.mutate(),
-            onCancel: () => setConfirmDisable2FA(false)
-          }
-        ),
-        confirmRegenerateBackupCodes && /* @__PURE__ */ jsxRuntime.jsx(
-          useModelSchema.ConfirmDialog,
-          {
-            title: "Regenerate backup codes",
-            message: "This will invalidate all existing backup codes. New codes will be shown once after generation. Are you sure?",
-            confirmLabel: "Regenerate",
-            loading: generateBackupCodesMutation.isLoading,
-            onConfirm: () => generateBackupCodesMutation.mutate(),
-            onCancel: () => setConfirmRegenerateBackupCodes(false)
-          }
-        ),
-        showTotpModal && totpUriData && /* @__PURE__ */ jsxRuntime.jsx(
-          designSystem.Modal.Root,
-          {
-            defaultOpen: true,
-            onOpenChange: (open) => !open && setShowTotpModal(false),
-            children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Modal.Content, { children: [
-              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Header, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "beta", tag: "h2", children: "TOTP authenticator" }) }),
-              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Body, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 4, children: [
-                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", textColor: "neutral600", children: "Share these details with the user to set up their authenticator app." }),
-                /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { children: [
-                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "TOTP URI" }),
-                  /* @__PURE__ */ jsxRuntime.jsx(ReadOnlyCodeInput, { children: totpUriData.totpURI })
-                ] }),
-                /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { children: [
-                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Secret key" }),
-                  /* @__PURE__ */ jsxRuntime.jsx(ReadOnlyCodeInput, { children: totpUriData.secret })
-                ] })
-              ] }) }),
-              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Footer, { children: /* @__PURE__ */ jsxRuntime.jsx(
-                designSystem.Button,
-                {
-                  variant: "tertiary",
-                  onClick: () => setShowTotpModal(false),
-                  children: "Close"
-                }
-              ) })
-            ] })
-          }
-        ),
-        showBackupCodesModal && backupCodesData && /* @__PURE__ */ jsxRuntime.jsx(
-          designSystem.Modal.Root,
-          {
-            defaultOpen: true,
-            onOpenChange: (open) => !open && setShowBackupCodesModal(false),
-            children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Modal.Content, { children: [
-              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Header, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "beta", tag: "h2", children: "Backup codes" }) }),
-              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Body, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 4, children: [
-                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", textColor: "neutral600", children: "Each code can only be used once. Store them somewhere safe." }),
-                /* @__PURE__ */ jsxRuntime.jsx(BackupCodeGrid, { children: backupCodesData.map((code) => /* @__PURE__ */ jsxRuntime.jsx(BackupCodeItem, { children: code }, code)) })
-              ] }) }),
-              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Footer, { children: /* @__PURE__ */ jsxRuntime.jsx(
-                designSystem.Button,
-                {
-                  variant: "tertiary",
-                  onClick: () => setShowBackupCodesModal(false),
-                  children: "Close"
-                }
-              ) })
-            ] })
-          }
-        )
-      ]
-    }
-  );
-}
-const PAGE_SIZE = 25;
-const fadeUp = styled.keyframes`
-  from { opacity: 0; transform: translateY(6px); }
-  to   { opacity: 1; transform: translateY(0); }
-`;
-const Wrap = styled__default.default.div`
-  padding: 28px 32px;
-  background: #f6f6f9;
-  min-height: 100%;
-  display: flex;
-  flex-direction: column;
-  gap: 20px;
-`;
-const PageHeader = styled__default.default.div`
-  display: flex;
-  justify-content: space-between;
-  align-items: flex-start;
-`;
-const TitleBlock = styled__default.default.div`
-  display: flex;
-  flex-direction: column;
-  gap: 4px;
-`;
-const PageTitle = styled__default.default.h1`
-  margin: 0;
-  font-size: 22px;
-  font-weight: 800;
-  color: #32324d;
-  letter-spacing: -0.03em;
-`;
-const PageSubtitle = styled__default.default.p`
-  margin: 0;
-  font-size: 12px;
-  color: #8e8ea9;
-`;
-const TableCard = styled__default.default.div`
-  background: #ffffff;
-  border: 1px solid #eaeaef;
-  border-radius: 10px;
-  overflow: hidden;
-`;
-const Table = styled__default.default.table`
-  width: 100%;
-  border-collapse: collapse;
-`;
-const TH = styled__default.default.th`
-  text-align: left;
-  padding: 10px 14px;
-  font-size: 10px;
-  font-weight: 700;
-  color: #8e8ea9;
-  text-transform: uppercase;
-  letter-spacing: 0.08em;
-  border-bottom: 1px solid #eaeaef;
-  background: #fafafa;
-  white-space: nowrap;
-  &:first-child { padding-left: 20px; }
-  &:last-child  { padding-right: 20px; }
-`;
-const THCheck = styled__default.default(TH)`
-  width: 44px;
-`;
-const THActions = styled__default.default(TH)`
-  width: 80px;
-`;
-const TD = styled__default.default.td`
-  padding: 11px 14px;
-  font-size: 12px;
-  color: #32324d;
-  border-bottom: 1px solid #f5f5f9;
-  vertical-align: middle;
-  &:first-child { padding-left: 20px; }
-  &:last-child  { padding-right: 20px; }
-`;
-const TDCheck = styled__default.default(TD)`
-  width: 44px;
-`;
-const TDActions = styled__default.default(TD)`
-  width: 80px;
-`;
-const TR = styled__default.default.tr`
-  animation: ${fadeUp} 280ms ease both;
-  animation-delay: ${(p) => (p.$i ?? 0) * 25}ms;
-  background: ${(p) => p.$selected ? "#f0f0ff" : "transparent"};
-  transition: background 120ms ease;
-  &:hover td { background: ${(p) => p.$selected ? "#e8e8ff" : "#fafafe"}; }
-  &:last-child td { border-bottom: none; }
-`;
-const StatusChip = styled__default.default.span`
-  display: inline-flex;
-  align-items: center;
-  gap: 4px;
-  padding: 2px 8px;
-  border-radius: 20px;
-  font-size: 10px;
-  font-weight: 700;
-  background: ${(p) => p.$variant === "verified" ? "#eafbe7" : p.$variant === "banned" ? "#fcecea" : "#f0f0ff"};
-  color: ${(p) => p.$variant === "verified" ? "#5cb176" : p.$variant === "banned" ? "#d02b20" : "#8e8ea9"};
-
-  &::before {
-    content: '';
-    display: inline-block;
-    width: 5px;
-    height: 5px;
-    border-radius: 50%;
-    background: ${(p) => p.$variant === "verified" ? "#5cb176" : p.$variant === "banned" ? "#d02b20" : "#b8b8c7"};
-  }
-`;
-const MonoText = styled__default.default.span`
-  font-family: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
-  font-size: 11px;
-  color: #8e8ea9;
-`;
-const DateText = styled__default.default.span`
-  font-size: 11px;
-  color: #b8b8c7;
-  font-variant-numeric: tabular-nums;
-`;
-const UserName = styled__default.default.span`
-  font-size: 12px;
-  font-weight: 600;
-  color: #32324d;
-`;
-const Toolbar = styled__default.default.div`
-  display: flex;
-  align-items: flex-end;
-  gap: 12px;
-`;
-function UsersPage({ config }) {
-  const rbac = admin.useRBAC(index.PERMISSIONS.user);
-  const qc = reactQuery.useQueryClient();
-  const { toggleNotification } = admin.useNotification();
-  const banEnabled = index.hasPlugin(config, "admin");
-  const emailVerificationEnabled = config.emailVerification.sendVerificationEmailEnabled;
-  const twoFactorEnabled = index.hasPlugin(config, "two-factor");
-  const [page, setPage] = react.useState(1);
-  const [search, setSearch] = react.useState("");
-  const [searchInput, setSearchInput] = react.useState("");
-  const [selected, setSelected] = react.useState(/* @__PURE__ */ new Set());
-  const [showCreate, setShowCreate] = react.useState(false);
-  const [detailUserId, setDetailUserId] = react.useState(null);
-  const [confirmDelete, setConfirmDelete] = react.useState(null);
-  const [confirmDeleteMany, setConfirmDeleteMany] = react.useState(false);
-  const [confirmBanMany, setConfirmBanMany] = react.useState(false);
-  const offset = (page - 1) * PAGE_SIZE;
-  const { data, isLoading, isError, error } = useUsers({
-    limit: PAGE_SIZE,
-    offset,
-    search: search || void 0
-  });
-  const users = data?.users ?? [];
-  const total = data?.total ?? 0;
-  const pageCount = Math.ceil(total / PAGE_SIZE);
-  const deleteMutation = reactQuery.useMutation({
-    mutationFn: async (userId) => {
-      const result = await index.client.dash.deleteUser(
-        {},
-        useModelSchema.withContext({ userId }, index.getAuthHeaders())
-      );
-      if (result.error)
-        throw new Error(result.error.message ?? "Delete failed");
-    },
-    onSuccess: () => {
-      setConfirmDelete(null);
-      qc.invalidateQueries({ queryKey: ["dash-users"] });
-      qc.invalidateQueries({ queryKey: ["dash-user-stats"] });
-      toggleNotification({ type: "success", message: "User deleted" });
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Failed to delete user"
-      });
-    }
-  });
-  const deleteManyMutation = reactQuery.useMutation({
-    mutationFn: async (userIds) => {
-      const result = await index.client.dash.deleteManyUsers(
-        {},
-        useModelSchema.withContext({ userIds }, index.getAuthHeaders())
-      );
-      if (result.error)
-        throw new Error(result.error.message ?? "Delete failed");
-      return result.data;
-    },
-    onSuccess: (_data, userIds) => {
-      setConfirmDeleteMany(false);
-      setSelected(/* @__PURE__ */ new Set());
-      qc.invalidateQueries({ queryKey: ["dash-users"] });
-      qc.invalidateQueries({ queryKey: ["dash-user-stats"] });
-      toggleNotification({
-        type: "success",
-        message: `${userIds.length} user${userIds.length !== 1 ? "s" : ""} deleted`
-      });
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Failed to delete users"
-      });
-    }
-  });
-  const banManyMutation = reactQuery.useMutation({
-    mutationFn: async (userIds) => {
-      const result = await index.client.dash.banManyUsers(
-        {},
-        useModelSchema.withContext({ userIds }, index.getAuthHeaders())
-      );
-      if (result.error) throw new Error(result.error.message ?? "Ban failed");
-      return result.data;
-    },
-    onSuccess: (_data, userIds) => {
-      setConfirmBanMany(false);
-      setSelected(/* @__PURE__ */ new Set());
-      qc.invalidateQueries({ queryKey: ["dash-users"] });
-      toggleNotification({
-        type: "success",
-        message: `${userIds.length} user${userIds.length !== 1 ? "s" : ""} banned`
-      });
-    },
-    onError: (err) => {
-      toggleNotification({
-        type: "danger",
-        message: err.message ?? "Failed to ban users"
-      });
-    }
-  });
-  const toggleSelect = (id) => {
-    setSelected((prev) => {
-      const next = new Set(prev);
-      if (next.has(id)) next.delete(id);
-      else next.add(id);
-      return next;
-    });
-  };
-  const allSelected = users.length > 0 && users.every((u) => selected.has(u.id));
-  const someSelected = selected.size > 0;
-  const handleSelectAll = () => {
-    if (allSelected) {
-      setSelected(/* @__PURE__ */ new Set());
-    } else {
-      setSelected(new Set(users.map((u) => u.id)));
-    }
-  };
-  const handleSearch = (e) => {
-    e.preventDefault();
-    setSearch(searchInput);
-    setPage(1);
-  };
-  return /* @__PURE__ */ jsxRuntime.jsxs(Wrap, { "data-testid": "users-page", children: [
-    /* @__PURE__ */ jsxRuntime.jsxs(PageHeader, { children: [
-      /* @__PURE__ */ jsxRuntime.jsxs(TitleBlock, { children: [
-        /* @__PURE__ */ jsxRuntime.jsx(PageTitle, { children: "Users" }),
-        /* @__PURE__ */ jsxRuntime.jsxs(PageSubtitle, { children: [
-          total.toLocaleString(),
-          " total",
-          data?.onlineUsers ? ` · ${data.onlineUsers} online` : ""
-        ] })
-      ] }),
-      rbac.allowedActions.canCreate && /* @__PURE__ */ jsxRuntime.jsx(
-        designSystem.Button,
-        {
-          startIcon: /* @__PURE__ */ jsxRuntime.jsx(icons.Plus, {}),
-          onClick: () => setShowCreate(true),
-          "data-testid": "create-user-btn",
-          children: "Create user"
-        }
-      )
-    ] }),
-    /* @__PURE__ */ jsxRuntime.jsxs(Toolbar, { children: [
-      /* @__PURE__ */ jsxRuntime.jsx(designSystem.SearchForm, { onSubmit: handleSearch, children: /* @__PURE__ */ jsxRuntime.jsx(
-        designSystem.Searchbar,
-        {
-          clearLabel: "Clear",
-          name: "search",
-          placeholder: "Search by email…",
-          value: searchInput,
-          onChange: (e) => setSearchInput(e.target.value),
-          onClear: () => {
-            setSearchInput("");
-            setSearch("");
-            setPage(1);
-          },
-          "data-testid": "user-search",
-          children: "Search users"
-        }
-      ) }),
-      someSelected && /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 2, children: [
-        rbac.allowedActions.canDelete && /* @__PURE__ */ jsxRuntime.jsxs(
-          designSystem.Button,
-          {
-            variant: "danger-light",
-            size: "S",
-            onClick: () => setConfirmDeleteMany(true),
-            "data-testid": "delete-selected-btn",
-            children: [
-              "Delete ",
-              selected.size,
-              " selected"
-            ]
-          }
-        ),
-        banEnabled && rbac.allowedActions.canUpdate && /* @__PURE__ */ jsxRuntime.jsxs(
-          designSystem.Button,
-          {
-            variant: "secondary",
-            size: "S",
-            onClick: () => setConfirmBanMany(true),
-            children: [
-              "Ban ",
-              selected.size,
-              " selected"
-            ]
-          }
-        )
-      ] })
-    ] }),
-    isError && /* @__PURE__ */ jsxRuntime.jsx("div", { style: { color: "#d02b20", fontSize: 12, padding: "8px 0" }, children: error?.message }),
-    /* @__PURE__ */ jsxRuntime.jsx(TableCard, { children: isLoading ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { justifyContent: "center", padding: 8, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Loader, { children: "Loading users…" }) }) : /* @__PURE__ */ jsxRuntime.jsxs(Table, { children: [
-      /* @__PURE__ */ jsxRuntime.jsx("thead", { children: /* @__PURE__ */ jsxRuntime.jsxs("tr", { children: [
-        (rbac.allowedActions.canDelete || rbac.allowedActions.canUpdate) && /* @__PURE__ */ jsxRuntime.jsx(THCheck, { children: /* @__PURE__ */ jsxRuntime.jsx(
-          designSystem.Checkbox,
-          {
-            checked: allSelected,
-            onCheckedChange: handleSelectAll,
-            "aria-label": "Select all"
-          }
-        ) }),
-        /* @__PURE__ */ jsxRuntime.jsx(TH, { children: "Name" }),
-        /* @__PURE__ */ jsxRuntime.jsx(TH, { children: "Email" }),
-        /* @__PURE__ */ jsxRuntime.jsx(TH, { children: "Status" }),
-        /* @__PURE__ */ jsxRuntime.jsx(TH, { children: "Created" }),
-        /* @__PURE__ */ jsxRuntime.jsx(THActions, {})
-      ] }) }),
-      /* @__PURE__ */ jsxRuntime.jsx("tbody", { children: users.length === 0 ? /* @__PURE__ */ jsxRuntime.jsx("tr", { children: /* @__PURE__ */ jsxRuntime.jsx(
-        TD,
-        {
-          colSpan: 6,
-          style: {
-            textAlign: "center",
-            padding: "40px",
-            color: "#8e8ea9"
-          },
-          "data-testid": "users-empty",
-          children: search ? `No users matching "${search}"` : "No users found"
-        }
-      ) }) : users.map((user, i) => /* @__PURE__ */ jsxRuntime.jsxs(
-        TR,
-        {
-          $selected: selected.has(user.id),
-          $i: i,
-          "data-testid": "user-row",
-          children: [
-            (rbac.allowedActions.canDelete || rbac.allowedActions.canUpdate) && /* @__PURE__ */ jsxRuntime.jsx(TDCheck, { children: /* @__PURE__ */ jsxRuntime.jsx(
-              designSystem.Checkbox,
-              {
-                checked: selected.has(user.id),
-                onCheckedChange: () => toggleSelect(user.id),
-                "aria-label": `Select ${user.name}`
-              }
-            ) }),
-            /* @__PURE__ */ jsxRuntime.jsx(TD, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { alignItems: "center", gap: 2, children: [
-              /* @__PURE__ */ jsxRuntime.jsx(
-                Avatar.Avatar,
-                {
-                  name: user.name ?? "",
-                  src: user.image,
-                  size: 28
-                }
-              ),
-              /* @__PURE__ */ jsxRuntime.jsx(UserName, { children: user.name })
-            ] }) }),
-            /* @__PURE__ */ jsxRuntime.jsx(TD, { children: /* @__PURE__ */ jsxRuntime.jsx(MonoText, { children: user.email }) }),
-            /* @__PURE__ */ jsxRuntime.jsx(TD, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 1, children: [
-              user.emailVerified ? /* @__PURE__ */ jsxRuntime.jsx(StatusChip, { $variant: "verified", children: "Verified" }) : /* @__PURE__ */ jsxRuntime.jsx(StatusChip, { $variant: "unverified", children: "Unverified" }),
-              user.banned && /* @__PURE__ */ jsxRuntime.jsx(StatusChip, { $variant: "banned", children: "Banned" })
-            ] }) }),
-            /* @__PURE__ */ jsxRuntime.jsx(TD, { children: /* @__PURE__ */ jsxRuntime.jsx(DateText, { children: new Date(user.createdAt).toLocaleDateString() }) }),
-            /* @__PURE__ */ jsxRuntime.jsx(TDActions, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 1, justifyContent: "flex-end", children: [
-              rbac.allowedActions.canUpdate && /* @__PURE__ */ jsxRuntime.jsx(
-                designSystem.IconButton,
-                {
-                  label: "Edit user",
-                  onClick: () => setDetailUserId(user.id),
-                  "data-testid": "edit-user-btn",
-                  children: /* @__PURE__ */ jsxRuntime.jsx(icons.Pencil, {})
-                }
-              ),
-              rbac.allowedActions.canDelete && /* @__PURE__ */ jsxRuntime.jsx(
-                designSystem.IconButton,
-                {
-                  label: "Delete user",
-                  onClick: () => setConfirmDelete(user.id),
-                  "data-testid": "delete-user-btn",
-                  children: /* @__PURE__ */ jsxRuntime.jsx(icons.Trash, {})
-                }
-              )
-            ] }) })
-          ]
-        },
-        user.id
-      )) })
-    ] }) }),
-    pageCount > 1 && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { justifyContent: "flex-end", children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 2, children: [
-      /* @__PURE__ */ jsxRuntime.jsx(
-        designSystem.Button,
-        {
-          variant: "tertiary",
-          size: "S",
-          disabled: page === 1,
-          onClick: () => setPage((p) => p - 1),
-          children: "Previous"
-        }
-      ),
-      /* @__PURE__ */ jsxRuntime.jsx(
-        designSystem.Button,
-        {
-          variant: "tertiary",
-          size: "S",
-          disabled: page >= pageCount,
-          onClick: () => setPage((p) => p + 1),
-          children: "Next"
-        }
-      )
-    ] }) }),
-    rbac.allowedActions.canCreate && showCreate && /* @__PURE__ */ jsxRuntime.jsx(CreateUserDialog, { onClose: () => setShowCreate(false) }),
-    rbac.allowedActions.canUpdate && detailUserId && /* @__PURE__ */ jsxRuntime.jsx(
-      UserDetailDrawer,
-      {
-        userId: detailUserId,
-        banEnabled,
-        emailVerificationEnabled,
-        twoFactorEnabled,
-        onClose: () => setDetailUserId(null)
-      }
-    ),
-    rbac.allowedActions.canDelete && confirmDelete && /* @__PURE__ */ jsxRuntime.jsx(
-      useModelSchema.ConfirmDialog,
-      {
-        title: "Delete user",
-        message: "Are you sure you want to delete this user? This action cannot be undone.",
-        confirmLabel: "Delete",
-        loading: deleteMutation.isLoading,
-        onConfirm: () => deleteMutation.mutate(confirmDelete),
-        onCancel: () => setConfirmDelete(null)
-      }
-    ),
-    rbac.allowedActions.canDelete && confirmDeleteMany && /* @__PURE__ */ jsxRuntime.jsx(
-      useModelSchema.ConfirmDialog,
-      {
-        title: `Delete ${selected.size} user${selected.size !== 1 ? "s" : ""}`,
-        message: `Are you sure you want to delete ${selected.size} user${selected.size !== 1 ? "s" : ""}? This action cannot be undone.`,
-        confirmLabel: "Delete all",
-        loading: deleteManyMutation.isLoading,
-        onConfirm: () => deleteManyMutation.mutate([...selected]),
-        onCancel: () => setConfirmDeleteMany(false)
-      }
-    ),
-    rbac.allowedActions.canUpdate && confirmBanMany && /* @__PURE__ */ jsxRuntime.jsx(
-      useModelSchema.ConfirmDialog,
-      {
-        title: `Ban ${selected.size} user${selected.size !== 1 ? "s" : ""}`,
-        message: `Are you sure you want to ban ${selected.size} user${selected.size !== 1 ? "s" : ""}? They will be prevented from signing in.`,
-        confirmLabel: "Ban all",
-        variant: "danger",
-        loading: banManyMutation.isLoading,
-        onConfirm: () => banManyMutation.mutate([...selected]),
-        onCancel: () => setConfirmBanMany(false)
-      }
-    )
-  ] });
-}
-function ProtectedUsersPage() {
-  const { data: config, isError, error } = index.useDashConfig();
-  if (isError) {
-    return /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { padding: 6, children: /* @__PURE__ */ jsxRuntime.jsx(
-      designSystem.Alert,
-      {
-        closeLabel: "Close",
-        title: "Error loading configuration",
-        variant: "danger",
-        children: error.message
-      }
-    ) });
-  }
-  if (!config) {
-    return /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { justifyContent: "center", alignItems: "center", padding: 12, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Loader, { children: "Loading user configuration…" }) });
-  }
-  return /* @__PURE__ */ jsxRuntime.jsx(
-    admin.Page.Protect,
-    {
-      permissions: index.PERMISSIONS.user.filter(
-        (p) => p.action === `plugin::${index.PLUGIN_ID}.user.read`
-      ),
-      children: /* @__PURE__ */ jsxRuntime.jsx(UsersPage, { config })
-    }
-  );
-}
-exports.UsersPage = UsersPage;
-exports.default = ProtectedUsersPage;