@terreno/mcp 0.21.0

package/src/docs/versioned/0.19.0/implementationPlans/admin-only.md

@@ -0,0 +1,616 @@
+# Admin-Only: Serve Admin SPA From a Terreno Backend (Opt-In)
+
+**Status:** Draft
+**Branch:** `admin-only`
+**Owner:** Josh Gachnang
+**Created:** 2026-05-11
+
+## Goal
+
+Let any Terreno backend opt-in to serving a pre-built admin SPA from the same Node process, eliminating the need for a separate static-site deploy to GCS / Netlify / Cloudflare Pages. The default backend image stays small (no React) — admin assets only ship in the npm tarball for consumers who actually want them.
+
+The embedded use case (admin screens inside the consumer's main Expo app, as `example-frontend/app/admin/*` does today) remains supported and unchanged.
+
+## Non-Goals
+
+- **SSR.** Admin is behind auth, no SEO benefit, and would drag the Expo runtime into backend containers.
+- **A breaking change to existing `/admin/*` API paths.** The SPA mounts at `/console` (configurable). The `AdminApp` plugin's `basePath` default is untouched. Path consolidation onto `/admin` is a future, opt-in migration.
+- **Standalone-consumable Expo Router subtree** for embedding into other apps. Deferred — complex with file-based routing.
+- **Legacy JWT/Passport auth in the standalone SPA.** Better-Auth only for v1.
+- **Tenant scoping in URLs** (e.g. `/console/{tenant}`). Consumer-owned via permissions.
+- **Bundle splitting**, brotli precompression, custom font subsetting. Defer to v2 perf pass.
+
+## Decisions
+
+| Question | Decision |
+|---|---|
+| SPA path | `/console` (configurable via `basePath` option). Non-breaking. |
+| Build | `bun expo export -p web --output-dir dist`, run in `prepublishOnly`. `dist/` ships in npm tarball. Build with **no** `experiments.baseUrl` — bundle is path-agnostic. |
+| Path-agnostic SPA | `AdminSpaServeApp` rewrites absolute `/_expo/` / `/assets/` references inside `dist/index.html` to `${basePath}/_expo/` / `${basePath}/assets/` once at boot (cached). One pre-built bundle works at any `basePath`. |
+| Auth | Better-Auth same-origin session cookies. Admin-spa calls `createAuthClient` from `better-auth/react` **directly** (no expo plugin — admin-spa is web-only). `basePath` passed in via app-config. |
+| Base URL resolution | New `__SAME_ORIGIN__` sentinel in `@terreno/rtk`. Resolves to `window.location.origin` at runtime. Sentinel check moves to the **top** of `resolveBaseUrls` (before the `!isDev` gate). |
+| Theming / branding | Runtime `GET ${basePath}/app-config.json` (absolute, not relative). Served by `AdminSpaServeApp` from constructor options. SPA fetches on boot. |
+| Asset caching | `_expo/` and `assets/` directories: `Cache-Control: public, max-age=31536000, immutable`. `index.html` and `app-config.json`: `Cache-Control: no-store`. |
+| Admin gate | Bundle is served to anyone; gating happens in-app (session check + `user.admin === true`). Non-admins see a "Forbidden" screen, not the login form. |
+| Navigation vs API base | `@terreno/admin-frontend` is refactored to accept **two** props — `apiBase` (where the JSON lives) and `routeBase` (where navigation points). Backward-compat: `baseUrl` is kept as a deprecated alias that defaults both. The embedded case keeps passing `baseUrl="/admin"` — both ends. The standalone SPA passes `apiBase="/admin"` + `routeBase=""` so `router.push` stays inside the SPA's own root. |
+| Express 5 wildcard syntax | Use `${basePath}/*splat` to match the existing convention in `api/src/betterAuthSetup.ts:215`. Register a separate `app.get(basePath, ...)` to handle the no-trailing-slash case without a redirect. |
+| Dev iteration | New `bun run admin-spa:dev` script runs `bun expo start --web --port 8083`. Backend in dev mode optionally proxies `/console/*` to `:8083` when `ADMIN_SPA_DEV_PROXY=http://localhost:8083` is set. Avoids 30–60s `expo export` per change. |
+
+## Architecture
+
+```
+                                 ┌──────────────────────────────────────────────────┐
+                                 │ Consumer's Terreno backend (one Node process)    │
+                                 │                                                  │
+ Browser ──── GET /console/  ──▶ │  AdminSpaServeApp                                │
+                                 │   └─ express.static(dist/_expo, immutable)       │
+                                 │   └─ express.static(dist/assets, immutable)      │
+                                 │   └─ GET /console/app-config.json  (no-store)    │
+                                 │   └─ GET /console/*  → dist/index.html (no-store)│
+                                 │                                                  │
+ Browser ──── GET /admin/config ▶│  AdminApp           (existing, unchanged)        │
+ Browser ──── POST /api/auth/* ─▶│  BetterAuthApp      (existing, unchanged)        │
+                                 └──────────────────────────────────────────────────┘
+```
+
+Same-origin everywhere → session cookies attach automatically, no CORS.
+
+## Package layout
+
+New workspace package `admin-spa/`:
+
+```
+admin-spa/
+  package.json                # bun workspace + dist/** in files
+  tsconfig.json               # two tsconfigs: one for app/, one for src/
+  tsconfig.server.json
+  biome.jsonc
+  bunfig.toml
+  app.json                    # Expo config — web.output:"static", extra.BASE_URL:"__SAME_ORIGIN__"
+  README.md
+  metro.config.js             # if needed for workspace monorepo resolution
+  babel.config.js
+  openapi-config.ts           # SDK codegen pointing at admin endpoints only
+  app/                        # Expo Router source (the SPA itself)
+    _layout.tsx
+    index.tsx                 # AdminModelList route
+    login.tsx                 # Better-Auth login
+    forbidden.tsx             # Non-admin landing
+    configuration.tsx
+    scripts.tsx
+    version-config.tsx
+    [model]/
+      _layout.tsx
+      index.tsx
+      [id].tsx
+      create.tsx
+  store/
+    index.ts                  # Redux store + persistor + better-auth slice
+    sdk.ts                    # Enhanced endpoints + tags
+    openApiSdk.ts             # Generated (gitignored)
+  components/
+    AppConfigGate.tsx         # Fetches /console/app-config.json, blocks until ready
+    AdminGate.tsx             # Session check + admin check; redirects to login or forbidden
+  src/                        # Backend-side code (the Express plugin)
+    index.ts
+    serve.ts
+    appConfig.ts              # AppConfig type + defaults
+    serve.test.ts
+  dist/                       # Pre-built static export (gitignored, populated at publish)
+```
+
+Two TypeScript projects: `app/` + `store/` + `components/` compile against Expo's RN web tsconfig, `src/` compiles to plain Node ESM for the Express plugin.
+
+## Files to Create / Modify
+
+### NEW — `admin-spa/` (full package)
+
+| File | Purpose |
+|---|---|
+| `admin-spa/package.json` | Workspace package. `name: "@terreno/admin-spa"`. `main: "./src/dist/index.js"` (server plugin). `exports`: `"."` → server, `"./serve"` → plugin alias, `"./dist/*"` → static bytes. `files: ["src/dist/**", "dist/**"]`. Scripts: `compile`, `dev`, `build:web`, `prepublishOnly`, `test`, `lint`. Dev deps mirror example-frontend; runtime deps are `@terreno/admin-frontend`, `@terreno/api` (peer), `@terreno/rtk`, `@terreno/ui`, `expo`, `expo-router`, `react`, `react-dom`, `react-native`, `react-native-web`, `react-redux`, `redux-persist`, `better-auth`. |
+| `admin-spa/tsconfig.json` | App-side TS config (extends Expo's TS preset). |
+| `admin-spa/tsconfig.server.json` | Server-side TS config for `src/*.ts` → `src/dist/*.js`. |
+| `admin-spa/biome.jsonc` | Mirror `admin-frontend/biome.jsonc`. |
+| `admin-spa/bunfig.toml` | Mirror `admin-frontend/bunfig.toml`. |
+| `admin-spa/app.json` | Expo config. `web: {bundler: "metro", output: "static"}`, `extra: {BASE_URL: "__SAME_ORIGIN__"}`, `scheme: "terreno-admin"`. |
+| `admin-spa/babel.config.js` | Match example-frontend. |
+| `admin-spa/metro.config.js` | Workspace resolution for monorepo. Match example-frontend. |
+| `admin-spa/openapi-config.ts` | Codegen against `http://localhost:4000/openapi.json` → `store/openApiSdk.ts`. Filtered to admin endpoints (`endpointFilter` for paths starting with `/admin`). |
+| `admin-spa/app/_layout.tsx` | Root. `<Provider><PersistGate><TerrenoProvider><AppConfigGate><AdminGate><Stack/></AdminGate></AppConfigGate></TerrenoProvider></PersistGate></Provider>`. |
+| `admin-spa/app/login.tsx` | Calls `authClient.signIn.email` + `<SocialLoginButton>` for each configured provider. Provider list is read from app-config.json. |
+| `admin-spa/app/forbidden.tsx` | "You must be an admin to access this page." + sign-out button. |
+| `admin-spa/app/index.tsx` | Wraps `<AdminModelList api={terrenoApi} baseUrl="/admin" />`. |
+| `admin-spa/app/[model]/_layout.tsx` | `<Stack/>` for model sub-routes. |
+| `admin-spa/app/[model]/index.tsx` | Wraps `<AdminModelTable />`. |
+| `admin-spa/app/[model]/[id].tsx` | Wraps `<AdminModelForm id={id} />`. |
+| `admin-spa/app/[model]/create.tsx` | Wraps `<AdminModelForm />` (no id). |
+| `admin-spa/app/configuration.tsx` | Wraps `<ConfigurationScreen />`. |
+| `admin-spa/app/scripts.tsx` | Wraps `<AdminScriptList />`. |
+| `admin-spa/app/version-config.tsx` | Wraps `<AdminVersionConfig />`. |
+| `admin-spa/store/index.ts` | `configureStore` + `generateBetterAuthSlice(authClient)` + persistor. |
+| `admin-spa/store/sdk.ts` | Re-exports `openapi` with custom endpoints + tag types. |
+| `admin-spa/components/AppConfigGate.tsx` | Fetches `${basePath}/app-config.json` on boot. Provides via React context. Blocks render until loaded. |
+| `admin-spa/components/AdminGate.tsx` | Reads `useSelectIsAuthenticated`. If unauth → redirect to `/login`. If auth but not admin → redirect to `/forbidden`. |
+| `admin-spa/src/index.ts` | Server-side entry. Exports `AdminSpaServeApp`, `AdminSpaAppConfig`. |
+| `admin-spa/src/serve.ts` | `AdminSpaServeApp implements TerrenoPlugin` — see below. |
+| `admin-spa/src/appConfig.ts` | `AdminSpaAppConfig` interface; default values. |
+| `admin-spa/src/serve.test.ts` | Supertest-driven tests for the plugin. |
+| `admin-spa/README.md` | Install, register, customize. |
+
+### MODIFIED — existing files
+
+| File | Change |
+|---|---|
+| `package.json` (root) | Add `"admin-spa"` to `workspaces` array. Add `admin-spa:*` scripts mirroring `admin-frontend:*`. |
+| `rtk/src/constants.ts` | Add `SAME_ORIGIN_SENTINEL = "__SAME_ORIGIN__"`. In `resolveBaseUrls`, if `baseFromExtra === SAME_ORIGIN_SENTINEL` and `typeof window !== "undefined"`, return `baseUrl: window.location.origin` (+ `wss:` for websockets). |
+| `rtk/src/constants.test.ts` | Add tests for the sentinel — both with and without `window`. |
+| `example-backend/src/server.ts` | Add `.register(new AdminSpaServeApp({basePath: "/console", appConfig: {brandName: "Terreno Example", primaryColor: "#7C3AED"}}))` — gated on `process.env.ADMIN_SPA_ENABLED === "true"` so we don't force-enable in tests. |
+| `example-backend/package.json` | Add `"@terreno/admin-spa": "workspace:*"` dep. |
+| `CLAUDE.local.md` | Add `admin-spa/` to packages list and example commands. |
+| `.claude/rules/admin-spa/00-admin-spa.md` (NEW via `rulesync`) | Package docs file for AI/dev rules — mirror `admin-frontend/00-admin-frontend.md` shape. |
+
+## Express plugin — `AdminSpaServeApp` shape
+
+```typescript
+// admin-spa/src/serve.ts
+import express from "express";
+import fs from "node:fs";
+import path from "node:path";
+import {fileURLToPath} from "node:url";
+import type {TerrenoPlugin} from "@terreno/api";
+import {logger} from "@terreno/api";
+import type {AdminSpaAppConfig} from "./appConfig";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const DIST_DIR = path.resolve(__dirname, "../../dist"); // src/dist/ -> ../../dist
+
+export interface AdminSpaServeOptions {
+  basePath?: string;              // default "/console"
+  appConfig?: AdminSpaAppConfig;  // brand name, logo URL, primary color, enabled providers
+  distDir?: string;               // override for tests / custom builds
+  /** In dev, proxy SPA paths to a running `expo start --web` server. e.g. "http://localhost:8083". */
+  devProxyTarget?: string;
+}
+
+export class AdminSpaServeApp implements TerrenoPlugin {
+  constructor(private readonly opts: AdminSpaServeOptions = {}) {}
+
+  register(app: express.Application): void {
+    const basePath = this.opts.basePath ?? "/console";
+    const distDir = this.opts.distDir ?? DIST_DIR;
+    const appConfig: AdminSpaAppConfig = {
+      brandName: "Terreno Admin",
+      primaryColor: "#2563EB",
+      providers: ["email"],
+      ...this.opts.appConfig,
+    };
+
+    // 0. Dev proxy short-circuit. Forwards everything under basePath to `expo start --web`.
+    if (this.opts.devProxyTarget) {
+      const {createProxyMiddleware} = require("http-proxy-middleware");
+      app.use(basePath, createProxyMiddleware({
+        target: this.opts.devProxyTarget,
+        changeOrigin: true,
+        pathRewrite: {[`^${basePath}`]: ""},
+        ws: true,
+      }));
+      // app-config still served by the plugin so the dev SPA reads it from the same path.
+      app.get(`${basePath}/app-config.json`, (_req, res) => {
+        res.set("Cache-Control", "no-store").json(appConfig);
+      });
+      logger.info(`Admin SPA dev-proxied to ${this.opts.devProxyTarget} at ${basePath}/`);
+      return;
+    }
+
+    // Read index.html once and rewrite absolute /_expo/ and /assets/ refs to ${basePath}/_expo/...
+    // Lets the same pre-built bundle be served from any basePath without rebuilding.
+    const rawIndex = fs.readFileSync(path.join(distDir, "index.html"), "utf-8");
+    const indexHtml = rawIndex
+      .replaceAll('href="/_expo/', `href="${basePath}/_expo/`)
+      .replaceAll('src="/_expo/', `src="${basePath}/_expo/`)
+      .replaceAll('href="/assets/', `href="${basePath}/assets/`)
+      .replaceAll('src="/assets/', `src="${basePath}/assets/`);
+
+    // 1. Hashed asset directories — long cache, immutable.
+    const staticOpts = {immutable: true, maxAge: "365d" as const};
+    app.use(`${basePath}/_expo`, express.static(path.join(distDir, "_expo"), staticOpts));
+    app.use(`${basePath}/assets`, express.static(path.join(distDir, "assets"), staticOpts));
+
+    // 2. Runtime config — never cached.
+    app.get(`${basePath}/app-config.json`, (_req, res) => {
+      res.set("Cache-Control", "no-store");
+      res.json(appConfig);
+    });
+
+    // 3. SPA fallback. Two registrations: bare basePath (no trailing slash) AND splat. Matches
+    // `api/src/betterAuthSetup.ts:215` convention (`/*name`, no braces).
+    const serveSpa = (_req: express.Request, res: express.Response): void => {
+      res.set("Cache-Control", "no-store").type("html").send(indexHtml);
+    };
+    app.get(basePath, serveSpa);
+    app.get(`${basePath}/*splat`, serveSpa);
+
+    logger.info(`Admin SPA mounted at ${basePath}/`);
+  }
+}
+```
+
+Path-agnostic plumbing: assets are emitted by Expo at absolute `/_expo/...` and `/assets/...`. We don't pass `experiments.baseUrl` at build time (that would bake the path into the bundle). Instead the plugin rewrites the asset URLs in `index.html` once at boot. The hashed JS files don't need rewriting because they reference each other via relative-to-bundle imports, not absolute roots. **Phase 1 acceptance must grep `dist/index.html` for `_expo` paths and confirm this assumption.** If Expo Router 6 changes asset-reference format (e.g. emits `<link rel="modulepreload" href="...">` differently), the rewrite list must grow.
+
+Express 5 wildcard: matches the repo convention (`/*name`, no braces). Two registrations needed because `/*splat` on its own does NOT match `GET /console` without a trailing slash — Express 5 would otherwise redirect.
+
+## Same-origin BASE_URL — `@terreno/rtk` patch
+
+`rtk/src/constants.ts:75` currently gates `baseFromExtra` behind `!isDev`, so a naive "check sentinel at the end" patch silently breaks the sentinel in dev mode. The sentinel check must run **before** the existing branching:
+
+```typescript
+// rtk/src/constants.ts (delta)
+export const SAME_ORIGIN_SENTINEL = "__SAME_ORIGIN__";
+
+export const resolveBaseUrls = (args: {
+  envApiUrl?: string;
+  expoConstants: ExpoConstantsShape;
+  isDev: boolean;
+  // NEW — defaults to globalThis.location.origin. Injectable for tests.
+  windowOrigin?: string;
+}): BaseUrls => {
+  const baseFromExtra = args.expoConstants.expoConfig?.extra?.BASE_URL;
+  const origin =
+    args.windowOrigin ??
+    (typeof globalThis !== "undefined" && (globalThis as {location?: Location}).location?.origin) ??
+    undefined;
+
+  // Sentinel: resolves at runtime to window.location.origin, regardless of isDev.
+  if (baseFromExtra === SAME_ORIGIN_SENTINEL && origin) {
+    const wsBase = origin.replace(/^http/, "ws");
+    return {baseUrl: origin, baseTasksUrl: `${origin}/tasks`, baseWebsocketsUrl: `${wsBase}/`};
+  }
+
+  // ...existing resolution unchanged (hostUri / experience / LOCALHOST fallback).
+};
+```
+
+- Sentinel + native (no `window`): falls through to existing resolution. Admin SPA is web-only — this is a safety net.
+- Module-level call passes `globalThis.location?.origin` with a `typeof` guard so it doesn't blow up under Bun/Jest.
+- Tests in `rtk/src/constants.test.ts`: sentinel + `https://api.example.com` origin → `baseUrl/wss`; sentinel + http origin → `ws`; sentinel + no window → fallback path; sentinel + isDev=true + window → still returns the origin (regression for the `!isDev` gate); non-sentinel BASE_URL → unchanged.
+
+## App-config endpoint
+
+Lives at `${basePath}/app-config.json`, served by `AdminSpaServeApp`. Shape:
+
+```typescript
+// admin-spa/src/appConfig.ts
+export interface AdminSpaAppConfig {
+  /** Brand name shown in header (default: "Terreno Admin") */
+  brandName: string;
+  /** Logo asset URL (absolute or relative; optional) */
+  logoUrl?: string;
+  /** Primary brand color (hex). Default: "#2563EB". */
+  primaryColor: string;
+  /** Enabled login providers. Drives login screen rendering. */
+  providers: ReadonlyArray<"email" | "google" | "github" | "apple">;
+  /** Base path of the better-auth routes on this same origin. Default: "/api/auth". */
+  authBasePath?: string;
+  /** Base path of admin API on this same origin. Default: "/admin". */
+  adminApiBasePath?: string;
+}
+```
+
+The SPA fetches this on boot (`AppConfigGate`), uses it to:
+- Set theme primaries.
+- Conditionally render `<SocialLoginButton provider="google" />` etc. on login.
+- Pass `adminApiBasePath` as `baseUrl` to admin-frontend components.
+- Build the better-auth client with `basePath: appConfig.authBasePath`.
+
+This lets one pre-built bundle work for any consumer without rebuild.
+
+## SDK generation
+
+`admin-spa/openapi-config.ts`:
+
+```typescript
+import type {ConfigFile} from "@rtk-query/codegen-openapi";
+
+const config: ConfigFile = {
+  apiFile: "@terreno/rtk",
+  apiImport: "emptySplitApi",
+  outputFile: "./store/openApiSdk.ts",
+  schemaFile: "http://localhost:4000/openapi.json",
+  hooks: true,
+  tag: true,
+  flattenArg: true,
+  filterEndpoints: [/^get.+Admin/i, /^post.+Admin/i, /^patch.+Admin/i, /^delete.+Admin/i],
+};
+export default config;
+```
+
+The filter narrows the generated hooks to admin endpoints. We still generate the file at build time so types stay correct, but the runtime cost is bound by admin-only endpoints.
+
+## Build / publish pipeline
+
+`admin-spa/package.json` scripts:
+
+```json
+{
+  "scripts": {
+    "compile": "tsc -p tsconfig.server.json",
+    "compile:watch": "tsc -p tsconfig.server.json -w",
+    "build:web": "bun expo export --platform web --output-dir dist",
+    "sdk": "bunx @rtk-query/codegen-openapi openapi-config.ts",
+    "prepublishOnly": "bun run sdk && bun run build:web && bun run compile",
+    "test": "bun test src/",
+    "test:ci": "bun run test",
+    "lint": "biome check ./src ./app ./store ./components",
+    "lint:fix": "biome check --write ./src ./app ./store ./components"
+  }
+}
+```
+
+- `dist/` is gitignored; included in npm tarball via `files: ["src/dist/**", "dist/**"]`.
+- `prepublishOnly` runs SDK gen, builds the SPA, compiles the server plugin. On a fresh checkout the consumer skips this — they pull a published tarball.
+
+## Consumer DX
+
+```typescript
+import {AdminSpaServeApp} from "@terreno/admin-spa";
+
+new TerrenoApp({userModel: User})
+  .register(new BetterAuthApp({config: betterAuthConfig, userModel: User}))
+  .register(new AdminApp({models: [...]}))
+  .register(new AdminSpaServeApp({
+    basePath: "/console",
+    appConfig: {
+      brandName: "Acme Admin",
+      logoUrl: "/static/logo.svg",
+      primaryColor: "#FF6B35",
+      providers: ["email", "google"],
+    },
+  }))
+  .start();
+```
+
+Open `https://api.acme.com/console/` → admin UI. Done.
+
+## Phases
+
+### Phase 0 — `@terreno/admin-frontend` API split (prerequisite — adversarial review fallout)
+Before any admin-spa work: refactor `AdminModelList`, `AdminModelTable`, `AdminModelForm`, etc. to accept `apiBase` and `routeBase` separately. Existing `baseUrl` prop is kept as deprecated alias that defaults both. Embedded consumers continue to work with no changes (they pass `baseUrl="/admin"` → both become `/admin`). The standalone SPA passes `apiBase="/admin"` + `routeBase=""` so `router.push(\`${routeBase}/${modelName}\`)` stays inside the SPA root.
+
+Tasks:
+- 0.1 Add `apiBase` + `routeBase` props to each admin-frontend component that currently accepts `baseUrl`. Internally: `const resolvedApiBase = apiBase ?? baseUrl; const resolvedRouteBase = routeBase ?? baseUrl;`. Use `resolvedApiBase` everywhere data is fetched and `resolvedRouteBase` for every `router.push` / `href` call. Files: `admin-frontend/src/AdminModelList.tsx`, `AdminModelTable.tsx`, `AdminModelForm.tsx`, `AdminRefField.tsx`, `AdminScriptList.tsx`, `AdminVersionConfig.tsx`, `ConfigurationScreen.tsx`, `useAdminConfig.tsx`, `useAdminApi.ts`.
+- 0.2 Update existing tests to keep using `baseUrl` (alias path) — verify backward compat.
+- 0.3 Add a focused test in admin-frontend that asserts `router.push` is called with the `routeBase`-prefixed path when both props are passed independently.
+- 0.4 Verify `example-frontend` (embedded admin) still compiles and renders unchanged.
+
+### Phase 1 — Scaffold the package (foundation)
+Create the empty `admin-spa/` workspace, wire it into root `package.json`, get `bun install` + `bun run compile` green. Smallest-possible Expo Router app that exports successfully.
+
+Tasks:
+- 1.1 Create `admin-spa/package.json` (runtime deps: `@terreno/admin-frontend`, `@terreno/rtk`, `@terreno/ui`, `expo`, `expo-router`, `expo-constants`, `expo-font`, `react`, `react-dom`, `react-native`, `react-native-web`, `react-native-screens`, `react-native-safe-area-context`, `react-redux`, `redux-persist`, `@reduxjs/toolkit`, `@react-native-async-storage/async-storage`, `better-auth`; peer dep `@terreno/api`; runtime dep `http-proxy-middleware` for the dev proxy; dev deps mirror `example-frontend`). Add `tsconfig.json`, `tsconfig.server.json`, `biome.jsonc`, `bunfig.toml`, `app.json` (with `web.output: "static"`, `extra.BASE_URL: "__SAME_ORIGIN__"`, **no** `experiments.baseUrl`), `babel.config.js`. **No `expo-secure-store`** — admin-spa is web-only.
+- 1.2 Copy `example-frontend/metro.config.js` to `admin-spa/`, adjust `monorepoPackages` to include `@terreno/admin-frontend` (already there) and exclude `@terreno/api`, `express`, anything backend-only via `backendOnlyModules`.
+- 1.3 Add `"admin-spa"` to root `workspaces`. Add `admin-spa:compile`, `admin-spa:lint`, `admin-spa:test`, `admin-spa:build`, `admin-spa:dev`, `admin-spa:sdk` scripts.
+- 1.4 Stub `src/index.ts` exporting `AdminSpaServeApp` (no-op `register`). Add `"type": "module"` to `admin-spa/package.json`. Verify `tsc -p tsconfig.server.json` produces `src/dist/index.js`.
+- 1.5 Stub `app/_layout.tsx` + `app/index.tsx` returning a "Hello admin" `Box`.
+- 1.6 Verify `bun run --filter '@terreno/admin-spa' build:web` succeeds and outputs `dist/index.html`. **Grep `dist/index.html` for `_expo` and verify the path prefix matches what `AdminSpaServeApp` rewrites** (`/_expo/` absolute). If Expo emits a different format, expand the rewrite list in `serve.ts` before Phase 3.
+
+### Phase 2 — Same-origin BASE_URL support (`@terreno/rtk`)
+The one change to an existing package.
+
+Tasks:
+- 2.1 Add `SAME_ORIGIN_SENTINEL` export and `windowOrigin` parameter to `resolveBaseUrls` in `rtk/src/constants.ts`.
+- 2.2 Wire the resolver call to read `globalThis.location?.origin`.
+- 2.3 Tests: sentinel + window (http → ws, https → wss), sentinel + no window (falls back), sentinel + dev mode + window, missing sentinel (unchanged behavior).
+- 2.4 Verify `bun run rtk:test` passes.
+
+### Phase 3 — Express plugin (`AdminSpaServeApp`)
+Backend-side serving + app-config endpoint. No SPA logic yet; serve a placeholder `index.html`.
+
+Tasks:
+- 3.1 Implement `src/appConfig.ts` (type + defaults).
+- 3.2 Implement `src/serve.ts` with static + `app-config.json` + SPA fallback.
+- 3.3 `src/serve.test.ts` — supertest cases:
+  - `GET /console/` returns 200 + HTML.
+  - `GET /console/users` returns 200 + same HTML (SPA fallback).
+  - `GET /console/_expo/hashed-asset.js` returns 200 with immutable cache header.
+  - `GET /console/app-config.json` returns 200 + provided config + `Cache-Control: no-store`.
+  - `GET /console/app-config.json` returns defaults when no config passed.
+  - With `basePath: "/admin-ui"` everything moves.
+  - Passing a `distDir` override works (use a tmpdir with stub files).
+- 3.4 `bun run admin-spa:test` passes.
+
+### Phase 4 — App-config gate, store creation, auth gate (UI plumbing)
+Ordering is critical: app-config drives the auth client config, which the Redux store depends on. So app-config must be loaded **before** the Redux Provider is mounted.
+
+Tasks:
+- 4.1 `components/AppConfigGate.tsx` — top-level component (above `<Provider>`). Fetches `${basePath}/app-config.json` using `window.location.pathname` to derive `basePath` (split on the first `/` after origin and take everything before the SPA-internal route). Falls back to the path the SPA is mounted at — exposes via a small helper. Provides config via React context, shows splash with `testID="admin-spa-app-config-loading"` while loading. Errors → retry button.
+- 4.2 `components/StoreProvider.tsx` (NEW — replaces the "factory function inside child" pattern from the prior draft) — child of `AppConfigGate`. Reads `useAppConfig()`. **Inside the component body** builds:
+  - `authClient = createAuthClient({baseURL: window.location.origin, basePath: appConfig.authBasePath ?? "/api/auth"})` (using `better-auth/react`'s `createAuthClient` **directly** — not the `@terreno/rtk` factory, because the Expo plugin is native-only).
+  - `{betterAuthReducer, middleware, selectors} = generateBetterAuthSlice(authClient)`.
+  - `store = configureStore(...)` + `persistor = persistStore(store)`.
+  - Memoizes these once and renders `<Provider store={store}><PersistGate loading={<Spinner/>} persistor={persistor}>{children}</PersistGate></Provider>`. The PersistGate **must** have a `loading` prop so children don't render with empty state during rehydration (admin gate would otherwise flash login screen).
+- 4.3 `components/AdminGate.tsx` — child of `StoreProvider`. Calls `authClient.getSession()` on mount. While loading → spinner with `testID="admin-spa-admin-gate-loading"`. Unauth + not on `/login` → `router.replace("/login")`. Auth + `user.admin !== true` and not on `/forbidden` → `router.replace("/forbidden")`. Auth + admin + on `/login` or `/forbidden` → `router.replace("/")`. Otherwise pass-through.
+- 4.4 `app/login.tsx` — `useAppConfig().providers`. Email/password form via `authClient.signIn.email`. Per non-`"email"` provider, `<SocialLoginButton onPress={() => authClient.signIn.social({provider})}>`. On success → `router.replace("/")`.
+- 4.5 `app/forbidden.tsx` — heading + sign-out button calling `authClient.signOut()` then `router.replace("/login")`.
+- 4.6 `app/_layout.tsx` — final assembly order: `<AppConfigGate><StoreProvider><TerrenoProvider><AdminGate><Stack/></AdminGate></TerrenoProvider></StoreProvider></AppConfigGate>`. (`AppConfigGate` outside because we can't build the store without the config. `StoreProvider` includes `Provider` + `PersistGate`. `TerrenoProvider` is inside Provider so its theme hooks work. `AdminGate` is innermost so it has full access to Redux + persisted state.)
+
+### Phase 5 — Wire the admin screens
+Drop in the existing admin-frontend components on the right routes. **All screens now pass `apiBase={appConfig.adminApiBasePath ?? "/admin"}` and `routeBase=""`** — navigation stays inside the SPA's own `/console` root.
+
+Tasks:
+- 5.1 `app/index.tsx` — `<AdminModelList api={terrenoApi} apiBase={apiBase} routeBase={routeBase} customScreens={[]} />`. Get `apiBase`/`routeBase` from `useAppConfig()`.
+- 5.2 `app/[model]/_layout.tsx`, `[model]/index.tsx`, `[model]/[id].tsx`, `[model]/create.tsx` — wire `AdminModelTable` / `AdminModelForm` using `useLocalSearchParams`. Sentinel-handle `__scripts` and `version-config` like example-frontend does — those route to `<AdminScriptList>` and `<AdminVersionConfig>` instead of the generic table.
+- 5.3 `app/configuration.tsx`, `app/scripts.tsx`, `app/version-config.tsx` — wrap the corresponding `@terreno/admin-frontend` screens.
+- 5.4 `app/+not-found.tsx` + `app/+html.tsx` (Expo Router conventions; `+html.tsx` carries `<meta>` viewport + favicon).
+
+### Phase 6 — SDK glue
+Most admin endpoints are injected at runtime by `admin-frontend/src/useAdminApi.ts` and `useAdminConfig.tsx` — they do NOT depend on `@rtk-query/codegen-openapi`. The codegen-filter scheme in the prior draft was theatre.
+
+Tasks:
+- 6.1 Commit a hand-written `store/sdk.ts` that re-exports `emptySplitApi as openapi` from `@terreno/rtk` and adds the tag types admin-frontend expects (`admin-models`, `admin-version-config`, `admin-scripts`, `profile`). Export a `terrenoApi` that admin-frontend components are passed.
+- 6.2 Optional `openapi-config.ts` for consumers who want generated types for their **own** non-admin endpoints (useful if admin-spa is ever extended with custom screens). Default is to ship without running codegen.
+- 6.3 Document the optional codegen workflow in README; do not bake it into `prepublishOnly`.
+
+### Phase 7 — Example backend integration
+Make `example-backend` demo the new flow.
+
+Tasks:
+- 7.1 Add dep to `example-backend/package.json`.
+- 7.2 Register `AdminSpaServeApp` in `example-backend/src/server.ts`, gated on `ADMIN_SPA_ENABLED=true`.
+- 7.3 Manual smoke test:
+  - Start backend with `ADMIN_SPA_ENABLED=true AUTH_PROVIDER=better-auth`.
+  - Visit `http://localhost:4000/console/` → login screen.
+  - Sign in with admin user → admin list shown.
+  - Click "Users" → users table loads from `/admin/users`.
+  - Click a user → form loads, edit, save, see toast.
+  - Verify `app-config.json` is served and bundle is cached.
+
+### Phase 8 — Docs, rules, CI
+Update repo-level docs and the publish pipeline.
+
+Tasks:
+- 8.1 `admin-spa/README.md`.
+- 8.2 Author `.claude/rules/admin-spa/00-admin-spa.md`. Run `bun run rules` to regenerate rulesync artifacts. Verify `bun run rules:check` passes in the same PR.
+- 8.3 Add `admin-spa:*` to `CLAUDE.local.md`.
+- 8.4 "Standalone admin SPA" subsection in `admin-backend/README.md` pointing at admin-spa.
+- 8.5 **Add an `admin-spa` publish job to `.github/workflows/publish-on-tag.yml`** mirroring the existing 8 publish jobs but running `bun run --filter '@terreno/admin-spa' build:web` (and `compile`) before `bun publish` so the `dist/` directory is populated in the tarball. Without this, tagged releases will publish an empty `dist/`.
+- 8.6 Add a CI smoke job (separate workflow or extension of existing E2E): boot `example-backend` with `ADMIN_SPA_ENABLED=true AUTH_PROVIDER=better-auth` and `bun run --filter '@terreno/admin-spa' build:web`; curl `/console/`, `/console/app-config.json`, and one `/console/_expo/static/js/web/*.js` asset; assert 200s with correct cache headers. Catches the path-rewrite logic in CI.
+
+### Phase 9 — E2E (optional, only if Phase 7 looks shaky)
+Playwright test that exercises the full flow against example-backend. Spec: `e2e/admin-spa.spec.ts`. testIDs to add: `admin-spa-login-email`, `admin-spa-login-submit`, `admin-spa-model-list-screen`, `admin-spa-users-row-{id}`. Defer if Phase 7 manual smoke is sufficient.
+
+## Files needing testIDs (added during Phase 4/5)
+
+| Component | testID |
+|---|---|
+| `AppConfigGate` loading screen | `admin-spa-app-config-loading` |
+| `AdminGate` loading screen | `admin-spa-admin-gate-loading` |
+| `login.tsx` email input | `admin-spa-login-email` |
+| `login.tsx` password input | `admin-spa-login-password` |
+| `login.tsx` submit button | `admin-spa-login-submit` |
+| `login.tsx` per-provider button | `admin-spa-login-{provider}` |
+| `forbidden.tsx` root | `admin-spa-forbidden-screen` |
+| `forbidden.tsx` sign-out button | `admin-spa-forbidden-signout` |
+| `app/index.tsx` root | `admin-spa-model-list-screen` |
+
+Existing `@terreno/admin-frontend` components already expose their own testIDs (verified in `admin-frontend/src/AdminModelList.test.tsx`).
+
+## Risks
+
+| Risk | Mitigation |
+|---|---|
+| **`baseUrl` overload in admin-frontend** — `AdminModelList.tsx:129`, `AdminModelTable.tsx:126,222,314` use `baseUrl` BOTH as API path AND as navigation path. SPA-at-`/console` + API-at-`/admin` breaks navigation. | Phase 0 splits the prop into `apiBase` + `routeBase` with `baseUrl` as a deprecated alias defaulting both. Embedded consumers unchanged. |
+| **`createBetterAuthClient` has no `basePath` param** — only takes `baseURL`/`scheme`/`storagePrefix`. Prior draft of Task 4.2 wouldn't compile. | Admin-spa is web-only, so we call `createAuthClient` from `better-auth/react` **directly** (no expo plugin) and pass `basePath` as a top-level option. |
+| **Expo `experiments.baseUrl` would make the bundle path-specific** — baking `/console` into the build means the configurable `basePath` is fiction. | Don't pass `experiments.baseUrl`. The `AdminSpaServeApp` rewrites the absolute `/_expo/` and `/assets/` URLs in `index.html` once at boot to match the configured `basePath`. One pre-built tarball works at any path. Phase 1.6 verifies the rewrite list covers all generated references. |
+| **Expo Router web export breaks under monorepo** (Metro resolution of workspace deps) | Copy `example-frontend/metro.config.js` and its `extraNodeModules`, `nodeModulesPaths`, `unstable_enableSymlinks` settings. Phase 1.2 explicitly clones the file. |
+| **Express 5 wildcard syntax** — Express 5 ships path-to-regexp v8; bare `*` is gone. | Use `${basePath}/*splat` (named splat, no braces) to match `api/src/betterAuthSetup.ts:215`. Register a separate `app.get(basePath, ...)` for the no-trailing-slash case to avoid a redirect. AC3 tests both `GET /console` and `GET /console/`. |
+| **`!isDev` gate in `rtk/src/constants.ts:75`** silently kills the sentinel in dev mode. | Move the sentinel check to the top of `resolveBaseUrls`, before any branching. Test for `isDev=true + sentinel + window` returning origin. |
+| **PersistGate hydration races AdminGate** — store starts empty → AdminGate runs → flashes login screen → rehydration completes. | `PersistGate` gets a `loading={<Spinner/>}` prop so children don't render until rehydration is done. Phase 4.2 codifies this. |
+| **`app-config.json` fetched relative breaks on deep refresh** — from `/console/users/abc`, `./app-config.json` becomes `/console/users/app-config.json` → falls through to SPA fallback → returns HTML → JSON.parse error. | Use an absolute `${basePath}/app-config.json` URL, derived by `AppConfigGate` from `window.location.pathname` at the SPA root. |
+| **`createBetterAuthClient` Expo plugin** stores tokens in SecureStore on native; web variant uses AsyncStorage; both go through the RN-targeted factory. The admin-spa is web-only and using the factory drags `expo-secure-store` into the bundle for no reason. | Call `createAuthClient` from `better-auth/react` directly in admin-spa; rely on better-auth's built-in browser session cookies (no client-side token storage needed). |
+| **Auth cookie SameSite / Secure flags** — production HTTPS only. | Same-origin → `SameSite=Lax` default works for both http://localhost and HTTPS. Document. |
+| **Cookie `Path=/` from better-auth** — verify the session cookie set at `/api/auth/login` is sent to `/admin/*` and `/console/*` requests on the same origin. Default is `Path=/`; assumed correct but not verified against `betterAuthSetup.ts:73-89`. | Phase 7.3 manual smoke verifies; add a `supertest` regression in `betterAuthSetup.test.ts` if it bites. |
+| **Stale `index.html` at the edge** after a redeploy | Plugin returns `Cache-Control: no-store` on HTML and `app-config.json`. CDN/proxy may still cache — document. |
+| **Bundle size** — admin-frontend pulls in jspdf, signature-canvas, markdown editor. Plan's "1–3 MB gzip" estimate is unverified. | Measure in Phase 1.6. If > 5 MB gzip, code-split deferred imports (`AdminScriptRunModal`, `ConsentFormEditor`, etc.) via React.lazy or Expo Router's per-route splitting. |
+| **`Constants.expoConfig?.extra?.BASE_URL` propagation in static export** — assumed yes, not verified. | Phase 1.6 adds: `bun run admin-spa:build` then `grep -r '__SAME_ORIGIN__' admin-spa/dist/` — must find the sentinel string in at least one bundle JS file. If not, switch to a different injection mechanism (e.g. `<script>window.__ADMIN_BASE__ = "${origin}"</script>` injected by the plugin). |
+| **CI publish job missing for admin-spa** | Phase 8.5 adds it to `.github/workflows/publish-on-tag.yml`. |
+| **No dev iteration story** — re-exporting on every change is 30–60s. | Phase 4 + serve plugin support a `devProxyTarget` option. Dev workflow: run `bun run admin-spa:dev` (= `bun expo start --web --port 8083`) + `ADMIN_SPA_DEV_PROXY=http://localhost:8083 bun run backend:dev`. |
+| **`@rtk-query/codegen-openapi` filter regex was theatre** — admin endpoints are injected at runtime by `useAdminApi.ts:47-104`, not generated. | Phase 6 drops the codegen filter; ships a hand-written `store/sdk.ts` instead. Optional codegen is documented but not part of the build. |
+| **`bun pm ls | grep` heuristic for AC9** is unreliable (transitive deps from other workspace packages can pollute results). | AC9 verifies by reading the consumer's resolved lockfile / running `bun install` in a stripped-down test fixture without `admin-spa` and confirming no `react-native-web` or `expo-router` entries. |
+
+## Acceptance Criteria
+
+Each criterion lists: **Setup**, **Steps**, **Expected**, and (where relevant) **testIDs** needed for automated runs.
+
+### AC1 — Static export builds clean (automated)
+- **Setup:** Phase 1 + 4 + 5 complete. `bun install` done.
+- **Steps:** Run `bun run --filter '@terreno/admin-spa' build:web` from repo root.
+- **Expected:** Exit code 0. `admin-spa/dist/index.html` exists and is non-empty. `admin-spa/dist/_expo/static/js/web/` contains at least one bundled `.js` file. No `error:` lines in output. No `Cannot find module` warnings.
+
+### AC2 — Same-origin BASE_URL sentinel works (automated)
+- **Setup:** Phase 2 complete.
+- **Steps:** Run `bun run rtk:test`.
+- **Expected:** Existing tests pass. New cases pass: sentinel + `https` origin → `baseUrl: "https://api.example.com"`, `baseWebsocketsUrl: "wss://api.example.com/"`; sentinel + `http` origin → `ws://...`; sentinel + no window → falls back to existing localhost resolution; non-sentinel BASE_URL → unchanged behavior.
+
+### AC3 — Plugin serves bundle and config (automated)
+- **Setup:** Phase 3 complete.
+- **Steps:** Run `bun run --filter '@terreno/admin-spa' test`.
+- **Expected:** Supertest cases pass: `GET /console/` → 200 + HTML + `Cache-Control: no-store`; `GET /console/users/abc` → same HTML; `GET /console/_expo/static/js/web/foo.abc123.js` → 200 + `Cache-Control: public, max-age=31536000, immutable`; `GET /console/app-config.json` → 200 + JSON + `Cache-Control: no-store`; defaults returned when no `appConfig` passed; provided `appConfig` overrides defaults field-by-field; custom `basePath` works; `GET /unrelated` → 404.
+
+### AC4 — Anonymous user lands on login (manual + E2E)
+- **Setup:** Backend running with `ADMIN_SPA_ENABLED=true AUTH_PROVIDER=better-auth`. SPA built.
+- **Steps:** Open browser to `http://localhost:4000/console/` in a fresh incognito window.
+- **Expected:** No flash of admin content. Login screen renders. Brand name from `app-config.json` is visible. Email + password fields present. URL navigates to `/console/login` after redirect.
+- **testIDs:** `admin-spa-login-email`, `admin-spa-login-password`, `admin-spa-login-submit`.
+
+### AC5 — Email/password sign-in succeeds for admin (manual + E2E)
+- **Setup:** Same as AC4. An admin user (`admin: true`) exists in DB.
+- **Steps:** Fill email + password. Click sign in.
+- **Expected:** Loading spinner during request. On success, redirects to `/console/`. Admin model list renders. `app-config.json` brand name appears in header. No console errors.
+- **testIDs:** `admin-spa-model-list-screen` after login.
+
+### AC6 — Non-admin user is forbidden (manual + E2E)
+- **Setup:** A user with `admin: false` exists.
+- **Steps:** Sign in as that user.
+- **Expected:** No admin model list shown. URL becomes `/console/forbidden`. "Admins only" message + sign-out button visible.
+- **testIDs:** `admin-spa-forbidden-screen`, `admin-spa-forbidden-signout`.
+
+### AC7 — CRUD round-trip on a model (manual)
+- **Setup:** Logged in as admin. At least one User exists.
+- **Steps:** From the model list, click "Users". Click a row. Edit the `name` field. Click save.
+- **Expected:** Form opens with current values. Saving shows success toast. Navigating back to the table reflects the new value. Page reload preserves the change (server-confirmed).
+
+### AC8 — Embedded admin still works (manual regression)
+- **Setup:** `example-frontend` running locally (`bun run frontend:web`) against the example-backend.
+- **Steps:** Log in as admin in the main app. Navigate to the existing `/admin` route inside the main Expo app.
+- **Expected:** No regression — the embedded admin screens render identically to before this branch. (Spot-check the model list, a model table, and a form.)
+
+### AC9 — Backend image stays small when admin-spa is not installed (manual / inspection)
+- **Setup:** A fresh consumer project that depends on `@terreno/api` but not `@terreno/admin-spa`.
+- **Steps:** `bun install`. Inspect `node_modules` for `react`, `react-dom`, `react-native-web`, `expo`, `expo-router`.
+- **Expected:** None of those packages appear in the consumer's resolved deps. (Verified by `bun pm ls 2>&1 | grep -E 'react-native-web|expo-router'` returning empty.)
+
+### AC10 — Default app-config returned when none provided (automated)
+- **Setup:** Plugin registered with no `appConfig` argument.
+- **Steps:** `GET /console/app-config.json`.
+- **Expected:** Returns `{brandName: "Terreno Admin", primaryColor: "#2563EB", providers: ["email"]}` (plus optional fields undefined).
+
+### AC11 — Provider list drives login UI (manual + E2E)
+- **Setup:** Plugin registered with `appConfig: {providers: ["email", "google"]}`.
+- **Steps:** Open login screen.
+- **Expected:** Email/password form + a Google `<SocialLoginButton>`. No GitHub or Apple buttons. With `providers: ["email", "google", "github", "apple"]`, all three social buttons render.
+- **testIDs:** `admin-spa-login-google`, `admin-spa-login-github`, `admin-spa-login-apple`.
+
+### AC12 — Sign-out clears session and returns to login (manual)
+- **Setup:** Logged in as admin, on model list screen.
+- **Steps:** Trigger sign-out (from the header menu or `/console/forbidden` if testing non-admin).
+- **Expected:** Session cookie cleared. Redirects to `/console/login`. Hitting `/console/` directly afterwards re-routes to login. (Verified by clearing devtools `Application > Cookies` shows the better-auth session cookie removed.)
+
+## Review Log (2026-05-11 / 2026-05-12)
+
+Adversarial review (Opus, fallback after codex CLI hit 401) found 5 verified CRITICAL issues against an earlier draft. All have been folded back into the plan above:
+
+1. **`baseUrl` is overloaded as nav + API in admin-frontend.** Verified at `AdminModelList.tsx:129`, `AdminModelTable.tsx:126,222,314`. → Added **Phase 0**: split `baseUrl` into `apiBase` + `routeBase`, with backward-compat alias.
+2. **`createBetterAuthClient` has no `basePath` prop.** Verified at `rtk/src/betterAuthClient.ts:91-105` + `betterAuthTypes.ts`. → Plan now uses `createAuthClient` from `better-auth/react` **directly** in admin-spa (web-only, no expo plugin).
+3. **Express 5 wildcard syntax was invented** (`{/*splat}`). Repo convention is `/*name` per `betterAuthSetup.ts:215`. → Updated `AdminSpaServeApp` to use `${basePath}/*splat` + a separate `app.get(basePath, ...)` for the no-slash case.
+4. **Expo Router emits absolute `/_expo/...` paths** in `dist/index.html` — without `experiments.baseUrl` they 404 when mounted at `/console`; WITH `experiments.baseUrl` the bundle becomes path-specific (contradicting "one tarball, any path"). → Don't pass `experiments.baseUrl`; have the plugin rewrite `/_expo/` and `/assets/` in `index.html` at boot.
+5. **`rtk/src/constants.ts:75` gates `baseFromExtra` behind `!isDev`** — sentinel would be silently dead in dev. → Sentinel check moves to the **top** of `resolveBaseUrls`, before all branching.
+
+Also folded in HIGH/MEDIUM findings:
+- Codegen `filterEndpoints` regex was theatre (admin endpoints are injected at runtime). Phase 6 now ships a hand-written sdk.ts.
+- PersistGate needs an explicit `loading` prop or AdminGate flashes login screen. Phase 4.2 codifies this.
+- `app-config.json` fetched with a relative URL breaks on deep refresh. Use absolute `${basePath}/app-config.json`.
+- Provider order: AppConfigGate must be **outside** Provider (the store is built using config). Phase 4 reorders.
+- Missing CI publish job → Phase 8.5.
+- Missing dev iteration story → `devProxyTarget` option + `admin-spa:dev` script.
+- Missing deps in package.json (`better-auth`, `@react-native-async-storage/async-storage`, `http-proxy-middleware`) — Task 1.1 enumerated.
+- `metro.config.js` workspace setup must be cloned from `example-frontend`, not handwaved — Task 1.2 explicit.
+
+## Out of Scope (Future Work)
+
+- Path consolidation: SPA at `/admin`, API moved to `/admin/_api/*`. One-time breaking change.
+- Embeddable Expo Router subtree (`@terreno/admin-spa/routes`) for consumers wanting to drop admin into their main app without 7 wrapper files.
+- Multi-bundle per-tenant theming (`/console/{tenantSlug}` with tenant-aware app-config).
+- Brotli/gzip precompression of static assets.
+- Service worker for offline / PWA support.
+- JWT/Passport fallback in standalone SPA.
+- Custom field renderer plugin system.