tempest-express-sdk 0.22.0 → 0.24.0

package/dist/index.cjs

@@ -11,13 +11,14 @@ var fs = require('fs');
 var path = require('path');
 var os = require('os');
 var util = require('util');
-var express2 = require('express');
+var express3 = require('express');
+var module$1 = require('module');
 var swaggerUiDist = require('swagger-ui-dist');
 var migrations = require('tempest-db-js/migrations');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
-var express2__default = /*#__PURE__*/_interopDefault(express2);
+var express3__default = /*#__PURE__*/_interopDefault(express3);
 
 // src/core/context.ts
 var storage = new async_hooks.AsyncLocalStorage();
@@ -892,7 +893,7 @@ function wrapWithSlowQueryLog(driver, options = {}) {
   const thresholdMs = options.thresholdMs ?? 500;
   const level = options.level ?? "warning";
   const logParameters = options.logParameters ?? false;
-  const logger4 = new JSONLogger(
+  const logger5 = new JSONLogger(
     options.loggerName ?? "tempest_express_sdk.db.slow_query"
   );
   const timed = (exec) => {
@@ -903,7 +904,7 @@ function wrapWithSlowQueryLog(driver, options = {}) {
       } finally {
         const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
         if (durationMs >= thresholdMs) {
-          logger4.log(level, "slow query", {
+          logger5.log(level, "slow query", {
             sql: sql5,
             durationMs: Math.round(durationMs * 1e3) / 1e3,
             ...logParameters ? { params } : {}
@@ -7683,7 +7684,6 @@ var HTTPClient = class {
         this.breakerRecord(host, true);
         if (attempt < this.retryPolicy.maxRetries) {
           await this.sleep(this.retryPolicy.sleepFor(attempt));
-          continue;
         }
       }
     }
@@ -9118,7 +9118,7 @@ function safeEqual(a, b) {
 }
 function makeWhatsAppWebhookRouter(options) {
   const path = options.path ?? "/whatsapp/inbound";
-  const router = express2.Router();
+  const router = express3.Router();
   router.post(path, async (req, res) => {
     if (options.apiKey) {
       const provided = req.header("x-api-key") ?? "";
@@ -9294,7 +9294,7 @@ function validateTwilioSignature(authToken, url, params, signature) {
 }
 function makeTwilioWebhookRouter(options) {
   const path = options.path ?? "/sms/inbound";
-  const router = express2.Router();
+  const router = express3.Router();
   router.post(path, async (req, res) => {
     const body = req.body ?? {};
     if (options.authToken) {
@@ -9444,207 +9444,3388 @@ var MessagingHub = class {
   }
 };
 
-// src/admin/site.ts
-var AdminSite = class {
+// src/admin/columns.ts
+function humanizeField(name) {
+  return name.replace(/[_-]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").trim().split(/\s+/).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+}
+function adminColumns(model) {
+  return tempestDbJs.columnsOf(model);
+}
+function widgetForColumn(column6) {
+  const { kind, meta } = column6.type;
+  const plain = (widget) => ({
+    widget,
+    step: null,
+    options: []
+  });
+  switch (kind) {
+    case "json":
+      return plain("json");
+    case "boolean":
+      return plain("checkbox");
+    case "enum":
+      return {
+        widget: "select",
+        step: null,
+        options: (meta.values ?? []).map((value) => ({
+          value,
+          label: humanizeField(value)
+        }))
+      };
+    case "smallint":
+    case "integer":
+    case "bigint":
+      return { widget: "number", step: "1", options: [] };
+    case "numeric":
+    case "real":
+    case "double":
+      return { widget: "number", step: "any", options: [] };
+    case "datetime":
+    case "timestamp":
+      return plain("datetime");
+    case "date":
+      return plain("date");
+    case "time":
+      return plain("time");
+    case "text":
+      return plain("textarea");
+    case "varchar":
+    case "char":
+      return plain(meta.length !== void 0 && meta.length > 255 ? "textarea" : "text");
+    default:
+      return plain("text");
+  }
+}
+function isColumnOptional(column6) {
+  return !column6.flags.notNull || column6.flags.hasDefault || column6.flags.primaryKey;
+}
+function filterForColumn(column6) {
+  const { kind, meta } = column6.type;
+  if (kind === "boolean") {
+    return {
+      kind: "select",
+      options: [
+        { value: "true", label: "Yes" },
+        { value: "false", label: "No" }
+      ]
+    };
+  }
+  if (kind === "enum") {
+    return {
+      kind: "select",
+      options: (meta.values ?? []).map((value) => ({
+        value,
+        label: humanizeField(value)
+      }))
+    };
+  }
+  if (kind === "date" || kind === "datetime" || kind === "timestamp") {
+    return { kind: "daterange", options: [] };
+  }
+  return { kind: "text", options: [] };
+}
+function isSearchableColumn(column6) {
+  const { kind } = column6.type;
+  return kind === "varchar" || kind === "text" || kind === "char";
+}
+
+// src/admin/config.ts
+var NEVER_EDITABLE = [
+  "id",
+  "createdAt",
+  "updatedAt",
+  "hashedPassword"
+];
+var NEVER_LISTED = ["hashedPassword"];
+var AdminModel = class {
+  /** The managed model class. */
+  model;
+  /** Columns surfaced as filter controls. */
+  listFilter;
+  /** Text columns the search box matches against. */
+  searchFields;
+  /** Columns locked in the create/edit form. */
+  readonlyFields;
+  /** Default ordering column, or `null` to leave it to the repository. */
+  orderKey;
+  /** Whether {@link AdminModel.orderKey} sorts ascending. */
+  orderAscending;
+  /** Rows per page in the list view. */
+  pageSize;
+  /** Column used to look a single row up from the detail URL. */
+  identityField;
+  /** Whether the create form is exposed. */
+  canCreate;
+  /** Whether the edit form is exposed. */
+  canEdit;
+  /** Whether the delete action is exposed. */
+  canDelete;
+  slugOverride;
+  listDisplayOverride;
+  verboseNameOverride;
+  verboseNamePluralOverride;
+  /**
+   * Build and validate the configuration.
+   *
+   * @param options - The declarative configuration. See {@link AdminModelOptions}.
+   * @throws Error When a referenced column does not exist on the model.
+   */
+  constructor(options) {
+    this.model = options.model;
+    this.slugOverride = options.slug ?? null;
+    this.listDisplayOverride = options.listDisplay === void 0 ? null : [...options.listDisplay];
+    this.listFilter = [...options.listFilter ?? []];
+    this.searchFields = [...options.searchFields ?? []];
+    this.readonlyFields = [...options.readonlyFields ?? []];
+    this.pageSize = options.pageSize ?? 25;
+    this.identityField = options.identityField ?? "id";
+    this.verboseNameOverride = options.verboseName ?? null;
+    this.verboseNamePluralOverride = options.verboseNamePlural ?? null;
+    this.canCreate = options.canCreate ?? true;
+    this.canEdit = options.canEdit ?? true;
+    this.canDelete = options.canDelete ?? true;
+    const known = new Set(this.columnNames());
+    for (const [option, names] of [
+      ["listDisplay", this.listDisplayOverride ?? []],
+      ["listFilter", this.listFilter],
+      ["searchFields", this.searchFields],
+      ["readonlyFields", this.readonlyFields],
+      ["identityField", [this.identityField]]
+    ]) {
+      for (const name of names) {
+        if (!known.has(name)) {
+          throw new Error(
+            `AdminModel(${this.model.tablename}).${option} references unknown column "${name}"; available: ${[...known].join(", ")}`
+          );
+        }
+      }
+    }
+    const ordering = options.ordering ?? (known.has("createdAt") ? "-createdAt" : void 0);
+    if (ordering === void 0) {
+      this.orderKey = null;
+      this.orderAscending = true;
+    } else {
+      const descending = ordering.startsWith("-");
+      const key = descending ? ordering.slice(1) : ordering;
+      if (!known.has(key)) {
+        throw new Error(
+          `AdminModel(${this.model.tablename}).ordering references unknown column "${key}"`
+        );
+      }
+      this.orderKey = key;
+      this.orderAscending = !descending;
+    }
+  }
   /**
-   * @param brand - Display name surfaced under `GET {prefix}/`.
+   * Return the URL slug the model is exposed under.
+   *
+   * @returns The configured slug, or the model's table name.
    */
-  constructor(brand = "Admin") {
-    this.brand = brand;
+  slug() {
+    return this.slugOverride ?? this.model.tablename;
   }
-  brand;
-  resources = /* @__PURE__ */ new Map();
   /**
-   * Register a resource.
+   * Return the singular display name.
    *
-   * @param resource - The resource config.
-   * @returns The same resource (for chaining).
+   * @returns The configured name, or the humanized class name without its
+   *   trailing `Model`.
    */
-  register(resource) {
-    this.resources.set(resource.name, resource);
-    return resource;
+  verboseName() {
+    if (this.verboseNameOverride !== null) return this.verboseNameOverride;
+    const className = this.model.name;
+    return humanizeField(className.replace(/Model$/, ""));
   }
-  /** Look up a resource by slug, or `null`. */
-  get(name) {
-    return this.resources.get(name) ?? null;
+  /**
+   * Return the plural display name.
+   *
+   * @returns The configured plural, or the singular with an `s`.
+   */
+  verboseNamePlural() {
+    return this.verboseNamePluralOverride ?? `${this.verboseName()}s`;
   }
-  /** Every registered resource. */
-  list() {
-    return [...this.resources.values()];
+  /**
+   * Return every column key on the model, in declaration order.
+   *
+   * @returns The column keys.
+   */
+  columnNames() {
+    return Object.keys(adminColumns(this.model));
+  }
+  /**
+   * Return the columns the list view renders.
+   *
+   * @returns The configured `listDisplay`, or every column but the password hash.
+   */
+  listDisplayNames() {
+    if (this.listDisplayOverride !== null) return [...this.listDisplayOverride];
+    return this.columnNames().filter((name) => !NEVER_LISTED.includes(name));
+  }
+  /**
+   * Return the columns the detail view renders.
+   *
+   * Unlike {@link AdminModel.listDisplayNames}, this is not narrowed by
+   * `listDisplay`: the list view is a scannable summary, but the detail view is
+   * where an operator goes to see the whole record, so trimming it there would
+   * hide data with nowhere else to read it.
+   *
+   * @returns Every column but the password hash, in declaration order.
+   */
+  detailFieldNames() {
+    return this.columnNames().filter((name) => !NEVER_LISTED.includes(name));
+  }
+  /**
+   * Return the columns a create/edit form exposes.
+   *
+   * Excludes the primary key, the managed timestamps, the password hash and
+   * anything listed in `readonlyFields` — none of which a user edits directly
+   * through the generic form.
+   *
+   * @returns The editable column keys, in declaration order.
+   */
+  editableFieldNames() {
+    const skip = /* @__PURE__ */ new Set([...this.readonlyFields, ...NEVER_EDITABLE]);
+    return this.columnNames().filter((name) => !skip.has(name));
+  }
+  /**
+   * Build a repository for this model bound to a session.
+   *
+   * @param session - The session the repository runs its statements on.
+   * @returns A repository over {@link AdminModel.model}.
+   */
+  repository(session) {
+    return new tempestDbJs.BaseRepository(this.model, session);
   }
 };
-var PAGINATION_KEYS2 = /* @__PURE__ */ new Set(["page", "pageSize"]);
-function methodNotAllowed(operation) {
-  return new AppException({
-    message: `Operation not allowed: ${operation}`,
-    code: "METHOD_NOT_ALLOWED",
-    statusCode: 405
+
+// src/admin/forms.ts
+function formatFieldValue(widget, value) {
+  if (value === null || value === void 0) return "";
+  if (widget === "json") {
+    return typeof value === "string" ? value : JSON.stringify(value, null, 2);
+  }
+  if (value instanceof Date) {
+    const iso = value.toISOString();
+    if (widget === "date") return iso.slice(0, 10);
+    if (widget === "time") return iso.slice(11, 19);
+    return iso.slice(0, 16);
+  }
+  if (widget === "datetime" || widget === "date") {
+    const parsed = new Date(String(value));
+    if (!Number.isNaN(parsed.getTime())) {
+      const iso = parsed.toISOString();
+      return widget === "date" ? iso.slice(0, 10) : iso.slice(0, 16);
+    }
+  }
+  return String(value);
+}
+function literalDefault(column6) {
+  const fallback = column6.defaultValue;
+  if (fallback === null || fallback.kind !== "literal") return void 0;
+  return fallback.value;
+}
+function buildFormFields(admin, options = {}) {
+  const columns = adminColumns(admin.model);
+  const values = options.values ?? {};
+  const errors = options.errors ?? {};
+  return admin.editableFieldNames().flatMap((name) => {
+    const column6 = columns[name];
+    if (column6 === void 0) return [];
+    const spec = widgetForColumn(column6);
+    const raw = name in values ? values[name] : literalDefault(column6);
+    return [
+      {
+        name,
+        label: humanizeField(name),
+        widget: spec.widget,
+        value: spec.widget === "checkbox" ? "" : formatFieldValue(spec.widget, raw),
+        required: !isColumnOptional(column6),
+        checked: spec.widget === "checkbox" && toBoolean(raw),
+        step: spec.step,
+        options: spec.options,
+        error: errors[name] ?? null
+      }
+    ];
   });
 }
-function requireResource(site, name) {
-  const resource = site.get(name);
-  if (!resource) throw new NotFoundException({ message: `Unknown resource: ${name}` });
-  return resource;
-}
-function makeAdminRouter(site, options = {}) {
-  const prefix = (options.prefix ?? "/admin").replace(/\/$/, "");
-  const router = express2.Router();
-  if (options.guard) router.use(prefix, options.guard);
-  router.get(prefix, (_req, res) => {
-    res.json({
-      brand: site.brand,
-      resources: site.list().map((r) => ({ name: r.name, fields: r.fields }))
-    });
-  });
-  router.get(`${prefix}/:resource/_meta`, (req, res) => {
-    const resource = requireResource(site, req.params.resource);
-    res.json({
-      name: resource.name,
-      fields: resource.fields,
-      operations: {
-        create: Boolean(resource.create),
-        update: Boolean(resource.update),
-        remove: Boolean(resource.remove)
+function toBoolean(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number") return value !== 0;
+  if (typeof value !== "string") return false;
+  return ["true", "on", "yes", "1"].includes(value.trim().toLowerCase());
+}
+function coerceValue(column6, widget, raw) {
+  const { kind, meta } = column6.type;
+  switch (widget) {
+    case "number": {
+      const parsed = Number(raw);
+      if (!Number.isFinite(parsed)) throw new Error("Enter a valid number.");
+      if (kind === "bigint") return BigInt(raw);
+      if (kind === "smallint" || kind === "integer") {
+        if (!Number.isInteger(parsed)) throw new Error("Enter a whole number.");
+        return parsed;
       }
-    });
-  });
-  router.get(`${prefix}/:resource`, async (req, res) => {
-    const resource = requireResource(site, req.params.resource);
-    const filters = {};
-    for (const [key, value] of Object.entries(req.query)) {
-      if (!PAGINATION_KEYS2.has(key) && typeof value === "string") filters[key] = value;
+      if (kind === "numeric") return raw;
+      return parsed;
     }
-    const page2 = Math.max(1, Number.parseInt(String(req.query.page ?? "1"), 10) || 1);
-    const pageSize = Math.max(
-      1,
-      Number.parseInt(String(req.query.pageSize ?? "20"), 10) || 20
-    );
-    res.json(await resource.list({ page: page2, pageSize, filters }));
-  });
-  router.get(`${prefix}/:resource/:id`, async (req, res) => {
-    const resource = requireResource(site, req.params.resource);
-    const record = await resource.get(req.params.id);
-    if (record === null) throw new NotFoundException({ message: "Record not found" });
-    res.json(record);
-  });
-  router.post(`${prefix}/:resource`, async (req, res) => {
-    const resource = requireResource(site, req.params.resource);
-    if (!resource.create) throw methodNotAllowed("create");
-    const data = resource.createSchema ? resource.createSchema.parse(req.body) : req.body;
-    res.status(201).json(await resource.create(data));
-  });
-  router.patch(`${prefix}/:resource/:id`, async (req, res) => {
-    const resource = requireResource(site, req.params.resource);
-    if (!resource.update) throw methodNotAllowed("update");
-    const data = resource.updateSchema ? resource.updateSchema.parse(req.body) : req.body;
-    res.json(await resource.update(req.params.id, data));
-  });
-  router.delete(`${prefix}/:resource/:id`, async (req, res) => {
-    const resource = requireResource(site, req.params.resource);
-    if (!resource.remove) throw methodNotAllowed("remove");
-    await resource.remove(req.params.id);
-    res.status(204).end();
-  });
-  return router;
+    case "datetime":
+    case "date": {
+      const parsed = new Date(raw);
+      if (Number.isNaN(parsed.getTime())) throw new Error("Enter a valid date.");
+      return parsed;
+    }
+    case "json":
+      try {
+        return JSON.parse(raw);
+      } catch {
+        throw new Error("Enter valid JSON.");
+      }
+    case "select": {
+      const allowed = meta.values ?? [];
+      if (allowed.length > 0 && !allowed.includes(raw)) {
+        throw new Error(`Choose one of: ${allowed.join(", ")}.`);
+      }
+      return raw;
+    }
+    default:
+      return raw;
+  }
+}
+function parseFormBody(admin, body) {
+  const columns = adminColumns(admin.model);
+  const data = {};
+  const errors = {};
+  for (const name of admin.editableFieldNames()) {
+    const column6 = columns[name];
+    if (column6 === void 0) continue;
+    const { widget } = widgetForColumn(column6);
+    if (widget === "checkbox") {
+      data[name] = toBoolean(body[name]);
+      continue;
+    }
+    const submitted = body[name];
+    const raw = typeof submitted === "string" ? submitted.trim() : "";
+    if (raw === "") {
+      if (!isColumnOptional(column6)) {
+        errors[name] = "This field is required.";
+        continue;
+      }
+      if (column6.flags.hasDefault && !(name in body)) continue;
+      data[name] = null;
+      continue;
+    }
+    try {
+      data[name] = coerceValue(column6, widget, raw);
+    } catch (error) {
+      errors[name] = error instanceof Error ? error.message : "Invalid value.";
+    }
+  }
+  return { data, errors };
 }
-
-// src/auth/schemas.ts
-var signupSchema = zod.z.object({
-  email: zod.z.email().openapi({ description: "Login identifier (email)." }),
-  password: zod.z.string().min(1).openapi({ description: "Plaintext password (hashed server-side)." }),
-  name: zod.z.string().max(120).optional().openapi({ description: "Optional display name." })
-}).openapi("Signup");
-var loginSchema = zod.z.object({
-  email: zod.z.email().openapi({ description: "Login identifier (email)." }),
-  password: zod.z.string().min(1).openapi({ description: "Plaintext password." })
-}).openapi("Login");
-var refreshSchema = zod.z.object({
-  refreshToken: zod.z.string().min(1).openapi({ description: "A valid refresh token." })
-}).openapi("Refresh");
-var tokenPairSchema = zod.z.object({
-  accessToken: zod.z.string().openapi({ description: "Short-lived bearer access token." }),
-  refreshToken: zod.z.string().openapi({ description: "Long-lived refresh token." }),
-  tokenType: zod.z.literal("bearer").openapi({ description: "Always 'bearer'." }),
-  expiresIn: zod.z.number().int().openapi({ description: "Access-token lifetime in seconds." })
-}).openapi("TokenPair");
-var userPublicSchema = zod.z.object({
-  id: zod.z.string().openapi({ description: "User id." }),
-  email: zod.z.email().openapi({ description: "User email." }),
-  name: zod.z.string().nullable().openapi({ description: "Display name, or null." }),
-  isActive: zod.z.boolean().openapi({ description: "Whether the account is active." }),
-  roles: zod.z.array(zod.z.string()).openapi({ description: "Assigned role names." })
-}).openapi("UserPublic");
-var authResponseSchema = zod.z.object({
-  user: userPublicSchema,
-  tokens: tokenPairSchema
-}).openapi("AuthResponse");
-var mfaEnrollResponseSchema = zod.z.object({
-  secret: zod.z.string().openapi({ description: "Base32 TOTP secret (manual entry)." }),
-  otpauthUri: zod.z.string().openapi({ description: "otpauth:// URI to render as QR." })
-}).openapi("MfaEnrollResponse");
-var mfaCodeSchema = zod.z.object({ code: zod.z.string().min(1).openapi({ description: "Authenticator code." }) }).openapi("MfaCode");
-var mfaChallengeSchema = zod.z.object({
-  mfaToken: zod.z.string().min(1).openapi({ description: "Challenge token from login." }),
-  code: zod.z.string().min(1).openapi({ description: "Authenticator code." })
-}).openapi("MfaChallenge");
-var activationSchema = zod.z.object({ token: zod.z.string().min(1).openapi({ description: "Activation token." }) }).openapi("Activation");
-var passwordResetRequestSchema = zod.z.object({ email: zod.z.email().openapi({ description: "Account email." }) }).openapi("PasswordResetRequest");
-var passwordResetConfirmSchema = zod.z.object({
-  token: zod.z.string().min(1).openapi({ description: "Reset token." }),
-  password: zod.z.string().min(1).openapi({ description: "New plaintext password." })
-}).openapi("PasswordResetConfirm");
-
-// src/auth/service.ts
-function toPublic(user) {
-  return {
-    id: user.id,
-    email: user.email,
-    name: user.name,
-    isActive: user.isActive,
-    roles: user.roles
-  };
+function formatCellValue(value) {
+  if (value === null || value === void 0) return "";
+  if (value instanceof Date) return value.toISOString().replace("T", " ").slice(0, 19);
+  if (typeof value === "boolean") return value ? "Yes" : "No";
+  if (typeof value === "object") return JSON.stringify(value);
+  return String(value);
 }
-var UserAuthService = class {
-  store;
-  password;
-  jwt;
-  passwordMinLength;
-  accessTtlSeconds;
-  refreshTtlSeconds;
+
+// src/admin/auth.ts
+var UserModelAuthBackend = class {
+  model;
+  passwords;
   mfa;
-  mfaChallengeTtlSeconds;
+  identifierField;
+  requireAdmin;
   /**
-   * @param options - Store, password/JWT helpers and token policy.
+   * Build the backend.
+   *
+   * @param model - The user model class (a `BaseUserModel` subclass).
+   * @param options - Hasher, MFA verifier and gating overrides.
    */
-  constructor(options) {
-    this.store = options.store;
-    this.password = options.password;
-    this.jwt = options.jwt;
-    this.passwordMinLength = options.passwordMinLength ?? 12;
-    this.accessTtlSeconds = options.accessTtlSeconds ?? 3600;
-    this.refreshTtlSeconds = options.refreshTtlSeconds ?? 60 * 60 * 24 * 14;
-    this.mfa = options.mfa;
-    this.mfaChallengeTtlSeconds = options.mfaChallengeTtlSeconds ?? 300;
+  constructor(model, options = {}) {
+    this.model = model;
+    this.passwords = options.passwords ?? new PasswordUtils();
+    this.mfa = options.mfa ?? null;
+    this.identifierField = options.identifierField ?? "email";
+    this.requireAdmin = options.requireAdmin ?? true;
   }
-  /** Mint a signed access + refresh token pair for `user`. */
-  async issueTokens(user) {
-    const accessToken = await this.jwt.encode(
-      { sub: user.id, roles: user.roles, type: "access" },
-      { ttlSeconds: this.accessTtlSeconds }
-    );
-    const refreshToken = await this.jwt.encode(
-      { sub: user.id, type: "refresh" },
-      { ttlSeconds: this.refreshTtlSeconds }
-    );
-    return {
-      accessToken,
-      refreshToken,
-      tokenType: "bearer",
-      expiresIn: this.accessTtlSeconds
-    };
+  /**
+   * Whether a row is allowed into the panel at all.
+   *
+   * @param row - The candidate row.
+   * @returns `true` when the row is active and (when required) an admin.
+   */
+  admits(row) {
+    if (row.isActive === false) return false;
+    return !this.requireAdmin || row.isAdmin === true;
   }
   /**
-   * Register a new user and issue tokens.
+   * Verify an identifier/password pair.
+   *
+   * The identifier is lowercased and trimmed before lookup, matching the
+   * normalization the auth service applies on signup.
+   *
+   * @param session - A DB session for the current request.
+   * @param identifier - The submitted identifier.
+   * @param password - The submitted plaintext password.
+   * @returns The matching row, or `null` when it does not qualify.
+   */
+  async authenticate(session, identifier, password) {
+    const repository = new tempestDbJs.BaseRepository(this.model, session);
+    const filters = { [this.identifierField]: identifier.trim().toLowerCase() };
+    const row = await repository.first(
+      filters
+    );
+    if (row === null || !this.admits(row)) return null;
+    if (!await this.passwords.verify(password, row.hashedPassword)) return null;
+    return row;
+  }
+  /**
+   * Re-load the principal a session points at.
+   *
+   * @param session - A DB session for the current request.
+   * @param subject - The principal id from the session cookie.
+   * @returns The row, or `null` when it vanished or lost its privileges.
+   */
+  async loadPrincipal(session, subject) {
+    const repository = new tempestDbJs.BaseRepository(this.model, session);
+    const row = await repository.getByIdOrNull(
+      subject
+    );
+    if (row === null || !this.admits(row)) return null;
+    return row;
+  }
+  /**
+   * Return the row's primary key.
+   *
+   * @param principal - The authenticated row.
+   * @returns The principal id.
+   */
+  principalId(principal) {
+    return String(principal.id);
+  }
+  /**
+   * Return the label shown in the panel header.
+   *
+   * @param principal - The authenticated row.
+   * @returns The identifier column's value.
+   */
+  displayName(principal) {
+    const value = principal[this.identifierField];
+    return typeof value === "string" ? value : String(principal.id);
+  }
+  /**
+   * Whether the principal enrolled a second factor.
+   *
+   * @param principal - The authenticated row.
+   * @returns `true` when an MFA verifier is configured and reports a secret.
+   */
+  async mfaEnabled(principal) {
+    if (this.mfa === null) return false;
+    return await this.mfa.isEnabled(String(principal.id));
+  }
+  /**
+   * Verify a submitted TOTP code.
+   *
+   * @param principal - The authenticated row.
+   * @param code - The submitted code.
+   * @returns `true` when the code is valid.
+   */
+  async verifyMfa(principal, code) {
+    if (this.mfa === null) return false;
+    return await this.mfa.verify(String(principal.id), code);
+  }
+};
+var MIN_SECRET_LENGTH = 32;
+function encode(value) {
+  return Buffer.from(value, "utf8").toString("base64url");
+}
+var AdminSessionStore = class {
+  secret;
+  cookieName;
+  maxAgeSeconds;
+  cookieSecure;
+  cookiePath;
+  /**
+   * Build the store.
+   *
+   * @param options - Secret, cookie name, lifetime and cookie flags.
+   * @throws Error When the secret is shorter than 32 characters.
+   */
+  constructor(options) {
+    if (options.secret.length < MIN_SECRET_LENGTH) {
+      throw new Error(
+        `Admin session secret must be at least ${MIN_SECRET_LENGTH} characters; got ${options.secret.length}`
+      );
+    }
+    this.secret = options.secret;
+    this.cookieName = options.cookieName ?? "tempest_admin_session";
+    this.maxAgeSeconds = options.maxAgeSeconds ?? 8 * 60 * 60;
+    this.cookieSecure = options.cookieSecure ?? true;
+    this.cookiePath = options.cookiePath ?? "/";
+  }
+  /**
+   * Sign a payload.
+   *
+   * @param payload - The base64url payload to sign.
+   * @returns The base64url signature.
+   */
+  sign(payload) {
+    return crypto.createHmac("sha256", this.secret).update(payload).digest("base64url");
+  }
+  /**
+   * Mint a fresh session for an authenticated principal.
+   *
+   * @param subject - The principal id.
+   * @param displayName - The name shown in the header.
+   * @param mfaPassed - Whether the second factor is already satisfied.
+   * @returns The new session payload (not yet written to a response).
+   */
+  issue(subject, displayName, mfaPassed = true) {
+    return {
+      subject,
+      displayName,
+      csrfToken: crypto.randomUUID(),
+      expiresAt: Math.floor(Date.now() / 1e3) + this.maxAgeSeconds,
+      mfaPassed
+    };
+  }
+  /**
+   * Read and verify the session carried by a request.
+   *
+   * @param req - The inbound request.
+   * @returns The session, or `null` when absent, tampered with or expired.
+   */
+  load(req) {
+    const raw = parseCookies(req.header("cookie") ?? void 0)[this.cookieName];
+    if (raw === void 0) return null;
+    const separator = raw.lastIndexOf(".");
+    if (separator <= 0) return null;
+    const payload = raw.slice(0, separator);
+    const signature = Buffer.from(raw.slice(separator + 1), "base64url");
+    const expected = Buffer.from(this.sign(payload), "base64url");
+    if (signature.length !== expected.length) return null;
+    if (!crypto.timingSafeEqual(signature, expected)) return null;
+    let session;
+    try {
+      session = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    } catch {
+      return null;
+    }
+    if (typeof session.subject !== "string" || typeof session.csrfToken !== "string") {
+      return null;
+    }
+    if (session.expiresAt <= Math.floor(Date.now() / 1e3)) return null;
+    return session;
+  }
+  /**
+   * Write a session to the response as a signed cookie.
+   *
+   * @param res - The outbound response.
+   * @param session - The session to persist.
+   */
+  save(res, session) {
+    const payload = encode(JSON.stringify(session));
+    const value = `${payload}.${this.sign(payload)}`;
+    const maxAge = Math.max(0, session.expiresAt - Math.floor(Date.now() / 1e3));
+    res.append("set-cookie", this.cookie(value, maxAge));
+  }
+  /**
+   * Drop the session cookie.
+   *
+   * @param res - The outbound response.
+   */
+  clear(res) {
+    res.append("set-cookie", this.cookie("", 0));
+  }
+  /**
+   * Render a `Set-Cookie` value with the configured flags.
+   *
+   * @param value - The cookie value.
+   * @param maxAge - Lifetime in seconds (`0` expires it immediately).
+   * @returns The header value.
+   */
+  cookie(value, maxAge) {
+    const parts = [
+      `${this.cookieName}=${value}`,
+      `Path=${this.cookiePath}`,
+      `Max-Age=${maxAge}`,
+      "HttpOnly",
+      "SameSite=Lax"
+    ];
+    if (this.cookieSecure) parts.push("Secure");
+    return parts.join("; ");
+  }
+};
+function csrfTokenMatches(session, submitted) {
+  if (typeof submitted !== "string") return false;
+  const expected = Buffer.from(session.csrfToken, "utf8");
+  const actual = Buffer.from(submitted, "utf8");
+  if (expected.length !== actual.length) return false;
+  return crypto.timingSafeEqual(expected, actual);
+}
+
+// src/admin/site.ts
+function isConcreteModel(value) {
+  if (typeof value !== "function") return false;
+  const proto = value.prototype;
+  if (typeof proto !== "object" || proto === null) return false;
+  if (!(proto instanceof tempestDbJs.Model)) return false;
+  const tablename = value.tablename;
+  return typeof tablename === "string" && tablename.length > 0;
+}
+var AdminSite = class {
+  /** Text used in the page `<title>` and the dashboard heading. */
+  title;
+  /** Centered header brand, or `null` to fall back to {@link AdminSite.title}. */
+  brand;
+  /** Dashboard subtitle. */
+  indexSubtitle;
+  /** Outbound "View site" link, or `null`. */
+  siteUrl;
+  /** Typed appearance overrides. */
+  theme;
+  registry = /* @__PURE__ */ new Map();
+  /**
+   * Initialize the site.
+   *
+   * @param options - Branding and appearance. See {@link AdminSiteOptions}.
+   */
+  constructor(options = {}) {
+    this.title = options.title ?? "Admin";
+    this.brand = options.brand ?? null;
+    this.indexSubtitle = options.indexSubtitle ?? "Site administration";
+    this.siteUrl = options.siteUrl ?? null;
+    this.theme = options.theme ?? {};
+  }
+  /**
+   * Return the centered header brand text.
+   *
+   * @returns {@link AdminSite.brand} when set, otherwise {@link AdminSite.title}.
+   */
+  brandText() {
+    return this.brand ?? this.title;
+  }
+  /**
+   * Register a model configuration under its slug.
+   *
+   * @param admin - An {@link AdminModel} instance, or the options to build one.
+   * @returns The registered instance, so the call can be chained or assigned.
+   * @throws Error When another configuration already holds the same slug.
+   */
+  register(admin) {
+    const config = admin instanceof AdminModel ? admin : new AdminModel(admin);
+    const slug = config.slug();
+    const existing = this.registry.get(slug);
+    if (existing !== void 0) {
+      throw new Error(
+        `AdminModel for slug "${slug}" is already registered (${existing.model.tablename}); refusing to overwrite with ${config.model.tablename}`
+      );
+    }
+    this.registry.set(slug, config);
+    return config;
+  }
+  /**
+   * Remove a previously registered configuration.
+   *
+   * @param slug - The slug to drop.
+   * @throws Error When no configuration is registered under the slug.
+   */
+  unregister(slug) {
+    if (!this.registry.delete(slug)) {
+      throw new Error(`No AdminModel registered for slug "${slug}"`);
+    }
+  }
+  /**
+   * Look a configuration up by slug.
+   *
+   * @param slug - The admin slug.
+   * @returns The configuration, or `null` when nothing matches.
+   */
+  get(slug) {
+    return this.registry.get(slug) ?? null;
+  }
+  /**
+   * Return every registered configuration, ordered by display name.
+   *
+   * @returns The configurations (empty when nothing is registered).
+   */
+  list() {
+    return [...this.registry.values()].sort(
+      (left, right) => left.verboseNamePlural().toLowerCase().localeCompare(right.verboseNamePlural().toLowerCase())
+    );
+  }
+  /**
+   * Register every concrete model found in `source` at once.
+   *
+   * The batch counterpart to {@link AdminSite.register}: instead of one call
+   * per table, hand it the models barrel and every model class declaring a
+   * `tablename` is wrapped in a default {@link AdminModel}.
+   *
+   * ```ts
+   * import * as models from "./db/models";
+   *
+   * site.automap(models);
+   * site.automap([UserModel, OrderModel], { pageSize: 50 });
+   * ```
+   *
+   * @param source - An array of model classes, or a module namespace object
+   *   whose values are swept (non-model entries are ignored).
+   * @param options - `exclude`, `skipRegistered` and any {@link AdminModel}
+   *   option applied uniformly to every model discovered here.
+   * @returns The configurations newly registered by this call.
+   * @throws Error When `skipRegistered` is `false` and a slug collides.
+   */
+  automap(source, options = {}) {
+    const { exclude = [], skipRegistered = true, ...adminOptions } = options;
+    const excluded = new Set(
+      exclude.map((entry) => typeof entry === "string" ? entry : entry.tablename)
+    );
+    const candidates = Array.isArray(source) ? source : Object.values(source);
+    const registered = [];
+    for (const candidate of candidates) {
+      if (!isConcreteModel(candidate)) continue;
+      if (excluded.has(candidate.tablename)) continue;
+      const config = new AdminModel({ ...adminOptions, model: candidate });
+      if (skipRegistered && this.registry.get(config.slug()) !== void 0) continue;
+      registered.push(this.register(config));
+    }
+    return registered.sort((left, right) => left.slug().localeCompare(right.slug()));
+  }
+};
+
+// src/admin/styles.ts
+var ADMIN_CSS = `:root {
+  --tempest-bg: #0f172a;
+  --tempest-bg-soft: #1e293b;
+  --tempest-bg-row: #f8fafc;
+  --tempest-bg-row-alt: #f1f5f9;
+  --tempest-fg: #0f172a;
+  --tempest-fg-soft: #475569;
+  --tempest-accent: #2563eb;
+  --tempest-accent-hover: #1d4ed8;
+  --tempest-accent-soft: rgba(37, 99, 235, 0.1);
+  --tempest-danger: #b91c1c;
+  /* Light surface + hairline used by cards / tables / dropdowns on the
+     (light) content area \u2014 distinct from the dark sidebar bg vars above.
+     Overridable by AdminTheme for dark mode. */
+  --tempest-surface: #ffffff;
+  --tempest-border: #e2e8f0;
+  --tempest-radius: 6px;
+  --tempest-shadow: 0 1px 2px rgba(15, 23, 42, 0.08);
+}
+
+* {
+  box-sizing: border-box;
+}
+
+body {
+  margin: 0;
+  font-family: var(--tempest-font, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif);
+  font-size: 14px;
+  color: var(--tempest-fg);
+  background: var(--tempest-page-bg, #f8fafc);
+  /* Sticky-footer column so the layout (and its sidebar) fills the
+     viewport even when the page content is short. */
+  min-height: 100vh;
+  display: flex;
+  flex-direction: column;
+}
+
+a {
+  color: var(--tempest-accent);
+  text-decoration: none;
+}
+
+a:hover {
+  color: var(--tempest-accent-hover);
+  text-decoration: underline;
+}
+
+button {
+  border: 0;
+  background: var(--tempest-accent);
+  color: #fff;
+  padding: 0.5rem 1rem;
+  border-radius: var(--tempest-radius);
+  cursor: pointer;
+  font: inherit;
+}
+
+button:hover {
+  background: var(--tempest-accent-hover);
+}
+
+input,
+select,
+textarea {
+  font: inherit;
+  padding: 0.45rem 0.6rem;
+  border-radius: var(--tempest-radius);
+  border: 1px solid #cbd5e1;
+  background: #fff;
+}
+
+.tempest-admin-header {
+  position: relative;
+  z-index: 20;
+  background: var(--tempest-bg);
+  color: #f8fafc;
+  padding: 0.75rem 1.5rem;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  box-shadow: var(--tempest-shadow);
+}
+
+/* Centered brand \u2014 pinned to the middle of the header (i.e. the screen)
+   regardless of the left (burger) / right (nav) cluster widths. */
+.tempest-admin-header__brand {
+  position: absolute;
+  left: 50%;
+  transform: translateX(-50%);
+  text-align: center;
+  pointer-events: none;
+}
+
+.tempest-admin-header__brand a {
+  color: #fff;
+  font-weight: 600;
+  font-size: 1.1rem;
+  pointer-events: auto;
+  display: inline-flex;
+  align-items: center;
+}
+
+/* Logo image (shown instead of the brand text when theme.logo_url is
+   set). Capped to the header height so any aspect ratio fits cleanly. */
+.tempest-admin-header__logo {
+  display: block;
+  max-height: 32px;
+  width: auto;
+}
+
+.tempest-admin-header__nav {
+  display: flex;
+  align-items: center;
+  gap: 1rem;
+  color: #cbd5e1;
+}
+
+.tempest-admin-header__nav a {
+  color: #cbd5e1;
+}
+
+.tempest-admin-header__user {
+  font-weight: 500;
+  color: #f1f5f9;
+}
+
+.tempest-admin-header__logout {
+  margin: 0;
+}
+
+.tempest-admin-header__logout button {
+  background: transparent;
+  color: #f1f5f9;
+  padding: 0.25rem 0.5rem;
+  border: 1px solid #475569;
+}
+
+.tempest-admin-header__logout button:hover {
+  background: rgba(255, 255, 255, 0.08);
+}
+
+.tempest-admin-header__left {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+}
+
+/* ---- Layout: persistent sidebar + content ---- */
+.tempest-admin-layout {
+  display: flex;
+  align-items: stretch;
+  flex: 1;            /* fill the viewport so the sidebar is full-height */
+}
+
+.tempest-admin-sidebar {
+  flex: 0 0 220px;
+  width: 220px;
+  background: var(--tempest-bg-soft);
+  color: #e2e8f0;
+  padding: 1rem 0.75rem;
+}
+
+.tempest-admin-sidebar__nav {
+  display: flex;
+  flex-direction: column;
+  gap: 0.15rem;
+  position: sticky;
+  top: 1rem;
+}
+
+.tempest-admin-sidebar__heading {
+  font-size: 0.7rem;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: #94a3b8;
+  margin: 1rem 0.75rem 0.35rem;
+}
+
+.tempest-admin-sidebar__link {
+  display: block;
+  padding: 0.5rem 0.75rem;
+  border-radius: var(--tempest-radius);
+  color: #cbd5e1;
+}
+
+.tempest-admin-sidebar__link:hover {
+  background: rgba(255, 255, 255, 0.06);
+  color: #fff;
+  text-decoration: none;
+}
+
+.tempest-admin-sidebar__link--active,
+.tempest-admin-sidebar__link--active:hover {
+  background: var(--tempest-accent);
+  color: #fff;
+}
+
+/* Burger toggle (CSS-only, via the hidden checkbox) \u2014 mobile only. */
+.tempest-admin-burger {
+  display: none;
+  flex-direction: column;
+  gap: 4px;
+  cursor: pointer;
+  padding: 0.3rem;
+}
+
+.tempest-admin-burger span {
+  display: block;
+  width: 22px;
+  height: 2px;
+  background: #f8fafc;
+  border-radius: 2px;
+}
+
+.tempest-admin-scrim {
+  display: none;
+}
+
+.tempest-admin-main {
+  flex: 1 1 auto;
+  min-width: 0;
+  max-width: 1080px;
+  margin: 2rem auto;
+  padding: 0 1.5rem;
+}
+
+.tempest-admin-messages {
+  list-style: none;
+  padding: 0;
+  margin: 0 0 1.5rem;
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+.tempest-admin-messages__item {
+  padding: 0.75rem 1rem;
+  border-radius: var(--tempest-radius);
+  border-left: 4px solid var(--tempest-accent);
+  background: #eff6ff;
+}
+
+.tempest-admin-messages__item--error {
+  border-left-color: var(--tempest-danger);
+  background: #fef2f2;
+}
+
+.tempest-admin-login {
+  max-width: 360px;
+  margin: 4rem auto;
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  padding: 2rem;
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-login h1 {
+  margin-top: 0;
+}
+
+.tempest-admin-login__form {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+
+.tempest-admin-login__form label {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+}
+
+.tempest-admin-login__error {
+  background: #fef2f2;
+  color: var(--tempest-danger);
+  padding: 0.75rem 1rem;
+  border-radius: var(--tempest-radius);
+}
+
+.tempest-admin-dashboard__table,
+.tempest-admin-list__table {
+  width: 100%;
+  border-collapse: collapse;
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  overflow: hidden;
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-dashboard__table th,
+.tempest-admin-dashboard__table td,
+.tempest-admin-list__table th,
+.tempest-admin-list__table td {
+  padding: 0.75rem 1rem;
+  text-align: left;
+  border-bottom: 1px solid #e2e8f0;
+  vertical-align: top;
+}
+
+.tempest-admin-list__table tr:nth-child(even) td {
+  background: var(--tempest-bg-row-alt);
+}
+
+.tempest-admin-list__header {
+  display: flex;
+  justify-content: space-between;
+  align-items: baseline;
+  margin-bottom: 1rem;
+}
+
+.tempest-admin-list__filters {
+  display: flex;
+  gap: 0.75rem;
+  align-items: end;
+  margin-bottom: 1rem;
+  flex-wrap: wrap;
+}
+
+.tempest-admin-list__filters label {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+}
+
+.tempest-admin-list__pagination {
+  display: flex;
+  gap: 1rem;
+  align-items: center;
+  justify-content: center;
+  margin-top: 1.5rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-detail__fields {
+  display: grid;
+  grid-template-columns: 200px 1fr;
+  gap: 0.5rem 1.5rem;
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  padding: 1.5rem;
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-detail__fields dt {
+  font-weight: 600;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-detail__fields dd {
+  margin: 0;
+  word-break: break-word;
+}
+
+.tempest-admin-detail__audit-title {
+  font-size: 1rem;
+  margin: 1.5rem 0 0.5rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-detail__json {
+  margin: 0;
+  padding: 0.5rem 0.75rem;
+  background: var(--tempest-bg-row);
+  border: 1px solid var(--tempest-border);
+  border-radius: var(--tempest-radius);
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 0.8rem;
+  overflow-x: auto;
+}
+
+.tempest-admin-history {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  border-left: 2px solid var(--tempest-border);
+}
+
+.tempest-admin-history__item {
+  position: relative;
+  padding: 0.5rem 0 1rem 1rem;
+}
+
+.tempest-admin-history__item::before {
+  content: "";
+  position: absolute;
+  left: -0.4rem;
+  top: 0.9rem;
+  width: 0.6rem;
+  height: 0.6rem;
+  border-radius: 50%;
+  background: var(--tempest-fg-soft);
+}
+
+.tempest-admin-history__item--create::before { background: #16a34a; }
+.tempest-admin-history__item--update::before { background: #d97706; }
+.tempest-admin-history__item--delete::before { background: #dc2626; }
+
+.tempest-admin-history__head {
+  display: flex;
+  gap: 0.75rem;
+  align-items: baseline;
+  flex-wrap: wrap;
+}
+
+.tempest-admin-history__action {
+  font-weight: 600;
+  text-transform: uppercase;
+  font-size: 0.75rem;
+  letter-spacing: 0.04em;
+}
+
+.tempest-admin-history__meta {
+  color: var(--tempest-fg-soft);
+  font-size: 0.85rem;
+}
+
+.tempest-admin-history__changes {
+  width: 100%;
+  border-collapse: collapse;
+  margin-top: 0.5rem;
+  font-size: 0.85rem;
+}
+
+.tempest-admin-history__changes th,
+.tempest-admin-history__changes td {
+  text-align: left;
+  padding: 0.25rem 0.5rem;
+  border-bottom: 1px solid var(--tempest-border);
+  vertical-align: top;
+  word-break: break-word;
+}
+
+.tempest-admin-history__changes th {
+  color: var(--tempest-fg-soft);
+  font-weight: 600;
+}
+
+.tempest-admin-history__empty {
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-ac {
+  position: relative;
+}
+
+.tempest-admin-ac__search {
+  width: 100%;
+}
+
+.tempest-admin-ac__results {
+  list-style: none;
+  margin: 0.25rem 0 0;
+  padding: 0;
+  border: 1px solid var(--tempest-border);
+  border-radius: var(--tempest-radius, 6px);
+  max-height: 12rem;
+  overflow-y: auto;
+  background: var(--tempest-surface);
+}
+
+.tempest-admin-ac__results:empty {
+  display: none;
+}
+
+.tempest-admin-ac__option {
+  display: block;
+  width: 100%;
+  text-align: left;
+  padding: 0.4rem 0.6rem;
+  background: none;
+  border: 0;
+  cursor: pointer;
+  color: inherit;
+  font: inherit;
+}
+
+.tempest-admin-ac__option:hover,
+.tempest-admin-ac__option:focus {
+  background: var(--tempest-accent-soft, rgba(0, 0, 0, 0.06));
+}
+
+.tempest-admin-ac__empty {
+  padding: 0.4rem 0.6rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-inline {
+  margin-top: 2rem;
+}
+
+.tempest-admin-inline__header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  margin-bottom: 0.5rem;
+}
+
+.tempest-admin-inline__header h2 {
+  font-size: 1rem;
+  margin: 0;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-inline__count {
+  font-weight: 400;
+}
+
+.tempest-admin-inline__scroll {
+  overflow-x: auto;
+}
+
+.tempest-admin-inline__table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.9rem;
+}
+
+.tempest-admin-inline__table th,
+.tempest-admin-inline__table td {
+  text-align: left;
+  padding: 0.4rem 0.6rem;
+  border-bottom: 1px solid var(--tempest-border);
+  white-space: nowrap;
+}
+
+.tempest-admin-inline__table th {
+  color: var(--tempest-fg-soft);
+  font-weight: 600;
+}
+
+.tempest-admin-inline__empty,
+.tempest-admin-inline__more {
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-cards {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(14rem, 1fr));
+  gap: 1rem;
+  margin: 1rem 0 2rem;
+}
+
+.tempest-admin-card {
+  display: flex;
+  flex-direction: column;
+  gap: 0.35rem;
+  padding: 1rem 1.1rem;
+  border: 1px solid var(--tempest-border);
+  border-radius: var(--tempest-radius, 8px);
+  background: var(--tempest-surface);
+}
+
+.tempest-admin-card__label {
+  font-size: 0.8rem;
+  color: var(--tempest-fg-soft);
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+
+.tempest-admin-card__value {
+  font-size: 1.7rem;
+  font-weight: 700;
+  line-height: 1.1;
+}
+
+.tempest-admin-card__value small {
+  font-size: 0.9rem;
+  font-weight: 400;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-card__trend {
+  font-size: 0.9rem;
+  font-weight: 600;
+}
+
+.tempest-admin-card__trend small {
+  font-weight: 400;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-card__trend--up { color: #16a34a; }
+.tempest-admin-card__trend--down { color: #dc2626; }
+.tempest-admin-card__trend--flat { color: var(--tempest-fg-soft); }
+
+.tempest-admin-card__parts {
+  list-style: none;
+  margin: 0.25rem 0 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 0.3rem;
+}
+
+.tempest-admin-card__parts li {
+  display: grid;
+  grid-template-columns: 6rem 1fr auto;
+  align-items: center;
+  gap: 0.5rem;
+  font-size: 0.85rem;
+}
+
+.tempest-admin-card__part-label {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-card__part-bar {
+  display: block;
+  height: 0.5rem;
+  border-radius: 999px;
+  background: var(--tempest-border);
+  overflow: hidden;
+}
+
+.tempest-admin-card__part-bar span {
+  display: block;
+  height: 100%;
+  background: var(--tempest-accent, #2563eb);
+}
+
+.tempest-admin-card__help {
+  font-size: 0.8rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-import__result {
+  margin: 1rem 0;
+}
+
+.tempest-admin-import__ok {
+  color: #16a34a;
+  font-weight: 600;
+}
+
+.tempest-admin-import__failed {
+  color: #d97706;
+  font-weight: 600;
+}
+
+.tempest-admin-import__errors {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.85rem;
+}
+
+.tempest-admin-import__errors th,
+.tempest-admin-import__errors td {
+  text-align: left;
+  padding: 0.3rem 0.5rem;
+  border-bottom: 1px solid var(--tempest-border);
+  vertical-align: top;
+}
+
+.tempest-admin-import__form label {
+  display: block;
+  margin: 1rem 0 0.5rem;
+}
+
+.tempest-admin-lenses {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.4rem;
+  margin: 0.5rem 0 1rem;
+  border-bottom: 1px solid var(--tempest-border);
+  padding-bottom: 0.5rem;
+}
+
+.tempest-admin-lens {
+  padding: 0.3rem 0.7rem;
+  border-radius: 999px;
+  border: 1px solid var(--tempest-border);
+  color: var(--tempest-fg-soft);
+  text-decoration: none;
+  font-size: 0.85rem;
+}
+
+.tempest-admin-lens:hover {
+  color: inherit;
+}
+
+.tempest-admin-lens--active {
+  background: var(--tempest-accent, #2563eb);
+  border-color: var(--tempest-accent, #2563eb);
+  color: #fff;
+}
+
+.tempest-admin-footer {
+  position: relative;
+  z-index: 20;
+  text-align: center;
+  padding: 2rem 0;
+  color: var(--tempest-fg-soft);
+}
+
+/* List toolbar: search/filters on the left, actions (export) on the right. */
+.tempest-admin-list__toolbar {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.75rem 1rem;
+  align-items: flex-end;
+  justify-content: space-between;
+  margin-bottom: 1rem;
+}
+
+.tempest-admin-list__actions {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+}
+
+.tempest-admin-list__actions a {
+  display: inline-block;
+  padding: 0.45rem 0.8rem;
+  border: 1px solid var(--tempest-accent);
+  border-radius: var(--tempest-radius);
+  background: #fff;
+  white-space: nowrap;
+}
+
+.tempest-admin-list__actions a:hover {
+  background: #eff6ff;
+  text-decoration: none;
+}
+
+/* Dashboard: system-metric stat cards + model cards. */
+.tempest-admin-stats {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
+  gap: 1rem;
+  margin: 1.5rem 0;
+}
+
+.tempest-admin-stat {
+  display: flex;
+  flex-direction: column;
+  gap: 0.15rem;
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  padding: 1rem 1.25rem;
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-stat__label {
+  font-size: 0.8rem;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-stat__value {
+  font-size: 1.6rem;
+  font-weight: 700;
+}
+
+.tempest-admin-stat__sub {
+  font-size: 0.8rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-models {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(240px, 1fr));
+  gap: 1rem;
+  margin-top: 1rem;
+}
+
+.tempest-admin-model-card {
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  padding: 1rem 1.25rem;
+  box-shadow: var(--tempest-shadow);
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+}
+
+.tempest-admin-model-card__head {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 0.5rem;
+}
+
+.tempest-admin-model-card__head h2 {
+  margin: 0;
+  font-size: 1.05rem;
+}
+
+.tempest-admin-model-card__count {
+  font-weight: 700;
+  color: var(--tempest-accent);
+}
+
+.tempest-admin-model-card__actions {
+  display: flex;
+  gap: 1rem;
+}
+
+/* Bulk-action bar above the list table. */
+.tempest-admin-bulk {
+  margin: 0;
+}
+
+.tempest-admin-bulk__bar {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+  margin-bottom: 0.75rem;
+}
+
+.tempest-admin-list__check {
+  width: 1%;
+  white-space: nowrap;
+  text-align: center;
+}
+
+.tempest-admin-list__check input {
+  width: auto;
+}
+
+/* Horizontal-scroll wrapper so wide tables never break the layout. */
+.tempest-admin-table-wrap {
+  width: 100%;
+  overflow-x: auto;
+  -webkit-overflow-scrolling: touch;
+  border-radius: var(--tempest-radius);
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-table-wrap .tempest-admin-list__table,
+.tempest-admin-table-wrap .tempest-admin-dashboard__table {
+  box-shadow: none;
+}
+
+/* Sortable column headers. */
+.tempest-admin-list__table th a.tempest-sort {
+  color: inherit;
+  display: inline-flex;
+  align-items: center;
+  gap: 0.3rem;
+  white-space: nowrap;
+}
+
+.tempest-admin-list__table th a.tempest-sort:hover {
+  color: var(--tempest-accent);
+  text-decoration: none;
+}
+
+.tempest-sort__arrow {
+  font-size: 0.75em;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-sort--active .tempest-sort__arrow {
+  color: var(--tempest-accent);
+}
+
+/* Detail header actions (back / edit / delete). */
+.tempest-admin-detail__header {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.5rem 1rem;
+  align-items: center;
+  justify-content: space-between;
+  margin-bottom: 1rem;
+}
+
+.tempest-admin-detail__actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.5rem;
+  align-items: center;
+}
+
+.tempest-admin-detail__delete {
+  margin: 0;
+}
+
+.tempest-admin-btn {
+  display: inline-block;
+  padding: 0.45rem 0.8rem;
+  border: 1px solid var(--tempest-accent);
+  border-radius: var(--tempest-radius);
+  background: #fff;
+}
+
+.tempest-admin-btn:hover {
+  background: #eff6ff;
+  text-decoration: none;
+}
+
+.tempest-admin-btn--danger {
+  background: var(--tempest-danger);
+}
+
+.tempest-admin-btn--danger:hover {
+  background: #991b1b;
+}
+
+/* Scoped under __actions so it beats \`.tempest-admin-list__actions a\`
+   (otherwise the white action-link background won + white text = invisible). */
+.tempest-admin-list__actions a.tempest-admin-list__new,
+a.tempest-admin-list__new {
+  background: var(--tempest-accent);
+  color: #fff;
+  border-color: var(--tempest-accent);
+}
+
+.tempest-admin-list__actions a.tempest-admin-list__new:hover,
+a.tempest-admin-list__new:hover {
+  background: var(--tempest-accent-hover);
+  color: #fff;
+}
+
+/* Create / edit form. */
+.tempest-admin-form__form {
+  display: grid;
+  gap: 1rem;
+  max-width: 640px;
+  background: #fff;
+  padding: 1.5rem;
+  border-radius: var(--tempest-radius);
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-form__field {
+  display: flex;
+  flex-direction: column;
+  gap: 0.3rem;
+}
+
+.tempest-admin-form__field > label {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+}
+
+.tempest-admin-form__field > label > span {
+  font-weight: 600;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-form__field input,
+.tempest-admin-form__field select,
+.tempest-admin-form__field textarea {
+  width: 100%;
+}
+
+.tempest-admin-form__json {
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 0.85rem;
+  white-space: pre;
+  overflow-wrap: normal;
+  overflow-x: auto;
+}
+
+.tempest-admin-form__check {
+  flex-direction: row !important;
+  align-items: center;
+  gap: 0.5rem;
+}
+
+.tempest-admin-form__check input {
+  width: auto;
+}
+
+.tempest-admin-form__field--error input,
+.tempest-admin-form__field--error select,
+.tempest-admin-form__field--error textarea {
+  border-color: var(--tempest-danger);
+}
+
+.tempest-admin-form__field-error {
+  color: var(--tempest-danger);
+}
+
+.tempest-admin-form__error {
+  background: #fef2f2;
+  color: var(--tempest-danger);
+  padding: 0.75rem 1rem;
+  border-radius: var(--tempest-radius);
+  margin-bottom: 1rem;
+}
+
+.tempest-admin-form__actions {
+  display: flex;
+  gap: 1rem;
+  align-items: center;
+}
+
+/* ---- Responsive ---- */
+
+/* Tablet and below. */
+@media (max-width: 1023px) {
+  .tempest-admin-main {
+    margin: 1.25rem auto;
+    padding: 0 1rem;
+  }
+}
+
+/* Mobile (<= 430px and small phones). */
+@media (max-width: 600px) {
+  .tempest-admin-header {
+    flex-direction: column;
+    align-items: flex-start;
+    gap: 0.5rem;
+    padding: 0.75rem 1rem;
+  }
+
+  .tempest-admin-header__nav {
+    width: 100%;
+    flex-wrap: wrap;
+    gap: 0.5rem 0.75rem;
+  }
+
+  .tempest-admin-main {
+    margin: 1rem auto;
+    padding: 0 0.75rem;
+  }
+
+  .tempest-admin-list__header {
+    flex-direction: column;
+    gap: 0.25rem;
+    align-items: flex-start;
+  }
+
+  .tempest-admin-list__toolbar {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .tempest-admin-list__filters {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .tempest-admin-list__filters input,
+  .tempest-admin-list__filters select,
+  .tempest-admin-list__filters button {
+    width: 100%;
+  }
+
+  .tempest-admin-list__actions {
+    justify-content: stretch;
+  }
+
+  .tempest-admin-list__actions a {
+    flex: 1;
+    text-align: center;
+  }
+
+  /* Stack the detail grid into single-column rows. */
+  .tempest-admin-detail__fields {
+    grid-template-columns: 1fr;
+    gap: 0.15rem 0;
+    padding: 1rem;
+  }
+
+  /* The logs table becomes stacked cards. Horizontal scroll is fine for a
+     list view you skim, but the logs table's fourth column carries the
+     message, the request context and the traceback \u2014 everything you came to
+     read \u2014 so at this width it sat off-screen behind a sideways drag, and an
+     opened traceback showed up only as a tall blank row. Labels come from
+     each cell's data-label, so the header can be dropped without losing
+     which value is which. Scoped to this table: the other list views keep
+     the scroll treatment. */
+  .tempest-admin-logs .tempest-admin-table-wrap {
+    overflow-x: visible;
+  }
+
+  .tempest-admin-logs__table thead {
+    display: none;
+  }
+
+  .tempest-admin-logs__table,
+  .tempest-admin-logs__table tbody,
+  .tempest-admin-logs__table tr,
+  .tempest-admin-logs__table td {
+    display: block;
+    width: 100%;
+  }
+
+  .tempest-admin-logs__table tr {
+    padding: 0.85rem 0.9rem;
+    border-bottom: 1px solid #e2e8f0;
+  }
+
+  .tempest-admin-logs__table tr:last-child {
+    border-bottom: none;
+  }
+
+  .tempest-admin-logs__table td {
+    padding: 0.1rem 0;
+    border: none;
+  }
+
+  .tempest-admin-logs__table td[data-label]::before {
+    content: attr(data-label);
+    display: block;
+    color: var(--tempest-fg-soft);
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+    font-size: 0.64rem;
+    font-weight: 600;
+  }
+
+  /* The message is the card's body, not another labelled field. */
+  .tempest-admin-logs__table td.tempest-admin-logs__msg {
+    margin-top: 0.5rem;
+  }
+
+  .tempest-admin-logs__table td.tempest-admin-logs__msg::before {
+    display: none;
+  }
+
+  .tempest-admin-logs__logger {
+    white-space: normal;
+    overflow-wrap: anywhere;
+  }
+
+  .tempest-admin-detail__fields dt {
+    margin-top: 0.75rem;
+  }
+
+  .tempest-admin-detail__fields dd {
+    padding-bottom: 0.5rem;
+    border-bottom: 1px solid #e2e8f0;
+  }
+
+  .tempest-admin-login {
+    margin: 1.5rem auto;
+    padding: 1.5rem;
+  }
+
+  .tempest-admin-form__form {
+    padding: 1rem;
+  }
+
+  .tempest-admin-form__actions {
+    flex-direction: column-reverse;
+    align-items: stretch;
+  }
+
+  .tempest-admin-form__actions button,
+  .tempest-admin-form__actions .tempest-admin-form__cancel {
+    width: 100%;
+    text-align: center;
+  }
+
+  .tempest-admin-bulk__bar {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .tempest-admin-bulk__bar select,
+  .tempest-admin-bulk__bar button {
+    width: 100%;
+  }
+}
+
+/* ---- Application logs page ---- */
+.tempest-log-badge {
+  display: inline-block;
+  padding: 0.1rem 0.5rem;
+  border-radius: 999px;
+  font-size: 0.72rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+  background: #e2e8f0;
+  color: #334155;
+}
+
+.tempest-log-badge--debug {
+  background: #e2e8f0;
+  color: #475569;
+}
+
+.tempest-log-badge--info {
+  background: #dbeafe;
+  color: #1e40af;
+}
+
+.tempest-log-badge--warning {
+  background: #fef3c7;
+  color: #92400e;
+}
+
+.tempest-log-badge--error {
+  background: #fee2e2;
+  color: #991b1b;
+}
+
+.tempest-log-badge--critical {
+  background: #7f1d1d;
+  color: #fff;
+}
+
+.tempest-admin-logs__ts {
+  white-space: nowrap;
+  font-variant-numeric: tabular-nums;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-logs__logger {
+  color: var(--tempest-fg-soft);
+  white-space: nowrap;
+}
+
+.tempest-admin-logs__msg {
+  word-break: break-word;
+}
+
+.tempest-admin-logs__empty {
+  color: var(--tempest-fg-soft);
+  background: #fff;
+  padding: 1.5rem;
+  border-radius: var(--tempest-radius);
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-logs__actions {
+  display: flex;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+}
+
+.tempest-admin-logs__export {
+  display: inline-block;
+  padding: 0.35rem 0.75rem;
+  border-radius: var(--tempest-radius);
+  border: 1px solid #cbd5e1;
+  background: #fff;
+  color: #334155;
+  font-size: 0.82rem;
+  font-weight: 600;
+  text-decoration: none;
+}
+
+.tempest-admin-logs__export:hover {
+  background: #f1f5f9;
+}
+
+.tempest-admin-logs__meta {
+  list-style: none;
+  margin: 0.4rem 0 0;
+  padding: 0;
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.3rem 0.75rem;
+  font-size: 0.75rem;
+}
+
+/* The gap is layout only \u2014 it does not survive a copy, and an operator copying a
+   row to paste into an issue would get "status_code404". The template keeps a
+   real space between the label and the value for that; this widens the visual
+   separation on top of it, since an uppercase micro-label sitting against a
+   monospace value reads as one token. */
+.tempest-admin-logs__meta li {
+  display: inline-flex;
+  align-items: baseline;
+  gap: 0.4rem;
+}
+
+.tempest-admin-logs__meta span {
+  color: var(--tempest-fg-soft);
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+  font-size: 0.68rem;
+}
+
+.tempest-admin-logs__meta code {
+  word-break: break-all;
+}
+
+/* Collapsed by default so a page full of 500s stays scannable; details/summary
+   keeps that working with no JavaScript, which the admin does not ship. */
+.tempest-admin-logs__trace {
+  margin-top: 0.5rem;
+}
+
+/* The summary carries the record's own message, so the whole item is the click
+   target instead of a separate link. It must therefore read as body text, not
+   as a control \u2014 the affordance is the marker plus the hint chip. */
+.tempest-admin-logs__trace summary {
+  cursor: pointer;
+  list-style: none;
+  display: block;
+}
+
+.tempest-admin-logs__trace summary::-webkit-details-marker {
+  display: none;
+}
+
+.tempest-admin-logs__msg-text::before {
+  content: "\u25B8";
+  display: inline-block;
+  width: 0.9rem;
+  color: #991b1b;
+  font-size: 0.7rem;
+}
+
+.tempest-admin-logs__trace[open] .tempest-admin-logs__msg-text::before {
+  content: "\u25BE";
+}
+
+.tempest-admin-logs__trace-hint {
+  display: inline-block;
+  margin-top: 0.3rem;
+  font-size: 0.68rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: #991b1b;
+}
+
+.tempest-admin-logs__trace[open] .tempest-admin-logs__trace-hint {
+  opacity: 0.55;
+}
+
+/* Lines wrap instead of extending. A <pre> is sized by its longest line and it
+   sits in a table cell, which sizes to content, so \`overflow-x\` on the <pre>
+   cannot shrink it: the table grew past its scroll container (measured 1364px
+   against a 1012px wrap) and the trace could only be read by dragging the table
+   sideways. Wrapping keeps the table at its container width. It costs the
+   alignment of the caret markers on screen; the markdown export carries the
+   exact unwrapped text for real analysis. */
+.tempest-admin-logs__trace pre {
+  margin: 0.5rem 0 0;
+  padding: 0.75rem;
+  max-height: 24rem;
+  overflow-y: auto;
+  background: #0f172a;
+  color: #e2e8f0;
+  border-radius: var(--tempest-radius);
+  font-size: 0.74rem;
+  line-height: 1.45;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+  -webkit-user-select: all;
+  user-select: all;
+}
+
+.tempest-admin-logs__note {
+  color: var(--tempest-fg-soft);
+  font-size: 0.8rem;
+  margin-top: 0.75rem;
+}
+
+/* ---- Sidebar off-canvas on tablet/mobile, burger reveals it ---- */
+@media (max-width: 768px) {
+  .tempest-admin-burger {
+    display: flex;
+  }
+
+  .tempest-admin-sidebar {
+    position: fixed;
+    top: 0;
+    left: 0;
+    bottom: 0;
+    z-index: 50;
+    width: 240px;
+    flex-basis: 240px;
+    transform: translateX(-100%);
+    transition: transform 0.2s ease;
+    overflow-y: auto;
+    box-shadow: 0 0 24px rgba(15, 23, 42, 0.35);
+  }
+
+  .tempest-admin-navtoggle:checked ~ .tempest-admin-layout .tempest-admin-sidebar {
+    transform: translateX(0);
+  }
+
+  .tempest-admin-navtoggle:checked ~ .tempest-admin-layout .tempest-admin-scrim {
+    display: block;
+    position: fixed;
+    inset: 0;
+    z-index: 40;
+    background: rgba(15, 23, 42, 0.45);
+  }
+}
+
+/* ---- Desktop: sidebar overlays the header + footer ---- */
+@media (min-width: 769px) {
+  .tempest-admin-sidebar {
+    position: fixed;
+    top: 0;
+    left: 0;
+    bottom: 0;
+    z-index: 100;        /* above header/footer (z-index: 20) */
+    overflow-y: auto;
+    /* Clear the header bar so the first nav link sits below it. */
+    padding-top: 3.75rem;
+  }
+
+  /* The fixed sidebar leaves the flex flow, so reserve its gutter on
+     the layout row to keep the main content from sliding underneath. */
+  .tempest-admin-layout {
+    padding-left: 220px;
+  }
+}
+
+/* Flash banner shown after a custom bulk action runs. */
+.tempest-admin-flash {
+  margin: 0 0 1rem;
+  padding: 0.7rem 1rem;
+  border-radius: var(--tempest-radius);
+  border-left: 4px solid var(--tempest-accent);
+  background: var(--tempest-bg);
+  color: var(--tempest-fg);
+}
+
+.tempest-admin-flash--error {
+  border-left-color: var(--tempest-danger);
+}
+
+.tempest-admin-flash--warning {
+  border-left-color: #d97706;
+}
+
+/* Task panel \u2014 declared schedule and persisted runs. */
+.tempest-admin-tasks__scope {
+  margin: 0 0 1.25rem;
+  color: var(--tempest-fg-soft);
+  font-size: 0.9rem;
+}
+
+.tempest-admin-tasks__heading {
+  margin: 1.75rem 0 0.75rem;
+  font-size: 1.05rem;
+}
+
+.tempest-admin-tasks__empty {
+  padding: 1rem;
+  border: 1px dashed var(--tempest-border);
+  border-radius: var(--tempest-radius);
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-tasks__trigger + .tempest-admin-tasks__trigger {
+  margin-top: 0.35rem;
+}
+
+.tempest-admin-tasks__offset {
+  color: var(--tempest-fg-soft);
+  font-size: 0.85rem;
+  white-space: nowrap;
+}
+
+.tempest-admin-tasks__status {
+  display: inline-block;
+  padding: 0.1rem 0.5rem;
+  border-radius: 999px;
+  font-size: 0.8rem;
+  border: 1px solid var(--tempest-border);
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-tasks__status--running {
+  border-color: var(--tempest-accent);
+  color: var(--tempest-accent);
+}
+
+.tempest-admin-tasks__status--done {
+  border-color: #15803d;
+  color: #15803d;
+}
+
+.tempest-admin-tasks__status--failed {
+  border-color: var(--tempest-danger);
+  color: var(--tempest-danger);
+}
+
+/* Cancelled is terminal but not a failure, so it stays neutral: an
+   operator scanning for red should find only what went wrong. */
+.tempest-admin-tasks__status--cancelled {
+  border-color: var(--tempest-border);
+  color: var(--tempest-fg-soft);
+}
+
+/* The track uses the border token, not a row background: the list stripes
+   rows with --tempest-bg-row-alt, so a track painted in it vanished on
+   every other row \u2014 an empty progress cell reads as "no data", not as 0%. */
+.tempest-admin-tasks__bar {
+  display: inline-block;
+  width: 90px;
+  height: 8px;
+  border-radius: 999px;
+  background: var(--tempest-border);
+  overflow: hidden;
+  vertical-align: middle;
+}
+
+.tempest-admin-tasks__bar--wide {
+  display: block;
+  width: 100%;
+  height: 12px;
+  margin: 0 0 1.25rem;
+}
+
+.tempest-admin-tasks__bar-fill {
+  display: block;
+  height: 100%;
+  background: var(--tempest-accent);
+}
+
+.tempest-admin-tasks__facts {
+  display: grid;
+  grid-template-columns: max-content 1fr;
+  gap: 0.4rem 1.25rem;
+  margin: 0 0 1.5rem;
+}
+
+.tempest-admin-tasks__facts dt {
+  color: var(--tempest-fg-soft);
+  font-size: 0.85rem;
+}
+
+.tempest-admin-tasks__facts dd {
+  margin: 0;
+}
+
+.tempest-admin-tasks__error pre {
+  padding: 0.85rem;
+  border-radius: var(--tempest-radius);
+  border-left: 4px solid var(--tempest-danger);
+  background: var(--tempest-bg-row-alt);
+  overflow-x: auto;
+  white-space: pre-wrap;
+}
+
+.tempest-admin-tasks__cancel {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+  margin: 0 0 1.5rem;
+}
+
+.tempest-admin-tasks__hint {
+  color: var(--tempest-fg-soft);
+  font-size: 0.85rem;
+}
+
+@media (max-width: 640px) {
+  .tempest-admin-tasks__facts {
+    grid-template-columns: 1fr;
+    gap: 0.15rem;
+  }
+
+  .tempest-admin-tasks__facts dd {
+    margin: 0 0 0.6rem;
+  }
+}
+`;
+
+// src/admin/theme.ts
+var FORBIDDEN_CHARS = ["<", ">", "{", "}", '"'];
+function assertSafe(field, value) {
+  if (value === void 0) return;
+  const bad = FORBIDDEN_CHARS.filter((char) => value.includes(char));
+  if (bad.length > 0) {
+    throw new Error(
+      `AdminTheme.${field} contains forbidden character(s) ${bad.join(" ")}; these would break the injected <style>/HTML. Got: ${value}`
+    );
+  }
+}
+function resolveAdminTheme(theme = {}) {
+  for (const [field, value] of Object.entries(theme)) {
+    if (typeof value === "string") assertSafe(field, value);
+  }
+  const headerBg = theme.headerBg ?? "#0f172a";
+  return {
+    accent: theme.accent ?? "#2563eb",
+    accentHover: theme.accentHover ?? "#1d4ed8",
+    danger: theme.danger ?? "#b91c1c",
+    headerBg,
+    sidebarBg: theme.sidebarBg ?? headerBg,
+    pageBg: theme.pageBg ?? null,
+    radius: theme.radius ?? "6px",
+    fontFamily: theme.fontFamily ?? null,
+    logoUrl: theme.logoUrl ?? null,
+    logoAlt: theme.logoAlt ?? "Logo",
+    faviconUrl: theme.faviconUrl ?? null,
+    footerText: theme.footerText ?? "Powered by tempest-express-sdk",
+    darkMode: theme.darkMode ?? false,
+    customCssUrl: theme.customCssUrl ?? null
+  };
+}
+function adminThemeCss(theme) {
+  const variables = {
+    "--tempest-accent": theme.accent,
+    "--tempest-accent-hover": theme.accentHover,
+    "--tempest-danger": theme.danger,
+    "--tempest-bg": theme.headerBg,
+    "--tempest-bg-soft": theme.sidebarBg,
+    "--tempest-radius": theme.radius
+  };
+  if (theme.fontFamily !== null) variables["--tempest-font"] = theme.fontFamily;
+  if (theme.pageBg !== null) variables["--tempest-page-bg"] = theme.pageBg;
+  const rootLines = Object.entries(variables).map(([name, value]) => `  ${name}: ${value};`).join("\n");
+  const blocks = [`:root {
+${rootLines}
+}`];
+  if (theme.darkMode && theme.pageBg === null) {
+    blocks.push(
+      [
+        ":root {",
+        "  --tempest-page-bg: #0b1120;",
+        "  --tempest-bg-row: #1e293b;",
+        "  --tempest-bg-row-alt: #172033;",
+        "  --tempest-fg: #e2e8f0;",
+        "  --tempest-fg-soft: #94a3b8;",
+        "}",
+        "body { color: var(--tempest-fg); }",
+        "input, select, textarea {",
+        "  background: #1e293b;",
+        "  color: var(--tempest-fg);",
+        "  border-color: #334155;",
+        "}"
+      ].join("\n")
+    );
+  }
+  if (theme.fontFamily !== null) {
+    blocks.push("body { font-family: var(--tempest-font); }");
+  }
+  return blocks.join("\n");
+}
+
+// src/admin/templates.ts
+function escapeHtml(value) {
+  return String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function renderLayout(context, title, body) {
+  const { site, theme, prefix, session, currentPath, navModels, messages } = context;
+  const authed = session !== null;
+  const indexUrl = `${prefix}/`;
+  const navLink = (url, label, active) => `<a href="${escapeHtml(url)}" class="tempest-admin-sidebar__link${active ? " tempest-admin-sidebar__link--active" : ""}">${escapeHtml(label)}</a>`;
+  const sidebar = authed ? `<label for="tempest-nav-toggle" class="tempest-admin-scrim" aria-hidden="true"></label>
+    <aside class="tempest-admin-sidebar">
+      <nav class="tempest-admin-sidebar__nav" aria-label="Admin navigation">
+        ${navLink(indexUrl, "Dashboard", currentPath === indexUrl)}
+        ${navModels.length > 0 ? `<span class="tempest-admin-sidebar__heading">Models</span>${navModels.map(
+    (entry) => navLink(entry.url, entry.label, currentPath.startsWith(entry.url))
+  ).join("")}` : ""}
+      </nav>
+    </aside>` : "";
+  const brand = theme.logoUrl !== null ? `<img src="${escapeHtml(theme.logoUrl)}" alt="${escapeHtml(theme.logoAlt)}" class="tempest-admin-header__logo">` : escapeHtml(site.brandText());
+  const headerNav = authed ? `<nav class="tempest-admin-header__nav">
+      <span class="tempest-admin-header__user">${escapeHtml(session.displayName)}</span>
+      ${site.siteUrl !== null ? `<a href="${escapeHtml(site.siteUrl)}">View site</a>` : ""}
+      <form method="post" action="${escapeHtml(`${prefix}/logout`)}" class="tempest-admin-header__logout">
+        <input type="hidden" name="csrf_token" value="${escapeHtml(session.csrfToken)}">
+        <button type="submit">Logout</button>
+      </form>
+    </nav>` : "";
+  const banners = messages.length > 0 ? `<ul class="tempest-admin-messages">${messages.map(
+    (message) => `<li class="tempest-admin-messages__item tempest-admin-messages__item--${escapeHtml(
+      message.level
+    )}">${escapeHtml(message.text)}</li>`
+  ).join("")}</ul>` : "";
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${escapeHtml(title)}</title>
+  ${theme.faviconUrl !== null ? `<link rel="icon" href="${escapeHtml(theme.faviconUrl)}">` : ""}
+  <link rel="stylesheet" href="${escapeHtml(`${prefix}/static/admin.css`)}">
+  <style>${adminThemeCss(theme)}</style>
+  ${theme.customCssUrl !== null ? `<link rel="stylesheet" href="${escapeHtml(theme.customCssUrl)}">` : ""}
+</head>
+<body>
+  ${authed ? '<input type="checkbox" id="tempest-nav-toggle" class="tempest-admin-navtoggle" hidden>' : ""}
+  <header class="tempest-admin-header">
+    <div class="tempest-admin-header__left">
+      ${authed ? `<label for="tempest-nav-toggle" class="tempest-admin-burger" aria-label="Toggle navigation"><span></span><span></span><span></span></label>` : ""}
+      <div class="tempest-admin-header__brand"><a href="${escapeHtml(indexUrl)}">${brand}</a></div>
+    </div>
+    ${headerNav}
+  </header>
+  <div class="tempest-admin-layout">
+    ${sidebar}
+    <main class="tempest-admin-main">
+      ${banners}
+      ${body}
+    </main>
+  </div>
+  <footer class="tempest-admin-footer"><small>${escapeHtml(theme.footerText)}</small></footer>
+</body>
+</html>`;
+}
+function renderLoginPage(context, error) {
+  const body = `<section class="tempest-admin-login">
+  <h1>Sign in</h1>
+  <p>${escapeHtml(context.site.indexSubtitle)}</p>
+  ${error !== null ? `<p class="tempest-admin-login__error" role="alert">${escapeHtml(error)}</p>` : ""}
+  <form method="post" action="${escapeHtml(`${context.prefix}/login`)}" class="tempest-admin-login__form">
+    <label><span>Email</span><input type="email" name="identifier" autocomplete="username" required autofocus></label>
+    <label><span>Password</span><input type="password" name="password" autocomplete="current-password" required></label>
+    <button type="submit">Sign in</button>
+  </form>
+</section>`;
+  return renderLayout(context, `Sign in \xB7 ${context.site.title}`, body);
+}
+function renderMfaPage(context, error) {
+  const body = `<section class="tempest-admin-login">
+  <h1>Two-factor code</h1>
+  <p>Enter the 6-digit code from your authenticator app.</p>
+  ${error !== null ? `<p class="tempest-admin-login__error" role="alert">${escapeHtml(error)}</p>` : ""}
+  <form method="post" action="${escapeHtml(`${context.prefix}/mfa`)}" class="tempest-admin-login__form">
+    <label><span>Code</span><input type="text" name="code" inputmode="numeric" autocomplete="one-time-code" required autofocus></label>
+    <button type="submit">Verify</button>
+  </form>
+</section>`;
+  return renderLayout(context, `Two-factor \xB7 ${context.site.title}`, body);
+}
+function renderDashboardPage(context, cards, metrics) {
+  const metricsPanel = metrics === null ? "" : `<div class="tempest-admin-stats" aria-label="System metrics">
+    <div class="tempest-admin-stat">
+      <span class="tempest-admin-stat__label">CPU</span>
+      <span class="tempest-admin-stat__value">${escapeHtml(metrics.cpuPercent)}%</span>
+    </div>
+    <div class="tempest-admin-stat">
+      <span class="tempest-admin-stat__label">Memory</span>
+      <span class="tempest-admin-stat__value">${escapeHtml(metrics.memoryPercent)}%</span>
+      <span class="tempest-admin-stat__sub">${escapeHtml(metrics.memoryUsedGb)} / ${escapeHtml(metrics.memoryTotalGb)} GB</span>
+    </div>
+  </div>`;
+  const models = cards.length > 0 ? `<div class="tempest-admin-models">${cards.map(
+    (card) => `<article class="tempest-admin-model-card">
+      <header class="tempest-admin-model-card__head">
+        <h2>${escapeHtml(card.label)}</h2>
+        ${card.count !== null ? `<span class="tempest-admin-model-card__count">${escapeHtml(card.count)}</span>` : ""}
+      </header>
+      <div class="tempest-admin-model-card__actions">
+        <a href="${escapeHtml(card.url)}">Browse</a>
+        ${card.newUrl !== null ? `<a href="${escapeHtml(card.newUrl)}">+ New</a>` : ""}
+      </div>
+    </article>`
+  ).join("")}</div>` : "<p>No models registered. Register an <code>AdminModel</code> on the <code>AdminSite</code> to populate this dashboard.</p>";
+  const body = `<section class="tempest-admin-dashboard">
+  <h1>${escapeHtml(context.site.title)}</h1>
+  <p>${escapeHtml(context.site.indexSubtitle)}</p>
+  ${metricsPanel}
+  ${models}
+</section>`;
+  return renderLayout(context, context.site.title, body);
+}
+function renderFilter(filter) {
+  const name = `filter_${filter.field}`;
+  if (filter.kind === "select") {
+    const options = filter.options.map(
+      (option) => `<option value="${escapeHtml(option.value)}"${option.selected ? " selected" : ""}>${escapeHtml(option.label)}</option>`
+    ).join("");
+    return `<label><span>${escapeHtml(filter.label)}</span><select name="${escapeHtml(name)}"><option value="">\u2014 any \u2014</option>${options}</select></label>`;
+  }
+  if (filter.kind === "daterange") {
+    return `<label><span>${escapeHtml(filter.label)}</span><span class="tempest-admin-list__daterange">
+      <input type="date" name="${escapeHtml(`${name}_from`)}" value="${escapeHtml(filter.valueFrom)}" aria-label="${escapeHtml(filter.label)} from">
+      <input type="date" name="${escapeHtml(`${name}_to`)}" value="${escapeHtml(filter.valueTo)}" aria-label="${escapeHtml(filter.label)} to">
+    </span></label>`;
+  }
+  return `<label><span>${escapeHtml(filter.label)}</span><input type="text" name="${escapeHtml(name)}" value="${escapeHtml(filter.value)}"></label>`;
+}
+function renderListPage(context, view) {
+  const headers = view.columns.map((column6) => {
+    const state = view.sort[column6];
+    if (state === void 0) return `<th>${escapeHtml(column6)}</th>`;
+    const arrow = state.active ? state.ascending ? "\u25B2" : "\u25BC" : "\u2195";
+    return `<th><a class="tempest-sort${state.active ? " tempest-sort--active" : ""}" href="${escapeHtml(state.url)}"><span>${escapeHtml(column6)}</span><span class="tempest-sort__arrow" aria-hidden="true">${arrow}</span></a></th>`;
+  }).join("");
+  const rows = view.rows.length > 0 ? view.rows.map(
+    (row) => `<tr>${row.cells.map((cell) => `<td>${escapeHtml(cell)}</td>`).join("")}<td><a href="${escapeHtml(row.url)}">View</a></td></tr>`
+  ).join("") : `<tr><td colspan="${view.columns.length + 1}">No records.</td></tr>`;
+  const hasControls = view.searchable || view.filters.length > 0;
+  const body = `<section class="tempest-admin-list">
+  <header class="tempest-admin-list__header">
+    <h1>${escapeHtml(view.title)}</h1>
+    <p>${escapeHtml(view.total)} record${view.total === 1 ? "" : "s"}.</p>
+  </header>
+  <div class="tempest-admin-list__toolbar">
+    <form method="get" class="tempest-admin-list__filters">
+      ${view.searchable ? `<input type="search" name="q" value="${escapeHtml(view.searchValue)}" placeholder="Search\u2026" aria-label="Search">` : ""}
+      ${view.filters.map(renderFilter).join("")}
+      ${hasControls ? '<button type="submit">Apply</button>' : ""}
+    </form>
+    <div class="tempest-admin-list__actions">
+      ${view.newUrl !== null ? `<a class="tempest-admin-list__new" href="${escapeHtml(view.newUrl)}">+ New</a>` : ""}
+    </div>
+  </div>
+  <div class="tempest-admin-table-wrap">
+    <table class="tempest-admin-list__table">
+      <thead><tr>${headers}<th>Actions</th></tr></thead>
+      <tbody>${rows}</tbody>
+    </table>
+  </div>
+  ${view.pages > 1 ? `<nav class="tempest-admin-list__pagination" aria-label="Pagination">
+    ${view.prevUrl !== null ? `<a href="${escapeHtml(view.prevUrl)}">\u2190 Prev</a>` : ""}
+    <span>Page ${escapeHtml(view.page)} of ${escapeHtml(view.pages)}</span>
+    ${view.nextUrl !== null ? `<a href="${escapeHtml(view.nextUrl)}">Next \u2192</a>` : ""}
+  </nav>` : ""}
+</section>`;
+  return renderLayout(context, `${view.title} \xB7 ${context.site.title}`, body);
+}
+function renderDetailPage(context, view) {
+  if (context.session === null) throw new Error("The detail view requires a session");
+  const csrf = escapeHtml(context.session.csrfToken);
+  const fields = view.fields.map(
+    (field) => `<dt>${escapeHtml(field.label)}</dt><dd>${field.value === "" ? "<em>\u2014</em>" : escapeHtml(field.value)}</dd>`
+  ).join("");
+  const body = `<section class="tempest-admin-detail">
+  <header class="tempest-admin-detail__header">
+    <h1>${escapeHtml(view.title)} \xB7 ${escapeHtml(view.identity)}</h1>
+    <div class="tempest-admin-detail__actions">
+      <a href="${escapeHtml(view.backUrl)}">\u2190 Back to list</a>
+      ${view.editUrl !== null ? `<a class="tempest-admin-btn" href="${escapeHtml(view.editUrl)}">Edit</a>` : ""}
+      ${view.deleteUrl !== null ? `<form method="post" action="${escapeHtml(view.deleteUrl)}" class="tempest-admin-detail__delete" onsubmit="return confirm('Delete this record? This cannot be undone.');">
+        <input type="hidden" name="csrf_token" value="${csrf}">
+        <button type="submit" class="tempest-admin-btn--danger">Delete</button>
+      </form>` : ""}
+    </div>
+  </header>
+  <dl class="tempest-admin-detail__fields">${fields}</dl>
+</section>`;
+  return renderLayout(context, `${view.title} \xB7 ${view.identity}`, body);
+}
+function renderFormField(field) {
+  const required = field.required ? " required" : "";
+  const name = escapeHtml(field.name);
+  const value = escapeHtml(field.value);
+  const label = escapeHtml(field.label);
+  let control;
+  switch (field.widget) {
+    case "checkbox":
+      control = `<label class="tempest-admin-form__check"><input type="checkbox" name="${name}" value="true"${field.checked ? " checked" : ""}><span>${label}</span></label>`;
+      break;
+    case "textarea":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><textarea name="${name}" rows="4"${required}>${value}</textarea></label>`;
+      break;
+    case "json":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><textarea name="${name}" rows="6" class="tempest-admin-form__json" spellcheck="false"${required}>${value}</textarea><small class="tempest-admin-form__hint">JSON \u2014 must parse (e.g. <code>{}</code>, <code>[]</code>, <code>"text"</code>).</small></label>`;
+      break;
+    case "select": {
+      const blank = field.required ? "" : '<option value="">\u2014 none \u2014</option>';
+      const options = field.options.map(
+        (option) => `<option value="${escapeHtml(option.value)}"${option.value === field.value ? " selected" : ""}>${escapeHtml(option.label)}</option>`
+      ).join("");
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><select name="${name}"${required}>${blank}${options}</select></label>`;
+      break;
+    }
+    case "number":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="number" name="${name}" value="${value}"${field.step !== null ? ` step="${escapeHtml(field.step)}"` : ""}${required}></label>`;
+      break;
+    case "datetime":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="datetime-local" name="${name}" value="${value}"${required}></label>`;
+      break;
+    case "date":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="date" name="${name}" value="${value}"${required}></label>`;
+      break;
+    case "time":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="time" name="${name}" value="${value}"${required}></label>`;
+      break;
+    default:
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="text" name="${name}" value="${value}"${required}></label>`;
+  }
+  const error = field.error !== null ? `<small class="tempest-admin-form__field-error">${escapeHtml(field.error)}</small>` : "";
+  return `<div class="tempest-admin-form__field${field.error !== null ? " tempest-admin-form__field--error" : ""}">${control}${error}</div>`;
+}
+function renderFormPage(context, view) {
+  if (context.session === null) throw new Error("The admin form requires a session");
+  const heading = view.mode === "create" ? `New ${view.title}` : `Edit ${view.title}`;
+  const body = `<section class="tempest-admin-form">
+  <header class="tempest-admin-detail__header">
+    <h1>${escapeHtml(heading)}</h1>
+    <a href="${escapeHtml(view.backUrl)}">\u2190 Back</a>
+  </header>
+  ${view.error !== null ? `<p class="tempest-admin-form__error">${escapeHtml(view.error)}</p>` : ""}
+  <form method="post" action="${escapeHtml(view.actionUrl)}" class="tempest-admin-form__form">
+    <input type="hidden" name="csrf_token" value="${escapeHtml(context.session.csrfToken)}">
+    ${view.fields.map(renderFormField).join("")}
+    <div class="tempest-admin-form__actions">
+      <button type="submit">${view.mode === "create" ? "Create" : "Save"}</button>
+      <a href="${escapeHtml(view.backUrl)}" class="tempest-admin-form__cancel">Cancel</a>
+    </div>
+  </form>
+</section>`;
+  return renderLayout(context, `${heading} \xB7 ${context.site.title}`, body);
+}
+var logger2 = new JSONLogger("tempest_express_sdk.admin.router");
+var FLASH_MESSAGES = {
+  created: { text: "Record created.", level: "success" },
+  updated: { text: "Record updated.", level: "success" },
+  deleted: { text: "Record deleted.", level: "success" }
+};
+function queryString(value) {
+  if (typeof value === "string") return value.trim();
+  if (Array.isArray(value) && typeof value[0] === "string") return value[0].trim();
+  return "";
+}
+function buildQuery(entries) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(entries)) {
+    if (value === void 0 || value === "") continue;
+    params.set(key, String(value));
+  }
+  return params.toString();
+}
+function makeAdminRouter(site, options) {
+  const prefix = (options.prefix ?? "/admin").replace(/\/$/, "");
+  const theme = resolveAdminTheme(site.theme);
+  const showMetrics = options.showMetrics ?? true;
+  const sessions = new AdminSessionStore({
+    secret: options.secretKey,
+    ...options.cookieName === void 0 ? {} : { cookieName: options.cookieName },
+    ...options.sessionMaxAgeSeconds === void 0 ? {} : { maxAgeSeconds: options.sessionMaxAgeSeconds },
+    ...options.cookieSecure === void 0 ? {} : { cookieSecure: options.cookieSecure },
+    cookiePath: prefix === "" ? "/" : prefix
+  });
+  const backend = options.authBackend;
+  const router = express3__default.default.Router();
+  router.use(prefix, express3__default.default.urlencoded({ extended: false }));
+  const context = (req, session) => ({
+    site,
+    theme,
+    prefix,
+    session,
+    currentPath: req.originalUrl.split("?")[0] ?? req.path,
+    navModels: site.list().map((admin) => ({
+      label: admin.verboseNamePlural(),
+      url: `${prefix}/m/${admin.slug()}`
+    })),
+    messages: flashFor(req)
+  });
+  const flashFor = (req) => {
+    const message = FLASH_MESSAGES[queryString(req.query.ok)];
+    return message === void 0 ? [] : [message];
+  };
+  const html = (res, body, status = 200) => {
+    res.status(status).type("html").send(body);
+  };
+  const guarded = (handler) => (req, res) => {
+    handler(req, res).catch((error) => {
+      logger2.error("Admin request failed", {
+        path: req.originalUrl,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      if (res.headersSent) return;
+      html(
+        res,
+        renderLoginPage(context(req, null), "Something went wrong. Please try again."),
+        500
+      );
+    });
+  };
+  const authenticate = async (req, res) => {
+    const session = sessions.load(req);
+    if (session === null) {
+      res.redirect(`${prefix}/login`);
+      return null;
+    }
+    const dbSession = options.engine.session();
+    const principal = await backend.loadPrincipal(dbSession, session.subject);
+    if (principal === null) {
+      sessions.clear(res);
+      res.redirect(`${prefix}/login`);
+      return null;
+    }
+    if (!session.mfaPassed) {
+      res.redirect(`${prefix}/mfa`);
+      return null;
+    }
+    return { session, dbSession };
+  };
+  const resolveAdmin = (req, res, state) => {
+    const admin = site.get(String(req.params.slug));
+    if (admin === null) {
+      html(res, renderNotFound(context(req, state.session)), 404);
+      return null;
+    }
+    return admin;
+  };
+  const renderNotFound = (ctx) => renderDashboardPage(
+    { ...ctx, messages: [{ text: "Not found.", level: "error" }] },
+    [],
+    null
+  );
+  const checkCsrf = (req, res, state) => {
+    const body = req.body;
+    if (csrfTokenMatches(state.session, body?.csrf_token)) return true;
+    html(res, renderNotFound(context(req, state.session)), 403);
+    return false;
+  };
+  router.get(`${prefix}/static/admin.css`, (_req, res) => {
+    res.type("css").set("cache-control", "public, max-age=3600").send(ADMIN_CSS);
+  });
+  router.get(`${prefix}/login`, (req, res) => {
+    html(res, renderLoginPage(context(req, null), null));
+  });
+  router.post(
+    `${prefix}/login`,
+    guarded(async (req, res) => {
+      const body = req.body;
+      const identifier = typeof body.identifier === "string" ? body.identifier : "";
+      const password = typeof body.password === "string" ? body.password : "";
+      const dbSession = options.engine.session();
+      const principal = await backend.authenticate(dbSession, identifier, password);
+      if (principal === null) {
+        html(res, renderLoginPage(context(req, null), "Invalid credentials."), 401);
+        return;
+      }
+      const needsMfa = await backend.mfaEnabled?.(principal) ?? false;
+      const session = sessions.issue(
+        backend.principalId(principal),
+        backend.displayName(principal),
+        !needsMfa
+      );
+      sessions.save(res, session);
+      res.redirect(needsMfa ? `${prefix}/mfa` : `${prefix}/`);
+    })
+  );
+  router.get(`${prefix}/mfa`, (req, res) => {
+    const session = sessions.load(req);
+    if (session === null) {
+      res.redirect(`${prefix}/login`);
+      return;
+    }
+    if (session.mfaPassed) {
+      res.redirect(`${prefix}/`);
+      return;
+    }
+    html(res, renderMfaPage(context(req, null), null));
+  });
+  router.post(
+    `${prefix}/mfa`,
+    guarded(async (req, res) => {
+      const session = sessions.load(req);
+      if (session === null) {
+        res.redirect(`${prefix}/login`);
+        return;
+      }
+      const body = req.body;
+      const code = typeof body.code === "string" ? body.code : "";
+      const dbSession = options.engine.session();
+      const principal = await backend.loadPrincipal(dbSession, session.subject);
+      const verified = principal !== null && (await backend.verifyMfa?.(principal, code) ?? false);
+      if (!verified) {
+        html(res, renderMfaPage(context(req, null), "Invalid code."), 401);
+        return;
+      }
+      sessions.save(res, { ...session, mfaPassed: true });
+      res.redirect(`${prefix}/`);
+    })
+  );
+  router.post(
+    `${prefix}/logout`,
+    guarded(async (req, res) => {
+      const session = sessions.load(req);
+      if (session !== null && !csrfTokenMatches(session, req.body?.csrf_token)) {
+        html(res, renderLoginPage(context(req, null), "Invalid request."), 403);
+        return;
+      }
+      sessions.clear(res);
+      res.redirect(`${prefix}/login`);
+    })
+  );
+  router.get(
+    `${prefix}/`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const cards = [];
+      for (const admin of site.list()) {
+        let count = null;
+        try {
+          count = await admin.repository(state.dbSession).count();
+        } catch (error) {
+          logger2.warning("Admin dashboard count failed", {
+            slug: admin.slug(),
+            error: error instanceof Error ? error.message : String(error)
+          });
+        }
+        cards.push({
+          label: admin.verboseNamePlural(),
+          count,
+          url: `${prefix}/m/${admin.slug()}`,
+          newUrl: admin.canCreate ? `${prefix}/m/${admin.slug()}/new` : null
+        });
+      }
+      let metrics = null;
+      if (showMetrics) {
+        const snapshot2 = MetricsUtils.system();
+        metrics = {
+          cpuPercent: Math.round(snapshot2.cpu.loadPercent),
+          memoryPercent: Math.round(snapshot2.memory.usedPercent),
+          memoryUsedGb: (snapshot2.memory.used / 1024 ** 3).toFixed(1),
+          memoryTotalGb: (snapshot2.memory.total / 1024 ** 3).toFixed(1)
+        };
+      }
+      html(res, renderDashboardPage(context(req, state.session), cards, metrics));
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      html(res, await renderList(req, admin, state));
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug/new`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      if (!admin.canCreate) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      html(
+        res,
+        renderFormPage(context(req, state.session), {
+          mode: "create",
+          title: admin.verboseName(),
+          fields: buildFormFields(admin),
+          actionUrl: `${prefix}/m/${admin.slug()}/new`,
+          backUrl: `${prefix}/m/${admin.slug()}`,
+          error: null
+        })
+      );
+    })
+  );
+  router.post(
+    `${prefix}/m/:slug/new`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      if (!admin.canCreate) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      if (!checkCsrf(req, res, state)) return;
+      const body = req.body;
+      const parsed = parseFormBody(admin, body);
+      const rerender = (error, status) => {
+        html(
+          res,
+          renderFormPage(context(req, state.session), {
+            mode: "create",
+            title: admin.verboseName(),
+            fields: buildFormFields(admin, { values: body, errors: parsed.errors }),
+            actionUrl: `${prefix}/m/${admin.slug()}/new`,
+            backUrl: `${prefix}/m/${admin.slug()}`,
+            error
+          }),
+          status
+        );
+      };
+      if (Object.keys(parsed.errors).length > 0) {
+        rerender("Please fix the highlighted fields.", 400);
+        return;
+      }
+      try {
+        await admin.repository(state.dbSession).create(parsed.data);
+      } catch (error) {
+        rerender(describeWriteFailure(admin, error), 400);
+        return;
+      }
+      res.redirect(`${prefix}/m/${admin.slug()}?ok=created`);
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug/:identity`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      const row = await findRow(admin, state.dbSession, String(req.params.identity));
+      if (row === null) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      const identity = String(row[admin.identityField]);
+      html(
+        res,
+        renderDetailPage(context(req, state.session), {
+          title: admin.verboseName(),
+          identity,
+          fields: admin.detailFieldNames().map((name) => ({ label: name, value: formatCellValue(row[name]) })),
+          backUrl: `${prefix}/m/${admin.slug()}`,
+          editUrl: admin.canEdit ? `${prefix}/m/${admin.slug()}/${identity}/edit` : null,
+          deleteUrl: admin.canDelete ? `${prefix}/m/${admin.slug()}/${identity}/delete` : null
+        })
+      );
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug/:identity/edit`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      const identity = String(req.params.identity);
+      const row = admin.canEdit ? await findRow(admin, state.dbSession, identity) : null;
+      if (row === null) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      html(
+        res,
+        renderFormPage(context(req, state.session), {
+          mode: "edit",
+          title: admin.verboseName(),
+          fields: buildFormFields(admin, { values: row }),
+          actionUrl: `${prefix}/m/${admin.slug()}/${identity}/edit`,
+          backUrl: `${prefix}/m/${admin.slug()}/${identity}`,
+          error: null
+        })
+      );
+    })
+  );
+  router.post(
+    `${prefix}/m/:slug/:identity/edit`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      const identity = String(req.params.identity);
+      if (!admin.canEdit) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      if (!checkCsrf(req, res, state)) return;
+      const body = req.body;
+      const parsed = parseFormBody(admin, body);
+      const rerender = (error, status) => {
+        html(
+          res,
+          renderFormPage(context(req, state.session), {
+            mode: "edit",
+            title: admin.verboseName(),
+            fields: buildFormFields(admin, { values: body, errors: parsed.errors }),
+            actionUrl: `${prefix}/m/${admin.slug()}/${identity}/edit`,
+            backUrl: `${prefix}/m/${admin.slug()}/${identity}`,
+            error
+          }),
+          status
+        );
+      };
+      if (Object.keys(parsed.errors).length > 0) {
+        rerender("Please fix the highlighted fields.", 400);
+        return;
+      }
+      try {
+        const changed = await admin.repository(state.dbSession).update({ [admin.identityField]: identity }, parsed.data);
+        if (changed === 0) {
+          html(res, renderNotFound(context(req, state.session)), 404);
+          return;
+        }
+      } catch (error) {
+        rerender(describeWriteFailure(admin, error), 400);
+        return;
+      }
+      res.redirect(`${prefix}/m/${admin.slug()}/${identity}?ok=updated`);
+    })
+  );
+  router.post(
+    `${prefix}/m/:slug/:identity/delete`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      if (!admin.canDelete) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      if (!checkCsrf(req, res, state)) return;
+      await admin.repository(state.dbSession).delete({ [admin.identityField]: String(req.params.identity) });
+      res.redirect(`${prefix}/m/${admin.slug()}?ok=deleted`);
+    })
+  );
+  async function findRow(admin, dbSession, identity) {
+    const row = await admin.repository(dbSession).first({ [admin.identityField]: identity });
+    return row ?? null;
+  }
+  async function renderList(req, admin, state) {
+    const columns = adminColumns(admin.model);
+    const search = queryString(req.query.q);
+    const page2 = Math.max(1, Number.parseInt(queryString(req.query.page), 10) || 1);
+    const sortField = queryString(req.query.sort);
+    const sortColumn = sortField in columns ? sortField : null;
+    const ascending = sortColumn === null ? admin.orderAscending : queryString(req.query.dir) !== "desc";
+    const conditions = [];
+    const filterViews = [];
+    for (const field of admin.listFilter) {
+      const column6 = columns[field];
+      if (column6 === void 0) continue;
+      const spec = filterForColumn(column6);
+      if (spec.kind === "daterange") {
+        const from = queryString(req.query[`filter_${field}_from`]);
+        const to = queryString(req.query[`filter_${field}_to`]);
+        const bounds = {};
+        if (from !== "") bounds.gte = new Date(from);
+        if (to !== "") bounds.lte = /* @__PURE__ */ new Date(`${to}T23:59:59.999Z`);
+        if (Object.keys(bounds).length > 0) conditions.push({ [field]: bounds });
+        filterViews.push({
+          field,
+          label: humanizeField(field),
+          kind: "daterange",
+          value: "",
+          valueFrom: from,
+          valueTo: to,
+          options: []
+        });
+        continue;
+      }
+      const value = queryString(req.query[`filter_${field}`]);
+      if (value !== "") {
+        conditions.push({
+          [field]: column6.type.kind === "boolean" ? value === "true" : value
+        });
+      }
+      filterViews.push({
+        field,
+        label: humanizeField(field),
+        kind: spec.kind,
+        value,
+        valueFrom: "",
+        valueTo: "",
+        options: spec.options.map((option) => ({
+          value: option.value,
+          label: option.label,
+          selected: option.value === value
+        }))
+      });
+    }
+    const searchable = admin.searchFields.filter((field) => {
+      const column6 = columns[field];
+      return column6 !== void 0 && isSearchableColumn(column6);
+    });
+    if (search !== "" && searchable.length > 0) {
+      conditions.push(
+        tempestDbJs.or(...searchable.map((field) => ({ [field]: { ilike: `%${search}%` } })))
+      );
+    }
+    const where = conditions.length === 0 ? void 0 : tempestDbJs.and(...conditions);
+    const orderBy = sortColumn ?? admin.orderKey ?? void 0;
+    const result = await admin.repository(state.dbSession).paginate({
+      page: page2,
+      pageSize: admin.pageSize,
+      ...orderBy === void 0 ? {} : { orderBy },
+      ascending,
+      ...where === void 0 ? {} : { filters: where }
+    });
+    const displayed = admin.listDisplayNames();
+    const baseQuery = { q: search };
+    for (const view2 of filterViews) {
+      if (view2.kind === "daterange") {
+        baseQuery[`filter_${view2.field}_from`] = view2.valueFrom;
+        baseQuery[`filter_${view2.field}_to`] = view2.valueTo;
+      } else {
+        baseQuery[`filter_${view2.field}`] = view2.value;
+      }
+    }
+    const sort = {};
+    for (const column6 of displayed) {
+      if (!(column6 in columns)) continue;
+      const active = (sortColumn ?? admin.orderKey) === column6;
+      const nextAscending = active ? !ascending : true;
+      sort[column6] = {
+        url: `?${buildQuery({
+          ...baseQuery,
+          sort: column6,
+          dir: nextAscending ? "asc" : "desc"
+        })}`,
+        active,
+        ascending
+      };
+    }
+    const pageUrl = (target) => `?${buildQuery({
+      ...baseQuery,
+      sort: sortColumn ?? void 0,
+      dir: sortColumn === null ? void 0 : ascending ? "asc" : "desc",
+      page: target
+    })}`;
+    const view = {
+      title: admin.verboseNamePlural(),
+      columns: displayed,
+      rows: result.items.map((row) => {
+        const identity = String(row[admin.identityField]);
+        return {
+          identity,
+          cells: displayed.map((column6) => formatCellValue(row[column6])),
+          url: `${prefix}/m/${admin.slug()}/${identity}`
+        };
+      }),
+      total: result.total,
+      page: result.page,
+      pages: result.pages,
+      prevUrl: result.page > 1 ? pageUrl(result.page - 1) : null,
+      nextUrl: result.page < result.pages ? pageUrl(result.page + 1) : null,
+      searchable: searchable.length > 0,
+      searchValue: search,
+      filters: filterViews,
+      sort,
+      newUrl: admin.canCreate ? `${prefix}/m/${admin.slug()}/new` : null
+    };
+    return renderListPage(context(req, state.session), view);
+  }
+  return router;
+}
+function describeWriteFailure(admin, error) {
+  const detail = error instanceof Error ? error.message : String(error);
+  return `The database refused this ${admin.verboseName().toLowerCase()}: ${detail}`;
+}
+
+// src/admin/json/site.ts
+var AdminJsonSite = class {
+  /**
+   * @param brand - Display name surfaced under `GET {prefix}/`.
+   */
+  constructor(brand = "Admin") {
+    this.brand = brand;
+  }
+  brand;
+  resources = /* @__PURE__ */ new Map();
+  /**
+   * Register a resource.
+   *
+   * @param resource - The resource config.
+   * @returns The same resource (for chaining).
+   */
+  register(resource) {
+    this.resources.set(resource.name, resource);
+    return resource;
+  }
+  /** Look up a resource by slug, or `null`. */
+  get(name) {
+    return this.resources.get(name) ?? null;
+  }
+  /** Every registered resource. */
+  list() {
+    return [...this.resources.values()];
+  }
+};
+var PAGINATION_KEYS2 = /* @__PURE__ */ new Set(["page", "pageSize"]);
+function methodNotAllowed(operation) {
+  return new AppException({
+    message: `Operation not allowed: ${operation}`,
+    code: "METHOD_NOT_ALLOWED",
+    statusCode: 405
+  });
+}
+function requireResource(site, name) {
+  const resource = site.get(name);
+  if (!resource) throw new NotFoundException({ message: `Unknown resource: ${name}` });
+  return resource;
+}
+function makeAdminJsonRouter(site, options = {}) {
+  const prefix = (options.prefix ?? "/admin").replace(/\/$/, "");
+  const router = express3.Router();
+  if (options.guard) router.use(prefix, options.guard);
+  router.get(prefix, (_req, res) => {
+    res.json({
+      brand: site.brand,
+      resources: site.list().map((r) => ({ name: r.name, fields: r.fields }))
+    });
+  });
+  router.get(`${prefix}/:resource/_meta`, (req, res) => {
+    const resource = requireResource(site, req.params.resource);
+    res.json({
+      name: resource.name,
+      fields: resource.fields,
+      operations: {
+        create: Boolean(resource.create),
+        update: Boolean(resource.update),
+        remove: Boolean(resource.remove)
+      }
+    });
+  });
+  router.get(`${prefix}/:resource`, async (req, res) => {
+    const resource = requireResource(site, req.params.resource);
+    const filters = {};
+    for (const [key, value] of Object.entries(req.query)) {
+      if (!PAGINATION_KEYS2.has(key) && typeof value === "string") filters[key] = value;
+    }
+    const page2 = Math.max(1, Number.parseInt(String(req.query.page ?? "1"), 10) || 1);
+    const pageSize = Math.max(
+      1,
+      Number.parseInt(String(req.query.pageSize ?? "20"), 10) || 20
+    );
+    res.json(await resource.list({ page: page2, pageSize, filters }));
+  });
+  router.get(`${prefix}/:resource/:id`, async (req, res) => {
+    const resource = requireResource(site, req.params.resource);
+    const record = await resource.get(req.params.id);
+    if (record === null) throw new NotFoundException({ message: "Record not found" });
+    res.json(record);
+  });
+  router.post(`${prefix}/:resource`, async (req, res) => {
+    const resource = requireResource(site, req.params.resource);
+    if (!resource.create) throw methodNotAllowed("create");
+    const data = resource.createSchema ? resource.createSchema.parse(req.body) : req.body;
+    res.status(201).json(await resource.create(data));
+  });
+  router.patch(`${prefix}/:resource/:id`, async (req, res) => {
+    const resource = requireResource(site, req.params.resource);
+    if (!resource.update) throw methodNotAllowed("update");
+    const data = resource.updateSchema ? resource.updateSchema.parse(req.body) : req.body;
+    res.json(await resource.update(req.params.id, data));
+  });
+  router.delete(`${prefix}/:resource/:id`, async (req, res) => {
+    const resource = requireResource(site, req.params.resource);
+    if (!resource.remove) throw methodNotAllowed("remove");
+    await resource.remove(req.params.id);
+    res.status(204).end();
+  });
+  return router;
+}
+
+// src/auth/schemas.ts
+var signupSchema = zod.z.object({
+  email: zod.z.email().openapi({ description: "Login identifier (email)." }),
+  password: zod.z.string().min(1).openapi({ description: "Plaintext password (hashed server-side)." }),
+  name: zod.z.string().max(120).optional().openapi({ description: "Optional display name." })
+}).openapi("Signup");
+var loginSchema = zod.z.object({
+  email: zod.z.email().openapi({ description: "Login identifier (email)." }),
+  password: zod.z.string().min(1).openapi({ description: "Plaintext password." })
+}).openapi("Login");
+var refreshSchema = zod.z.object({
+  refreshToken: zod.z.string().min(1).openapi({ description: "A valid refresh token." })
+}).openapi("Refresh");
+var tokenPairSchema = zod.z.object({
+  accessToken: zod.z.string().openapi({ description: "Short-lived bearer access token." }),
+  refreshToken: zod.z.string().openapi({ description: "Long-lived refresh token." }),
+  tokenType: zod.z.literal("bearer").openapi({ description: "Always 'bearer'." }),
+  expiresIn: zod.z.number().int().openapi({ description: "Access-token lifetime in seconds." })
+}).openapi("TokenPair");
+var userPublicSchema = zod.z.object({
+  id: zod.z.string().openapi({ description: "User id." }),
+  email: zod.z.email().openapi({ description: "User email." }),
+  name: zod.z.string().nullable().openapi({ description: "Display name, or null." }),
+  isActive: zod.z.boolean().openapi({ description: "Whether the account is active." }),
+  roles: zod.z.array(zod.z.string()).openapi({ description: "Assigned role names." })
+}).openapi("UserPublic");
+var authResponseSchema = zod.z.object({
+  user: userPublicSchema,
+  tokens: tokenPairSchema
+}).openapi("AuthResponse");
+var mfaEnrollResponseSchema = zod.z.object({
+  secret: zod.z.string().openapi({ description: "Base32 TOTP secret (manual entry)." }),
+  otpauthUri: zod.z.string().openapi({ description: "otpauth:// URI to render as QR." })
+}).openapi("MfaEnrollResponse");
+var mfaCodeSchema = zod.z.object({ code: zod.z.string().min(1).openapi({ description: "Authenticator code." }) }).openapi("MfaCode");
+var mfaChallengeSchema = zod.z.object({
+  mfaToken: zod.z.string().min(1).openapi({ description: "Challenge token from login." }),
+  code: zod.z.string().min(1).openapi({ description: "Authenticator code." })
+}).openapi("MfaChallenge");
+var activationSchema = zod.z.object({ token: zod.z.string().min(1).openapi({ description: "Activation token." }) }).openapi("Activation");
+var passwordResetRequestSchema = zod.z.object({ email: zod.z.email().openapi({ description: "Account email." }) }).openapi("PasswordResetRequest");
+var passwordResetConfirmSchema = zod.z.object({
+  token: zod.z.string().min(1).openapi({ description: "Reset token." }),
+  password: zod.z.string().min(1).openapi({ description: "New plaintext password." })
+}).openapi("PasswordResetConfirm");
+
+// src/auth/service.ts
+function toPublic(user) {
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    isActive: user.isActive,
+    roles: user.roles
+  };
+}
+var UserAuthService = class {
+  store;
+  password;
+  jwt;
+  passwordMinLength;
+  accessTtlSeconds;
+  refreshTtlSeconds;
+  mfa;
+  mfaChallengeTtlSeconds;
+  /**
+   * @param options - Store, password/JWT helpers and token policy.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.password = options.password;
+    this.jwt = options.jwt;
+    this.passwordMinLength = options.passwordMinLength ?? 12;
+    this.accessTtlSeconds = options.accessTtlSeconds ?? 3600;
+    this.refreshTtlSeconds = options.refreshTtlSeconds ?? 60 * 60 * 24 * 14;
+    this.mfa = options.mfa;
+    this.mfaChallengeTtlSeconds = options.mfaChallengeTtlSeconds ?? 300;
+  }
+  /** Mint a signed access + refresh token pair for `user`. */
+  async issueTokens(user) {
+    const accessToken = await this.jwt.encode(
+      { sub: user.id, roles: user.roles, type: "access" },
+      { ttlSeconds: this.accessTtlSeconds }
+    );
+    const refreshToken = await this.jwt.encode(
+      { sub: user.id, type: "refresh" },
+      { ttlSeconds: this.refreshTtlSeconds }
+    );
+    return {
+      accessToken,
+      refreshToken,
+      tokenType: "bearer",
+      expiresIn: this.accessTtlSeconds
+    };
+  }
+  /**
+   * Register a new user and issue tokens.
    *
    * @param data - Validated signup payload.
    * @returns The public user and a fresh token pair.
@@ -10004,7 +13185,7 @@ function registerPaths(registry, prefix) {
 function makeAuthRouter(options) {
   const { service, jwt, prefix = "/auth", registry } = options;
   if (registry) registerPaths(registry, prefix);
-  const router = express2.Router();
+  const router = express3.Router();
   router.post(`${prefix}/signup`, async (req, res) => {
     const result = await service.signup(signupSchema.parse(req.body));
     res.status(201).json(result);
@@ -10125,7 +13306,7 @@ function renderPasswordResetFormPage(options) {
      </form>`
   );
 }
-var logger2 = new JSONLogger("tempest_express_sdk.api.handlers");
+var logger3 = new JSONLogger("tempest_express_sdk.api.handlers");
 var REQUEST_ID_HEADER = "X-Request-ID";
 var VALID_REQUEST_ID = /^[A-Za-z0-9._\-:+/=]{1,128}$/;
 function requestIdMiddleware() {
@@ -10167,7 +13348,7 @@ function makeAppExceptionHandler(options = {}) {
       return;
     }
     const isServerError = exc.statusCode >= 500;
-    logger2.log(isServerError ? serverErrorLevel : "info", "AppException handled", {
+    logger3.log(isServerError ? serverErrorLevel : "info", "AppException handled", {
       path: req.path,
       method: req.method,
       statusCode: exc.statusCode,
@@ -10191,7 +13372,7 @@ function makeUnhandledExceptionHandler(options = {}) {
   const { includeStack = false, logLevel = "error" } = options;
   return (err, req, res, _next) => {
     const error = err instanceof Error ? err : new Error(String(err));
-    logger2.log(logLevel, "Unhandled exception", {
+    logger3.log(logLevel, "Unhandled exception", {
       path: req.path,
       method: req.method,
       [HTTP_500_MARKER]: true,
@@ -10242,70 +13423,184 @@ function generateOpenApiDocument(registry, options) {
   const document = new Generator(registry.definitions).generateDocument(config);
   return document;
 }
+var DEFAULT_DOCS_FAVICON = "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAzMiAzMiI+PHJlY3Qgd2lkdGg9IjMyIiBoZWlnaHQ9IjMyIiByeD0iNyIgZmlsbD0iIzRjNmVmNSIvPjxwYXRoIGQ9Ik0xNy45IDQuNSA4LjYgMTguNGg1LjJMMTMgMjcuNWw5LjQtMTMuOWgtNS4zeiIgZmlsbD0iI2ZmZiIvPjwvc3ZnPg==";
+var REDOC_CDN_URL = "https://cdn.jsdelivr.net/npm/redoc@2/bundles/redoc.standalone.js";
+var REDOC_BUNDLE_SPECIFIER = "redoc/bundles/redoc.standalone.js";
+function escapeHtml2(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function scriptLiteral(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+function faviconTag(favicon) {
+  if (favicon === false) return "";
+  return `
+    <link rel="icon" href="${escapeHtml2(favicon)}" />`;
+}
 function mountOpenApiJson(app, path, document) {
   app.get(path, (_req, res) => {
     res.json(document);
   });
 }
-function swaggerHtml(specUrl, title, assetsBase) {
+var SWAGGER_UI_DEFAULTS = Object.freeze({
+  deepLinking: true,
+  persistAuthorization: true,
+  layout: "BaseLayout"
+});
+function assertSerializableUiOptions(options, trail = []) {
+  if (typeof options === "function") {
+    throw new Error(
+      [
+        `mountSwaggerUi: \`ui.${trail.join(".")}\` is a function, and the options are`,
+        "serialized as JSON into the page, so it would be dropped silently. Swagger UI",
+        "options that take a callback have to be wired in the browser."
+      ].join(" ")
+    );
+  }
+  if (Array.isArray(options)) {
+    options.forEach(
+      (entry, index) => assertSerializableUiOptions(entry, [...trail, String(index)])
+    );
+    return;
+  }
+  if (typeof options === "object" && options !== null) {
+    for (const [key, value] of Object.entries(options)) {
+      assertSerializableUiOptions(value, [...trail, key]);
+    }
+  }
+}
+function swaggerHtml(options) {
+  const { specUrl, title, assetsBase, favicon, ui } = options;
+  const merged = {
+    url: specUrl,
+    dom_id: "#swagger-ui",
+    ...SWAGGER_UI_DEFAULTS,
+    ...ui
+  };
+  const standalone = merged.layout === "StandaloneLayout";
+  const presetScript = standalone ? `
+    <script src="${escapeHtml2(assetsBase)}/swagger-ui-standalone-preset.js"></script>` : "";
+  const presets = standalone ? "[SwaggerUIBundle.presets.apis, SwaggerUIStandalonePreset]" : "[SwaggerUIBundle.presets.apis]";
   return `<!doctype html>
 <html lang="en">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>${title}</title>
-    <link rel="stylesheet" href="${assetsBase}/swagger-ui.css" />
+    <title>${escapeHtml2(title)}</title>${faviconTag(favicon)}
+    <link rel="stylesheet" href="${escapeHtml2(assetsBase)}/swagger-ui.css" />
   </head>
   <body>
     <div id="swagger-ui"></div>
-    <script src="${assetsBase}/swagger-ui-bundle.js"></script>
-    <script src="${assetsBase}/swagger-ui-standalone-preset.js"></script>
+    <script src="${escapeHtml2(assetsBase)}/swagger-ui-bundle.js"></script>${presetScript}
     <script>
-      window.ui = SwaggerUIBundle({
-        url: ${JSON.stringify(specUrl)},
-        dom_id: "#swagger-ui",
-        presets: [SwaggerUIBundle.presets.apis, SwaggerUIStandalonePreset],
-        layout: "StandaloneLayout",
-      });
+      var options = ${scriptLiteral(merged)};
+      options.presets = ${presets};
+      window.ui = SwaggerUIBundle(options);
     </script>
   </body>
 </html>`;
 }
 function mountSwaggerUi(app, path, specUrl, options = {}) {
   const title = options.title ?? "API docs";
+  const favicon = options.favicon ?? DEFAULT_DOCS_FAVICON;
+  const ui = options.ui ?? {};
+  assertSerializableUiOptions(ui);
   const assetsPath = `${path.replace(/\/$/, "")}/assets`;
-  app.use(assetsPath, express2__default.default.static(swaggerUiDist.getAbsoluteFSPath()));
+  app.use(assetsPath, express3__default.default.static(swaggerUiDist.getAbsoluteFSPath()));
   const handler = (_req, res) => {
-    res.type("html").send(swaggerHtml(specUrl, title, assetsPath));
+    res.type("html").send(swaggerHtml({ specUrl, title, assetsBase: assetsPath, favicon, ui }));
   };
   app.get(path, handler);
 }
-function redocHtml(specUrl, title, scriptUrl) {
+function resolveRedocBundle() {
+  try {
+    const requireFrom = module$1.createRequire(path.join(process.cwd(), "package.json"));
+    return requireFrom.resolve(REDOC_BUNDLE_SPECIFIER);
+  } catch {
+    return null;
+  }
+}
+function redocHtml(specUrl, title, scriptUrl, favicon) {
   return `<!doctype html>
 <html lang="en">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>${title}</title>
-    <style>body { margin: 0; padding: 0; }</style>
+    <title>${escapeHtml2(title)}</title>${faviconTag(favicon)}
+    <style>
+      body { margin: 0; padding: 0; }
+      #redoc-load-error {
+        display: none;
+        font: 14px/1.6 system-ui, sans-serif;
+        margin: 3rem auto;
+        max-width: 40rem;
+        padding: 0 1rem;
+      }
+      #redoc-load-error code {
+        background: #f1f3f5;
+        border-radius: 3px;
+        padding: 0.1rem 0.3rem;
+      }
+    </style>
   </head>
   <body>
-    <redoc spec-url=${JSON.stringify(specUrl)}></redoc>
-    <script src=${JSON.stringify(scriptUrl)}></script>
+    <div id="redoc-load-error">
+      <h1>The API reference could not load</h1>
+      <p>
+        The Redoc renderer was requested from
+        <code id="redoc-script-url"></code> and did not load. The OpenAPI
+        document itself is fine \u2014 it is served at
+        <code id="redoc-spec-url"></code>.
+      </p>
+      <p>
+        On a closed network, install the renderer next to the service
+        (<code>npm install redoc</code>) so it is served locally, or point
+        <code>scriptUrl</code> at a copy you host.
+      </p>
+    </div>
+    <redoc spec-url="${escapeHtml2(specUrl)}"></redoc>
+    <script>
+      window.__redocLoadFailed = function () {
+        document.getElementById("redoc-script-url").textContent = ${scriptLiteral(scriptUrl)};
+        document.getElementById("redoc-spec-url").textContent = ${scriptLiteral(specUrl)};
+        document.getElementById("redoc-load-error").style.display = "block";
+        var element = document.querySelector("redoc");
+        if (element) element.style.display = "none";
+      };
+    </script>
+    <script src="${escapeHtml2(scriptUrl)}" onerror="window.__redocLoadFailed()"></script>
   </body>
 </html>`;
 }
 function mountRedoc(app, path, specUrl, options = {}) {
   const title = options.title ?? "API reference";
-  const scriptUrl = options.scriptUrl ?? "https://cdn.jsdelivr.net/npm/redoc@2/bundles/redoc.standalone.js";
+  const favicon = options.favicon ?? DEFAULT_DOCS_FAVICON;
+  const source = options.bundle ?? "auto";
+  const assetsPath = `${path.replace(/\/$/, "")}/assets`;
+  const bundleRoute = `${assetsPath}/redoc.standalone.js`;
+  let scriptUrl = options.scriptUrl;
+  if (scriptUrl === void 0 && source !== "cdn") {
+    const bundlePath = options.bundlePath ?? resolveRedocBundle();
+    if (bundlePath !== null && bundlePath !== void 0) {
+      app.get(bundleRoute, (_req, res) => {
+        res.sendFile(bundlePath);
+      });
+      scriptUrl = bundleRoute;
+    } else if (source === "local") {
+      throw new Error(
+        'mountRedoc: bundle "local" requires the `redoc` package. Install it (`npm install redoc`) or pass `bundlePath` with an absolute path to a Redoc standalone bundle.'
+      );
+    }
+  }
+  const resolvedScriptUrl = scriptUrl ?? REDOC_CDN_URL;
   app.get(path, (_req, res) => {
-    res.type("html").send(redocHtml(specUrl, title, scriptUrl));
+    res.type("html").send(redocHtml(specUrl, title, resolvedScriptUrl, favicon));
   });
 }
 function makeHealthRouter(options = {}) {
   const path = options.path ?? "/health";
   const checks = options.checks ?? [];
-  const router = express2.Router();
+  const router = express3.Router();
   router.get(path, async (_req, res) => {
     const results = {};
     let healthy = true;
@@ -10328,7 +13623,7 @@ function makeHealthRouter(options = {}) {
 }
 function makeMetricsRouter(options = {}) {
   const path = options.path ?? "/metrics";
-  const router = express2.Router();
+  const router = express3.Router();
   if (options.guard) router.use(path, options.guard);
   router.get(path, async (_req, res) => {
     const gpus = options.includeGpu ? await MetricsUtils.gpus() : [];
@@ -10336,7 +13631,7 @@ function makeMetricsRouter(options = {}) {
   });
   return router;
 }
-var logger3 = new JSONLogger("tempest_express_sdk.api.server");
+var logger4 = new JSONLogger("tempest_express_sdk.api.server");
 function corsMiddleware(origins) {
   const allowAll = origins === "*";
   const allowList = new Set(Array.isArray(origins) ? origins : [origins]);
@@ -10361,9 +13656,9 @@ function corsMiddleware(origins) {
   };
 }
 async function createApp(options = {}) {
-  const app = express2__default.default();
-  app.use(express2__default.default.json({ limit: options.jsonLimit ?? "100kb" }));
-  app.use(express2__default.default.urlencoded({ extended: true }));
+  const app = express3__default.default();
+  app.use(express3__default.default.json({ limit: options.jsonLimit ?? "100kb" }));
+  app.use(express3__default.default.urlencoded({ extended: true }));
   app.use(requestIdMiddleware());
   if (options.corsOrigins) {
     app.use(corsMiddleware(options.corsOrigins));
@@ -10395,7 +13690,7 @@ function runServer(app, options = {}) {
   const port = options.port ?? 8e3;
   return new Promise((resolve) => {
     const server = app.listen(port, host, () => {
-      logger3.info("Server listening", { host, port });
+      logger4.info("Server listening", { host, port });
       resolve(server);
     });
   });
@@ -10937,7 +14232,7 @@ function rateLimitMiddleware(options = {}) {
 
 // src/api/middlewares/tracing.ts
 function requestTracingMiddleware(options = {}) {
-  const logger4 = new JSONLogger(options.loggerName ?? "tempest_express_sdk.api.tracing");
+  const logger5 = new JSONLogger(options.loggerName ?? "tempest_express_sdk.api.tracing");
   const level = options.level ?? "info";
   const exempt = new Set(options.exemptPaths ?? []);
   return (req, res, next) => {
@@ -10948,7 +14243,7 @@ function requestTracingMiddleware(options = {}) {
     const start = process.hrtime.bigint();
     res.on("finish", () => {
       const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
-      logger4.log(level, "request", {
+      logger5.log(level, "request", {
         method: req.method,
         path: req.path,
         statusCode: res.statusCode,
@@ -11237,7 +14532,7 @@ var WebhookSignatureVerifier = class {
   }
 };
 function makeToolSpecRouter(spec, options = {}) {
-  const router = express2.Router();
+  const router = express3.Router();
   const path = options.path ?? "/tool-spec";
   router.get(path, (_req, res, next) => {
     Promise.resolve(typeof spec === "function" ? spec() : spec).then((result) => res.json(result)).catch(next);
@@ -11269,7 +14564,7 @@ async function readEntries(files) {
   return entries;
 }
 function makeLogsRouter(options) {
-  const router = express2.Router();
+  const router = express3.Router();
   const path = options.path ?? "/logs";
   const guards = options.guards ?? [];
   const handler = (req, res, next) => {
@@ -11329,7 +14624,7 @@ async function withTestDatabase(models, fn) {
 }
 
 // src/version.ts
-var VERSION = "0.22.0";
+var VERSION = "0.24.0";
 
 Object.defineProperty(exports, "OpenAPIRegistry", {
   enumerable: true,
@@ -11483,7 +14778,11 @@ Object.defineProperty(exports, "update", {
   enumerable: true,
   get: function () { return tempestDbJs.update; }
 });
+exports.ADMIN_CSS = ADMIN_CSS;
 exports.ActivationService = ActivationService;
+exports.AdminJsonSite = AdminJsonSite;
+exports.AdminModel = AdminModel;
+exports.AdminSessionStore = AdminSessionStore;
 exports.AdminSite = AdminSite;
 exports.AppException = AppException;
 exports.AttemptThrottle = AttemptThrottle;
@@ -11505,6 +14804,7 @@ exports.CSRF_HEADER_NAME = CSRF_HEADER_NAME;
 exports.CircuitOpenError = CircuitOpenError;
 exports.CompositeFeatureFlagBackend = CompositeFeatureFlagBackend;
 exports.ConflictException = ConflictException;
+exports.DEFAULT_DOCS_FAVICON = DEFAULT_DOCS_FAVICON;
 exports.DEFAULT_LOCALE = DEFAULT_LOCALE;
 exports.EmailProvider = EmailProvider;
 exports.EmailUtils = EmailUtils;
@@ -11545,6 +14845,7 @@ exports.OutboxStatus = OutboxStatus;
 exports.PHONE_BR_PATTERN = PHONE_BR_PATTERN;
 exports.PasswordResetService = PasswordResetService;
 exports.PasswordUtils = PasswordUtils;
+exports.REDOC_CDN_URL = REDOC_CDN_URL;
 exports.REQUEST_ID_HEADER = REQUEST_ID_HEADER;
 exports.RabbitBroker = RabbitBroker;
 exports.RedisCacheManager = RedisCacheManager;
@@ -11567,6 +14868,7 @@ exports.TwilioSmsProvider = TwilioSmsProvider;
 exports.UF = UF;
 exports.UnauthorizedException = UnauthorizedException;
 exports.UserAuthService = UserAuthService;
+exports.UserModelAuthBackend = UserModelAuthBackend;
 exports.UserTokenPurpose = UserTokenPurpose;
 exports.VERSION = VERSION;
 exports.ValidationException = ValidationException;
@@ -11578,6 +14880,8 @@ exports.WebhookSignatureVerifier = WebhookSignatureVerifier;
 exports.WhatsAppProvider = WhatsAppProvider;
 exports.activationSchema = activationSchema;
 exports.addLogSink = addLogSink;
+exports.adminColumns = adminColumns;
+exports.adminThemeCss = adminThemeCss;
 exports.attachWebSocketHub = attachWebSocketHub;
 exports.authResponseSchema = authResponseSchema;
 exports.authSettingsShape = authSettingsShape;
@@ -11589,6 +14893,7 @@ exports.bearerToken = bearerToken;
 exports.bodySizeLimitMiddleware = bodySizeLimitMiddleware;
 exports.broadcastText = broadcastText;
 exports.buildContentDisposition = buildContentDisposition;
+exports.buildFormFields = buildFormFields;
 exports.buildPaginationLinkHeader = buildPaginationLinkHeader;
 exports.cached = cached3;
 exports.centsField = centsField;
@@ -11606,6 +14911,7 @@ exports.createOpenApiRegistry = createOpenApiRegistry;
 exports.createTestDatabase = createTestDatabase;
 exports.createdByColumn = createdByColumn;
 exports.csrfMiddleware = csrfMiddleware;
+exports.csrfTokenMatches = csrfTokenMatches;
 exports.cursorPaginationFilterSchema = cursorPaginationFilterSchema;
 exports.cursorPaginationSchema = cursorPaginationSchema;
 exports.databaseSettingsShape = databaseSettingsShape;
@@ -11618,6 +14924,10 @@ exports.emailSettingsShape = emailSettingsShape;
 exports.encodeCursor = encodeCursor;
 exports.envBoolean = looseBoolean;
 exports.envList = envList;
+exports.escapeHtml = escapeHtml;
+exports.filterForColumn = filterForColumn;
+exports.formatCellValue = formatCellValue;
+exports.formatFieldValue = formatFieldValue;
 exports.generateCsrfToken = generateCsrfToken;
 exports.generateOAuthState = generateOAuthState;
 exports.generateOpaqueToken = generateOpaqueToken;
@@ -11630,8 +14940,11 @@ exports.getRequestId = getRequestId;
 exports.getState = getState;
 exports.hashOpaqueToken = hashOpaqueToken;
 exports.hexColorField = hexColorField;
+exports.humanizeField = humanizeField;
 exports.idempotencyMiddleware = idempotencyMiddleware;
 exports.inboundMessageSchema = inboundMessageSchema;
+exports.isColumnOptional = isColumnOptional;
+exports.isSearchableColumn = isSearchableColumn;
 exports.isValidCep = isValidCep;
 exports.isValidCity = isValidCity;
 exports.isValidCnpj = isValidCnpj;
@@ -11652,6 +14965,7 @@ exports.logSettingsShape = logSettingsShape;
 exports.loginSchema = loginSchema;
 exports.longitudeField = longitudeField;
 exports.looseBoolean = looseBoolean;
+exports.makeAdminJsonRouter = makeAdminJsonRouter;
 exports.makeAdminRouter = makeAdminRouter;
 exports.makeAppExceptionHandler = makeAppExceptionHandler;
 exports.makeAuthRouter = makeAuthRouter;
@@ -11688,6 +15002,7 @@ exports.paginationFilterSchema = paginationFilterSchema;
 exports.paginationSchema = paginationSchema;
 exports.parseAcceptLanguage = parseAcceptLanguage;
 exports.parseCookies = parseCookies;
+exports.parseFormBody = parseFormBody;
 exports.passwordResetConfirmSchema = passwordResetConfirmSchema;
 exports.passwordResetRequestSchema = passwordResetRequestSchema;
 exports.percentField = percentField;
@@ -11705,11 +15020,20 @@ exports.redisSettingsShape = redisSettingsShape;
 exports.refreshSchema = refreshSchema;
 exports.registerExceptionHandlers = registerExceptionHandlers;
 exports.renderAuthResultPage = renderAuthResultPage;
+exports.renderDashboardPage = renderDashboardPage;
+exports.renderDetailPage = renderDetailPage;
+exports.renderFormPage = renderFormPage;
+exports.renderLayout = renderLayout;
+exports.renderListPage = renderListPage;
+exports.renderLoginPage = renderLoginPage;
+exports.renderMfaPage = renderMfaPage;
 exports.renderPasswordResetFormPage = renderPasswordResetFormPage;
 exports.requestIdMiddleware = requestIdMiddleware;
 exports.requestTracingMiddleware = requestTracingMiddleware;
 exports.requireRoles = requireRoles;
+exports.resolveAdminTheme = resolveAdminTheme;
 exports.resolveDownloadPath = resolveDownloadPath;
+exports.resolveRedocBundle = resolveRedocBundle;
 exports.runServer = runServer;
 exports.runWithRequestContext = runWithRequestContext;
 exports.sendBytesDownload = sendBytesDownload;
@@ -11743,6 +15067,7 @@ exports.webPushPayloadSchema = webPushPayloadSchema;
 exports.webPushSettingsShape = webPushSettingsShape;
 exports.webPushSubscriptionSchema = webPushSubscriptionSchema;
 exports.webSocketSettingsShape = webSocketSettingsShape;
+exports.widgetForColumn = widgetForColumn;
 exports.withTestDatabase = withTestDatabase;
 exports.wrapWithSlowQueryLog = wrapWithSlowQueryLog;
 exports.wsEnvelopeSchema = wsEnvelopeSchema;