tempest-express-sdk 0.22.0 → 0.24.0

package/dist/index.js

@@ -1,7 +1,7 @@
-import { z, looseBoolean, toDict } from './chunk-7Q5NBMSP.js';
-export { PasswordUtils, VERSION, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, centsField, corsSettingsShape, databaseSettingsShape, looseBoolean as envBoolean, hexColorField, latitudeField, loadSettings, longitudeField, looseBoolean, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, percentField, portField, positiveFloatField, positiveIntField, priceField, ratingField, ratioField, serverSettingsShape, slugField, toDict, z } from './chunk-7Q5NBMSP.js';
+import { z, looseBoolean, toDict, PasswordUtils } from './chunk-6KJTKSG5.js';
+export { PasswordUtils, VERSION, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, centsField, corsSettingsShape, databaseSettingsShape, looseBoolean as envBoolean, hexColorField, latitudeField, loadSettings, longitudeField, looseBoolean, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, percentField, portField, positiveFloatField, positiveIntField, priceField, ratingField, ratioField, serverSettingsShape, slugField, toDict, z } from './chunk-6KJTKSG5.js';
 import { AsyncLocalStorage } from 'async_hooks';
-import { Model, column, sql, BaseRepository, RecordNotFound, detectDialect, NodeSqliteDriver, AsyncEngine } from 'tempest-db-js';
+import { Model, column, sql, BaseRepository, RecordNotFound, detectDialect, columnsOf, NodeSqliteDriver, AsyncEngine, or, and } from 'tempest-db-js';
 export { AsyncEngine, AsyncResult, AsyncSession, BaseRepository, Column, DeleteBuilder, InsertBuilder, Model, NoResultError, NodeSqliteDriver, PostgresDialect, RecordNotFound, SelectBuilder, SqliteDialect, SyncEngine, SyncSession, UpdateBuilder, and, belongsTo, column, columnsOf, createEngine, createSyncEngine, del, detectDialect, getDialect, hasMany, insert, join, loadRelations, not, or, parseDatabaseUrl, select, sql, update } from 'tempest-db-js';
 import { execFile, spawn } from 'child_process';
 import { copyFile, mkdir, writeFile, readFile, rm, stat } from 'fs/promises';
@@ -10,10 +10,11 @@ import { createReadStream, mkdirSync, createWriteStream } from 'fs';
 import { join, dirname, normalize, relative, isAbsolute } from 'path';
 import { cpus, loadavg, totalmem, freemem } from 'os';
 import { promisify } from 'util';
-import express2, { Router } from 'express';
+import express3, { Router } from 'express';
 import { ZodError } from 'zod';
 import { OpenAPIRegistry, OpenApiGeneratorV31, OpenApiGeneratorV3 } from '@asteasolutions/zod-to-openapi';
 export { OpenAPIRegistry } from '@asteasolutions/zod-to-openapi';
+import { createRequire } from 'module';
 import { getAbsoluteFSPath } from 'swagger-ui-dist';
 import { reflectTable, renderOperation } from 'tempest-db-js/migrations';
 
@@ -818,7 +819,7 @@ function wrapWithSlowQueryLog(driver, options = {}) {
   const thresholdMs = options.thresholdMs ?? 500;
   const level = options.level ?? "warning";
   const logParameters = options.logParameters ?? false;
-  const logger4 = new JSONLogger(
+  const logger5 = new JSONLogger(
     options.loggerName ?? "tempest_express_sdk.db.slow_query"
   );
   const timed = (exec) => {
@@ -829,7 +830,7 @@ function wrapWithSlowQueryLog(driver, options = {}) {
       } finally {
         const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
         if (durationMs >= thresholdMs) {
-          logger4.log(level, "slow query", {
+          logger5.log(level, "slow query", {
             sql: sql5,
             durationMs: Math.round(durationMs * 1e3) / 1e3,
             ...logParameters ? { params } : {}
@@ -7556,7 +7557,6 @@ var HTTPClient = class {
         this.breakerRecord(host, true);
         if (attempt < this.retryPolicy.maxRetries) {
           await this.sleep(this.retryPolicy.sleepFor(attempt));
-          continue;
         }
       }
     }
@@ -9317,207 +9317,3388 @@ var MessagingHub = class {
   }
 };
 
-// src/admin/site.ts
-var AdminSite = class {
+// src/admin/columns.ts
+function humanizeField(name) {
+  return name.replace(/[_-]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").trim().split(/\s+/).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+}
+function adminColumns(model) {
+  return columnsOf(model);
+}
+function widgetForColumn(column6) {
+  const { kind, meta } = column6.type;
+  const plain = (widget) => ({
+    widget,
+    step: null,
+    options: []
+  });
+  switch (kind) {
+    case "json":
+      return plain("json");
+    case "boolean":
+      return plain("checkbox");
+    case "enum":
+      return {
+        widget: "select",
+        step: null,
+        options: (meta.values ?? []).map((value) => ({
+          value,
+          label: humanizeField(value)
+        }))
+      };
+    case "smallint":
+    case "integer":
+    case "bigint":
+      return { widget: "number", step: "1", options: [] };
+    case "numeric":
+    case "real":
+    case "double":
+      return { widget: "number", step: "any", options: [] };
+    case "datetime":
+    case "timestamp":
+      return plain("datetime");
+    case "date":
+      return plain("date");
+    case "time":
+      return plain("time");
+    case "text":
+      return plain("textarea");
+    case "varchar":
+    case "char":
+      return plain(meta.length !== void 0 && meta.length > 255 ? "textarea" : "text");
+    default:
+      return plain("text");
+  }
+}
+function isColumnOptional(column6) {
+  return !column6.flags.notNull || column6.flags.hasDefault || column6.flags.primaryKey;
+}
+function filterForColumn(column6) {
+  const { kind, meta } = column6.type;
+  if (kind === "boolean") {
+    return {
+      kind: "select",
+      options: [
+        { value: "true", label: "Yes" },
+        { value: "false", label: "No" }
+      ]
+    };
+  }
+  if (kind === "enum") {
+    return {
+      kind: "select",
+      options: (meta.values ?? []).map((value) => ({
+        value,
+        label: humanizeField(value)
+      }))
+    };
+  }
+  if (kind === "date" || kind === "datetime" || kind === "timestamp") {
+    return { kind: "daterange", options: [] };
+  }
+  return { kind: "text", options: [] };
+}
+function isSearchableColumn(column6) {
+  const { kind } = column6.type;
+  return kind === "varchar" || kind === "text" || kind === "char";
+}
+
+// src/admin/config.ts
+var NEVER_EDITABLE = [
+  "id",
+  "createdAt",
+  "updatedAt",
+  "hashedPassword"
+];
+var NEVER_LISTED = ["hashedPassword"];
+var AdminModel = class {
+  /** The managed model class. */
+  model;
+  /** Columns surfaced as filter controls. */
+  listFilter;
+  /** Text columns the search box matches against. */
+  searchFields;
+  /** Columns locked in the create/edit form. */
+  readonlyFields;
+  /** Default ordering column, or `null` to leave it to the repository. */
+  orderKey;
+  /** Whether {@link AdminModel.orderKey} sorts ascending. */
+  orderAscending;
+  /** Rows per page in the list view. */
+  pageSize;
+  /** Column used to look a single row up from the detail URL. */
+  identityField;
+  /** Whether the create form is exposed. */
+  canCreate;
+  /** Whether the edit form is exposed. */
+  canEdit;
+  /** Whether the delete action is exposed. */
+  canDelete;
+  slugOverride;
+  listDisplayOverride;
+  verboseNameOverride;
+  verboseNamePluralOverride;
   /**
-   * @param brand - Display name surfaced under `GET {prefix}/`.
+   * Build and validate the configuration.
+   *
+   * @param options - The declarative configuration. See {@link AdminModelOptions}.
+   * @throws Error When a referenced column does not exist on the model.
    */
-  constructor(brand = "Admin") {
-    this.brand = brand;
+  constructor(options) {
+    this.model = options.model;
+    this.slugOverride = options.slug ?? null;
+    this.listDisplayOverride = options.listDisplay === void 0 ? null : [...options.listDisplay];
+    this.listFilter = [...options.listFilter ?? []];
+    this.searchFields = [...options.searchFields ?? []];
+    this.readonlyFields = [...options.readonlyFields ?? []];
+    this.pageSize = options.pageSize ?? 25;
+    this.identityField = options.identityField ?? "id";
+    this.verboseNameOverride = options.verboseName ?? null;
+    this.verboseNamePluralOverride = options.verboseNamePlural ?? null;
+    this.canCreate = options.canCreate ?? true;
+    this.canEdit = options.canEdit ?? true;
+    this.canDelete = options.canDelete ?? true;
+    const known = new Set(this.columnNames());
+    for (const [option, names] of [
+      ["listDisplay", this.listDisplayOverride ?? []],
+      ["listFilter", this.listFilter],
+      ["searchFields", this.searchFields],
+      ["readonlyFields", this.readonlyFields],
+      ["identityField", [this.identityField]]
+    ]) {
+      for (const name of names) {
+        if (!known.has(name)) {
+          throw new Error(
+            `AdminModel(${this.model.tablename}).${option} references unknown column "${name}"; available: ${[...known].join(", ")}`
+          );
+        }
+      }
+    }
+    const ordering = options.ordering ?? (known.has("createdAt") ? "-createdAt" : void 0);
+    if (ordering === void 0) {
+      this.orderKey = null;
+      this.orderAscending = true;
+    } else {
+      const descending = ordering.startsWith("-");
+      const key = descending ? ordering.slice(1) : ordering;
+      if (!known.has(key)) {
+        throw new Error(
+          `AdminModel(${this.model.tablename}).ordering references unknown column "${key}"`
+        );
+      }
+      this.orderKey = key;
+      this.orderAscending = !descending;
+    }
   }
-  brand;
-  resources = /* @__PURE__ */ new Map();
   /**
-   * Register a resource.
+   * Return the URL slug the model is exposed under.
    *
-   * @param resource - The resource config.
-   * @returns The same resource (for chaining).
+   * @returns The configured slug, or the model's table name.
    */
-  register(resource) {
-    this.resources.set(resource.name, resource);
-    return resource;
+  slug() {
+    return this.slugOverride ?? this.model.tablename;
   }
-  /** Look up a resource by slug, or `null`. */
-  get(name) {
-    return this.resources.get(name) ?? null;
+  /**
+   * Return the singular display name.
+   *
+   * @returns The configured name, or the humanized class name without its
+   *   trailing `Model`.
+   */
+  verboseName() {
+    if (this.verboseNameOverride !== null) return this.verboseNameOverride;
+    const className = this.model.name;
+    return humanizeField(className.replace(/Model$/, ""));
   }
-  /** Every registered resource. */
-  list() {
-    return [...this.resources.values()];
+  /**
+   * Return the plural display name.
+   *
+   * @returns The configured plural, or the singular with an `s`.
+   */
+  verboseNamePlural() {
+    return this.verboseNamePluralOverride ?? `${this.verboseName()}s`;
+  }
+  /**
+   * Return every column key on the model, in declaration order.
+   *
+   * @returns The column keys.
+   */
+  columnNames() {
+    return Object.keys(adminColumns(this.model));
+  }
+  /**
+   * Return the columns the list view renders.
+   *
+   * @returns The configured `listDisplay`, or every column but the password hash.
+   */
+  listDisplayNames() {
+    if (this.listDisplayOverride !== null) return [...this.listDisplayOverride];
+    return this.columnNames().filter((name) => !NEVER_LISTED.includes(name));
+  }
+  /**
+   * Return the columns the detail view renders.
+   *
+   * Unlike {@link AdminModel.listDisplayNames}, this is not narrowed by
+   * `listDisplay`: the list view is a scannable summary, but the detail view is
+   * where an operator goes to see the whole record, so trimming it there would
+   * hide data with nowhere else to read it.
+   *
+   * @returns Every column but the password hash, in declaration order.
+   */
+  detailFieldNames() {
+    return this.columnNames().filter((name) => !NEVER_LISTED.includes(name));
+  }
+  /**
+   * Return the columns a create/edit form exposes.
+   *
+   * Excludes the primary key, the managed timestamps, the password hash and
+   * anything listed in `readonlyFields` — none of which a user edits directly
+   * through the generic form.
+   *
+   * @returns The editable column keys, in declaration order.
+   */
+  editableFieldNames() {
+    const skip = /* @__PURE__ */ new Set([...this.readonlyFields, ...NEVER_EDITABLE]);
+    return this.columnNames().filter((name) => !skip.has(name));
+  }
+  /**
+   * Build a repository for this model bound to a session.
+   *
+   * @param session - The session the repository runs its statements on.
+   * @returns A repository over {@link AdminModel.model}.
+   */
+  repository(session) {
+    return new BaseRepository(this.model, session);
   }
 };
-var PAGINATION_KEYS2 = /* @__PURE__ */ new Set(["page", "pageSize"]);
-function methodNotAllowed(operation) {
-  return new AppException({
-    message: `Operation not allowed: ${operation}`,
-    code: "METHOD_NOT_ALLOWED",
-    statusCode: 405
+
+// src/admin/forms.ts
+function formatFieldValue(widget, value) {
+  if (value === null || value === void 0) return "";
+  if (widget === "json") {
+    return typeof value === "string" ? value : JSON.stringify(value, null, 2);
+  }
+  if (value instanceof Date) {
+    const iso = value.toISOString();
+    if (widget === "date") return iso.slice(0, 10);
+    if (widget === "time") return iso.slice(11, 19);
+    return iso.slice(0, 16);
+  }
+  if (widget === "datetime" || widget === "date") {
+    const parsed = new Date(String(value));
+    if (!Number.isNaN(parsed.getTime())) {
+      const iso = parsed.toISOString();
+      return widget === "date" ? iso.slice(0, 10) : iso.slice(0, 16);
+    }
+  }
+  return String(value);
+}
+function literalDefault(column6) {
+  const fallback = column6.defaultValue;
+  if (fallback === null || fallback.kind !== "literal") return void 0;
+  return fallback.value;
+}
+function buildFormFields(admin, options = {}) {
+  const columns = adminColumns(admin.model);
+  const values = options.values ?? {};
+  const errors = options.errors ?? {};
+  return admin.editableFieldNames().flatMap((name) => {
+    const column6 = columns[name];
+    if (column6 === void 0) return [];
+    const spec = widgetForColumn(column6);
+    const raw = name in values ? values[name] : literalDefault(column6);
+    return [
+      {
+        name,
+        label: humanizeField(name),
+        widget: spec.widget,
+        value: spec.widget === "checkbox" ? "" : formatFieldValue(spec.widget, raw),
+        required: !isColumnOptional(column6),
+        checked: spec.widget === "checkbox" && toBoolean(raw),
+        step: spec.step,
+        options: spec.options,
+        error: errors[name] ?? null
+      }
+    ];
   });
 }
-function requireResource(site, name) {
-  const resource = site.get(name);
-  if (!resource) throw new NotFoundException({ message: `Unknown resource: ${name}` });
-  return resource;
-}
-function makeAdminRouter(site, options = {}) {
-  const prefix = (options.prefix ?? "/admin").replace(/\/$/, "");
-  const router = Router();
-  if (options.guard) router.use(prefix, options.guard);
-  router.get(prefix, (_req, res) => {
-    res.json({
-      brand: site.brand,
-      resources: site.list().map((r) => ({ name: r.name, fields: r.fields }))
-    });
-  });
-  router.get(`${prefix}/:resource/_meta`, (req, res) => {
-    const resource = requireResource(site, req.params.resource);
-    res.json({
-      name: resource.name,
-      fields: resource.fields,
-      operations: {
-        create: Boolean(resource.create),
-        update: Boolean(resource.update),
-        remove: Boolean(resource.remove)
+function toBoolean(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number") return value !== 0;
+  if (typeof value !== "string") return false;
+  return ["true", "on", "yes", "1"].includes(value.trim().toLowerCase());
+}
+function coerceValue(column6, widget, raw) {
+  const { kind, meta } = column6.type;
+  switch (widget) {
+    case "number": {
+      const parsed = Number(raw);
+      if (!Number.isFinite(parsed)) throw new Error("Enter a valid number.");
+      if (kind === "bigint") return BigInt(raw);
+      if (kind === "smallint" || kind === "integer") {
+        if (!Number.isInteger(parsed)) throw new Error("Enter a whole number.");
+        return parsed;
       }
-    });
-  });
-  router.get(`${prefix}/:resource`, async (req, res) => {
-    const resource = requireResource(site, req.params.resource);
-    const filters = {};
-    for (const [key, value] of Object.entries(req.query)) {
-      if (!PAGINATION_KEYS2.has(key) && typeof value === "string") filters[key] = value;
+      if (kind === "numeric") return raw;
+      return parsed;
     }
-    const page2 = Math.max(1, Number.parseInt(String(req.query.page ?? "1"), 10) || 1);
-    const pageSize = Math.max(
-      1,
-      Number.parseInt(String(req.query.pageSize ?? "20"), 10) || 20
-    );
-    res.json(await resource.list({ page: page2, pageSize, filters }));
-  });
-  router.get(`${prefix}/:resource/:id`, async (req, res) => {
-    const resource = requireResource(site, req.params.resource);
-    const record = await resource.get(req.params.id);
-    if (record === null) throw new NotFoundException({ message: "Record not found" });
-    res.json(record);
-  });
-  router.post(`${prefix}/:resource`, async (req, res) => {
-    const resource = requireResource(site, req.params.resource);
-    if (!resource.create) throw methodNotAllowed("create");
-    const data = resource.createSchema ? resource.createSchema.parse(req.body) : req.body;
-    res.status(201).json(await resource.create(data));
-  });
-  router.patch(`${prefix}/:resource/:id`, async (req, res) => {
-    const resource = requireResource(site, req.params.resource);
-    if (!resource.update) throw methodNotAllowed("update");
-    const data = resource.updateSchema ? resource.updateSchema.parse(req.body) : req.body;
-    res.json(await resource.update(req.params.id, data));
-  });
-  router.delete(`${prefix}/:resource/:id`, async (req, res) => {
-    const resource = requireResource(site, req.params.resource);
-    if (!resource.remove) throw methodNotAllowed("remove");
-    await resource.remove(req.params.id);
-    res.status(204).end();
-  });
-  return router;
+    case "datetime":
+    case "date": {
+      const parsed = new Date(raw);
+      if (Number.isNaN(parsed.getTime())) throw new Error("Enter a valid date.");
+      return parsed;
+    }
+    case "json":
+      try {
+        return JSON.parse(raw);
+      } catch {
+        throw new Error("Enter valid JSON.");
+      }
+    case "select": {
+      const allowed = meta.values ?? [];
+      if (allowed.length > 0 && !allowed.includes(raw)) {
+        throw new Error(`Choose one of: ${allowed.join(", ")}.`);
+      }
+      return raw;
+    }
+    default:
+      return raw;
+  }
+}
+function parseFormBody(admin, body) {
+  const columns = adminColumns(admin.model);
+  const data = {};
+  const errors = {};
+  for (const name of admin.editableFieldNames()) {
+    const column6 = columns[name];
+    if (column6 === void 0) continue;
+    const { widget } = widgetForColumn(column6);
+    if (widget === "checkbox") {
+      data[name] = toBoolean(body[name]);
+      continue;
+    }
+    const submitted = body[name];
+    const raw = typeof submitted === "string" ? submitted.trim() : "";
+    if (raw === "") {
+      if (!isColumnOptional(column6)) {
+        errors[name] = "This field is required.";
+        continue;
+      }
+      if (column6.flags.hasDefault && !(name in body)) continue;
+      data[name] = null;
+      continue;
+    }
+    try {
+      data[name] = coerceValue(column6, widget, raw);
+    } catch (error) {
+      errors[name] = error instanceof Error ? error.message : "Invalid value.";
+    }
+  }
+  return { data, errors };
 }
-
-// src/auth/schemas.ts
-var signupSchema = z.object({
-  email: z.email().openapi({ description: "Login identifier (email)." }),
-  password: z.string().min(1).openapi({ description: "Plaintext password (hashed server-side)." }),
-  name: z.string().max(120).optional().openapi({ description: "Optional display name." })
-}).openapi("Signup");
-var loginSchema = z.object({
-  email: z.email().openapi({ description: "Login identifier (email)." }),
-  password: z.string().min(1).openapi({ description: "Plaintext password." })
-}).openapi("Login");
-var refreshSchema = z.object({
-  refreshToken: z.string().min(1).openapi({ description: "A valid refresh token." })
-}).openapi("Refresh");
-var tokenPairSchema = z.object({
-  accessToken: z.string().openapi({ description: "Short-lived bearer access token." }),
-  refreshToken: z.string().openapi({ description: "Long-lived refresh token." }),
-  tokenType: z.literal("bearer").openapi({ description: "Always 'bearer'." }),
-  expiresIn: z.number().int().openapi({ description: "Access-token lifetime in seconds." })
-}).openapi("TokenPair");
-var userPublicSchema = z.object({
-  id: z.string().openapi({ description: "User id." }),
-  email: z.email().openapi({ description: "User email." }),
-  name: z.string().nullable().openapi({ description: "Display name, or null." }),
-  isActive: z.boolean().openapi({ description: "Whether the account is active." }),
-  roles: z.array(z.string()).openapi({ description: "Assigned role names." })
-}).openapi("UserPublic");
-var authResponseSchema = z.object({
-  user: userPublicSchema,
-  tokens: tokenPairSchema
-}).openapi("AuthResponse");
-var mfaEnrollResponseSchema = z.object({
-  secret: z.string().openapi({ description: "Base32 TOTP secret (manual entry)." }),
-  otpauthUri: z.string().openapi({ description: "otpauth:// URI to render as QR." })
-}).openapi("MfaEnrollResponse");
-var mfaCodeSchema = z.object({ code: z.string().min(1).openapi({ description: "Authenticator code." }) }).openapi("MfaCode");
-var mfaChallengeSchema = z.object({
-  mfaToken: z.string().min(1).openapi({ description: "Challenge token from login." }),
-  code: z.string().min(1).openapi({ description: "Authenticator code." })
-}).openapi("MfaChallenge");
-var activationSchema = z.object({ token: z.string().min(1).openapi({ description: "Activation token." }) }).openapi("Activation");
-var passwordResetRequestSchema = z.object({ email: z.email().openapi({ description: "Account email." }) }).openapi("PasswordResetRequest");
-var passwordResetConfirmSchema = z.object({
-  token: z.string().min(1).openapi({ description: "Reset token." }),
-  password: z.string().min(1).openapi({ description: "New plaintext password." })
-}).openapi("PasswordResetConfirm");
-
-// src/auth/service.ts
-function toPublic(user) {
-  return {
-    id: user.id,
-    email: user.email,
-    name: user.name,
-    isActive: user.isActive,
-    roles: user.roles
-  };
+function formatCellValue(value) {
+  if (value === null || value === void 0) return "";
+  if (value instanceof Date) return value.toISOString().replace("T", " ").slice(0, 19);
+  if (typeof value === "boolean") return value ? "Yes" : "No";
+  if (typeof value === "object") return JSON.stringify(value);
+  return String(value);
 }
-var UserAuthService = class {
-  store;
-  password;
-  jwt;
-  passwordMinLength;
-  accessTtlSeconds;
-  refreshTtlSeconds;
+
+// src/admin/auth.ts
+var UserModelAuthBackend = class {
+  model;
+  passwords;
   mfa;
-  mfaChallengeTtlSeconds;
+  identifierField;
+  requireAdmin;
   /**
-   * @param options - Store, password/JWT helpers and token policy.
+   * Build the backend.
+   *
+   * @param model - The user model class (a `BaseUserModel` subclass).
+   * @param options - Hasher, MFA verifier and gating overrides.
    */
-  constructor(options) {
-    this.store = options.store;
-    this.password = options.password;
-    this.jwt = options.jwt;
-    this.passwordMinLength = options.passwordMinLength ?? 12;
-    this.accessTtlSeconds = options.accessTtlSeconds ?? 3600;
-    this.refreshTtlSeconds = options.refreshTtlSeconds ?? 60 * 60 * 24 * 14;
-    this.mfa = options.mfa;
-    this.mfaChallengeTtlSeconds = options.mfaChallengeTtlSeconds ?? 300;
-  }
-  /** Mint a signed access + refresh token pair for `user`. */
-  async issueTokens(user) {
-    const accessToken = await this.jwt.encode(
-      { sub: user.id, roles: user.roles, type: "access" },
-      { ttlSeconds: this.accessTtlSeconds }
-    );
-    const refreshToken = await this.jwt.encode(
-      { sub: user.id, type: "refresh" },
-      { ttlSeconds: this.refreshTtlSeconds }
-    );
-    return {
-      accessToken,
-      refreshToken,
-      tokenType: "bearer",
-      expiresIn: this.accessTtlSeconds
-    };
+  constructor(model, options = {}) {
+    this.model = model;
+    this.passwords = options.passwords ?? new PasswordUtils();
+    this.mfa = options.mfa ?? null;
+    this.identifierField = options.identifierField ?? "email";
+    this.requireAdmin = options.requireAdmin ?? true;
   }
   /**
-   * Register a new user and issue tokens.
+   * Whether a row is allowed into the panel at all.
+   *
+   * @param row - The candidate row.
+   * @returns `true` when the row is active and (when required) an admin.
+   */
+  admits(row) {
+    if (row.isActive === false) return false;
+    return !this.requireAdmin || row.isAdmin === true;
+  }
+  /**
+   * Verify an identifier/password pair.
+   *
+   * The identifier is lowercased and trimmed before lookup, matching the
+   * normalization the auth service applies on signup.
+   *
+   * @param session - A DB session for the current request.
+   * @param identifier - The submitted identifier.
+   * @param password - The submitted plaintext password.
+   * @returns The matching row, or `null` when it does not qualify.
+   */
+  async authenticate(session, identifier, password) {
+    const repository = new BaseRepository(this.model, session);
+    const filters = { [this.identifierField]: identifier.trim().toLowerCase() };
+    const row = await repository.first(
+      filters
+    );
+    if (row === null || !this.admits(row)) return null;
+    if (!await this.passwords.verify(password, row.hashedPassword)) return null;
+    return row;
+  }
+  /**
+   * Re-load the principal a session points at.
+   *
+   * @param session - A DB session for the current request.
+   * @param subject - The principal id from the session cookie.
+   * @returns The row, or `null` when it vanished or lost its privileges.
+   */
+  async loadPrincipal(session, subject) {
+    const repository = new BaseRepository(this.model, session);
+    const row = await repository.getByIdOrNull(
+      subject
+    );
+    if (row === null || !this.admits(row)) return null;
+    return row;
+  }
+  /**
+   * Return the row's primary key.
+   *
+   * @param principal - The authenticated row.
+   * @returns The principal id.
+   */
+  principalId(principal) {
+    return String(principal.id);
+  }
+  /**
+   * Return the label shown in the panel header.
+   *
+   * @param principal - The authenticated row.
+   * @returns The identifier column's value.
+   */
+  displayName(principal) {
+    const value = principal[this.identifierField];
+    return typeof value === "string" ? value : String(principal.id);
+  }
+  /**
+   * Whether the principal enrolled a second factor.
+   *
+   * @param principal - The authenticated row.
+   * @returns `true` when an MFA verifier is configured and reports a secret.
+   */
+  async mfaEnabled(principal) {
+    if (this.mfa === null) return false;
+    return await this.mfa.isEnabled(String(principal.id));
+  }
+  /**
+   * Verify a submitted TOTP code.
+   *
+   * @param principal - The authenticated row.
+   * @param code - The submitted code.
+   * @returns `true` when the code is valid.
+   */
+  async verifyMfa(principal, code) {
+    if (this.mfa === null) return false;
+    return await this.mfa.verify(String(principal.id), code);
+  }
+};
+var MIN_SECRET_LENGTH = 32;
+function encode(value) {
+  return Buffer.from(value, "utf8").toString("base64url");
+}
+var AdminSessionStore = class {
+  secret;
+  cookieName;
+  maxAgeSeconds;
+  cookieSecure;
+  cookiePath;
+  /**
+   * Build the store.
+   *
+   * @param options - Secret, cookie name, lifetime and cookie flags.
+   * @throws Error When the secret is shorter than 32 characters.
+   */
+  constructor(options) {
+    if (options.secret.length < MIN_SECRET_LENGTH) {
+      throw new Error(
+        `Admin session secret must be at least ${MIN_SECRET_LENGTH} characters; got ${options.secret.length}`
+      );
+    }
+    this.secret = options.secret;
+    this.cookieName = options.cookieName ?? "tempest_admin_session";
+    this.maxAgeSeconds = options.maxAgeSeconds ?? 8 * 60 * 60;
+    this.cookieSecure = options.cookieSecure ?? true;
+    this.cookiePath = options.cookiePath ?? "/";
+  }
+  /**
+   * Sign a payload.
+   *
+   * @param payload - The base64url payload to sign.
+   * @returns The base64url signature.
+   */
+  sign(payload) {
+    return createHmac("sha256", this.secret).update(payload).digest("base64url");
+  }
+  /**
+   * Mint a fresh session for an authenticated principal.
+   *
+   * @param subject - The principal id.
+   * @param displayName - The name shown in the header.
+   * @param mfaPassed - Whether the second factor is already satisfied.
+   * @returns The new session payload (not yet written to a response).
+   */
+  issue(subject, displayName, mfaPassed = true) {
+    return {
+      subject,
+      displayName,
+      csrfToken: randomUUID(),
+      expiresAt: Math.floor(Date.now() / 1e3) + this.maxAgeSeconds,
+      mfaPassed
+    };
+  }
+  /**
+   * Read and verify the session carried by a request.
+   *
+   * @param req - The inbound request.
+   * @returns The session, or `null` when absent, tampered with or expired.
+   */
+  load(req) {
+    const raw = parseCookies(req.header("cookie") ?? void 0)[this.cookieName];
+    if (raw === void 0) return null;
+    const separator = raw.lastIndexOf(".");
+    if (separator <= 0) return null;
+    const payload = raw.slice(0, separator);
+    const signature = Buffer.from(raw.slice(separator + 1), "base64url");
+    const expected = Buffer.from(this.sign(payload), "base64url");
+    if (signature.length !== expected.length) return null;
+    if (!timingSafeEqual(signature, expected)) return null;
+    let session;
+    try {
+      session = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    } catch {
+      return null;
+    }
+    if (typeof session.subject !== "string" || typeof session.csrfToken !== "string") {
+      return null;
+    }
+    if (session.expiresAt <= Math.floor(Date.now() / 1e3)) return null;
+    return session;
+  }
+  /**
+   * Write a session to the response as a signed cookie.
+   *
+   * @param res - The outbound response.
+   * @param session - The session to persist.
+   */
+  save(res, session) {
+    const payload = encode(JSON.stringify(session));
+    const value = `${payload}.${this.sign(payload)}`;
+    const maxAge = Math.max(0, session.expiresAt - Math.floor(Date.now() / 1e3));
+    res.append("set-cookie", this.cookie(value, maxAge));
+  }
+  /**
+   * Drop the session cookie.
+   *
+   * @param res - The outbound response.
+   */
+  clear(res) {
+    res.append("set-cookie", this.cookie("", 0));
+  }
+  /**
+   * Render a `Set-Cookie` value with the configured flags.
+   *
+   * @param value - The cookie value.
+   * @param maxAge - Lifetime in seconds (`0` expires it immediately).
+   * @returns The header value.
+   */
+  cookie(value, maxAge) {
+    const parts = [
+      `${this.cookieName}=${value}`,
+      `Path=${this.cookiePath}`,
+      `Max-Age=${maxAge}`,
+      "HttpOnly",
+      "SameSite=Lax"
+    ];
+    if (this.cookieSecure) parts.push("Secure");
+    return parts.join("; ");
+  }
+};
+function csrfTokenMatches(session, submitted) {
+  if (typeof submitted !== "string") return false;
+  const expected = Buffer.from(session.csrfToken, "utf8");
+  const actual = Buffer.from(submitted, "utf8");
+  if (expected.length !== actual.length) return false;
+  return timingSafeEqual(expected, actual);
+}
+
+// src/admin/site.ts
+function isConcreteModel(value) {
+  if (typeof value !== "function") return false;
+  const proto = value.prototype;
+  if (typeof proto !== "object" || proto === null) return false;
+  if (!(proto instanceof Model)) return false;
+  const tablename = value.tablename;
+  return typeof tablename === "string" && tablename.length > 0;
+}
+var AdminSite = class {
+  /** Text used in the page `<title>` and the dashboard heading. */
+  title;
+  /** Centered header brand, or `null` to fall back to {@link AdminSite.title}. */
+  brand;
+  /** Dashboard subtitle. */
+  indexSubtitle;
+  /** Outbound "View site" link, or `null`. */
+  siteUrl;
+  /** Typed appearance overrides. */
+  theme;
+  registry = /* @__PURE__ */ new Map();
+  /**
+   * Initialize the site.
+   *
+   * @param options - Branding and appearance. See {@link AdminSiteOptions}.
+   */
+  constructor(options = {}) {
+    this.title = options.title ?? "Admin";
+    this.brand = options.brand ?? null;
+    this.indexSubtitle = options.indexSubtitle ?? "Site administration";
+    this.siteUrl = options.siteUrl ?? null;
+    this.theme = options.theme ?? {};
+  }
+  /**
+   * Return the centered header brand text.
+   *
+   * @returns {@link AdminSite.brand} when set, otherwise {@link AdminSite.title}.
+   */
+  brandText() {
+    return this.brand ?? this.title;
+  }
+  /**
+   * Register a model configuration under its slug.
+   *
+   * @param admin - An {@link AdminModel} instance, or the options to build one.
+   * @returns The registered instance, so the call can be chained or assigned.
+   * @throws Error When another configuration already holds the same slug.
+   */
+  register(admin) {
+    const config = admin instanceof AdminModel ? admin : new AdminModel(admin);
+    const slug = config.slug();
+    const existing = this.registry.get(slug);
+    if (existing !== void 0) {
+      throw new Error(
+        `AdminModel for slug "${slug}" is already registered (${existing.model.tablename}); refusing to overwrite with ${config.model.tablename}`
+      );
+    }
+    this.registry.set(slug, config);
+    return config;
+  }
+  /**
+   * Remove a previously registered configuration.
+   *
+   * @param slug - The slug to drop.
+   * @throws Error When no configuration is registered under the slug.
+   */
+  unregister(slug) {
+    if (!this.registry.delete(slug)) {
+      throw new Error(`No AdminModel registered for slug "${slug}"`);
+    }
+  }
+  /**
+   * Look a configuration up by slug.
+   *
+   * @param slug - The admin slug.
+   * @returns The configuration, or `null` when nothing matches.
+   */
+  get(slug) {
+    return this.registry.get(slug) ?? null;
+  }
+  /**
+   * Return every registered configuration, ordered by display name.
+   *
+   * @returns The configurations (empty when nothing is registered).
+   */
+  list() {
+    return [...this.registry.values()].sort(
+      (left, right) => left.verboseNamePlural().toLowerCase().localeCompare(right.verboseNamePlural().toLowerCase())
+    );
+  }
+  /**
+   * Register every concrete model found in `source` at once.
+   *
+   * The batch counterpart to {@link AdminSite.register}: instead of one call
+   * per table, hand it the models barrel and every model class declaring a
+   * `tablename` is wrapped in a default {@link AdminModel}.
+   *
+   * ```ts
+   * import * as models from "./db/models";
+   *
+   * site.automap(models);
+   * site.automap([UserModel, OrderModel], { pageSize: 50 });
+   * ```
+   *
+   * @param source - An array of model classes, or a module namespace object
+   *   whose values are swept (non-model entries are ignored).
+   * @param options - `exclude`, `skipRegistered` and any {@link AdminModel}
+   *   option applied uniformly to every model discovered here.
+   * @returns The configurations newly registered by this call.
+   * @throws Error When `skipRegistered` is `false` and a slug collides.
+   */
+  automap(source, options = {}) {
+    const { exclude = [], skipRegistered = true, ...adminOptions } = options;
+    const excluded = new Set(
+      exclude.map((entry) => typeof entry === "string" ? entry : entry.tablename)
+    );
+    const candidates = Array.isArray(source) ? source : Object.values(source);
+    const registered = [];
+    for (const candidate of candidates) {
+      if (!isConcreteModel(candidate)) continue;
+      if (excluded.has(candidate.tablename)) continue;
+      const config = new AdminModel({ ...adminOptions, model: candidate });
+      if (skipRegistered && this.registry.get(config.slug()) !== void 0) continue;
+      registered.push(this.register(config));
+    }
+    return registered.sort((left, right) => left.slug().localeCompare(right.slug()));
+  }
+};
+
+// src/admin/styles.ts
+var ADMIN_CSS = `:root {
+  --tempest-bg: #0f172a;
+  --tempest-bg-soft: #1e293b;
+  --tempest-bg-row: #f8fafc;
+  --tempest-bg-row-alt: #f1f5f9;
+  --tempest-fg: #0f172a;
+  --tempest-fg-soft: #475569;
+  --tempest-accent: #2563eb;
+  --tempest-accent-hover: #1d4ed8;
+  --tempest-accent-soft: rgba(37, 99, 235, 0.1);
+  --tempest-danger: #b91c1c;
+  /* Light surface + hairline used by cards / tables / dropdowns on the
+     (light) content area \u2014 distinct from the dark sidebar bg vars above.
+     Overridable by AdminTheme for dark mode. */
+  --tempest-surface: #ffffff;
+  --tempest-border: #e2e8f0;
+  --tempest-radius: 6px;
+  --tempest-shadow: 0 1px 2px rgba(15, 23, 42, 0.08);
+}
+
+* {
+  box-sizing: border-box;
+}
+
+body {
+  margin: 0;
+  font-family: var(--tempest-font, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif);
+  font-size: 14px;
+  color: var(--tempest-fg);
+  background: var(--tempest-page-bg, #f8fafc);
+  /* Sticky-footer column so the layout (and its sidebar) fills the
+     viewport even when the page content is short. */
+  min-height: 100vh;
+  display: flex;
+  flex-direction: column;
+}
+
+a {
+  color: var(--tempest-accent);
+  text-decoration: none;
+}
+
+a:hover {
+  color: var(--tempest-accent-hover);
+  text-decoration: underline;
+}
+
+button {
+  border: 0;
+  background: var(--tempest-accent);
+  color: #fff;
+  padding: 0.5rem 1rem;
+  border-radius: var(--tempest-radius);
+  cursor: pointer;
+  font: inherit;
+}
+
+button:hover {
+  background: var(--tempest-accent-hover);
+}
+
+input,
+select,
+textarea {
+  font: inherit;
+  padding: 0.45rem 0.6rem;
+  border-radius: var(--tempest-radius);
+  border: 1px solid #cbd5e1;
+  background: #fff;
+}
+
+.tempest-admin-header {
+  position: relative;
+  z-index: 20;
+  background: var(--tempest-bg);
+  color: #f8fafc;
+  padding: 0.75rem 1.5rem;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  box-shadow: var(--tempest-shadow);
+}
+
+/* Centered brand \u2014 pinned to the middle of the header (i.e. the screen)
+   regardless of the left (burger) / right (nav) cluster widths. */
+.tempest-admin-header__brand {
+  position: absolute;
+  left: 50%;
+  transform: translateX(-50%);
+  text-align: center;
+  pointer-events: none;
+}
+
+.tempest-admin-header__brand a {
+  color: #fff;
+  font-weight: 600;
+  font-size: 1.1rem;
+  pointer-events: auto;
+  display: inline-flex;
+  align-items: center;
+}
+
+/* Logo image (shown instead of the brand text when theme.logo_url is
+   set). Capped to the header height so any aspect ratio fits cleanly. */
+.tempest-admin-header__logo {
+  display: block;
+  max-height: 32px;
+  width: auto;
+}
+
+.tempest-admin-header__nav {
+  display: flex;
+  align-items: center;
+  gap: 1rem;
+  color: #cbd5e1;
+}
+
+.tempest-admin-header__nav a {
+  color: #cbd5e1;
+}
+
+.tempest-admin-header__user {
+  font-weight: 500;
+  color: #f1f5f9;
+}
+
+.tempest-admin-header__logout {
+  margin: 0;
+}
+
+.tempest-admin-header__logout button {
+  background: transparent;
+  color: #f1f5f9;
+  padding: 0.25rem 0.5rem;
+  border: 1px solid #475569;
+}
+
+.tempest-admin-header__logout button:hover {
+  background: rgba(255, 255, 255, 0.08);
+}
+
+.tempest-admin-header__left {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+}
+
+/* ---- Layout: persistent sidebar + content ---- */
+.tempest-admin-layout {
+  display: flex;
+  align-items: stretch;
+  flex: 1;            /* fill the viewport so the sidebar is full-height */
+}
+
+.tempest-admin-sidebar {
+  flex: 0 0 220px;
+  width: 220px;
+  background: var(--tempest-bg-soft);
+  color: #e2e8f0;
+  padding: 1rem 0.75rem;
+}
+
+.tempest-admin-sidebar__nav {
+  display: flex;
+  flex-direction: column;
+  gap: 0.15rem;
+  position: sticky;
+  top: 1rem;
+}
+
+.tempest-admin-sidebar__heading {
+  font-size: 0.7rem;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: #94a3b8;
+  margin: 1rem 0.75rem 0.35rem;
+}
+
+.tempest-admin-sidebar__link {
+  display: block;
+  padding: 0.5rem 0.75rem;
+  border-radius: var(--tempest-radius);
+  color: #cbd5e1;
+}
+
+.tempest-admin-sidebar__link:hover {
+  background: rgba(255, 255, 255, 0.06);
+  color: #fff;
+  text-decoration: none;
+}
+
+.tempest-admin-sidebar__link--active,
+.tempest-admin-sidebar__link--active:hover {
+  background: var(--tempest-accent);
+  color: #fff;
+}
+
+/* Burger toggle (CSS-only, via the hidden checkbox) \u2014 mobile only. */
+.tempest-admin-burger {
+  display: none;
+  flex-direction: column;
+  gap: 4px;
+  cursor: pointer;
+  padding: 0.3rem;
+}
+
+.tempest-admin-burger span {
+  display: block;
+  width: 22px;
+  height: 2px;
+  background: #f8fafc;
+  border-radius: 2px;
+}
+
+.tempest-admin-scrim {
+  display: none;
+}
+
+.tempest-admin-main {
+  flex: 1 1 auto;
+  min-width: 0;
+  max-width: 1080px;
+  margin: 2rem auto;
+  padding: 0 1.5rem;
+}
+
+.tempest-admin-messages {
+  list-style: none;
+  padding: 0;
+  margin: 0 0 1.5rem;
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+.tempest-admin-messages__item {
+  padding: 0.75rem 1rem;
+  border-radius: var(--tempest-radius);
+  border-left: 4px solid var(--tempest-accent);
+  background: #eff6ff;
+}
+
+.tempest-admin-messages__item--error {
+  border-left-color: var(--tempest-danger);
+  background: #fef2f2;
+}
+
+.tempest-admin-login {
+  max-width: 360px;
+  margin: 4rem auto;
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  padding: 2rem;
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-login h1 {
+  margin-top: 0;
+}
+
+.tempest-admin-login__form {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+
+.tempest-admin-login__form label {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+}
+
+.tempest-admin-login__error {
+  background: #fef2f2;
+  color: var(--tempest-danger);
+  padding: 0.75rem 1rem;
+  border-radius: var(--tempest-radius);
+}
+
+.tempest-admin-dashboard__table,
+.tempest-admin-list__table {
+  width: 100%;
+  border-collapse: collapse;
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  overflow: hidden;
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-dashboard__table th,
+.tempest-admin-dashboard__table td,
+.tempest-admin-list__table th,
+.tempest-admin-list__table td {
+  padding: 0.75rem 1rem;
+  text-align: left;
+  border-bottom: 1px solid #e2e8f0;
+  vertical-align: top;
+}
+
+.tempest-admin-list__table tr:nth-child(even) td {
+  background: var(--tempest-bg-row-alt);
+}
+
+.tempest-admin-list__header {
+  display: flex;
+  justify-content: space-between;
+  align-items: baseline;
+  margin-bottom: 1rem;
+}
+
+.tempest-admin-list__filters {
+  display: flex;
+  gap: 0.75rem;
+  align-items: end;
+  margin-bottom: 1rem;
+  flex-wrap: wrap;
+}
+
+.tempest-admin-list__filters label {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+}
+
+.tempest-admin-list__pagination {
+  display: flex;
+  gap: 1rem;
+  align-items: center;
+  justify-content: center;
+  margin-top: 1.5rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-detail__fields {
+  display: grid;
+  grid-template-columns: 200px 1fr;
+  gap: 0.5rem 1.5rem;
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  padding: 1.5rem;
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-detail__fields dt {
+  font-weight: 600;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-detail__fields dd {
+  margin: 0;
+  word-break: break-word;
+}
+
+.tempest-admin-detail__audit-title {
+  font-size: 1rem;
+  margin: 1.5rem 0 0.5rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-detail__json {
+  margin: 0;
+  padding: 0.5rem 0.75rem;
+  background: var(--tempest-bg-row);
+  border: 1px solid var(--tempest-border);
+  border-radius: var(--tempest-radius);
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 0.8rem;
+  overflow-x: auto;
+}
+
+.tempest-admin-history {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  border-left: 2px solid var(--tempest-border);
+}
+
+.tempest-admin-history__item {
+  position: relative;
+  padding: 0.5rem 0 1rem 1rem;
+}
+
+.tempest-admin-history__item::before {
+  content: "";
+  position: absolute;
+  left: -0.4rem;
+  top: 0.9rem;
+  width: 0.6rem;
+  height: 0.6rem;
+  border-radius: 50%;
+  background: var(--tempest-fg-soft);
+}
+
+.tempest-admin-history__item--create::before { background: #16a34a; }
+.tempest-admin-history__item--update::before { background: #d97706; }
+.tempest-admin-history__item--delete::before { background: #dc2626; }
+
+.tempest-admin-history__head {
+  display: flex;
+  gap: 0.75rem;
+  align-items: baseline;
+  flex-wrap: wrap;
+}
+
+.tempest-admin-history__action {
+  font-weight: 600;
+  text-transform: uppercase;
+  font-size: 0.75rem;
+  letter-spacing: 0.04em;
+}
+
+.tempest-admin-history__meta {
+  color: var(--tempest-fg-soft);
+  font-size: 0.85rem;
+}
+
+.tempest-admin-history__changes {
+  width: 100%;
+  border-collapse: collapse;
+  margin-top: 0.5rem;
+  font-size: 0.85rem;
+}
+
+.tempest-admin-history__changes th,
+.tempest-admin-history__changes td {
+  text-align: left;
+  padding: 0.25rem 0.5rem;
+  border-bottom: 1px solid var(--tempest-border);
+  vertical-align: top;
+  word-break: break-word;
+}
+
+.tempest-admin-history__changes th {
+  color: var(--tempest-fg-soft);
+  font-weight: 600;
+}
+
+.tempest-admin-history__empty {
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-ac {
+  position: relative;
+}
+
+.tempest-admin-ac__search {
+  width: 100%;
+}
+
+.tempest-admin-ac__results {
+  list-style: none;
+  margin: 0.25rem 0 0;
+  padding: 0;
+  border: 1px solid var(--tempest-border);
+  border-radius: var(--tempest-radius, 6px);
+  max-height: 12rem;
+  overflow-y: auto;
+  background: var(--tempest-surface);
+}
+
+.tempest-admin-ac__results:empty {
+  display: none;
+}
+
+.tempest-admin-ac__option {
+  display: block;
+  width: 100%;
+  text-align: left;
+  padding: 0.4rem 0.6rem;
+  background: none;
+  border: 0;
+  cursor: pointer;
+  color: inherit;
+  font: inherit;
+}
+
+.tempest-admin-ac__option:hover,
+.tempest-admin-ac__option:focus {
+  background: var(--tempest-accent-soft, rgba(0, 0, 0, 0.06));
+}
+
+.tempest-admin-ac__empty {
+  padding: 0.4rem 0.6rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-inline {
+  margin-top: 2rem;
+}
+
+.tempest-admin-inline__header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  margin-bottom: 0.5rem;
+}
+
+.tempest-admin-inline__header h2 {
+  font-size: 1rem;
+  margin: 0;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-inline__count {
+  font-weight: 400;
+}
+
+.tempest-admin-inline__scroll {
+  overflow-x: auto;
+}
+
+.tempest-admin-inline__table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.9rem;
+}
+
+.tempest-admin-inline__table th,
+.tempest-admin-inline__table td {
+  text-align: left;
+  padding: 0.4rem 0.6rem;
+  border-bottom: 1px solid var(--tempest-border);
+  white-space: nowrap;
+}
+
+.tempest-admin-inline__table th {
+  color: var(--tempest-fg-soft);
+  font-weight: 600;
+}
+
+.tempest-admin-inline__empty,
+.tempest-admin-inline__more {
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-cards {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(14rem, 1fr));
+  gap: 1rem;
+  margin: 1rem 0 2rem;
+}
+
+.tempest-admin-card {
+  display: flex;
+  flex-direction: column;
+  gap: 0.35rem;
+  padding: 1rem 1.1rem;
+  border: 1px solid var(--tempest-border);
+  border-radius: var(--tempest-radius, 8px);
+  background: var(--tempest-surface);
+}
+
+.tempest-admin-card__label {
+  font-size: 0.8rem;
+  color: var(--tempest-fg-soft);
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+
+.tempest-admin-card__value {
+  font-size: 1.7rem;
+  font-weight: 700;
+  line-height: 1.1;
+}
+
+.tempest-admin-card__value small {
+  font-size: 0.9rem;
+  font-weight: 400;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-card__trend {
+  font-size: 0.9rem;
+  font-weight: 600;
+}
+
+.tempest-admin-card__trend small {
+  font-weight: 400;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-card__trend--up { color: #16a34a; }
+.tempest-admin-card__trend--down { color: #dc2626; }
+.tempest-admin-card__trend--flat { color: var(--tempest-fg-soft); }
+
+.tempest-admin-card__parts {
+  list-style: none;
+  margin: 0.25rem 0 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 0.3rem;
+}
+
+.tempest-admin-card__parts li {
+  display: grid;
+  grid-template-columns: 6rem 1fr auto;
+  align-items: center;
+  gap: 0.5rem;
+  font-size: 0.85rem;
+}
+
+.tempest-admin-card__part-label {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-card__part-bar {
+  display: block;
+  height: 0.5rem;
+  border-radius: 999px;
+  background: var(--tempest-border);
+  overflow: hidden;
+}
+
+.tempest-admin-card__part-bar span {
+  display: block;
+  height: 100%;
+  background: var(--tempest-accent, #2563eb);
+}
+
+.tempest-admin-card__help {
+  font-size: 0.8rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-import__result {
+  margin: 1rem 0;
+}
+
+.tempest-admin-import__ok {
+  color: #16a34a;
+  font-weight: 600;
+}
+
+.tempest-admin-import__failed {
+  color: #d97706;
+  font-weight: 600;
+}
+
+.tempest-admin-import__errors {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.85rem;
+}
+
+.tempest-admin-import__errors th,
+.tempest-admin-import__errors td {
+  text-align: left;
+  padding: 0.3rem 0.5rem;
+  border-bottom: 1px solid var(--tempest-border);
+  vertical-align: top;
+}
+
+.tempest-admin-import__form label {
+  display: block;
+  margin: 1rem 0 0.5rem;
+}
+
+.tempest-admin-lenses {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.4rem;
+  margin: 0.5rem 0 1rem;
+  border-bottom: 1px solid var(--tempest-border);
+  padding-bottom: 0.5rem;
+}
+
+.tempest-admin-lens {
+  padding: 0.3rem 0.7rem;
+  border-radius: 999px;
+  border: 1px solid var(--tempest-border);
+  color: var(--tempest-fg-soft);
+  text-decoration: none;
+  font-size: 0.85rem;
+}
+
+.tempest-admin-lens:hover {
+  color: inherit;
+}
+
+.tempest-admin-lens--active {
+  background: var(--tempest-accent, #2563eb);
+  border-color: var(--tempest-accent, #2563eb);
+  color: #fff;
+}
+
+.tempest-admin-footer {
+  position: relative;
+  z-index: 20;
+  text-align: center;
+  padding: 2rem 0;
+  color: var(--tempest-fg-soft);
+}
+
+/* List toolbar: search/filters on the left, actions (export) on the right. */
+.tempest-admin-list__toolbar {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.75rem 1rem;
+  align-items: flex-end;
+  justify-content: space-between;
+  margin-bottom: 1rem;
+}
+
+.tempest-admin-list__actions {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+}
+
+.tempest-admin-list__actions a {
+  display: inline-block;
+  padding: 0.45rem 0.8rem;
+  border: 1px solid var(--tempest-accent);
+  border-radius: var(--tempest-radius);
+  background: #fff;
+  white-space: nowrap;
+}
+
+.tempest-admin-list__actions a:hover {
+  background: #eff6ff;
+  text-decoration: none;
+}
+
+/* Dashboard: system-metric stat cards + model cards. */
+.tempest-admin-stats {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
+  gap: 1rem;
+  margin: 1.5rem 0;
+}
+
+.tempest-admin-stat {
+  display: flex;
+  flex-direction: column;
+  gap: 0.15rem;
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  padding: 1rem 1.25rem;
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-stat__label {
+  font-size: 0.8rem;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-stat__value {
+  font-size: 1.6rem;
+  font-weight: 700;
+}
+
+.tempest-admin-stat__sub {
+  font-size: 0.8rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-models {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(240px, 1fr));
+  gap: 1rem;
+  margin-top: 1rem;
+}
+
+.tempest-admin-model-card {
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  padding: 1rem 1.25rem;
+  box-shadow: var(--tempest-shadow);
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+}
+
+.tempest-admin-model-card__head {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 0.5rem;
+}
+
+.tempest-admin-model-card__head h2 {
+  margin: 0;
+  font-size: 1.05rem;
+}
+
+.tempest-admin-model-card__count {
+  font-weight: 700;
+  color: var(--tempest-accent);
+}
+
+.tempest-admin-model-card__actions {
+  display: flex;
+  gap: 1rem;
+}
+
+/* Bulk-action bar above the list table. */
+.tempest-admin-bulk {
+  margin: 0;
+}
+
+.tempest-admin-bulk__bar {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+  margin-bottom: 0.75rem;
+}
+
+.tempest-admin-list__check {
+  width: 1%;
+  white-space: nowrap;
+  text-align: center;
+}
+
+.tempest-admin-list__check input {
+  width: auto;
+}
+
+/* Horizontal-scroll wrapper so wide tables never break the layout. */
+.tempest-admin-table-wrap {
+  width: 100%;
+  overflow-x: auto;
+  -webkit-overflow-scrolling: touch;
+  border-radius: var(--tempest-radius);
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-table-wrap .tempest-admin-list__table,
+.tempest-admin-table-wrap .tempest-admin-dashboard__table {
+  box-shadow: none;
+}
+
+/* Sortable column headers. */
+.tempest-admin-list__table th a.tempest-sort {
+  color: inherit;
+  display: inline-flex;
+  align-items: center;
+  gap: 0.3rem;
+  white-space: nowrap;
+}
+
+.tempest-admin-list__table th a.tempest-sort:hover {
+  color: var(--tempest-accent);
+  text-decoration: none;
+}
+
+.tempest-sort__arrow {
+  font-size: 0.75em;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-sort--active .tempest-sort__arrow {
+  color: var(--tempest-accent);
+}
+
+/* Detail header actions (back / edit / delete). */
+.tempest-admin-detail__header {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.5rem 1rem;
+  align-items: center;
+  justify-content: space-between;
+  margin-bottom: 1rem;
+}
+
+.tempest-admin-detail__actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.5rem;
+  align-items: center;
+}
+
+.tempest-admin-detail__delete {
+  margin: 0;
+}
+
+.tempest-admin-btn {
+  display: inline-block;
+  padding: 0.45rem 0.8rem;
+  border: 1px solid var(--tempest-accent);
+  border-radius: var(--tempest-radius);
+  background: #fff;
+}
+
+.tempest-admin-btn:hover {
+  background: #eff6ff;
+  text-decoration: none;
+}
+
+.tempest-admin-btn--danger {
+  background: var(--tempest-danger);
+}
+
+.tempest-admin-btn--danger:hover {
+  background: #991b1b;
+}
+
+/* Scoped under __actions so it beats \`.tempest-admin-list__actions a\`
+   (otherwise the white action-link background won + white text = invisible). */
+.tempest-admin-list__actions a.tempest-admin-list__new,
+a.tempest-admin-list__new {
+  background: var(--tempest-accent);
+  color: #fff;
+  border-color: var(--tempest-accent);
+}
+
+.tempest-admin-list__actions a.tempest-admin-list__new:hover,
+a.tempest-admin-list__new:hover {
+  background: var(--tempest-accent-hover);
+  color: #fff;
+}
+
+/* Create / edit form. */
+.tempest-admin-form__form {
+  display: grid;
+  gap: 1rem;
+  max-width: 640px;
+  background: #fff;
+  padding: 1.5rem;
+  border-radius: var(--tempest-radius);
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-form__field {
+  display: flex;
+  flex-direction: column;
+  gap: 0.3rem;
+}
+
+.tempest-admin-form__field > label {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+}
+
+.tempest-admin-form__field > label > span {
+  font-weight: 600;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-form__field input,
+.tempest-admin-form__field select,
+.tempest-admin-form__field textarea {
+  width: 100%;
+}
+
+.tempest-admin-form__json {
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 0.85rem;
+  white-space: pre;
+  overflow-wrap: normal;
+  overflow-x: auto;
+}
+
+.tempest-admin-form__check {
+  flex-direction: row !important;
+  align-items: center;
+  gap: 0.5rem;
+}
+
+.tempest-admin-form__check input {
+  width: auto;
+}
+
+.tempest-admin-form__field--error input,
+.tempest-admin-form__field--error select,
+.tempest-admin-form__field--error textarea {
+  border-color: var(--tempest-danger);
+}
+
+.tempest-admin-form__field-error {
+  color: var(--tempest-danger);
+}
+
+.tempest-admin-form__error {
+  background: #fef2f2;
+  color: var(--tempest-danger);
+  padding: 0.75rem 1rem;
+  border-radius: var(--tempest-radius);
+  margin-bottom: 1rem;
+}
+
+.tempest-admin-form__actions {
+  display: flex;
+  gap: 1rem;
+  align-items: center;
+}
+
+/* ---- Responsive ---- */
+
+/* Tablet and below. */
+@media (max-width: 1023px) {
+  .tempest-admin-main {
+    margin: 1.25rem auto;
+    padding: 0 1rem;
+  }
+}
+
+/* Mobile (<= 430px and small phones). */
+@media (max-width: 600px) {
+  .tempest-admin-header {
+    flex-direction: column;
+    align-items: flex-start;
+    gap: 0.5rem;
+    padding: 0.75rem 1rem;
+  }
+
+  .tempest-admin-header__nav {
+    width: 100%;
+    flex-wrap: wrap;
+    gap: 0.5rem 0.75rem;
+  }
+
+  .tempest-admin-main {
+    margin: 1rem auto;
+    padding: 0 0.75rem;
+  }
+
+  .tempest-admin-list__header {
+    flex-direction: column;
+    gap: 0.25rem;
+    align-items: flex-start;
+  }
+
+  .tempest-admin-list__toolbar {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .tempest-admin-list__filters {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .tempest-admin-list__filters input,
+  .tempest-admin-list__filters select,
+  .tempest-admin-list__filters button {
+    width: 100%;
+  }
+
+  .tempest-admin-list__actions {
+    justify-content: stretch;
+  }
+
+  .tempest-admin-list__actions a {
+    flex: 1;
+    text-align: center;
+  }
+
+  /* Stack the detail grid into single-column rows. */
+  .tempest-admin-detail__fields {
+    grid-template-columns: 1fr;
+    gap: 0.15rem 0;
+    padding: 1rem;
+  }
+
+  /* The logs table becomes stacked cards. Horizontal scroll is fine for a
+     list view you skim, but the logs table's fourth column carries the
+     message, the request context and the traceback \u2014 everything you came to
+     read \u2014 so at this width it sat off-screen behind a sideways drag, and an
+     opened traceback showed up only as a tall blank row. Labels come from
+     each cell's data-label, so the header can be dropped without losing
+     which value is which. Scoped to this table: the other list views keep
+     the scroll treatment. */
+  .tempest-admin-logs .tempest-admin-table-wrap {
+    overflow-x: visible;
+  }
+
+  .tempest-admin-logs__table thead {
+    display: none;
+  }
+
+  .tempest-admin-logs__table,
+  .tempest-admin-logs__table tbody,
+  .tempest-admin-logs__table tr,
+  .tempest-admin-logs__table td {
+    display: block;
+    width: 100%;
+  }
+
+  .tempest-admin-logs__table tr {
+    padding: 0.85rem 0.9rem;
+    border-bottom: 1px solid #e2e8f0;
+  }
+
+  .tempest-admin-logs__table tr:last-child {
+    border-bottom: none;
+  }
+
+  .tempest-admin-logs__table td {
+    padding: 0.1rem 0;
+    border: none;
+  }
+
+  .tempest-admin-logs__table td[data-label]::before {
+    content: attr(data-label);
+    display: block;
+    color: var(--tempest-fg-soft);
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+    font-size: 0.64rem;
+    font-weight: 600;
+  }
+
+  /* The message is the card's body, not another labelled field. */
+  .tempest-admin-logs__table td.tempest-admin-logs__msg {
+    margin-top: 0.5rem;
+  }
+
+  .tempest-admin-logs__table td.tempest-admin-logs__msg::before {
+    display: none;
+  }
+
+  .tempest-admin-logs__logger {
+    white-space: normal;
+    overflow-wrap: anywhere;
+  }
+
+  .tempest-admin-detail__fields dt {
+    margin-top: 0.75rem;
+  }
+
+  .tempest-admin-detail__fields dd {
+    padding-bottom: 0.5rem;
+    border-bottom: 1px solid #e2e8f0;
+  }
+
+  .tempest-admin-login {
+    margin: 1.5rem auto;
+    padding: 1.5rem;
+  }
+
+  .tempest-admin-form__form {
+    padding: 1rem;
+  }
+
+  .tempest-admin-form__actions {
+    flex-direction: column-reverse;
+    align-items: stretch;
+  }
+
+  .tempest-admin-form__actions button,
+  .tempest-admin-form__actions .tempest-admin-form__cancel {
+    width: 100%;
+    text-align: center;
+  }
+
+  .tempest-admin-bulk__bar {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .tempest-admin-bulk__bar select,
+  .tempest-admin-bulk__bar button {
+    width: 100%;
+  }
+}
+
+/* ---- Application logs page ---- */
+.tempest-log-badge {
+  display: inline-block;
+  padding: 0.1rem 0.5rem;
+  border-radius: 999px;
+  font-size: 0.72rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+  background: #e2e8f0;
+  color: #334155;
+}
+
+.tempest-log-badge--debug {
+  background: #e2e8f0;
+  color: #475569;
+}
+
+.tempest-log-badge--info {
+  background: #dbeafe;
+  color: #1e40af;
+}
+
+.tempest-log-badge--warning {
+  background: #fef3c7;
+  color: #92400e;
+}
+
+.tempest-log-badge--error {
+  background: #fee2e2;
+  color: #991b1b;
+}
+
+.tempest-log-badge--critical {
+  background: #7f1d1d;
+  color: #fff;
+}
+
+.tempest-admin-logs__ts {
+  white-space: nowrap;
+  font-variant-numeric: tabular-nums;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-logs__logger {
+  color: var(--tempest-fg-soft);
+  white-space: nowrap;
+}
+
+.tempest-admin-logs__msg {
+  word-break: break-word;
+}
+
+.tempest-admin-logs__empty {
+  color: var(--tempest-fg-soft);
+  background: #fff;
+  padding: 1.5rem;
+  border-radius: var(--tempest-radius);
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-logs__actions {
+  display: flex;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+}
+
+.tempest-admin-logs__export {
+  display: inline-block;
+  padding: 0.35rem 0.75rem;
+  border-radius: var(--tempest-radius);
+  border: 1px solid #cbd5e1;
+  background: #fff;
+  color: #334155;
+  font-size: 0.82rem;
+  font-weight: 600;
+  text-decoration: none;
+}
+
+.tempest-admin-logs__export:hover {
+  background: #f1f5f9;
+}
+
+.tempest-admin-logs__meta {
+  list-style: none;
+  margin: 0.4rem 0 0;
+  padding: 0;
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.3rem 0.75rem;
+  font-size: 0.75rem;
+}
+
+/* The gap is layout only \u2014 it does not survive a copy, and an operator copying a
+   row to paste into an issue would get "status_code404". The template keeps a
+   real space between the label and the value for that; this widens the visual
+   separation on top of it, since an uppercase micro-label sitting against a
+   monospace value reads as one token. */
+.tempest-admin-logs__meta li {
+  display: inline-flex;
+  align-items: baseline;
+  gap: 0.4rem;
+}
+
+.tempest-admin-logs__meta span {
+  color: var(--tempest-fg-soft);
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+  font-size: 0.68rem;
+}
+
+.tempest-admin-logs__meta code {
+  word-break: break-all;
+}
+
+/* Collapsed by default so a page full of 500s stays scannable; details/summary
+   keeps that working with no JavaScript, which the admin does not ship. */
+.tempest-admin-logs__trace {
+  margin-top: 0.5rem;
+}
+
+/* The summary carries the record's own message, so the whole item is the click
+   target instead of a separate link. It must therefore read as body text, not
+   as a control \u2014 the affordance is the marker plus the hint chip. */
+.tempest-admin-logs__trace summary {
+  cursor: pointer;
+  list-style: none;
+  display: block;
+}
+
+.tempest-admin-logs__trace summary::-webkit-details-marker {
+  display: none;
+}
+
+.tempest-admin-logs__msg-text::before {
+  content: "\u25B8";
+  display: inline-block;
+  width: 0.9rem;
+  color: #991b1b;
+  font-size: 0.7rem;
+}
+
+.tempest-admin-logs__trace[open] .tempest-admin-logs__msg-text::before {
+  content: "\u25BE";
+}
+
+.tempest-admin-logs__trace-hint {
+  display: inline-block;
+  margin-top: 0.3rem;
+  font-size: 0.68rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: #991b1b;
+}
+
+.tempest-admin-logs__trace[open] .tempest-admin-logs__trace-hint {
+  opacity: 0.55;
+}
+
+/* Lines wrap instead of extending. A <pre> is sized by its longest line and it
+   sits in a table cell, which sizes to content, so \`overflow-x\` on the <pre>
+   cannot shrink it: the table grew past its scroll container (measured 1364px
+   against a 1012px wrap) and the trace could only be read by dragging the table
+   sideways. Wrapping keeps the table at its container width. It costs the
+   alignment of the caret markers on screen; the markdown export carries the
+   exact unwrapped text for real analysis. */
+.tempest-admin-logs__trace pre {
+  margin: 0.5rem 0 0;
+  padding: 0.75rem;
+  max-height: 24rem;
+  overflow-y: auto;
+  background: #0f172a;
+  color: #e2e8f0;
+  border-radius: var(--tempest-radius);
+  font-size: 0.74rem;
+  line-height: 1.45;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+  -webkit-user-select: all;
+  user-select: all;
+}
+
+.tempest-admin-logs__note {
+  color: var(--tempest-fg-soft);
+  font-size: 0.8rem;
+  margin-top: 0.75rem;
+}
+
+/* ---- Sidebar off-canvas on tablet/mobile, burger reveals it ---- */
+@media (max-width: 768px) {
+  .tempest-admin-burger {
+    display: flex;
+  }
+
+  .tempest-admin-sidebar {
+    position: fixed;
+    top: 0;
+    left: 0;
+    bottom: 0;
+    z-index: 50;
+    width: 240px;
+    flex-basis: 240px;
+    transform: translateX(-100%);
+    transition: transform 0.2s ease;
+    overflow-y: auto;
+    box-shadow: 0 0 24px rgba(15, 23, 42, 0.35);
+  }
+
+  .tempest-admin-navtoggle:checked ~ .tempest-admin-layout .tempest-admin-sidebar {
+    transform: translateX(0);
+  }
+
+  .tempest-admin-navtoggle:checked ~ .tempest-admin-layout .tempest-admin-scrim {
+    display: block;
+    position: fixed;
+    inset: 0;
+    z-index: 40;
+    background: rgba(15, 23, 42, 0.45);
+  }
+}
+
+/* ---- Desktop: sidebar overlays the header + footer ---- */
+@media (min-width: 769px) {
+  .tempest-admin-sidebar {
+    position: fixed;
+    top: 0;
+    left: 0;
+    bottom: 0;
+    z-index: 100;        /* above header/footer (z-index: 20) */
+    overflow-y: auto;
+    /* Clear the header bar so the first nav link sits below it. */
+    padding-top: 3.75rem;
+  }
+
+  /* The fixed sidebar leaves the flex flow, so reserve its gutter on
+     the layout row to keep the main content from sliding underneath. */
+  .tempest-admin-layout {
+    padding-left: 220px;
+  }
+}
+
+/* Flash banner shown after a custom bulk action runs. */
+.tempest-admin-flash {
+  margin: 0 0 1rem;
+  padding: 0.7rem 1rem;
+  border-radius: var(--tempest-radius);
+  border-left: 4px solid var(--tempest-accent);
+  background: var(--tempest-bg);
+  color: var(--tempest-fg);
+}
+
+.tempest-admin-flash--error {
+  border-left-color: var(--tempest-danger);
+}
+
+.tempest-admin-flash--warning {
+  border-left-color: #d97706;
+}
+
+/* Task panel \u2014 declared schedule and persisted runs. */
+.tempest-admin-tasks__scope {
+  margin: 0 0 1.25rem;
+  color: var(--tempest-fg-soft);
+  font-size: 0.9rem;
+}
+
+.tempest-admin-tasks__heading {
+  margin: 1.75rem 0 0.75rem;
+  font-size: 1.05rem;
+}
+
+.tempest-admin-tasks__empty {
+  padding: 1rem;
+  border: 1px dashed var(--tempest-border);
+  border-radius: var(--tempest-radius);
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-tasks__trigger + .tempest-admin-tasks__trigger {
+  margin-top: 0.35rem;
+}
+
+.tempest-admin-tasks__offset {
+  color: var(--tempest-fg-soft);
+  font-size: 0.85rem;
+  white-space: nowrap;
+}
+
+.tempest-admin-tasks__status {
+  display: inline-block;
+  padding: 0.1rem 0.5rem;
+  border-radius: 999px;
+  font-size: 0.8rem;
+  border: 1px solid var(--tempest-border);
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-tasks__status--running {
+  border-color: var(--tempest-accent);
+  color: var(--tempest-accent);
+}
+
+.tempest-admin-tasks__status--done {
+  border-color: #15803d;
+  color: #15803d;
+}
+
+.tempest-admin-tasks__status--failed {
+  border-color: var(--tempest-danger);
+  color: var(--tempest-danger);
+}
+
+/* Cancelled is terminal but not a failure, so it stays neutral: an
+   operator scanning for red should find only what went wrong. */
+.tempest-admin-tasks__status--cancelled {
+  border-color: var(--tempest-border);
+  color: var(--tempest-fg-soft);
+}
+
+/* The track uses the border token, not a row background: the list stripes
+   rows with --tempest-bg-row-alt, so a track painted in it vanished on
+   every other row \u2014 an empty progress cell reads as "no data", not as 0%. */
+.tempest-admin-tasks__bar {
+  display: inline-block;
+  width: 90px;
+  height: 8px;
+  border-radius: 999px;
+  background: var(--tempest-border);
+  overflow: hidden;
+  vertical-align: middle;
+}
+
+.tempest-admin-tasks__bar--wide {
+  display: block;
+  width: 100%;
+  height: 12px;
+  margin: 0 0 1.25rem;
+}
+
+.tempest-admin-tasks__bar-fill {
+  display: block;
+  height: 100%;
+  background: var(--tempest-accent);
+}
+
+.tempest-admin-tasks__facts {
+  display: grid;
+  grid-template-columns: max-content 1fr;
+  gap: 0.4rem 1.25rem;
+  margin: 0 0 1.5rem;
+}
+
+.tempest-admin-tasks__facts dt {
+  color: var(--tempest-fg-soft);
+  font-size: 0.85rem;
+}
+
+.tempest-admin-tasks__facts dd {
+  margin: 0;
+}
+
+.tempest-admin-tasks__error pre {
+  padding: 0.85rem;
+  border-radius: var(--tempest-radius);
+  border-left: 4px solid var(--tempest-danger);
+  background: var(--tempest-bg-row-alt);
+  overflow-x: auto;
+  white-space: pre-wrap;
+}
+
+.tempest-admin-tasks__cancel {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+  margin: 0 0 1.5rem;
+}
+
+.tempest-admin-tasks__hint {
+  color: var(--tempest-fg-soft);
+  font-size: 0.85rem;
+}
+
+@media (max-width: 640px) {
+  .tempest-admin-tasks__facts {
+    grid-template-columns: 1fr;
+    gap: 0.15rem;
+  }
+
+  .tempest-admin-tasks__facts dd {
+    margin: 0 0 0.6rem;
+  }
+}
+`;
+
+// src/admin/theme.ts
+var FORBIDDEN_CHARS = ["<", ">", "{", "}", '"'];
+function assertSafe(field, value) {
+  if (value === void 0) return;
+  const bad = FORBIDDEN_CHARS.filter((char) => value.includes(char));
+  if (bad.length > 0) {
+    throw new Error(
+      `AdminTheme.${field} contains forbidden character(s) ${bad.join(" ")}; these would break the injected <style>/HTML. Got: ${value}`
+    );
+  }
+}
+function resolveAdminTheme(theme = {}) {
+  for (const [field, value] of Object.entries(theme)) {
+    if (typeof value === "string") assertSafe(field, value);
+  }
+  const headerBg = theme.headerBg ?? "#0f172a";
+  return {
+    accent: theme.accent ?? "#2563eb",
+    accentHover: theme.accentHover ?? "#1d4ed8",
+    danger: theme.danger ?? "#b91c1c",
+    headerBg,
+    sidebarBg: theme.sidebarBg ?? headerBg,
+    pageBg: theme.pageBg ?? null,
+    radius: theme.radius ?? "6px",
+    fontFamily: theme.fontFamily ?? null,
+    logoUrl: theme.logoUrl ?? null,
+    logoAlt: theme.logoAlt ?? "Logo",
+    faviconUrl: theme.faviconUrl ?? null,
+    footerText: theme.footerText ?? "Powered by tempest-express-sdk",
+    darkMode: theme.darkMode ?? false,
+    customCssUrl: theme.customCssUrl ?? null
+  };
+}
+function adminThemeCss(theme) {
+  const variables = {
+    "--tempest-accent": theme.accent,
+    "--tempest-accent-hover": theme.accentHover,
+    "--tempest-danger": theme.danger,
+    "--tempest-bg": theme.headerBg,
+    "--tempest-bg-soft": theme.sidebarBg,
+    "--tempest-radius": theme.radius
+  };
+  if (theme.fontFamily !== null) variables["--tempest-font"] = theme.fontFamily;
+  if (theme.pageBg !== null) variables["--tempest-page-bg"] = theme.pageBg;
+  const rootLines = Object.entries(variables).map(([name, value]) => `  ${name}: ${value};`).join("\n");
+  const blocks = [`:root {
+${rootLines}
+}`];
+  if (theme.darkMode && theme.pageBg === null) {
+    blocks.push(
+      [
+        ":root {",
+        "  --tempest-page-bg: #0b1120;",
+        "  --tempest-bg-row: #1e293b;",
+        "  --tempest-bg-row-alt: #172033;",
+        "  --tempest-fg: #e2e8f0;",
+        "  --tempest-fg-soft: #94a3b8;",
+        "}",
+        "body { color: var(--tempest-fg); }",
+        "input, select, textarea {",
+        "  background: #1e293b;",
+        "  color: var(--tempest-fg);",
+        "  border-color: #334155;",
+        "}"
+      ].join("\n")
+    );
+  }
+  if (theme.fontFamily !== null) {
+    blocks.push("body { font-family: var(--tempest-font); }");
+  }
+  return blocks.join("\n");
+}
+
+// src/admin/templates.ts
+function escapeHtml(value) {
+  return String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function renderLayout(context, title, body) {
+  const { site, theme, prefix, session, currentPath, navModels, messages } = context;
+  const authed = session !== null;
+  const indexUrl = `${prefix}/`;
+  const navLink = (url, label, active) => `<a href="${escapeHtml(url)}" class="tempest-admin-sidebar__link${active ? " tempest-admin-sidebar__link--active" : ""}">${escapeHtml(label)}</a>`;
+  const sidebar = authed ? `<label for="tempest-nav-toggle" class="tempest-admin-scrim" aria-hidden="true"></label>
+    <aside class="tempest-admin-sidebar">
+      <nav class="tempest-admin-sidebar__nav" aria-label="Admin navigation">
+        ${navLink(indexUrl, "Dashboard", currentPath === indexUrl)}
+        ${navModels.length > 0 ? `<span class="tempest-admin-sidebar__heading">Models</span>${navModels.map(
+    (entry) => navLink(entry.url, entry.label, currentPath.startsWith(entry.url))
+  ).join("")}` : ""}
+      </nav>
+    </aside>` : "";
+  const brand = theme.logoUrl !== null ? `<img src="${escapeHtml(theme.logoUrl)}" alt="${escapeHtml(theme.logoAlt)}" class="tempest-admin-header__logo">` : escapeHtml(site.brandText());
+  const headerNav = authed ? `<nav class="tempest-admin-header__nav">
+      <span class="tempest-admin-header__user">${escapeHtml(session.displayName)}</span>
+      ${site.siteUrl !== null ? `<a href="${escapeHtml(site.siteUrl)}">View site</a>` : ""}
+      <form method="post" action="${escapeHtml(`${prefix}/logout`)}" class="tempest-admin-header__logout">
+        <input type="hidden" name="csrf_token" value="${escapeHtml(session.csrfToken)}">
+        <button type="submit">Logout</button>
+      </form>
+    </nav>` : "";
+  const banners = messages.length > 0 ? `<ul class="tempest-admin-messages">${messages.map(
+    (message) => `<li class="tempest-admin-messages__item tempest-admin-messages__item--${escapeHtml(
+      message.level
+    )}">${escapeHtml(message.text)}</li>`
+  ).join("")}</ul>` : "";
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${escapeHtml(title)}</title>
+  ${theme.faviconUrl !== null ? `<link rel="icon" href="${escapeHtml(theme.faviconUrl)}">` : ""}
+  <link rel="stylesheet" href="${escapeHtml(`${prefix}/static/admin.css`)}">
+  <style>${adminThemeCss(theme)}</style>
+  ${theme.customCssUrl !== null ? `<link rel="stylesheet" href="${escapeHtml(theme.customCssUrl)}">` : ""}
+</head>
+<body>
+  ${authed ? '<input type="checkbox" id="tempest-nav-toggle" class="tempest-admin-navtoggle" hidden>' : ""}
+  <header class="tempest-admin-header">
+    <div class="tempest-admin-header__left">
+      ${authed ? `<label for="tempest-nav-toggle" class="tempest-admin-burger" aria-label="Toggle navigation"><span></span><span></span><span></span></label>` : ""}
+      <div class="tempest-admin-header__brand"><a href="${escapeHtml(indexUrl)}">${brand}</a></div>
+    </div>
+    ${headerNav}
+  </header>
+  <div class="tempest-admin-layout">
+    ${sidebar}
+    <main class="tempest-admin-main">
+      ${banners}
+      ${body}
+    </main>
+  </div>
+  <footer class="tempest-admin-footer"><small>${escapeHtml(theme.footerText)}</small></footer>
+</body>
+</html>`;
+}
+function renderLoginPage(context, error) {
+  const body = `<section class="tempest-admin-login">
+  <h1>Sign in</h1>
+  <p>${escapeHtml(context.site.indexSubtitle)}</p>
+  ${error !== null ? `<p class="tempest-admin-login__error" role="alert">${escapeHtml(error)}</p>` : ""}
+  <form method="post" action="${escapeHtml(`${context.prefix}/login`)}" class="tempest-admin-login__form">
+    <label><span>Email</span><input type="email" name="identifier" autocomplete="username" required autofocus></label>
+    <label><span>Password</span><input type="password" name="password" autocomplete="current-password" required></label>
+    <button type="submit">Sign in</button>
+  </form>
+</section>`;
+  return renderLayout(context, `Sign in \xB7 ${context.site.title}`, body);
+}
+function renderMfaPage(context, error) {
+  const body = `<section class="tempest-admin-login">
+  <h1>Two-factor code</h1>
+  <p>Enter the 6-digit code from your authenticator app.</p>
+  ${error !== null ? `<p class="tempest-admin-login__error" role="alert">${escapeHtml(error)}</p>` : ""}
+  <form method="post" action="${escapeHtml(`${context.prefix}/mfa`)}" class="tempest-admin-login__form">
+    <label><span>Code</span><input type="text" name="code" inputmode="numeric" autocomplete="one-time-code" required autofocus></label>
+    <button type="submit">Verify</button>
+  </form>
+</section>`;
+  return renderLayout(context, `Two-factor \xB7 ${context.site.title}`, body);
+}
+function renderDashboardPage(context, cards, metrics) {
+  const metricsPanel = metrics === null ? "" : `<div class="tempest-admin-stats" aria-label="System metrics">
+    <div class="tempest-admin-stat">
+      <span class="tempest-admin-stat__label">CPU</span>
+      <span class="tempest-admin-stat__value">${escapeHtml(metrics.cpuPercent)}%</span>
+    </div>
+    <div class="tempest-admin-stat">
+      <span class="tempest-admin-stat__label">Memory</span>
+      <span class="tempest-admin-stat__value">${escapeHtml(metrics.memoryPercent)}%</span>
+      <span class="tempest-admin-stat__sub">${escapeHtml(metrics.memoryUsedGb)} / ${escapeHtml(metrics.memoryTotalGb)} GB</span>
+    </div>
+  </div>`;
+  const models = cards.length > 0 ? `<div class="tempest-admin-models">${cards.map(
+    (card) => `<article class="tempest-admin-model-card">
+      <header class="tempest-admin-model-card__head">
+        <h2>${escapeHtml(card.label)}</h2>
+        ${card.count !== null ? `<span class="tempest-admin-model-card__count">${escapeHtml(card.count)}</span>` : ""}
+      </header>
+      <div class="tempest-admin-model-card__actions">
+        <a href="${escapeHtml(card.url)}">Browse</a>
+        ${card.newUrl !== null ? `<a href="${escapeHtml(card.newUrl)}">+ New</a>` : ""}
+      </div>
+    </article>`
+  ).join("")}</div>` : "<p>No models registered. Register an <code>AdminModel</code> on the <code>AdminSite</code> to populate this dashboard.</p>";
+  const body = `<section class="tempest-admin-dashboard">
+  <h1>${escapeHtml(context.site.title)}</h1>
+  <p>${escapeHtml(context.site.indexSubtitle)}</p>
+  ${metricsPanel}
+  ${models}
+</section>`;
+  return renderLayout(context, context.site.title, body);
+}
+function renderFilter(filter) {
+  const name = `filter_${filter.field}`;
+  if (filter.kind === "select") {
+    const options = filter.options.map(
+      (option) => `<option value="${escapeHtml(option.value)}"${option.selected ? " selected" : ""}>${escapeHtml(option.label)}</option>`
+    ).join("");
+    return `<label><span>${escapeHtml(filter.label)}</span><select name="${escapeHtml(name)}"><option value="">\u2014 any \u2014</option>${options}</select></label>`;
+  }
+  if (filter.kind === "daterange") {
+    return `<label><span>${escapeHtml(filter.label)}</span><span class="tempest-admin-list__daterange">
+      <input type="date" name="${escapeHtml(`${name}_from`)}" value="${escapeHtml(filter.valueFrom)}" aria-label="${escapeHtml(filter.label)} from">
+      <input type="date" name="${escapeHtml(`${name}_to`)}" value="${escapeHtml(filter.valueTo)}" aria-label="${escapeHtml(filter.label)} to">
+    </span></label>`;
+  }
+  return `<label><span>${escapeHtml(filter.label)}</span><input type="text" name="${escapeHtml(name)}" value="${escapeHtml(filter.value)}"></label>`;
+}
+function renderListPage(context, view) {
+  const headers = view.columns.map((column6) => {
+    const state = view.sort[column6];
+    if (state === void 0) return `<th>${escapeHtml(column6)}</th>`;
+    const arrow = state.active ? state.ascending ? "\u25B2" : "\u25BC" : "\u2195";
+    return `<th><a class="tempest-sort${state.active ? " tempest-sort--active" : ""}" href="${escapeHtml(state.url)}"><span>${escapeHtml(column6)}</span><span class="tempest-sort__arrow" aria-hidden="true">${arrow}</span></a></th>`;
+  }).join("");
+  const rows = view.rows.length > 0 ? view.rows.map(
+    (row) => `<tr>${row.cells.map((cell) => `<td>${escapeHtml(cell)}</td>`).join("")}<td><a href="${escapeHtml(row.url)}">View</a></td></tr>`
+  ).join("") : `<tr><td colspan="${view.columns.length + 1}">No records.</td></tr>`;
+  const hasControls = view.searchable || view.filters.length > 0;
+  const body = `<section class="tempest-admin-list">
+  <header class="tempest-admin-list__header">
+    <h1>${escapeHtml(view.title)}</h1>
+    <p>${escapeHtml(view.total)} record${view.total === 1 ? "" : "s"}.</p>
+  </header>
+  <div class="tempest-admin-list__toolbar">
+    <form method="get" class="tempest-admin-list__filters">
+      ${view.searchable ? `<input type="search" name="q" value="${escapeHtml(view.searchValue)}" placeholder="Search\u2026" aria-label="Search">` : ""}
+      ${view.filters.map(renderFilter).join("")}
+      ${hasControls ? '<button type="submit">Apply</button>' : ""}
+    </form>
+    <div class="tempest-admin-list__actions">
+      ${view.newUrl !== null ? `<a class="tempest-admin-list__new" href="${escapeHtml(view.newUrl)}">+ New</a>` : ""}
+    </div>
+  </div>
+  <div class="tempest-admin-table-wrap">
+    <table class="tempest-admin-list__table">
+      <thead><tr>${headers}<th>Actions</th></tr></thead>
+      <tbody>${rows}</tbody>
+    </table>
+  </div>
+  ${view.pages > 1 ? `<nav class="tempest-admin-list__pagination" aria-label="Pagination">
+    ${view.prevUrl !== null ? `<a href="${escapeHtml(view.prevUrl)}">\u2190 Prev</a>` : ""}
+    <span>Page ${escapeHtml(view.page)} of ${escapeHtml(view.pages)}</span>
+    ${view.nextUrl !== null ? `<a href="${escapeHtml(view.nextUrl)}">Next \u2192</a>` : ""}
+  </nav>` : ""}
+</section>`;
+  return renderLayout(context, `${view.title} \xB7 ${context.site.title}`, body);
+}
+function renderDetailPage(context, view) {
+  if (context.session === null) throw new Error("The detail view requires a session");
+  const csrf = escapeHtml(context.session.csrfToken);
+  const fields = view.fields.map(
+    (field) => `<dt>${escapeHtml(field.label)}</dt><dd>${field.value === "" ? "<em>\u2014</em>" : escapeHtml(field.value)}</dd>`
+  ).join("");
+  const body = `<section class="tempest-admin-detail">
+  <header class="tempest-admin-detail__header">
+    <h1>${escapeHtml(view.title)} \xB7 ${escapeHtml(view.identity)}</h1>
+    <div class="tempest-admin-detail__actions">
+      <a href="${escapeHtml(view.backUrl)}">\u2190 Back to list</a>
+      ${view.editUrl !== null ? `<a class="tempest-admin-btn" href="${escapeHtml(view.editUrl)}">Edit</a>` : ""}
+      ${view.deleteUrl !== null ? `<form method="post" action="${escapeHtml(view.deleteUrl)}" class="tempest-admin-detail__delete" onsubmit="return confirm('Delete this record? This cannot be undone.');">
+        <input type="hidden" name="csrf_token" value="${csrf}">
+        <button type="submit" class="tempest-admin-btn--danger">Delete</button>
+      </form>` : ""}
+    </div>
+  </header>
+  <dl class="tempest-admin-detail__fields">${fields}</dl>
+</section>`;
+  return renderLayout(context, `${view.title} \xB7 ${view.identity}`, body);
+}
+function renderFormField(field) {
+  const required = field.required ? " required" : "";
+  const name = escapeHtml(field.name);
+  const value = escapeHtml(field.value);
+  const label = escapeHtml(field.label);
+  let control;
+  switch (field.widget) {
+    case "checkbox":
+      control = `<label class="tempest-admin-form__check"><input type="checkbox" name="${name}" value="true"${field.checked ? " checked" : ""}><span>${label}</span></label>`;
+      break;
+    case "textarea":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><textarea name="${name}" rows="4"${required}>${value}</textarea></label>`;
+      break;
+    case "json":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><textarea name="${name}" rows="6" class="tempest-admin-form__json" spellcheck="false"${required}>${value}</textarea><small class="tempest-admin-form__hint">JSON \u2014 must parse (e.g. <code>{}</code>, <code>[]</code>, <code>"text"</code>).</small></label>`;
+      break;
+    case "select": {
+      const blank = field.required ? "" : '<option value="">\u2014 none \u2014</option>';
+      const options = field.options.map(
+        (option) => `<option value="${escapeHtml(option.value)}"${option.value === field.value ? " selected" : ""}>${escapeHtml(option.label)}</option>`
+      ).join("");
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><select name="${name}"${required}>${blank}${options}</select></label>`;
+      break;
+    }
+    case "number":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="number" name="${name}" value="${value}"${field.step !== null ? ` step="${escapeHtml(field.step)}"` : ""}${required}></label>`;
+      break;
+    case "datetime":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="datetime-local" name="${name}" value="${value}"${required}></label>`;
+      break;
+    case "date":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="date" name="${name}" value="${value}"${required}></label>`;
+      break;
+    case "time":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="time" name="${name}" value="${value}"${required}></label>`;
+      break;
+    default:
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="text" name="${name}" value="${value}"${required}></label>`;
+  }
+  const error = field.error !== null ? `<small class="tempest-admin-form__field-error">${escapeHtml(field.error)}</small>` : "";
+  return `<div class="tempest-admin-form__field${field.error !== null ? " tempest-admin-form__field--error" : ""}">${control}${error}</div>`;
+}
+function renderFormPage(context, view) {
+  if (context.session === null) throw new Error("The admin form requires a session");
+  const heading = view.mode === "create" ? `New ${view.title}` : `Edit ${view.title}`;
+  const body = `<section class="tempest-admin-form">
+  <header class="tempest-admin-detail__header">
+    <h1>${escapeHtml(heading)}</h1>
+    <a href="${escapeHtml(view.backUrl)}">\u2190 Back</a>
+  </header>
+  ${view.error !== null ? `<p class="tempest-admin-form__error">${escapeHtml(view.error)}</p>` : ""}
+  <form method="post" action="${escapeHtml(view.actionUrl)}" class="tempest-admin-form__form">
+    <input type="hidden" name="csrf_token" value="${escapeHtml(context.session.csrfToken)}">
+    ${view.fields.map(renderFormField).join("")}
+    <div class="tempest-admin-form__actions">
+      <button type="submit">${view.mode === "create" ? "Create" : "Save"}</button>
+      <a href="${escapeHtml(view.backUrl)}" class="tempest-admin-form__cancel">Cancel</a>
+    </div>
+  </form>
+</section>`;
+  return renderLayout(context, `${heading} \xB7 ${context.site.title}`, body);
+}
+var logger2 = new JSONLogger("tempest_express_sdk.admin.router");
+var FLASH_MESSAGES = {
+  created: { text: "Record created.", level: "success" },
+  updated: { text: "Record updated.", level: "success" },
+  deleted: { text: "Record deleted.", level: "success" }
+};
+function queryString(value) {
+  if (typeof value === "string") return value.trim();
+  if (Array.isArray(value) && typeof value[0] === "string") return value[0].trim();
+  return "";
+}
+function buildQuery(entries) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(entries)) {
+    if (value === void 0 || value === "") continue;
+    params.set(key, String(value));
+  }
+  return params.toString();
+}
+function makeAdminRouter(site, options) {
+  const prefix = (options.prefix ?? "/admin").replace(/\/$/, "");
+  const theme = resolveAdminTheme(site.theme);
+  const showMetrics = options.showMetrics ?? true;
+  const sessions = new AdminSessionStore({
+    secret: options.secretKey,
+    ...options.cookieName === void 0 ? {} : { cookieName: options.cookieName },
+    ...options.sessionMaxAgeSeconds === void 0 ? {} : { maxAgeSeconds: options.sessionMaxAgeSeconds },
+    ...options.cookieSecure === void 0 ? {} : { cookieSecure: options.cookieSecure },
+    cookiePath: prefix === "" ? "/" : prefix
+  });
+  const backend = options.authBackend;
+  const router = express3.Router();
+  router.use(prefix, express3.urlencoded({ extended: false }));
+  const context = (req, session) => ({
+    site,
+    theme,
+    prefix,
+    session,
+    currentPath: req.originalUrl.split("?")[0] ?? req.path,
+    navModels: site.list().map((admin) => ({
+      label: admin.verboseNamePlural(),
+      url: `${prefix}/m/${admin.slug()}`
+    })),
+    messages: flashFor(req)
+  });
+  const flashFor = (req) => {
+    const message = FLASH_MESSAGES[queryString(req.query.ok)];
+    return message === void 0 ? [] : [message];
+  };
+  const html = (res, body, status = 200) => {
+    res.status(status).type("html").send(body);
+  };
+  const guarded = (handler) => (req, res) => {
+    handler(req, res).catch((error) => {
+      logger2.error("Admin request failed", {
+        path: req.originalUrl,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      if (res.headersSent) return;
+      html(
+        res,
+        renderLoginPage(context(req, null), "Something went wrong. Please try again."),
+        500
+      );
+    });
+  };
+  const authenticate = async (req, res) => {
+    const session = sessions.load(req);
+    if (session === null) {
+      res.redirect(`${prefix}/login`);
+      return null;
+    }
+    const dbSession = options.engine.session();
+    const principal = await backend.loadPrincipal(dbSession, session.subject);
+    if (principal === null) {
+      sessions.clear(res);
+      res.redirect(`${prefix}/login`);
+      return null;
+    }
+    if (!session.mfaPassed) {
+      res.redirect(`${prefix}/mfa`);
+      return null;
+    }
+    return { session, dbSession };
+  };
+  const resolveAdmin = (req, res, state) => {
+    const admin = site.get(String(req.params.slug));
+    if (admin === null) {
+      html(res, renderNotFound(context(req, state.session)), 404);
+      return null;
+    }
+    return admin;
+  };
+  const renderNotFound = (ctx) => renderDashboardPage(
+    { ...ctx, messages: [{ text: "Not found.", level: "error" }] },
+    [],
+    null
+  );
+  const checkCsrf = (req, res, state) => {
+    const body = req.body;
+    if (csrfTokenMatches(state.session, body?.csrf_token)) return true;
+    html(res, renderNotFound(context(req, state.session)), 403);
+    return false;
+  };
+  router.get(`${prefix}/static/admin.css`, (_req, res) => {
+    res.type("css").set("cache-control", "public, max-age=3600").send(ADMIN_CSS);
+  });
+  router.get(`${prefix}/login`, (req, res) => {
+    html(res, renderLoginPage(context(req, null), null));
+  });
+  router.post(
+    `${prefix}/login`,
+    guarded(async (req, res) => {
+      const body = req.body;
+      const identifier = typeof body.identifier === "string" ? body.identifier : "";
+      const password = typeof body.password === "string" ? body.password : "";
+      const dbSession = options.engine.session();
+      const principal = await backend.authenticate(dbSession, identifier, password);
+      if (principal === null) {
+        html(res, renderLoginPage(context(req, null), "Invalid credentials."), 401);
+        return;
+      }
+      const needsMfa = await backend.mfaEnabled?.(principal) ?? false;
+      const session = sessions.issue(
+        backend.principalId(principal),
+        backend.displayName(principal),
+        !needsMfa
+      );
+      sessions.save(res, session);
+      res.redirect(needsMfa ? `${prefix}/mfa` : `${prefix}/`);
+    })
+  );
+  router.get(`${prefix}/mfa`, (req, res) => {
+    const session = sessions.load(req);
+    if (session === null) {
+      res.redirect(`${prefix}/login`);
+      return;
+    }
+    if (session.mfaPassed) {
+      res.redirect(`${prefix}/`);
+      return;
+    }
+    html(res, renderMfaPage(context(req, null), null));
+  });
+  router.post(
+    `${prefix}/mfa`,
+    guarded(async (req, res) => {
+      const session = sessions.load(req);
+      if (session === null) {
+        res.redirect(`${prefix}/login`);
+        return;
+      }
+      const body = req.body;
+      const code = typeof body.code === "string" ? body.code : "";
+      const dbSession = options.engine.session();
+      const principal = await backend.loadPrincipal(dbSession, session.subject);
+      const verified = principal !== null && (await backend.verifyMfa?.(principal, code) ?? false);
+      if (!verified) {
+        html(res, renderMfaPage(context(req, null), "Invalid code."), 401);
+        return;
+      }
+      sessions.save(res, { ...session, mfaPassed: true });
+      res.redirect(`${prefix}/`);
+    })
+  );
+  router.post(
+    `${prefix}/logout`,
+    guarded(async (req, res) => {
+      const session = sessions.load(req);
+      if (session !== null && !csrfTokenMatches(session, req.body?.csrf_token)) {
+        html(res, renderLoginPage(context(req, null), "Invalid request."), 403);
+        return;
+      }
+      sessions.clear(res);
+      res.redirect(`${prefix}/login`);
+    })
+  );
+  router.get(
+    `${prefix}/`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const cards = [];
+      for (const admin of site.list()) {
+        let count = null;
+        try {
+          count = await admin.repository(state.dbSession).count();
+        } catch (error) {
+          logger2.warning("Admin dashboard count failed", {
+            slug: admin.slug(),
+            error: error instanceof Error ? error.message : String(error)
+          });
+        }
+        cards.push({
+          label: admin.verboseNamePlural(),
+          count,
+          url: `${prefix}/m/${admin.slug()}`,
+          newUrl: admin.canCreate ? `${prefix}/m/${admin.slug()}/new` : null
+        });
+      }
+      let metrics = null;
+      if (showMetrics) {
+        const snapshot2 = MetricsUtils.system();
+        metrics = {
+          cpuPercent: Math.round(snapshot2.cpu.loadPercent),
+          memoryPercent: Math.round(snapshot2.memory.usedPercent),
+          memoryUsedGb: (snapshot2.memory.used / 1024 ** 3).toFixed(1),
+          memoryTotalGb: (snapshot2.memory.total / 1024 ** 3).toFixed(1)
+        };
+      }
+      html(res, renderDashboardPage(context(req, state.session), cards, metrics));
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      html(res, await renderList(req, admin, state));
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug/new`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      if (!admin.canCreate) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      html(
+        res,
+        renderFormPage(context(req, state.session), {
+          mode: "create",
+          title: admin.verboseName(),
+          fields: buildFormFields(admin),
+          actionUrl: `${prefix}/m/${admin.slug()}/new`,
+          backUrl: `${prefix}/m/${admin.slug()}`,
+          error: null
+        })
+      );
+    })
+  );
+  router.post(
+    `${prefix}/m/:slug/new`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      if (!admin.canCreate) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      if (!checkCsrf(req, res, state)) return;
+      const body = req.body;
+      const parsed = parseFormBody(admin, body);
+      const rerender = (error, status) => {
+        html(
+          res,
+          renderFormPage(context(req, state.session), {
+            mode: "create",
+            title: admin.verboseName(),
+            fields: buildFormFields(admin, { values: body, errors: parsed.errors }),
+            actionUrl: `${prefix}/m/${admin.slug()}/new`,
+            backUrl: `${prefix}/m/${admin.slug()}`,
+            error
+          }),
+          status
+        );
+      };
+      if (Object.keys(parsed.errors).length > 0) {
+        rerender("Please fix the highlighted fields.", 400);
+        return;
+      }
+      try {
+        await admin.repository(state.dbSession).create(parsed.data);
+      } catch (error) {
+        rerender(describeWriteFailure(admin, error), 400);
+        return;
+      }
+      res.redirect(`${prefix}/m/${admin.slug()}?ok=created`);
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug/:identity`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      const row = await findRow(admin, state.dbSession, String(req.params.identity));
+      if (row === null) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      const identity = String(row[admin.identityField]);
+      html(
+        res,
+        renderDetailPage(context(req, state.session), {
+          title: admin.verboseName(),
+          identity,
+          fields: admin.detailFieldNames().map((name) => ({ label: name, value: formatCellValue(row[name]) })),
+          backUrl: `${prefix}/m/${admin.slug()}`,
+          editUrl: admin.canEdit ? `${prefix}/m/${admin.slug()}/${identity}/edit` : null,
+          deleteUrl: admin.canDelete ? `${prefix}/m/${admin.slug()}/${identity}/delete` : null
+        })
+      );
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug/:identity/edit`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      const identity = String(req.params.identity);
+      const row = admin.canEdit ? await findRow(admin, state.dbSession, identity) : null;
+      if (row === null) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      html(
+        res,
+        renderFormPage(context(req, state.session), {
+          mode: "edit",
+          title: admin.verboseName(),
+          fields: buildFormFields(admin, { values: row }),
+          actionUrl: `${prefix}/m/${admin.slug()}/${identity}/edit`,
+          backUrl: `${prefix}/m/${admin.slug()}/${identity}`,
+          error: null
+        })
+      );
+    })
+  );
+  router.post(
+    `${prefix}/m/:slug/:identity/edit`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      const identity = String(req.params.identity);
+      if (!admin.canEdit) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      if (!checkCsrf(req, res, state)) return;
+      const body = req.body;
+      const parsed = parseFormBody(admin, body);
+      const rerender = (error, status) => {
+        html(
+          res,
+          renderFormPage(context(req, state.session), {
+            mode: "edit",
+            title: admin.verboseName(),
+            fields: buildFormFields(admin, { values: body, errors: parsed.errors }),
+            actionUrl: `${prefix}/m/${admin.slug()}/${identity}/edit`,
+            backUrl: `${prefix}/m/${admin.slug()}/${identity}`,
+            error
+          }),
+          status
+        );
+      };
+      if (Object.keys(parsed.errors).length > 0) {
+        rerender("Please fix the highlighted fields.", 400);
+        return;
+      }
+      try {
+        const changed = await admin.repository(state.dbSession).update({ [admin.identityField]: identity }, parsed.data);
+        if (changed === 0) {
+          html(res, renderNotFound(context(req, state.session)), 404);
+          return;
+        }
+      } catch (error) {
+        rerender(describeWriteFailure(admin, error), 400);
+        return;
+      }
+      res.redirect(`${prefix}/m/${admin.slug()}/${identity}?ok=updated`);
+    })
+  );
+  router.post(
+    `${prefix}/m/:slug/:identity/delete`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      if (!admin.canDelete) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      if (!checkCsrf(req, res, state)) return;
+      await admin.repository(state.dbSession).delete({ [admin.identityField]: String(req.params.identity) });
+      res.redirect(`${prefix}/m/${admin.slug()}?ok=deleted`);
+    })
+  );
+  async function findRow(admin, dbSession, identity) {
+    const row = await admin.repository(dbSession).first({ [admin.identityField]: identity });
+    return row ?? null;
+  }
+  async function renderList(req, admin, state) {
+    const columns = adminColumns(admin.model);
+    const search = queryString(req.query.q);
+    const page2 = Math.max(1, Number.parseInt(queryString(req.query.page), 10) || 1);
+    const sortField = queryString(req.query.sort);
+    const sortColumn = sortField in columns ? sortField : null;
+    const ascending = sortColumn === null ? admin.orderAscending : queryString(req.query.dir) !== "desc";
+    const conditions = [];
+    const filterViews = [];
+    for (const field of admin.listFilter) {
+      const column6 = columns[field];
+      if (column6 === void 0) continue;
+      const spec = filterForColumn(column6);
+      if (spec.kind === "daterange") {
+        const from = queryString(req.query[`filter_${field}_from`]);
+        const to = queryString(req.query[`filter_${field}_to`]);
+        const bounds = {};
+        if (from !== "") bounds.gte = new Date(from);
+        if (to !== "") bounds.lte = /* @__PURE__ */ new Date(`${to}T23:59:59.999Z`);
+        if (Object.keys(bounds).length > 0) conditions.push({ [field]: bounds });
+        filterViews.push({
+          field,
+          label: humanizeField(field),
+          kind: "daterange",
+          value: "",
+          valueFrom: from,
+          valueTo: to,
+          options: []
+        });
+        continue;
+      }
+      const value = queryString(req.query[`filter_${field}`]);
+      if (value !== "") {
+        conditions.push({
+          [field]: column6.type.kind === "boolean" ? value === "true" : value
+        });
+      }
+      filterViews.push({
+        field,
+        label: humanizeField(field),
+        kind: spec.kind,
+        value,
+        valueFrom: "",
+        valueTo: "",
+        options: spec.options.map((option) => ({
+          value: option.value,
+          label: option.label,
+          selected: option.value === value
+        }))
+      });
+    }
+    const searchable = admin.searchFields.filter((field) => {
+      const column6 = columns[field];
+      return column6 !== void 0 && isSearchableColumn(column6);
+    });
+    if (search !== "" && searchable.length > 0) {
+      conditions.push(
+        or(...searchable.map((field) => ({ [field]: { ilike: `%${search}%` } })))
+      );
+    }
+    const where = conditions.length === 0 ? void 0 : and(...conditions);
+    const orderBy = sortColumn ?? admin.orderKey ?? void 0;
+    const result = await admin.repository(state.dbSession).paginate({
+      page: page2,
+      pageSize: admin.pageSize,
+      ...orderBy === void 0 ? {} : { orderBy },
+      ascending,
+      ...where === void 0 ? {} : { filters: where }
+    });
+    const displayed = admin.listDisplayNames();
+    const baseQuery = { q: search };
+    for (const view2 of filterViews) {
+      if (view2.kind === "daterange") {
+        baseQuery[`filter_${view2.field}_from`] = view2.valueFrom;
+        baseQuery[`filter_${view2.field}_to`] = view2.valueTo;
+      } else {
+        baseQuery[`filter_${view2.field}`] = view2.value;
+      }
+    }
+    const sort = {};
+    for (const column6 of displayed) {
+      if (!(column6 in columns)) continue;
+      const active = (sortColumn ?? admin.orderKey) === column6;
+      const nextAscending = active ? !ascending : true;
+      sort[column6] = {
+        url: `?${buildQuery({
+          ...baseQuery,
+          sort: column6,
+          dir: nextAscending ? "asc" : "desc"
+        })}`,
+        active,
+        ascending
+      };
+    }
+    const pageUrl = (target) => `?${buildQuery({
+      ...baseQuery,
+      sort: sortColumn ?? void 0,
+      dir: sortColumn === null ? void 0 : ascending ? "asc" : "desc",
+      page: target
+    })}`;
+    const view = {
+      title: admin.verboseNamePlural(),
+      columns: displayed,
+      rows: result.items.map((row) => {
+        const identity = String(row[admin.identityField]);
+        return {
+          identity,
+          cells: displayed.map((column6) => formatCellValue(row[column6])),
+          url: `${prefix}/m/${admin.slug()}/${identity}`
+        };
+      }),
+      total: result.total,
+      page: result.page,
+      pages: result.pages,
+      prevUrl: result.page > 1 ? pageUrl(result.page - 1) : null,
+      nextUrl: result.page < result.pages ? pageUrl(result.page + 1) : null,
+      searchable: searchable.length > 0,
+      searchValue: search,
+      filters: filterViews,
+      sort,
+      newUrl: admin.canCreate ? `${prefix}/m/${admin.slug()}/new` : null
+    };
+    return renderListPage(context(req, state.session), view);
+  }
+  return router;
+}
+function describeWriteFailure(admin, error) {
+  const detail = error instanceof Error ? error.message : String(error);
+  return `The database refused this ${admin.verboseName().toLowerCase()}: ${detail}`;
+}
+
+// src/admin/json/site.ts
+var AdminJsonSite = class {
+  /**
+   * @param brand - Display name surfaced under `GET {prefix}/`.
+   */
+  constructor(brand = "Admin") {
+    this.brand = brand;
+  }
+  brand;
+  resources = /* @__PURE__ */ new Map();
+  /**
+   * Register a resource.
+   *
+   * @param resource - The resource config.
+   * @returns The same resource (for chaining).
+   */
+  register(resource) {
+    this.resources.set(resource.name, resource);
+    return resource;
+  }
+  /** Look up a resource by slug, or `null`. */
+  get(name) {
+    return this.resources.get(name) ?? null;
+  }
+  /** Every registered resource. */
+  list() {
+    return [...this.resources.values()];
+  }
+};
+var PAGINATION_KEYS2 = /* @__PURE__ */ new Set(["page", "pageSize"]);
+function methodNotAllowed(operation) {
+  return new AppException({
+    message: `Operation not allowed: ${operation}`,
+    code: "METHOD_NOT_ALLOWED",
+    statusCode: 405
+  });
+}
+function requireResource(site, name) {
+  const resource = site.get(name);
+  if (!resource) throw new NotFoundException({ message: `Unknown resource: ${name}` });
+  return resource;
+}
+function makeAdminJsonRouter(site, options = {}) {
+  const prefix = (options.prefix ?? "/admin").replace(/\/$/, "");
+  const router = Router();
+  if (options.guard) router.use(prefix, options.guard);
+  router.get(prefix, (_req, res) => {
+    res.json({
+      brand: site.brand,
+      resources: site.list().map((r) => ({ name: r.name, fields: r.fields }))
+    });
+  });
+  router.get(`${prefix}/:resource/_meta`, (req, res) => {
+    const resource = requireResource(site, req.params.resource);
+    res.json({
+      name: resource.name,
+      fields: resource.fields,
+      operations: {
+        create: Boolean(resource.create),
+        update: Boolean(resource.update),
+        remove: Boolean(resource.remove)
+      }
+    });
+  });
+  router.get(`${prefix}/:resource`, async (req, res) => {
+    const resource = requireResource(site, req.params.resource);
+    const filters = {};
+    for (const [key, value] of Object.entries(req.query)) {
+      if (!PAGINATION_KEYS2.has(key) && typeof value === "string") filters[key] = value;
+    }
+    const page2 = Math.max(1, Number.parseInt(String(req.query.page ?? "1"), 10) || 1);
+    const pageSize = Math.max(
+      1,
+      Number.parseInt(String(req.query.pageSize ?? "20"), 10) || 20
+    );
+    res.json(await resource.list({ page: page2, pageSize, filters }));
+  });
+  router.get(`${prefix}/:resource/:id`, async (req, res) => {
+    const resource = requireResource(site, req.params.resource);
+    const record = await resource.get(req.params.id);
+    if (record === null) throw new NotFoundException({ message: "Record not found" });
+    res.json(record);
+  });
+  router.post(`${prefix}/:resource`, async (req, res) => {
+    const resource = requireResource(site, req.params.resource);
+    if (!resource.create) throw methodNotAllowed("create");
+    const data = resource.createSchema ? resource.createSchema.parse(req.body) : req.body;
+    res.status(201).json(await resource.create(data));
+  });
+  router.patch(`${prefix}/:resource/:id`, async (req, res) => {
+    const resource = requireResource(site, req.params.resource);
+    if (!resource.update) throw methodNotAllowed("update");
+    const data = resource.updateSchema ? resource.updateSchema.parse(req.body) : req.body;
+    res.json(await resource.update(req.params.id, data));
+  });
+  router.delete(`${prefix}/:resource/:id`, async (req, res) => {
+    const resource = requireResource(site, req.params.resource);
+    if (!resource.remove) throw methodNotAllowed("remove");
+    await resource.remove(req.params.id);
+    res.status(204).end();
+  });
+  return router;
+}
+
+// src/auth/schemas.ts
+var signupSchema = z.object({
+  email: z.email().openapi({ description: "Login identifier (email)." }),
+  password: z.string().min(1).openapi({ description: "Plaintext password (hashed server-side)." }),
+  name: z.string().max(120).optional().openapi({ description: "Optional display name." })
+}).openapi("Signup");
+var loginSchema = z.object({
+  email: z.email().openapi({ description: "Login identifier (email)." }),
+  password: z.string().min(1).openapi({ description: "Plaintext password." })
+}).openapi("Login");
+var refreshSchema = z.object({
+  refreshToken: z.string().min(1).openapi({ description: "A valid refresh token." })
+}).openapi("Refresh");
+var tokenPairSchema = z.object({
+  accessToken: z.string().openapi({ description: "Short-lived bearer access token." }),
+  refreshToken: z.string().openapi({ description: "Long-lived refresh token." }),
+  tokenType: z.literal("bearer").openapi({ description: "Always 'bearer'." }),
+  expiresIn: z.number().int().openapi({ description: "Access-token lifetime in seconds." })
+}).openapi("TokenPair");
+var userPublicSchema = z.object({
+  id: z.string().openapi({ description: "User id." }),
+  email: z.email().openapi({ description: "User email." }),
+  name: z.string().nullable().openapi({ description: "Display name, or null." }),
+  isActive: z.boolean().openapi({ description: "Whether the account is active." }),
+  roles: z.array(z.string()).openapi({ description: "Assigned role names." })
+}).openapi("UserPublic");
+var authResponseSchema = z.object({
+  user: userPublicSchema,
+  tokens: tokenPairSchema
+}).openapi("AuthResponse");
+var mfaEnrollResponseSchema = z.object({
+  secret: z.string().openapi({ description: "Base32 TOTP secret (manual entry)." }),
+  otpauthUri: z.string().openapi({ description: "otpauth:// URI to render as QR." })
+}).openapi("MfaEnrollResponse");
+var mfaCodeSchema = z.object({ code: z.string().min(1).openapi({ description: "Authenticator code." }) }).openapi("MfaCode");
+var mfaChallengeSchema = z.object({
+  mfaToken: z.string().min(1).openapi({ description: "Challenge token from login." }),
+  code: z.string().min(1).openapi({ description: "Authenticator code." })
+}).openapi("MfaChallenge");
+var activationSchema = z.object({ token: z.string().min(1).openapi({ description: "Activation token." }) }).openapi("Activation");
+var passwordResetRequestSchema = z.object({ email: z.email().openapi({ description: "Account email." }) }).openapi("PasswordResetRequest");
+var passwordResetConfirmSchema = z.object({
+  token: z.string().min(1).openapi({ description: "Reset token." }),
+  password: z.string().min(1).openapi({ description: "New plaintext password." })
+}).openapi("PasswordResetConfirm");
+
+// src/auth/service.ts
+function toPublic(user) {
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    isActive: user.isActive,
+    roles: user.roles
+  };
+}
+var UserAuthService = class {
+  store;
+  password;
+  jwt;
+  passwordMinLength;
+  accessTtlSeconds;
+  refreshTtlSeconds;
+  mfa;
+  mfaChallengeTtlSeconds;
+  /**
+   * @param options - Store, password/JWT helpers and token policy.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.password = options.password;
+    this.jwt = options.jwt;
+    this.passwordMinLength = options.passwordMinLength ?? 12;
+    this.accessTtlSeconds = options.accessTtlSeconds ?? 3600;
+    this.refreshTtlSeconds = options.refreshTtlSeconds ?? 60 * 60 * 24 * 14;
+    this.mfa = options.mfa;
+    this.mfaChallengeTtlSeconds = options.mfaChallengeTtlSeconds ?? 300;
+  }
+  /** Mint a signed access + refresh token pair for `user`. */
+  async issueTokens(user) {
+    const accessToken = await this.jwt.encode(
+      { sub: user.id, roles: user.roles, type: "access" },
+      { ttlSeconds: this.accessTtlSeconds }
+    );
+    const refreshToken = await this.jwt.encode(
+      { sub: user.id, type: "refresh" },
+      { ttlSeconds: this.refreshTtlSeconds }
+    );
+    return {
+      accessToken,
+      refreshToken,
+      tokenType: "bearer",
+      expiresIn: this.accessTtlSeconds
+    };
+  }
+  /**
+   * Register a new user and issue tokens.
    *
    * @param data - Validated signup payload.
    * @returns The public user and a fresh token pair.
@@ -9998,7 +13179,7 @@ function renderPasswordResetFormPage(options) {
      </form>`
   );
 }
-var logger2 = new JSONLogger("tempest_express_sdk.api.handlers");
+var logger3 = new JSONLogger("tempest_express_sdk.api.handlers");
 var REQUEST_ID_HEADER = "X-Request-ID";
 var VALID_REQUEST_ID = /^[A-Za-z0-9._\-:+/=]{1,128}$/;
 function requestIdMiddleware() {
@@ -10040,7 +13221,7 @@ function makeAppExceptionHandler(options = {}) {
       return;
     }
     const isServerError = exc.statusCode >= 500;
-    logger2.log(isServerError ? serverErrorLevel : "info", "AppException handled", {
+    logger3.log(isServerError ? serverErrorLevel : "info", "AppException handled", {
       path: req.path,
       method: req.method,
       statusCode: exc.statusCode,
@@ -10064,7 +13245,7 @@ function makeUnhandledExceptionHandler(options = {}) {
   const { includeStack = false, logLevel = "error" } = options;
   return (err, req, res, _next) => {
     const error = err instanceof Error ? err : new Error(String(err));
-    logger2.log(logLevel, "Unhandled exception", {
+    logger3.log(logLevel, "Unhandled exception", {
       path: req.path,
       method: req.method,
       [HTTP_500_MARKER]: true,
@@ -10115,64 +13296,178 @@ function generateOpenApiDocument(registry, options) {
   const document = new Generator(registry.definitions).generateDocument(config);
   return document;
 }
+var DEFAULT_DOCS_FAVICON = "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAzMiAzMiI+PHJlY3Qgd2lkdGg9IjMyIiBoZWlnaHQ9IjMyIiByeD0iNyIgZmlsbD0iIzRjNmVmNSIvPjxwYXRoIGQ9Ik0xNy45IDQuNSA4LjYgMTguNGg1LjJMMTMgMjcuNWw5LjQtMTMuOWgtNS4zeiIgZmlsbD0iI2ZmZiIvPjwvc3ZnPg==";
+var REDOC_CDN_URL = "https://cdn.jsdelivr.net/npm/redoc@2/bundles/redoc.standalone.js";
+var REDOC_BUNDLE_SPECIFIER = "redoc/bundles/redoc.standalone.js";
+function escapeHtml2(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function scriptLiteral(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+function faviconTag(favicon) {
+  if (favicon === false) return "";
+  return `
+    <link rel="icon" href="${escapeHtml2(favicon)}" />`;
+}
 function mountOpenApiJson(app, path, document) {
   app.get(path, (_req, res) => {
     res.json(document);
   });
 }
-function swaggerHtml(specUrl, title, assetsBase) {
+var SWAGGER_UI_DEFAULTS = Object.freeze({
+  deepLinking: true,
+  persistAuthorization: true,
+  layout: "BaseLayout"
+});
+function assertSerializableUiOptions(options, trail = []) {
+  if (typeof options === "function") {
+    throw new Error(
+      [
+        `mountSwaggerUi: \`ui.${trail.join(".")}\` is a function, and the options are`,
+        "serialized as JSON into the page, so it would be dropped silently. Swagger UI",
+        "options that take a callback have to be wired in the browser."
+      ].join(" ")
+    );
+  }
+  if (Array.isArray(options)) {
+    options.forEach(
+      (entry, index) => assertSerializableUiOptions(entry, [...trail, String(index)])
+    );
+    return;
+  }
+  if (typeof options === "object" && options !== null) {
+    for (const [key, value] of Object.entries(options)) {
+      assertSerializableUiOptions(value, [...trail, key]);
+    }
+  }
+}
+function swaggerHtml(options) {
+  const { specUrl, title, assetsBase, favicon, ui } = options;
+  const merged = {
+    url: specUrl,
+    dom_id: "#swagger-ui",
+    ...SWAGGER_UI_DEFAULTS,
+    ...ui
+  };
+  const standalone = merged.layout === "StandaloneLayout";
+  const presetScript = standalone ? `
+    <script src="${escapeHtml2(assetsBase)}/swagger-ui-standalone-preset.js"></script>` : "";
+  const presets = standalone ? "[SwaggerUIBundle.presets.apis, SwaggerUIStandalonePreset]" : "[SwaggerUIBundle.presets.apis]";
   return `<!doctype html>
 <html lang="en">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>${title}</title>
-    <link rel="stylesheet" href="${assetsBase}/swagger-ui.css" />
+    <title>${escapeHtml2(title)}</title>${faviconTag(favicon)}
+    <link rel="stylesheet" href="${escapeHtml2(assetsBase)}/swagger-ui.css" />
   </head>
   <body>
     <div id="swagger-ui"></div>
-    <script src="${assetsBase}/swagger-ui-bundle.js"></script>
-    <script src="${assetsBase}/swagger-ui-standalone-preset.js"></script>
+    <script src="${escapeHtml2(assetsBase)}/swagger-ui-bundle.js"></script>${presetScript}
     <script>
-      window.ui = SwaggerUIBundle({
-        url: ${JSON.stringify(specUrl)},
-        dom_id: "#swagger-ui",
-        presets: [SwaggerUIBundle.presets.apis, SwaggerUIStandalonePreset],
-        layout: "StandaloneLayout",
-      });
+      var options = ${scriptLiteral(merged)};
+      options.presets = ${presets};
+      window.ui = SwaggerUIBundle(options);
     </script>
   </body>
 </html>`;
 }
 function mountSwaggerUi(app, path, specUrl, options = {}) {
   const title = options.title ?? "API docs";
+  const favicon = options.favicon ?? DEFAULT_DOCS_FAVICON;
+  const ui = options.ui ?? {};
+  assertSerializableUiOptions(ui);
   const assetsPath = `${path.replace(/\/$/, "")}/assets`;
-  app.use(assetsPath, express2.static(getAbsoluteFSPath()));
+  app.use(assetsPath, express3.static(getAbsoluteFSPath()));
   const handler = (_req, res) => {
-    res.type("html").send(swaggerHtml(specUrl, title, assetsPath));
+    res.type("html").send(swaggerHtml({ specUrl, title, assetsBase: assetsPath, favicon, ui }));
   };
   app.get(path, handler);
 }
-function redocHtml(specUrl, title, scriptUrl) {
+function resolveRedocBundle() {
+  try {
+    const requireFrom = createRequire(join(process.cwd(), "package.json"));
+    return requireFrom.resolve(REDOC_BUNDLE_SPECIFIER);
+  } catch {
+    return null;
+  }
+}
+function redocHtml(specUrl, title, scriptUrl, favicon) {
   return `<!doctype html>
 <html lang="en">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>${title}</title>
-    <style>body { margin: 0; padding: 0; }</style>
+    <title>${escapeHtml2(title)}</title>${faviconTag(favicon)}
+    <style>
+      body { margin: 0; padding: 0; }
+      #redoc-load-error {
+        display: none;
+        font: 14px/1.6 system-ui, sans-serif;
+        margin: 3rem auto;
+        max-width: 40rem;
+        padding: 0 1rem;
+      }
+      #redoc-load-error code {
+        background: #f1f3f5;
+        border-radius: 3px;
+        padding: 0.1rem 0.3rem;
+      }
+    </style>
   </head>
   <body>
-    <redoc spec-url=${JSON.stringify(specUrl)}></redoc>
-    <script src=${JSON.stringify(scriptUrl)}></script>
+    <div id="redoc-load-error">
+      <h1>The API reference could not load</h1>
+      <p>
+        The Redoc renderer was requested from
+        <code id="redoc-script-url"></code> and did not load. The OpenAPI
+        document itself is fine \u2014 it is served at
+        <code id="redoc-spec-url"></code>.
+      </p>
+      <p>
+        On a closed network, install the renderer next to the service
+        (<code>npm install redoc</code>) so it is served locally, or point
+        <code>scriptUrl</code> at a copy you host.
+      </p>
+    </div>
+    <redoc spec-url="${escapeHtml2(specUrl)}"></redoc>
+    <script>
+      window.__redocLoadFailed = function () {
+        document.getElementById("redoc-script-url").textContent = ${scriptLiteral(scriptUrl)};
+        document.getElementById("redoc-spec-url").textContent = ${scriptLiteral(specUrl)};
+        document.getElementById("redoc-load-error").style.display = "block";
+        var element = document.querySelector("redoc");
+        if (element) element.style.display = "none";
+      };
+    </script>
+    <script src="${escapeHtml2(scriptUrl)}" onerror="window.__redocLoadFailed()"></script>
   </body>
 </html>`;
 }
 function mountRedoc(app, path, specUrl, options = {}) {
   const title = options.title ?? "API reference";
-  const scriptUrl = options.scriptUrl ?? "https://cdn.jsdelivr.net/npm/redoc@2/bundles/redoc.standalone.js";
+  const favicon = options.favicon ?? DEFAULT_DOCS_FAVICON;
+  const source = options.bundle ?? "auto";
+  const assetsPath = `${path.replace(/\/$/, "")}/assets`;
+  const bundleRoute = `${assetsPath}/redoc.standalone.js`;
+  let scriptUrl = options.scriptUrl;
+  if (scriptUrl === void 0 && source !== "cdn") {
+    const bundlePath = options.bundlePath ?? resolveRedocBundle();
+    if (bundlePath !== null && bundlePath !== void 0) {
+      app.get(bundleRoute, (_req, res) => {
+        res.sendFile(bundlePath);
+      });
+      scriptUrl = bundleRoute;
+    } else if (source === "local") {
+      throw new Error(
+        'mountRedoc: bundle "local" requires the `redoc` package. Install it (`npm install redoc`) or pass `bundlePath` with an absolute path to a Redoc standalone bundle.'
+      );
+    }
+  }
+  const resolvedScriptUrl = scriptUrl ?? REDOC_CDN_URL;
   app.get(path, (_req, res) => {
-    res.type("html").send(redocHtml(specUrl, title, scriptUrl));
+    res.type("html").send(redocHtml(specUrl, title, resolvedScriptUrl, favicon));
   });
 }
 function makeHealthRouter(options = {}) {
@@ -10209,7 +13504,7 @@ function makeMetricsRouter(options = {}) {
   });
   return router;
 }
-var logger3 = new JSONLogger("tempest_express_sdk.api.server");
+var logger4 = new JSONLogger("tempest_express_sdk.api.server");
 function corsMiddleware(origins) {
   const allowAll = origins === "*";
   const allowList = new Set(Array.isArray(origins) ? origins : [origins]);
@@ -10234,9 +13529,9 @@ function corsMiddleware(origins) {
   };
 }
 async function createApp(options = {}) {
-  const app = express2();
-  app.use(express2.json({ limit: options.jsonLimit ?? "100kb" }));
-  app.use(express2.urlencoded({ extended: true }));
+  const app = express3();
+  app.use(express3.json({ limit: options.jsonLimit ?? "100kb" }));
+  app.use(express3.urlencoded({ extended: true }));
   app.use(requestIdMiddleware());
   if (options.corsOrigins) {
     app.use(corsMiddleware(options.corsOrigins));
@@ -10268,7 +13563,7 @@ function runServer(app, options = {}) {
   const port = options.port ?? 8e3;
   return new Promise((resolve) => {
     const server = app.listen(port, host, () => {
-      logger3.info("Server listening", { host, port });
+      logger4.info("Server listening", { host, port });
       resolve(server);
     });
   });
@@ -10810,7 +14105,7 @@ function rateLimitMiddleware(options = {}) {
 
 // src/api/middlewares/tracing.ts
 function requestTracingMiddleware(options = {}) {
-  const logger4 = new JSONLogger(options.loggerName ?? "tempest_express_sdk.api.tracing");
+  const logger5 = new JSONLogger(options.loggerName ?? "tempest_express_sdk.api.tracing");
   const level = options.level ?? "info";
   const exempt = new Set(options.exemptPaths ?? []);
   return (req, res, next) => {
@@ -10821,7 +14116,7 @@ function requestTracingMiddleware(options = {}) {
     const start = process.hrtime.bigint();
     res.on("finish", () => {
       const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
-      logger4.log(level, "request", {
+      logger5.log(level, "request", {
         method: req.method,
         path: req.path,
         statusCode: res.statusCode,
@@ -11201,6 +14496,6 @@ async function withTestDatabase(models, fn) {
   }
 }
 
-export { ActivationService, AdminSite, AppException, AttemptThrottle, AuditAction, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EmailProvider, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, HTTPClient, HTTP_500_LOG_FILE, HTTP_500_MARKER, HttpMetrics, IDEMPOTENCY_HEADER, InvalidTokenException, JSONLogger, JWTUtils, LEVEL_LOG_FILES, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MessagingHub, MetricsUtils, MfaService, NotFoundException, OAuthError, OIDCProvider, OutboxRelay, OutboxStatus, PHONE_BR_PATTERN, PasswordResetService, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisIdempotencyStore, RedisRateLimitStore, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, S3UploadStorage, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TenantScopedRepository, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, UserTokenPurpose, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WebhookSignatureVerifier, WhatsAppProvider, activationSchema, addLogSink, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildPaginationLinkHeader, cached2 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, cursorPaginationFilterSchema, cursorPaginationSchema, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, envList, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, idempotencyMiddleware, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, listStates, logEntrySchema, logSettingsShape, loginSchema, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderPasswordResetFormPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveDownloadPath, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };
+export { ADMIN_CSS, ActivationService, AdminJsonSite, AdminModel, AdminSessionStore, AdminSite, AppException, AttemptThrottle, AuditAction, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_DOCS_FAVICON, DEFAULT_LOCALE, EmailProvider, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, HTTPClient, HTTP_500_LOG_FILE, HTTP_500_MARKER, HttpMetrics, IDEMPOTENCY_HEADER, InvalidTokenException, JSONLogger, JWTUtils, LEVEL_LOG_FILES, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MessagingHub, MetricsUtils, MfaService, NotFoundException, OAuthError, OIDCProvider, OutboxRelay, OutboxStatus, PHONE_BR_PATTERN, PasswordResetService, REDOC_CDN_URL, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisIdempotencyStore, RedisRateLimitStore, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, S3UploadStorage, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TenantScopedRepository, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, UserModelAuthBackend, UserTokenPurpose, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WebhookSignatureVerifier, WhatsAppProvider, activationSchema, addLogSink, adminColumns, adminThemeCss, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildFormFields, buildPaginationLinkHeader, cached2 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, csrfTokenMatches, cursorPaginationFilterSchema, cursorPaginationSchema, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, envList, escapeHtml, filterForColumn, formatCellValue, formatFieldValue, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, humanizeField, idempotencyMiddleware, inboundMessageSchema, isColumnOptional, isSearchableColumn, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, listStates, logEntrySchema, logSettingsShape, loginSchema, makeAdminJsonRouter, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, parseFormBody, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderDashboardPage, renderDetailPage, renderFormPage, renderLayout, renderListPage, renderLoginPage, renderMfaPage, renderPasswordResetFormPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveAdminTheme, resolveDownloadPath, resolveRedocBundle, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, widgetForColumn, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map