tempest-express-sdk 0.23.0 → 0.25.0

package/dist/index.js

@@ -1,7 +1,7 @@
-import { z, looseBoolean, toDict } from './chunk-HC3TIN4M.js';
-export { PasswordUtils, VERSION, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, centsField, corsSettingsShape, databaseSettingsShape, looseBoolean as envBoolean, hexColorField, latitudeField, loadSettings, longitudeField, looseBoolean, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, percentField, portField, positiveFloatField, positiveIntField, priceField, ratingField, ratioField, serverSettingsShape, slugField, toDict, z } from './chunk-HC3TIN4M.js';
+import { z, looseBoolean, toDict, PasswordUtils } from './chunk-TIW2KPT2.js';
+export { PasswordUtils, VERSION, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, centsField, corsSettingsShape, databaseSettingsShape, looseBoolean as envBoolean, hexColorField, latitudeField, loadSettings, longitudeField, looseBoolean, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, percentField, portField, positiveFloatField, positiveIntField, priceField, ratingField, ratioField, serverSettingsShape, slugField, toDict, z } from './chunk-TIW2KPT2.js';
 import { AsyncLocalStorage } from 'async_hooks';
-import { Model, column, sql, BaseRepository, RecordNotFound, detectDialect, NodeSqliteDriver, AsyncEngine } from 'tempest-db-js';
+import { Model, column, sql, BaseRepository, RecordNotFound, detectDialect, columnsOf, NodeSqliteDriver, AsyncEngine, or, and } from 'tempest-db-js';
 export { AsyncEngine, AsyncResult, AsyncSession, BaseRepository, Column, DeleteBuilder, InsertBuilder, Model, NoResultError, NodeSqliteDriver, PostgresDialect, RecordNotFound, SelectBuilder, SqliteDialect, SyncEngine, SyncSession, UpdateBuilder, and, belongsTo, column, columnsOf, createEngine, createSyncEngine, del, detectDialect, getDialect, hasMany, insert, join, loadRelations, not, or, parseDatabaseUrl, select, sql, update } from 'tempest-db-js';
 import { execFile, spawn } from 'child_process';
 import { copyFile, mkdir, writeFile, readFile, rm, stat } from 'fs/promises';
@@ -10,7 +10,7 @@ import { createReadStream, mkdirSync, createWriteStream } from 'fs';
 import { join, dirname, normalize, relative, isAbsolute } from 'path';
 import { cpus, loadavg, totalmem, freemem } from 'os';
 import { promisify } from 'util';
-import express2, { Router } from 'express';
+import express3, { Router } from 'express';
 import { ZodError } from 'zod';
 import { OpenAPIRegistry, OpenApiGeneratorV31, OpenApiGeneratorV3 } from '@asteasolutions/zod-to-openapi';
 export { OpenAPIRegistry } from '@asteasolutions/zod-to-openapi';
@@ -819,7 +819,7 @@ function wrapWithSlowQueryLog(driver, options = {}) {
   const thresholdMs = options.thresholdMs ?? 500;
   const level = options.level ?? "warning";
   const logParameters = options.logParameters ?? false;
-  const logger4 = new JSONLogger(
+  const logger5 = new JSONLogger(
     options.loggerName ?? "tempest_express_sdk.db.slow_query"
   );
   const timed = (exec) => {
@@ -830,7 +830,7 @@ function wrapWithSlowQueryLog(driver, options = {}) {
       } finally {
         const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
         if (durationMs >= thresholdMs) {
-          logger4.log(level, "slow query", {
+          logger5.log(level, "slow query", {
             sql: sql5,
             durationMs: Math.round(durationMs * 1e3) / 1e3,
             ...logParameters ? { params } : {}
@@ -9317,8 +9317,3508 @@ var MessagingHub = class {
   }
 };
 
+// src/admin/actions.ts
+function slugify(label) {
+  return label.normalize("NFD").replace(/\p{M}/gu, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "action";
+}
+function adminAction(options, handler) {
+  const name = options.name ?? slugify(options.label);
+  if (name === "") throw new Error("adminAction requires a non-empty name or label");
+  return {
+    name,
+    label: options.label,
+    handler,
+    dangerous: options.dangerous ?? false
+  };
+}
+
+// src/admin/columns.ts
+function humanizeField(name) {
+  return name.replace(/[_-]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").trim().split(/\s+/).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+}
+function adminColumns(model) {
+  return columnsOf(model);
+}
+function widgetForColumn(column6) {
+  const { kind, meta } = column6.type;
+  const plain = (widget) => ({
+    widget,
+    step: null,
+    options: []
+  });
+  switch (kind) {
+    case "json":
+      return plain("json");
+    case "boolean":
+      return plain("checkbox");
+    case "enum":
+      return {
+        widget: "select",
+        step: null,
+        options: (meta.values ?? []).map((value) => ({
+          value,
+          label: humanizeField(value)
+        }))
+      };
+    case "smallint":
+    case "integer":
+    case "bigint":
+      return { widget: "number", step: "1", options: [] };
+    case "numeric":
+    case "real":
+    case "double":
+      return { widget: "number", step: "any", options: [] };
+    case "datetime":
+    case "timestamp":
+      return plain("datetime");
+    case "date":
+      return plain("date");
+    case "time":
+      return plain("time");
+    case "text":
+      return plain("textarea");
+    case "varchar":
+    case "char":
+      return plain(meta.length !== void 0 && meta.length > 255 ? "textarea" : "text");
+    default:
+      return plain("text");
+  }
+}
+function isColumnOptional(column6) {
+  return !column6.flags.notNull || column6.flags.hasDefault || column6.flags.primaryKey;
+}
+function filterForColumn(column6) {
+  const { kind, meta } = column6.type;
+  if (kind === "boolean") {
+    return {
+      kind: "select",
+      options: [
+        { value: "true", label: "Yes" },
+        { value: "false", label: "No" }
+      ]
+    };
+  }
+  if (kind === "enum") {
+    return {
+      kind: "select",
+      options: (meta.values ?? []).map((value) => ({
+        value,
+        label: humanizeField(value)
+      }))
+    };
+  }
+  if (kind === "date" || kind === "datetime" || kind === "timestamp") {
+    return { kind: "daterange", options: [] };
+  }
+  return { kind: "text", options: [] };
+}
+function foreignKeyTable(column6) {
+  return column6.reference?.table ?? null;
+}
+function isSearchableColumn(column6) {
+  const { kind } = column6.type;
+  return kind === "varchar" || kind === "text" || kind === "char";
+}
+
+// src/admin/config.ts
+var NEVER_EDITABLE = [
+  "id",
+  "createdAt",
+  "updatedAt",
+  "hashedPassword"
+];
+var NEVER_LISTED = ["hashedPassword"];
+var AdminModel = class {
+  /** The managed model class. */
+  model;
+  /** Columns surfaced as filter controls. */
+  listFilter;
+  /** Text columns the search box matches against. */
+  searchFields;
+  /** Columns locked in the create/edit form. */
+  readonlyFields;
+  /** Default ordering column, or `null` to leave it to the repository. */
+  orderKey;
+  /** Whether {@link AdminModel.orderKey} sorts ascending. */
+  orderAscending;
+  /** Rows per page in the list view. */
+  pageSize;
+  /** Column used to look a single row up from the detail URL. */
+  identityField;
+  /** Whether the create form is exposed. */
+  canCreate;
+  /** Whether the edit form is exposed. */
+  canEdit;
+  /** Whether the delete action is exposed. */
+  canDelete;
+  actions = /* @__PURE__ */ new Map();
+  slugOverride;
+  listDisplayOverride;
+  verboseNameOverride;
+  verboseNamePluralOverride;
+  /**
+   * Build and validate the configuration.
+   *
+   * @param options - The declarative configuration. See {@link AdminModelOptions}.
+   * @throws Error When a referenced column does not exist on the model.
+   */
+  constructor(options) {
+    this.model = options.model;
+    this.slugOverride = options.slug ?? null;
+    this.listDisplayOverride = options.listDisplay === void 0 ? null : [...options.listDisplay];
+    this.listFilter = [...options.listFilter ?? []];
+    this.searchFields = [...options.searchFields ?? []];
+    this.readonlyFields = [...options.readonlyFields ?? []];
+    this.pageSize = options.pageSize ?? 25;
+    this.identityField = options.identityField ?? "id";
+    this.verboseNameOverride = options.verboseName ?? null;
+    this.verboseNamePluralOverride = options.verboseNamePlural ?? null;
+    this.canCreate = options.canCreate ?? true;
+    this.canEdit = options.canEdit ?? true;
+    this.canDelete = options.canDelete ?? true;
+    for (const action of options.actions ?? []) {
+      if (this.actions.has(action.name)) {
+        throw new Error(
+          `Duplicate admin action name "${action.name}" on ${this.model.tablename}`
+        );
+      }
+      this.actions.set(action.name, action);
+    }
+    const known = new Set(this.columnNames());
+    for (const [option, names] of [
+      ["listDisplay", this.listDisplayOverride ?? []],
+      ["listFilter", this.listFilter],
+      ["searchFields", this.searchFields],
+      ["readonlyFields", this.readonlyFields],
+      ["identityField", [this.identityField]]
+    ]) {
+      for (const name of names) {
+        if (!known.has(name)) {
+          throw new Error(
+            `AdminModel(${this.model.tablename}).${option} references unknown column "${name}"; available: ${[...known].join(", ")}`
+          );
+        }
+      }
+    }
+    const ordering = options.ordering ?? (known.has("createdAt") ? "-createdAt" : void 0);
+    if (ordering === void 0) {
+      this.orderKey = null;
+      this.orderAscending = true;
+    } else {
+      const descending = ordering.startsWith("-");
+      const key = descending ? ordering.slice(1) : ordering;
+      if (!known.has(key)) {
+        throw new Error(
+          `AdminModel(${this.model.tablename}).ordering references unknown column "${key}"`
+        );
+      }
+      this.orderKey = key;
+      this.orderAscending = !descending;
+    }
+  }
+  /**
+   * Return the URL slug the model is exposed under.
+   *
+   * @returns The configured slug, or the model's table name.
+   */
+  slug() {
+    return this.slugOverride ?? this.model.tablename;
+  }
+  /**
+   * Return the singular display name.
+   *
+   * @returns The configured name, or the humanized class name without its
+   *   trailing `Model`.
+   */
+  verboseName() {
+    if (this.verboseNameOverride !== null) return this.verboseNameOverride;
+    const className = this.model.name;
+    return humanizeField(className.replace(/Model$/, ""));
+  }
+  /**
+   * Return the plural display name.
+   *
+   * @returns The configured plural, or the singular with an `s`.
+   */
+  verboseNamePlural() {
+    return this.verboseNamePluralOverride ?? `${this.verboseName()}s`;
+  }
+  /**
+   * Return every column key on the model, in declaration order.
+   *
+   * @returns The column keys.
+   */
+  columnNames() {
+    return Object.keys(adminColumns(this.model));
+  }
+  /**
+   * Return the columns the list view renders.
+   *
+   * @returns The configured `listDisplay`, or every column but the password hash.
+   */
+  listDisplayNames() {
+    if (this.listDisplayOverride !== null) return [...this.listDisplayOverride];
+    return this.columnNames().filter((name) => !NEVER_LISTED.includes(name));
+  }
+  /**
+   * Return the columns the detail view renders.
+   *
+   * Unlike {@link AdminModel.listDisplayNames}, this is not narrowed by
+   * `listDisplay`: the list view is a scannable summary, but the detail view is
+   * where an operator goes to see the whole record, so trimming it there would
+   * hide data with nowhere else to read it.
+   *
+   * @returns Every column but the password hash, in declaration order.
+   */
+  detailFieldNames() {
+    return this.columnNames().filter((name) => !NEVER_LISTED.includes(name));
+  }
+  /**
+   * Return the columns a create/edit form exposes.
+   *
+   * Excludes the primary key, the managed timestamps, the password hash and
+   * anything listed in `readonlyFields` — none of which a user edits directly
+   * through the generic form.
+   *
+   * @returns The editable column keys, in declaration order.
+   */
+  editableFieldNames() {
+    const skip = /* @__PURE__ */ new Set([...this.readonlyFields, ...NEVER_EDITABLE]);
+    return this.columnNames().filter((name) => !skip.has(name));
+  }
+  /**
+   * Return the registered custom actions, in declaration order.
+   *
+   * @returns The actions passed via `actions` (empty when none). The model
+   *   type is erased here, the way {@link AdminSite} erases it when it stores a
+   *   configuration — a registry keyed by slug cannot stay generic.
+   */
+  customActions() {
+    return [...this.actions.values()];
+  }
+  /**
+   * Look a custom action up by name.
+   *
+   * @param name - The action identifier (its submitted form value).
+   * @returns The action, or `null` when nothing matches.
+   */
+  getAction(name) {
+    return this.actions.get(name) ?? null;
+  }
+  /**
+   * Build a repository for this model bound to a session.
+   *
+   * @param session - The session the repository runs its statements on.
+   * @returns A repository over {@link AdminModel.model}.
+   */
+  repository(session) {
+    return new BaseRepository(this.model, session);
+  }
+};
+
+// src/admin/forms.ts
+function formatFieldValue(widget, value) {
+  if (value === null || value === void 0) return "";
+  if (widget === "json") {
+    return typeof value === "string" ? value : JSON.stringify(value, null, 2);
+  }
+  if (value instanceof Date) {
+    const iso = value.toISOString();
+    if (widget === "date") return iso.slice(0, 10);
+    if (widget === "time") return iso.slice(11, 19);
+    return iso.slice(0, 16);
+  }
+  if (widget === "datetime" || widget === "date") {
+    const parsed = new Date(String(value));
+    if (!Number.isNaN(parsed.getTime())) {
+      const iso = parsed.toISOString();
+      return widget === "date" ? iso.slice(0, 10) : iso.slice(0, 16);
+    }
+  }
+  return String(value);
+}
+function literalDefault(column6) {
+  const fallback = column6.defaultValue;
+  if (fallback === null || fallback.kind !== "literal") return void 0;
+  return fallback.value;
+}
+function buildFormFields(admin, options = {}) {
+  const columns = adminColumns(admin.model);
+  const values = options.values ?? {};
+  const errors = options.errors ?? {};
+  const foreignKeys = options.foreignKeyOptions ?? {};
+  return admin.editableFieldNames().flatMap((name) => {
+    const column6 = columns[name];
+    if (column6 === void 0) return [];
+    const related = foreignKeys[name];
+    const spec = related === void 0 ? widgetForColumn(column6) : { widget: "select", step: null, options: related };
+    const raw = name in values ? values[name] : literalDefault(column6);
+    return [
+      {
+        name,
+        label: humanizeField(name),
+        widget: spec.widget,
+        value: spec.widget === "checkbox" ? "" : formatFieldValue(spec.widget, raw),
+        required: !isColumnOptional(column6),
+        checked: spec.widget === "checkbox" && toBoolean(raw),
+        step: spec.step,
+        options: spec.options,
+        error: errors[name] ?? null
+      }
+    ];
+  });
+}
+function toBoolean(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number") return value !== 0;
+  if (typeof value !== "string") return false;
+  return ["true", "on", "yes", "1"].includes(value.trim().toLowerCase());
+}
+function coerceValue(column6, widget, raw) {
+  const { kind, meta } = column6.type;
+  switch (widget) {
+    case "number": {
+      const parsed = Number(raw);
+      if (!Number.isFinite(parsed)) throw new Error("Enter a valid number.");
+      if (kind === "bigint") return BigInt(raw);
+      if (kind === "smallint" || kind === "integer") {
+        if (!Number.isInteger(parsed)) throw new Error("Enter a whole number.");
+        return parsed;
+      }
+      if (kind === "numeric") return raw;
+      return parsed;
+    }
+    case "datetime":
+    case "date": {
+      const parsed = new Date(raw);
+      if (Number.isNaN(parsed.getTime())) throw new Error("Enter a valid date.");
+      return parsed;
+    }
+    case "json":
+      try {
+        return JSON.parse(raw);
+      } catch {
+        throw new Error("Enter valid JSON.");
+      }
+    case "select": {
+      const allowed = kind === "enum" ? meta.values ?? [] : [];
+      if (allowed.length > 0 && !allowed.includes(raw)) {
+        throw new Error(`Choose one of: ${allowed.join(", ")}.`);
+      }
+      return raw;
+    }
+    default:
+      return raw;
+  }
+}
+function parseFormBody(admin, body) {
+  const columns = adminColumns(admin.model);
+  const data = {};
+  const errors = {};
+  for (const name of admin.editableFieldNames()) {
+    const column6 = columns[name];
+    if (column6 === void 0) continue;
+    const { widget } = widgetForColumn(column6);
+    if (widget === "checkbox") {
+      data[name] = toBoolean(body[name]);
+      continue;
+    }
+    const submitted = body[name];
+    const raw = typeof submitted === "string" ? submitted.trim() : "";
+    if (raw === "") {
+      if (!isColumnOptional(column6)) {
+        errors[name] = "This field is required.";
+        continue;
+      }
+      if (column6.flags.hasDefault && !(name in body)) continue;
+      data[name] = null;
+      continue;
+    }
+    try {
+      data[name] = coerceValue(column6, widget, raw);
+    } catch (error) {
+      errors[name] = error instanceof Error ? error.message : "Invalid value.";
+    }
+  }
+  return { data, errors };
+}
+function formatCellValue(value) {
+  if (value === null || value === void 0) return "";
+  if (value instanceof Date) return value.toISOString().replace("T", " ").slice(0, 19);
+  if (typeof value === "boolean") return value ? "Yes" : "No";
+  if (typeof value === "object") return JSON.stringify(value);
+  return String(value);
+}
+function foreignKeyFields(admin) {
+  const columns = adminColumns(admin.model);
+  const out = {};
+  for (const name of admin.editableFieldNames()) {
+    const column6 = columns[name];
+    if (column6 === void 0) continue;
+    const table = foreignKeyTable(column6);
+    if (table !== null) out[name] = table;
+  }
+  return out;
+}
+function foreignKeyLabel(admin, row) {
+  for (const field of admin.searchFields) {
+    const value = row[field];
+    if (typeof value === "string" && value !== "") return value;
+  }
+  for (const field of ["name", "title", "email", "label", "reference"]) {
+    const value = row[field];
+    if (typeof value === "string" && value !== "") return value;
+  }
+  return String(row[admin.identityField] ?? "");
+}
+
+// src/admin/auth.ts
+var UserModelAuthBackend = class {
+  model;
+  passwords;
+  mfa;
+  identifierField;
+  requireAdmin;
+  /**
+   * Build the backend.
+   *
+   * @param model - The user model class (a `BaseUserModel` subclass).
+   * @param options - Hasher, MFA verifier and gating overrides.
+   */
+  constructor(model, options = {}) {
+    this.model = model;
+    this.passwords = options.passwords ?? new PasswordUtils();
+    this.mfa = options.mfa ?? null;
+    this.identifierField = options.identifierField ?? "email";
+    this.requireAdmin = options.requireAdmin ?? true;
+  }
+  /**
+   * Whether a row is allowed into the panel at all.
+   *
+   * @param row - The candidate row.
+   * @returns `true` when the row is active and (when required) an admin.
+   */
+  admits(row) {
+    if (row.isActive === false) return false;
+    return !this.requireAdmin || row.isAdmin === true;
+  }
+  /**
+   * Verify an identifier/password pair.
+   *
+   * The identifier is lowercased and trimmed before lookup, matching the
+   * normalization the auth service applies on signup.
+   *
+   * @param session - A DB session for the current request.
+   * @param identifier - The submitted identifier.
+   * @param password - The submitted plaintext password.
+   * @returns The matching row, or `null` when it does not qualify.
+   */
+  async authenticate(session, identifier, password) {
+    const repository = new BaseRepository(this.model, session);
+    const filters = { [this.identifierField]: identifier.trim().toLowerCase() };
+    const row = await repository.first(
+      filters
+    );
+    if (row === null || !this.admits(row)) return null;
+    if (!await this.passwords.verify(password, row.hashedPassword)) return null;
+    return row;
+  }
+  /**
+   * Re-load the principal a session points at.
+   *
+   * @param session - A DB session for the current request.
+   * @param subject - The principal id from the session cookie.
+   * @returns The row, or `null` when it vanished or lost its privileges.
+   */
+  async loadPrincipal(session, subject) {
+    const repository = new BaseRepository(this.model, session);
+    const row = await repository.getByIdOrNull(
+      subject
+    );
+    if (row === null || !this.admits(row)) return null;
+    return row;
+  }
+  /**
+   * Return the row's primary key.
+   *
+   * @param principal - The authenticated row.
+   * @returns The principal id.
+   */
+  principalId(principal) {
+    return String(principal.id);
+  }
+  /**
+   * Return the label shown in the panel header.
+   *
+   * @param principal - The authenticated row.
+   * @returns The identifier column's value.
+   */
+  displayName(principal) {
+    const value = principal[this.identifierField];
+    return typeof value === "string" ? value : String(principal.id);
+  }
+  /**
+   * Whether the principal enrolled a second factor.
+   *
+   * @param principal - The authenticated row.
+   * @returns `true` when an MFA verifier is configured and reports a secret.
+   */
+  async mfaEnabled(principal) {
+    if (this.mfa === null) return false;
+    return await this.mfa.isEnabled(String(principal.id));
+  }
+  /**
+   * Verify a submitted TOTP code.
+   *
+   * @param principal - The authenticated row.
+   * @param code - The submitted code.
+   * @returns `true` when the code is valid.
+   */
+  async verifyMfa(principal, code) {
+    if (this.mfa === null) return false;
+    return await this.mfa.verify(String(principal.id), code);
+  }
+};
+var MIN_SECRET_LENGTH = 32;
+function encode(value) {
+  return Buffer.from(value, "utf8").toString("base64url");
+}
+var AdminSessionStore = class {
+  secret;
+  cookieName;
+  maxAgeSeconds;
+  cookieSecure;
+  cookiePath;
+  /**
+   * Build the store.
+   *
+   * @param options - Secret, cookie name, lifetime and cookie flags.
+   * @throws Error When the secret is shorter than 32 characters.
+   */
+  constructor(options) {
+    if (options.secret.length < MIN_SECRET_LENGTH) {
+      throw new Error(
+        `Admin session secret must be at least ${MIN_SECRET_LENGTH} characters; got ${options.secret.length}`
+      );
+    }
+    this.secret = options.secret;
+    this.cookieName = options.cookieName ?? "tempest_admin_session";
+    this.maxAgeSeconds = options.maxAgeSeconds ?? 8 * 60 * 60;
+    this.cookieSecure = options.cookieSecure ?? true;
+    this.cookiePath = options.cookiePath ?? "/";
+  }
+  /**
+   * Sign a payload.
+   *
+   * @param payload - The base64url payload to sign.
+   * @returns The base64url signature.
+   */
+  sign(payload) {
+    return createHmac("sha256", this.secret).update(payload).digest("base64url");
+  }
+  /**
+   * Mint a fresh session for an authenticated principal.
+   *
+   * @param subject - The principal id.
+   * @param displayName - The name shown in the header.
+   * @param mfaPassed - Whether the second factor is already satisfied.
+   * @returns The new session payload (not yet written to a response).
+   */
+  issue(subject, displayName, mfaPassed = true) {
+    return {
+      subject,
+      displayName,
+      csrfToken: randomUUID(),
+      expiresAt: Math.floor(Date.now() / 1e3) + this.maxAgeSeconds,
+      mfaPassed
+    };
+  }
+  /**
+   * Read and verify the session carried by a request.
+   *
+   * @param req - The inbound request.
+   * @returns The session, or `null` when absent, tampered with or expired.
+   */
+  load(req) {
+    const raw = parseCookies(req.header("cookie") ?? void 0)[this.cookieName];
+    if (raw === void 0) return null;
+    const separator = raw.lastIndexOf(".");
+    if (separator <= 0) return null;
+    const payload = raw.slice(0, separator);
+    const signature = Buffer.from(raw.slice(separator + 1), "base64url");
+    const expected = Buffer.from(this.sign(payload), "base64url");
+    if (signature.length !== expected.length) return null;
+    if (!timingSafeEqual(signature, expected)) return null;
+    let session;
+    try {
+      session = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    } catch {
+      return null;
+    }
+    if (typeof session.subject !== "string" || typeof session.csrfToken !== "string") {
+      return null;
+    }
+    if (session.expiresAt <= Math.floor(Date.now() / 1e3)) return null;
+    return session;
+  }
+  /**
+   * Write a session to the response as a signed cookie.
+   *
+   * @param res - The outbound response.
+   * @param session - The session to persist.
+   */
+  save(res, session) {
+    const payload = encode(JSON.stringify(session));
+    const value = `${payload}.${this.sign(payload)}`;
+    const maxAge = Math.max(0, session.expiresAt - Math.floor(Date.now() / 1e3));
+    res.append("set-cookie", this.cookie(value, maxAge));
+  }
+  /**
+   * Drop the session cookie.
+   *
+   * @param res - The outbound response.
+   */
+  clear(res) {
+    res.append("set-cookie", this.cookie("", 0));
+  }
+  /**
+   * Render a `Set-Cookie` value with the configured flags.
+   *
+   * @param value - The cookie value.
+   * @param maxAge - Lifetime in seconds (`0` expires it immediately).
+   * @returns The header value.
+   */
+  cookie(value, maxAge) {
+    const parts = [
+      `${this.cookieName}=${value}`,
+      `Path=${this.cookiePath}`,
+      `Max-Age=${maxAge}`,
+      "HttpOnly",
+      "SameSite=Lax"
+    ];
+    if (this.cookieSecure) parts.push("Secure");
+    return parts.join("; ");
+  }
+};
+function csrfTokenMatches(session, submitted) {
+  if (typeof submitted !== "string") return false;
+  const expected = Buffer.from(session.csrfToken, "utf8");
+  const actual = Buffer.from(submitted, "utf8");
+  if (expected.length !== actual.length) return false;
+  return timingSafeEqual(expected, actual);
+}
+
 // src/admin/site.ts
+function isConcreteModel(value) {
+  if (typeof value !== "function") return false;
+  const proto = value.prototype;
+  if (typeof proto !== "object" || proto === null) return false;
+  if (!(proto instanceof Model)) return false;
+  const tablename = value.tablename;
+  return typeof tablename === "string" && tablename.length > 0;
+}
 var AdminSite = class {
+  /** Text used in the page `<title>` and the dashboard heading. */
+  title;
+  /** Centered header brand, or `null` to fall back to {@link AdminSite.title}. */
+  brand;
+  /** Dashboard subtitle. */
+  indexSubtitle;
+  /** Outbound "View site" link, or `null`. */
+  siteUrl;
+  /** Typed appearance overrides. */
+  theme;
+  registry = /* @__PURE__ */ new Map();
+  /**
+   * Initialize the site.
+   *
+   * @param options - Branding and appearance. See {@link AdminSiteOptions}.
+   */
+  constructor(options = {}) {
+    this.title = options.title ?? "Admin";
+    this.brand = options.brand ?? null;
+    this.indexSubtitle = options.indexSubtitle ?? "Site administration";
+    this.siteUrl = options.siteUrl ?? null;
+    this.theme = options.theme ?? {};
+  }
+  /**
+   * Return the centered header brand text.
+   *
+   * @returns {@link AdminSite.brand} when set, otherwise {@link AdminSite.title}.
+   */
+  brandText() {
+    return this.brand ?? this.title;
+  }
+  /**
+   * Register a model configuration under its slug.
+   *
+   * @param admin - An {@link AdminModel} instance, or the options to build one.
+   * @returns The registered instance, so the call can be chained or assigned.
+   * @throws Error When another configuration already holds the same slug.
+   */
+  register(admin) {
+    const config = admin instanceof AdminModel ? admin : new AdminModel(admin);
+    const slug = config.slug();
+    const existing = this.registry.get(slug);
+    if (existing !== void 0) {
+      throw new Error(
+        `AdminModel for slug "${slug}" is already registered (${existing.model.tablename}); refusing to overwrite with ${config.model.tablename}`
+      );
+    }
+    this.registry.set(slug, config);
+    return config;
+  }
+  /**
+   * Remove a previously registered configuration.
+   *
+   * @param slug - The slug to drop.
+   * @throws Error When no configuration is registered under the slug.
+   */
+  unregister(slug) {
+    if (!this.registry.delete(slug)) {
+      throw new Error(`No AdminModel registered for slug "${slug}"`);
+    }
+  }
+  /**
+   * Look a configuration up by slug.
+   *
+   * @param slug - The admin slug.
+   * @returns The configuration, or `null` when nothing matches.
+   */
+  get(slug) {
+    return this.registry.get(slug) ?? null;
+  }
+  /**
+   * Return every registered configuration, ordered by display name.
+   *
+   * @returns The configurations (empty when nothing is registered).
+   */
+  list() {
+    return [...this.registry.values()].sort(
+      (left, right) => left.verboseNamePlural().toLowerCase().localeCompare(right.verboseNamePlural().toLowerCase())
+    );
+  }
+  /**
+   * Register every concrete model found in `source` at once.
+   *
+   * The batch counterpart to {@link AdminSite.register}: instead of one call
+   * per table, hand it the models barrel and every model class declaring a
+   * `tablename` is wrapped in a default {@link AdminModel}.
+   *
+   * ```ts
+   * import * as models from "./db/models";
+   *
+   * site.automap(models);
+   * site.automap([UserModel, OrderModel], { pageSize: 50 });
+   * ```
+   *
+   * @param source - An array of model classes, or a module namespace object
+   *   whose values are swept (non-model entries are ignored).
+   * @param options - `exclude`, `skipRegistered` and any {@link AdminModel}
+   *   option applied uniformly to every model discovered here.
+   * @returns The configurations newly registered by this call.
+   * @throws Error When `skipRegistered` is `false` and a slug collides.
+   */
+  automap(source, options = {}) {
+    const { exclude = [], skipRegistered = true, ...adminOptions } = options;
+    const excluded = new Set(
+      exclude.map((entry) => typeof entry === "string" ? entry : entry.tablename)
+    );
+    const candidates = Array.isArray(source) ? source : Object.values(source);
+    const registered = [];
+    for (const candidate of candidates) {
+      if (!isConcreteModel(candidate)) continue;
+      if (excluded.has(candidate.tablename)) continue;
+      const config = new AdminModel({ ...adminOptions, model: candidate });
+      if (skipRegistered && this.registry.get(config.slug()) !== void 0) continue;
+      registered.push(this.register(config));
+    }
+    return registered.sort((left, right) => left.slug().localeCompare(right.slug()));
+  }
+};
+
+// src/admin/styles.ts
+var ADMIN_CSS = `:root {
+  --tempest-bg: #0f172a;
+  --tempest-bg-soft: #1e293b;
+  --tempest-bg-row: #f8fafc;
+  --tempest-bg-row-alt: #f1f5f9;
+  --tempest-fg: #0f172a;
+  --tempest-fg-soft: #475569;
+  --tempest-accent: #2563eb;
+  --tempest-accent-hover: #1d4ed8;
+  --tempest-accent-soft: rgba(37, 99, 235, 0.1);
+  --tempest-danger: #b91c1c;
+  /* Light surface + hairline used by cards / tables / dropdowns on the
+     (light) content area \u2014 distinct from the dark sidebar bg vars above.
+     Overridable by AdminTheme for dark mode. */
+  --tempest-surface: #ffffff;
+  --tempest-border: #e2e8f0;
+  --tempest-radius: 6px;
+  --tempest-shadow: 0 1px 2px rgba(15, 23, 42, 0.08);
+}
+
+* {
+  box-sizing: border-box;
+}
+
+body {
+  margin: 0;
+  font-family: var(--tempest-font, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif);
+  font-size: 14px;
+  color: var(--tempest-fg);
+  background: var(--tempest-page-bg, #f8fafc);
+  /* Sticky-footer column so the layout (and its sidebar) fills the
+     viewport even when the page content is short. */
+  min-height: 100vh;
+  display: flex;
+  flex-direction: column;
+}
+
+a {
+  color: var(--tempest-accent);
+  text-decoration: none;
+}
+
+a:hover {
+  color: var(--tempest-accent-hover);
+  text-decoration: underline;
+}
+
+button {
+  border: 0;
+  background: var(--tempest-accent);
+  color: #fff;
+  padding: 0.5rem 1rem;
+  border-radius: var(--tempest-radius);
+  cursor: pointer;
+  font: inherit;
+}
+
+button:hover {
+  background: var(--tempest-accent-hover);
+}
+
+input,
+select,
+textarea {
+  font: inherit;
+  padding: 0.45rem 0.6rem;
+  border-radius: var(--tempest-radius);
+  border: 1px solid #cbd5e1;
+  background: #fff;
+}
+
+.tempest-admin-header {
+  position: relative;
+  z-index: 20;
+  background: var(--tempest-bg);
+  color: #f8fafc;
+  padding: 0.75rem 1.5rem;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  box-shadow: var(--tempest-shadow);
+}
+
+/* Centered brand \u2014 pinned to the middle of the header (i.e. the screen)
+   regardless of the left (burger) / right (nav) cluster widths. */
+.tempest-admin-header__brand {
+  position: absolute;
+  left: 50%;
+  transform: translateX(-50%);
+  text-align: center;
+  pointer-events: none;
+}
+
+.tempest-admin-header__brand a {
+  color: #fff;
+  font-weight: 600;
+  font-size: 1.1rem;
+  pointer-events: auto;
+  display: inline-flex;
+  align-items: center;
+}
+
+/* Logo image (shown instead of the brand text when theme.logo_url is
+   set). Capped to the header height so any aspect ratio fits cleanly. */
+.tempest-admin-header__logo {
+  display: block;
+  max-height: 32px;
+  width: auto;
+}
+
+.tempest-admin-header__nav {
+  display: flex;
+  align-items: center;
+  gap: 1rem;
+  color: #cbd5e1;
+}
+
+.tempest-admin-header__nav a {
+  color: #cbd5e1;
+}
+
+.tempest-admin-header__user {
+  font-weight: 500;
+  color: #f1f5f9;
+}
+
+.tempest-admin-header__logout {
+  margin: 0;
+}
+
+.tempest-admin-header__logout button {
+  background: transparent;
+  color: #f1f5f9;
+  padding: 0.25rem 0.5rem;
+  border: 1px solid #475569;
+}
+
+.tempest-admin-header__logout button:hover {
+  background: rgba(255, 255, 255, 0.08);
+}
+
+.tempest-admin-header__left {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+}
+
+/* ---- Layout: persistent sidebar + content ---- */
+.tempest-admin-layout {
+  display: flex;
+  align-items: stretch;
+  flex: 1;            /* fill the viewport so the sidebar is full-height */
+}
+
+.tempest-admin-sidebar {
+  flex: 0 0 220px;
+  width: 220px;
+  background: var(--tempest-bg-soft);
+  color: #e2e8f0;
+  padding: 1rem 0.75rem;
+}
+
+.tempest-admin-sidebar__nav {
+  display: flex;
+  flex-direction: column;
+  gap: 0.15rem;
+  position: sticky;
+  top: 1rem;
+}
+
+.tempest-admin-sidebar__heading {
+  font-size: 0.7rem;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: #94a3b8;
+  margin: 1rem 0.75rem 0.35rem;
+}
+
+.tempest-admin-sidebar__link {
+  display: block;
+  padding: 0.5rem 0.75rem;
+  border-radius: var(--tempest-radius);
+  color: #cbd5e1;
+}
+
+.tempest-admin-sidebar__link:hover {
+  background: rgba(255, 255, 255, 0.06);
+  color: #fff;
+  text-decoration: none;
+}
+
+.tempest-admin-sidebar__link--active,
+.tempest-admin-sidebar__link--active:hover {
+  background: var(--tempest-accent);
+  color: #fff;
+}
+
+/* Burger toggle (CSS-only, via the hidden checkbox) \u2014 mobile only. */
+.tempest-admin-burger {
+  display: none;
+  flex-direction: column;
+  gap: 4px;
+  cursor: pointer;
+  padding: 0.3rem;
+}
+
+.tempest-admin-burger span {
+  display: block;
+  width: 22px;
+  height: 2px;
+  background: #f8fafc;
+  border-radius: 2px;
+}
+
+.tempest-admin-scrim {
+  display: none;
+}
+
+.tempest-admin-main {
+  flex: 1 1 auto;
+  min-width: 0;
+  max-width: 1080px;
+  margin: 2rem auto;
+  padding: 0 1.5rem;
+}
+
+.tempest-admin-messages {
+  list-style: none;
+  padding: 0;
+  margin: 0 0 1.5rem;
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+.tempest-admin-messages__item {
+  padding: 0.75rem 1rem;
+  border-radius: var(--tempest-radius);
+  border-left: 4px solid var(--tempest-accent);
+  background: #eff6ff;
+}
+
+.tempest-admin-messages__item--error {
+  border-left-color: var(--tempest-danger);
+  background: #fef2f2;
+}
+
+.tempest-admin-login {
+  max-width: 360px;
+  margin: 4rem auto;
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  padding: 2rem;
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-login h1 {
+  margin-top: 0;
+}
+
+.tempest-admin-login__form {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+
+.tempest-admin-login__form label {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+}
+
+.tempest-admin-login__error {
+  background: #fef2f2;
+  color: var(--tempest-danger);
+  padding: 0.75rem 1rem;
+  border-radius: var(--tempest-radius);
+}
+
+.tempest-admin-dashboard__table,
+.tempest-admin-list__table {
+  width: 100%;
+  border-collapse: collapse;
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  overflow: hidden;
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-dashboard__table th,
+.tempest-admin-dashboard__table td,
+.tempest-admin-list__table th,
+.tempest-admin-list__table td {
+  padding: 0.75rem 1rem;
+  text-align: left;
+  border-bottom: 1px solid #e2e8f0;
+  vertical-align: top;
+}
+
+.tempest-admin-list__table tr:nth-child(even) td {
+  background: var(--tempest-bg-row-alt);
+}
+
+.tempest-admin-list__header {
+  display: flex;
+  justify-content: space-between;
+  align-items: baseline;
+  margin-bottom: 1rem;
+}
+
+.tempest-admin-list__filters {
+  display: flex;
+  gap: 0.75rem;
+  align-items: end;
+  margin-bottom: 1rem;
+  flex-wrap: wrap;
+}
+
+.tempest-admin-list__filters label {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+}
+
+.tempest-admin-list__pagination {
+  display: flex;
+  gap: 1rem;
+  align-items: center;
+  justify-content: center;
+  margin-top: 1.5rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-detail__fields {
+  display: grid;
+  grid-template-columns: 200px 1fr;
+  gap: 0.5rem 1.5rem;
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  padding: 1.5rem;
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-detail__fields dt {
+  font-weight: 600;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-detail__fields dd {
+  margin: 0;
+  word-break: break-word;
+}
+
+.tempest-admin-detail__audit-title {
+  font-size: 1rem;
+  margin: 1.5rem 0 0.5rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-detail__json {
+  margin: 0;
+  padding: 0.5rem 0.75rem;
+  background: var(--tempest-bg-row);
+  border: 1px solid var(--tempest-border);
+  border-radius: var(--tempest-radius);
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 0.8rem;
+  overflow-x: auto;
+}
+
+.tempest-admin-history {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  border-left: 2px solid var(--tempest-border);
+}
+
+.tempest-admin-history__item {
+  position: relative;
+  padding: 0.5rem 0 1rem 1rem;
+}
+
+.tempest-admin-history__item::before {
+  content: "";
+  position: absolute;
+  left: -0.4rem;
+  top: 0.9rem;
+  width: 0.6rem;
+  height: 0.6rem;
+  border-radius: 50%;
+  background: var(--tempest-fg-soft);
+}
+
+.tempest-admin-history__item--create::before { background: #16a34a; }
+.tempest-admin-history__item--update::before { background: #d97706; }
+.tempest-admin-history__item--delete::before { background: #dc2626; }
+
+.tempest-admin-history__head {
+  display: flex;
+  gap: 0.75rem;
+  align-items: baseline;
+  flex-wrap: wrap;
+}
+
+.tempest-admin-history__action {
+  font-weight: 600;
+  text-transform: uppercase;
+  font-size: 0.75rem;
+  letter-spacing: 0.04em;
+}
+
+.tempest-admin-history__meta {
+  color: var(--tempest-fg-soft);
+  font-size: 0.85rem;
+}
+
+.tempest-admin-history__changes {
+  width: 100%;
+  border-collapse: collapse;
+  margin-top: 0.5rem;
+  font-size: 0.85rem;
+}
+
+.tempest-admin-history__changes th,
+.tempest-admin-history__changes td {
+  text-align: left;
+  padding: 0.25rem 0.5rem;
+  border-bottom: 1px solid var(--tempest-border);
+  vertical-align: top;
+  word-break: break-word;
+}
+
+.tempest-admin-history__changes th {
+  color: var(--tempest-fg-soft);
+  font-weight: 600;
+}
+
+.tempest-admin-history__empty {
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-ac {
+  position: relative;
+}
+
+.tempest-admin-ac__search {
+  width: 100%;
+}
+
+.tempest-admin-ac__results {
+  list-style: none;
+  margin: 0.25rem 0 0;
+  padding: 0;
+  border: 1px solid var(--tempest-border);
+  border-radius: var(--tempest-radius, 6px);
+  max-height: 12rem;
+  overflow-y: auto;
+  background: var(--tempest-surface);
+}
+
+.tempest-admin-ac__results:empty {
+  display: none;
+}
+
+.tempest-admin-ac__option {
+  display: block;
+  width: 100%;
+  text-align: left;
+  padding: 0.4rem 0.6rem;
+  background: none;
+  border: 0;
+  cursor: pointer;
+  color: inherit;
+  font: inherit;
+}
+
+.tempest-admin-ac__option:hover,
+.tempest-admin-ac__option:focus {
+  background: var(--tempest-accent-soft, rgba(0, 0, 0, 0.06));
+}
+
+.tempest-admin-ac__empty {
+  padding: 0.4rem 0.6rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-inline {
+  margin-top: 2rem;
+}
+
+.tempest-admin-inline__header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  margin-bottom: 0.5rem;
+}
+
+.tempest-admin-inline__header h2 {
+  font-size: 1rem;
+  margin: 0;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-inline__count {
+  font-weight: 400;
+}
+
+.tempest-admin-inline__scroll {
+  overflow-x: auto;
+}
+
+.tempest-admin-inline__table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.9rem;
+}
+
+.tempest-admin-inline__table th,
+.tempest-admin-inline__table td {
+  text-align: left;
+  padding: 0.4rem 0.6rem;
+  border-bottom: 1px solid var(--tempest-border);
+  white-space: nowrap;
+}
+
+.tempest-admin-inline__table th {
+  color: var(--tempest-fg-soft);
+  font-weight: 600;
+}
+
+.tempest-admin-inline__empty,
+.tempest-admin-inline__more {
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-cards {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(14rem, 1fr));
+  gap: 1rem;
+  margin: 1rem 0 2rem;
+}
+
+.tempest-admin-card {
+  display: flex;
+  flex-direction: column;
+  gap: 0.35rem;
+  padding: 1rem 1.1rem;
+  border: 1px solid var(--tempest-border);
+  border-radius: var(--tempest-radius, 8px);
+  background: var(--tempest-surface);
+}
+
+.tempest-admin-card__label {
+  font-size: 0.8rem;
+  color: var(--tempest-fg-soft);
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+
+.tempest-admin-card__value {
+  font-size: 1.7rem;
+  font-weight: 700;
+  line-height: 1.1;
+}
+
+.tempest-admin-card__value small {
+  font-size: 0.9rem;
+  font-weight: 400;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-card__trend {
+  font-size: 0.9rem;
+  font-weight: 600;
+}
+
+.tempest-admin-card__trend small {
+  font-weight: 400;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-card__trend--up { color: #16a34a; }
+.tempest-admin-card__trend--down { color: #dc2626; }
+.tempest-admin-card__trend--flat { color: var(--tempest-fg-soft); }
+
+.tempest-admin-card__parts {
+  list-style: none;
+  margin: 0.25rem 0 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 0.3rem;
+}
+
+.tempest-admin-card__parts li {
+  display: grid;
+  grid-template-columns: 6rem 1fr auto;
+  align-items: center;
+  gap: 0.5rem;
+  font-size: 0.85rem;
+}
+
+.tempest-admin-card__part-label {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-card__part-bar {
+  display: block;
+  height: 0.5rem;
+  border-radius: 999px;
+  background: var(--tempest-border);
+  overflow: hidden;
+}
+
+.tempest-admin-card__part-bar span {
+  display: block;
+  height: 100%;
+  background: var(--tempest-accent, #2563eb);
+}
+
+.tempest-admin-card__help {
+  font-size: 0.8rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-import__result {
+  margin: 1rem 0;
+}
+
+.tempest-admin-import__ok {
+  color: #16a34a;
+  font-weight: 600;
+}
+
+.tempest-admin-import__failed {
+  color: #d97706;
+  font-weight: 600;
+}
+
+.tempest-admin-import__errors {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.85rem;
+}
+
+.tempest-admin-import__errors th,
+.tempest-admin-import__errors td {
+  text-align: left;
+  padding: 0.3rem 0.5rem;
+  border-bottom: 1px solid var(--tempest-border);
+  vertical-align: top;
+}
+
+.tempest-admin-import__form label {
+  display: block;
+  margin: 1rem 0 0.5rem;
+}
+
+.tempest-admin-lenses {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.4rem;
+  margin: 0.5rem 0 1rem;
+  border-bottom: 1px solid var(--tempest-border);
+  padding-bottom: 0.5rem;
+}
+
+.tempest-admin-lens {
+  padding: 0.3rem 0.7rem;
+  border-radius: 999px;
+  border: 1px solid var(--tempest-border);
+  color: var(--tempest-fg-soft);
+  text-decoration: none;
+  font-size: 0.85rem;
+}
+
+.tempest-admin-lens:hover {
+  color: inherit;
+}
+
+.tempest-admin-lens--active {
+  background: var(--tempest-accent, #2563eb);
+  border-color: var(--tempest-accent, #2563eb);
+  color: #fff;
+}
+
+.tempest-admin-footer {
+  position: relative;
+  z-index: 20;
+  text-align: center;
+  padding: 2rem 0;
+  color: var(--tempest-fg-soft);
+}
+
+/* List toolbar: search/filters on the left, actions (export) on the right. */
+.tempest-admin-list__toolbar {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.75rem 1rem;
+  align-items: flex-end;
+  justify-content: space-between;
+  margin-bottom: 1rem;
+}
+
+.tempest-admin-list__actions {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+}
+
+.tempest-admin-list__actions a {
+  display: inline-block;
+  padding: 0.45rem 0.8rem;
+  border: 1px solid var(--tempest-accent);
+  border-radius: var(--tempest-radius);
+  background: #fff;
+  white-space: nowrap;
+}
+
+.tempest-admin-list__actions a:hover {
+  background: #eff6ff;
+  text-decoration: none;
+}
+
+/* Dashboard: system-metric stat cards + model cards. */
+.tempest-admin-stats {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
+  gap: 1rem;
+  margin: 1.5rem 0;
+}
+
+.tempest-admin-stat {
+  display: flex;
+  flex-direction: column;
+  gap: 0.15rem;
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  padding: 1rem 1.25rem;
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-stat__label {
+  font-size: 0.8rem;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-stat__value {
+  font-size: 1.6rem;
+  font-weight: 700;
+}
+
+.tempest-admin-stat__sub {
+  font-size: 0.8rem;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-models {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(240px, 1fr));
+  gap: 1rem;
+  margin-top: 1rem;
+}
+
+.tempest-admin-model-card {
+  background: #fff;
+  border-radius: var(--tempest-radius);
+  padding: 1rem 1.25rem;
+  box-shadow: var(--tempest-shadow);
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+}
+
+.tempest-admin-model-card__head {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 0.5rem;
+}
+
+.tempest-admin-model-card__head h2 {
+  margin: 0;
+  font-size: 1.05rem;
+}
+
+.tempest-admin-model-card__count {
+  font-weight: 700;
+  color: var(--tempest-accent);
+}
+
+.tempest-admin-model-card__actions {
+  display: flex;
+  gap: 1rem;
+}
+
+/* Bulk-action bar above the list table. */
+.tempest-admin-bulk {
+  margin: 0;
+}
+
+.tempest-admin-bulk__bar {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+  margin-bottom: 0.75rem;
+}
+
+.tempest-admin-list__check {
+  width: 1%;
+  white-space: nowrap;
+  text-align: center;
+}
+
+.tempest-admin-list__check input {
+  width: auto;
+}
+
+/* Horizontal-scroll wrapper so wide tables never break the layout. */
+.tempest-admin-table-wrap {
+  width: 100%;
+  overflow-x: auto;
+  -webkit-overflow-scrolling: touch;
+  border-radius: var(--tempest-radius);
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-table-wrap .tempest-admin-list__table,
+.tempest-admin-table-wrap .tempest-admin-dashboard__table {
+  box-shadow: none;
+}
+
+/* Sortable column headers. */
+.tempest-admin-list__table th a.tempest-sort {
+  color: inherit;
+  display: inline-flex;
+  align-items: center;
+  gap: 0.3rem;
+  white-space: nowrap;
+}
+
+.tempest-admin-list__table th a.tempest-sort:hover {
+  color: var(--tempest-accent);
+  text-decoration: none;
+}
+
+.tempest-sort__arrow {
+  font-size: 0.75em;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-sort--active .tempest-sort__arrow {
+  color: var(--tempest-accent);
+}
+
+/* Detail header actions (back / edit / delete). */
+.tempest-admin-detail__header {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.5rem 1rem;
+  align-items: center;
+  justify-content: space-between;
+  margin-bottom: 1rem;
+}
+
+.tempest-admin-detail__actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.5rem;
+  align-items: center;
+}
+
+.tempest-admin-detail__delete {
+  margin: 0;
+}
+
+.tempest-admin-btn {
+  display: inline-block;
+  padding: 0.45rem 0.8rem;
+  border: 1px solid var(--tempest-accent);
+  border-radius: var(--tempest-radius);
+  background: #fff;
+}
+
+.tempest-admin-btn:hover {
+  background: #eff6ff;
+  text-decoration: none;
+}
+
+.tempest-admin-btn--danger {
+  background: var(--tempest-danger);
+}
+
+.tempest-admin-btn--danger:hover {
+  background: #991b1b;
+}
+
+/* Scoped under __actions so it beats \`.tempest-admin-list__actions a\`
+   (otherwise the white action-link background won + white text = invisible). */
+.tempest-admin-list__actions a.tempest-admin-list__new,
+a.tempest-admin-list__new {
+  background: var(--tempest-accent);
+  color: #fff;
+  border-color: var(--tempest-accent);
+}
+
+.tempest-admin-list__actions a.tempest-admin-list__new:hover,
+a.tempest-admin-list__new:hover {
+  background: var(--tempest-accent-hover);
+  color: #fff;
+}
+
+/* Create / edit form. */
+.tempest-admin-form__form {
+  display: grid;
+  gap: 1rem;
+  max-width: 640px;
+  background: #fff;
+  padding: 1.5rem;
+  border-radius: var(--tempest-radius);
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-form__field {
+  display: flex;
+  flex-direction: column;
+  gap: 0.3rem;
+}
+
+.tempest-admin-form__field > label {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+}
+
+.tempest-admin-form__field > label > span {
+  font-weight: 600;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-form__field input,
+.tempest-admin-form__field select,
+.tempest-admin-form__field textarea {
+  width: 100%;
+}
+
+.tempest-admin-form__json {
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 0.85rem;
+  white-space: pre;
+  overflow-wrap: normal;
+  overflow-x: auto;
+}
+
+.tempest-admin-form__check {
+  flex-direction: row !important;
+  align-items: center;
+  gap: 0.5rem;
+}
+
+.tempest-admin-form__check input {
+  width: auto;
+}
+
+.tempest-admin-form__field--error input,
+.tempest-admin-form__field--error select,
+.tempest-admin-form__field--error textarea {
+  border-color: var(--tempest-danger);
+}
+
+.tempest-admin-form__field-error {
+  color: var(--tempest-danger);
+}
+
+.tempest-admin-form__error {
+  background: #fef2f2;
+  color: var(--tempest-danger);
+  padding: 0.75rem 1rem;
+  border-radius: var(--tempest-radius);
+  margin-bottom: 1rem;
+}
+
+.tempest-admin-form__actions {
+  display: flex;
+  gap: 1rem;
+  align-items: center;
+}
+
+/* ---- Responsive ---- */
+
+/* Tablet and below. */
+@media (max-width: 1023px) {
+  .tempest-admin-main {
+    margin: 1.25rem auto;
+    padding: 0 1rem;
+  }
+}
+
+/* Mobile (<= 430px and small phones). */
+@media (max-width: 600px) {
+  .tempest-admin-header {
+    flex-direction: column;
+    align-items: flex-start;
+    gap: 0.5rem;
+    padding: 0.75rem 1rem;
+  }
+
+  .tempest-admin-header__nav {
+    width: 100%;
+    flex-wrap: wrap;
+    gap: 0.5rem 0.75rem;
+  }
+
+  .tempest-admin-main {
+    margin: 1rem auto;
+    padding: 0 0.75rem;
+  }
+
+  .tempest-admin-list__header {
+    flex-direction: column;
+    gap: 0.25rem;
+    align-items: flex-start;
+  }
+
+  .tempest-admin-list__toolbar {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .tempest-admin-list__filters {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .tempest-admin-list__filters input,
+  .tempest-admin-list__filters select,
+  .tempest-admin-list__filters button {
+    width: 100%;
+  }
+
+  .tempest-admin-list__actions {
+    justify-content: stretch;
+  }
+
+  .tempest-admin-list__actions a {
+    flex: 1;
+    text-align: center;
+  }
+
+  /* Stack the detail grid into single-column rows. */
+  .tempest-admin-detail__fields {
+    grid-template-columns: 1fr;
+    gap: 0.15rem 0;
+    padding: 1rem;
+  }
+
+  /* The logs table becomes stacked cards. Horizontal scroll is fine for a
+     list view you skim, but the logs table's fourth column carries the
+     message, the request context and the traceback \u2014 everything you came to
+     read \u2014 so at this width it sat off-screen behind a sideways drag, and an
+     opened traceback showed up only as a tall blank row. Labels come from
+     each cell's data-label, so the header can be dropped without losing
+     which value is which. Scoped to this table: the other list views keep
+     the scroll treatment. */
+  .tempest-admin-logs .tempest-admin-table-wrap {
+    overflow-x: visible;
+  }
+
+  .tempest-admin-logs__table thead {
+    display: none;
+  }
+
+  .tempest-admin-logs__table,
+  .tempest-admin-logs__table tbody,
+  .tempest-admin-logs__table tr,
+  .tempest-admin-logs__table td {
+    display: block;
+    width: 100%;
+  }
+
+  .tempest-admin-logs__table tr {
+    padding: 0.85rem 0.9rem;
+    border-bottom: 1px solid #e2e8f0;
+  }
+
+  .tempest-admin-logs__table tr:last-child {
+    border-bottom: none;
+  }
+
+  .tempest-admin-logs__table td {
+    padding: 0.1rem 0;
+    border: none;
+  }
+
+  .tempest-admin-logs__table td[data-label]::before {
+    content: attr(data-label);
+    display: block;
+    color: var(--tempest-fg-soft);
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+    font-size: 0.64rem;
+    font-weight: 600;
+  }
+
+  /* The message is the card's body, not another labelled field. */
+  .tempest-admin-logs__table td.tempest-admin-logs__msg {
+    margin-top: 0.5rem;
+  }
+
+  .tempest-admin-logs__table td.tempest-admin-logs__msg::before {
+    display: none;
+  }
+
+  .tempest-admin-logs__logger {
+    white-space: normal;
+    overflow-wrap: anywhere;
+  }
+
+  .tempest-admin-detail__fields dt {
+    margin-top: 0.75rem;
+  }
+
+  .tempest-admin-detail__fields dd {
+    padding-bottom: 0.5rem;
+    border-bottom: 1px solid #e2e8f0;
+  }
+
+  .tempest-admin-login {
+    margin: 1.5rem auto;
+    padding: 1.5rem;
+  }
+
+  .tempest-admin-form__form {
+    padding: 1rem;
+  }
+
+  .tempest-admin-form__actions {
+    flex-direction: column-reverse;
+    align-items: stretch;
+  }
+
+  .tempest-admin-form__actions button,
+  .tempest-admin-form__actions .tempest-admin-form__cancel {
+    width: 100%;
+    text-align: center;
+  }
+
+  .tempest-admin-bulk__bar {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .tempest-admin-bulk__bar select,
+  .tempest-admin-bulk__bar button {
+    width: 100%;
+  }
+}
+
+/* ---- Application logs page ---- */
+.tempest-log-badge {
+  display: inline-block;
+  padding: 0.1rem 0.5rem;
+  border-radius: 999px;
+  font-size: 0.72rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+  background: #e2e8f0;
+  color: #334155;
+}
+
+.tempest-log-badge--debug {
+  background: #e2e8f0;
+  color: #475569;
+}
+
+.tempest-log-badge--info {
+  background: #dbeafe;
+  color: #1e40af;
+}
+
+.tempest-log-badge--warning {
+  background: #fef3c7;
+  color: #92400e;
+}
+
+.tempest-log-badge--error {
+  background: #fee2e2;
+  color: #991b1b;
+}
+
+.tempest-log-badge--critical {
+  background: #7f1d1d;
+  color: #fff;
+}
+
+.tempest-admin-logs__ts {
+  white-space: nowrap;
+  font-variant-numeric: tabular-nums;
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-logs__logger {
+  color: var(--tempest-fg-soft);
+  white-space: nowrap;
+}
+
+.tempest-admin-logs__msg {
+  word-break: break-word;
+}
+
+.tempest-admin-logs__empty {
+  color: var(--tempest-fg-soft);
+  background: #fff;
+  padding: 1.5rem;
+  border-radius: var(--tempest-radius);
+  box-shadow: var(--tempest-shadow);
+}
+
+.tempest-admin-logs__actions {
+  display: flex;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+}
+
+.tempest-admin-logs__export {
+  display: inline-block;
+  padding: 0.35rem 0.75rem;
+  border-radius: var(--tempest-radius);
+  border: 1px solid #cbd5e1;
+  background: #fff;
+  color: #334155;
+  font-size: 0.82rem;
+  font-weight: 600;
+  text-decoration: none;
+}
+
+.tempest-admin-logs__export:hover {
+  background: #f1f5f9;
+}
+
+.tempest-admin-logs__meta {
+  list-style: none;
+  margin: 0.4rem 0 0;
+  padding: 0;
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.3rem 0.75rem;
+  font-size: 0.75rem;
+}
+
+/* The gap is layout only \u2014 it does not survive a copy, and an operator copying a
+   row to paste into an issue would get "status_code404". The template keeps a
+   real space between the label and the value for that; this widens the visual
+   separation on top of it, since an uppercase micro-label sitting against a
+   monospace value reads as one token. */
+.tempest-admin-logs__meta li {
+  display: inline-flex;
+  align-items: baseline;
+  gap: 0.4rem;
+}
+
+.tempest-admin-logs__meta span {
+  color: var(--tempest-fg-soft);
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+  font-size: 0.68rem;
+}
+
+.tempest-admin-logs__meta code {
+  word-break: break-all;
+}
+
+/* Collapsed by default so a page full of 500s stays scannable; details/summary
+   keeps that working with no JavaScript, which the admin does not ship. */
+.tempest-admin-logs__trace {
+  margin-top: 0.5rem;
+}
+
+/* The summary carries the record's own message, so the whole item is the click
+   target instead of a separate link. It must therefore read as body text, not
+   as a control \u2014 the affordance is the marker plus the hint chip. */
+.tempest-admin-logs__trace summary {
+  cursor: pointer;
+  list-style: none;
+  display: block;
+}
+
+.tempest-admin-logs__trace summary::-webkit-details-marker {
+  display: none;
+}
+
+.tempest-admin-logs__msg-text::before {
+  content: "\u25B8";
+  display: inline-block;
+  width: 0.9rem;
+  color: #991b1b;
+  font-size: 0.7rem;
+}
+
+.tempest-admin-logs__trace[open] .tempest-admin-logs__msg-text::before {
+  content: "\u25BE";
+}
+
+.tempest-admin-logs__trace-hint {
+  display: inline-block;
+  margin-top: 0.3rem;
+  font-size: 0.68rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: #991b1b;
+}
+
+.tempest-admin-logs__trace[open] .tempest-admin-logs__trace-hint {
+  opacity: 0.55;
+}
+
+/* Lines wrap instead of extending. A <pre> is sized by its longest line and it
+   sits in a table cell, which sizes to content, so \`overflow-x\` on the <pre>
+   cannot shrink it: the table grew past its scroll container (measured 1364px
+   against a 1012px wrap) and the trace could only be read by dragging the table
+   sideways. Wrapping keeps the table at its container width. It costs the
+   alignment of the caret markers on screen; the markdown export carries the
+   exact unwrapped text for real analysis. */
+.tempest-admin-logs__trace pre {
+  margin: 0.5rem 0 0;
+  padding: 0.75rem;
+  max-height: 24rem;
+  overflow-y: auto;
+  background: #0f172a;
+  color: #e2e8f0;
+  border-radius: var(--tempest-radius);
+  font-size: 0.74rem;
+  line-height: 1.45;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+  -webkit-user-select: all;
+  user-select: all;
+}
+
+.tempest-admin-logs__note {
+  color: var(--tempest-fg-soft);
+  font-size: 0.8rem;
+  margin-top: 0.75rem;
+}
+
+/* ---- Sidebar off-canvas on tablet/mobile, burger reveals it ---- */
+@media (max-width: 768px) {
+  .tempest-admin-burger {
+    display: flex;
+  }
+
+  .tempest-admin-sidebar {
+    position: fixed;
+    top: 0;
+    left: 0;
+    bottom: 0;
+    z-index: 50;
+    width: 240px;
+    flex-basis: 240px;
+    transform: translateX(-100%);
+    transition: transform 0.2s ease;
+    overflow-y: auto;
+    box-shadow: 0 0 24px rgba(15, 23, 42, 0.35);
+  }
+
+  .tempest-admin-navtoggle:checked ~ .tempest-admin-layout .tempest-admin-sidebar {
+    transform: translateX(0);
+  }
+
+  .tempest-admin-navtoggle:checked ~ .tempest-admin-layout .tempest-admin-scrim {
+    display: block;
+    position: fixed;
+    inset: 0;
+    z-index: 40;
+    background: rgba(15, 23, 42, 0.45);
+  }
+}
+
+/* ---- Desktop: sidebar overlays the header + footer ---- */
+@media (min-width: 769px) {
+  .tempest-admin-sidebar {
+    position: fixed;
+    top: 0;
+    left: 0;
+    bottom: 0;
+    z-index: 100;        /* above header/footer (z-index: 20) */
+    overflow-y: auto;
+    /* Clear the header bar so the first nav link sits below it. */
+    padding-top: 3.75rem;
+  }
+
+  /* The fixed sidebar leaves the flex flow, so reserve its gutter on
+     the layout row to keep the main content from sliding underneath. */
+  .tempest-admin-layout {
+    padding-left: 220px;
+  }
+}
+
+/* Flash banner shown after a custom bulk action runs. */
+.tempest-admin-flash {
+  margin: 0 0 1rem;
+  padding: 0.7rem 1rem;
+  border-radius: var(--tempest-radius);
+  border-left: 4px solid var(--tempest-accent);
+  background: var(--tempest-bg);
+  color: var(--tempest-fg);
+}
+
+.tempest-admin-flash--error {
+  border-left-color: var(--tempest-danger);
+}
+
+.tempest-admin-flash--warning {
+  border-left-color: #d97706;
+}
+
+/* Task panel \u2014 declared schedule and persisted runs. */
+.tempest-admin-tasks__scope {
+  margin: 0 0 1.25rem;
+  color: var(--tempest-fg-soft);
+  font-size: 0.9rem;
+}
+
+.tempest-admin-tasks__heading {
+  margin: 1.75rem 0 0.75rem;
+  font-size: 1.05rem;
+}
+
+.tempest-admin-tasks__empty {
+  padding: 1rem;
+  border: 1px dashed var(--tempest-border);
+  border-radius: var(--tempest-radius);
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-tasks__trigger + .tempest-admin-tasks__trigger {
+  margin-top: 0.35rem;
+}
+
+.tempest-admin-tasks__offset {
+  color: var(--tempest-fg-soft);
+  font-size: 0.85rem;
+  white-space: nowrap;
+}
+
+.tempest-admin-tasks__status {
+  display: inline-block;
+  padding: 0.1rem 0.5rem;
+  border-radius: 999px;
+  font-size: 0.8rem;
+  border: 1px solid var(--tempest-border);
+  color: var(--tempest-fg-soft);
+}
+
+.tempest-admin-tasks__status--running {
+  border-color: var(--tempest-accent);
+  color: var(--tempest-accent);
+}
+
+.tempest-admin-tasks__status--done {
+  border-color: #15803d;
+  color: #15803d;
+}
+
+.tempest-admin-tasks__status--failed {
+  border-color: var(--tempest-danger);
+  color: var(--tempest-danger);
+}
+
+/* Cancelled is terminal but not a failure, so it stays neutral: an
+   operator scanning for red should find only what went wrong. */
+.tempest-admin-tasks__status--cancelled {
+  border-color: var(--tempest-border);
+  color: var(--tempest-fg-soft);
+}
+
+/* The track uses the border token, not a row background: the list stripes
+   rows with --tempest-bg-row-alt, so a track painted in it vanished on
+   every other row \u2014 an empty progress cell reads as "no data", not as 0%. */
+.tempest-admin-tasks__bar {
+  display: inline-block;
+  width: 90px;
+  height: 8px;
+  border-radius: 999px;
+  background: var(--tempest-border);
+  overflow: hidden;
+  vertical-align: middle;
+}
+
+.tempest-admin-tasks__bar--wide {
+  display: block;
+  width: 100%;
+  height: 12px;
+  margin: 0 0 1.25rem;
+}
+
+.tempest-admin-tasks__bar-fill {
+  display: block;
+  height: 100%;
+  background: var(--tempest-accent);
+}
+
+.tempest-admin-tasks__facts {
+  display: grid;
+  grid-template-columns: max-content 1fr;
+  gap: 0.4rem 1.25rem;
+  margin: 0 0 1.5rem;
+}
+
+.tempest-admin-tasks__facts dt {
+  color: var(--tempest-fg-soft);
+  font-size: 0.85rem;
+}
+
+.tempest-admin-tasks__facts dd {
+  margin: 0;
+}
+
+.tempest-admin-tasks__error pre {
+  padding: 0.85rem;
+  border-radius: var(--tempest-radius);
+  border-left: 4px solid var(--tempest-danger);
+  background: var(--tempest-bg-row-alt);
+  overflow-x: auto;
+  white-space: pre-wrap;
+}
+
+.tempest-admin-tasks__cancel {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+  margin: 0 0 1.5rem;
+}
+
+.tempest-admin-tasks__hint {
+  color: var(--tempest-fg-soft);
+  font-size: 0.85rem;
+}
+
+@media (max-width: 640px) {
+  .tempest-admin-tasks__facts {
+    grid-template-columns: 1fr;
+    gap: 0.15rem;
+  }
+
+  .tempest-admin-tasks__facts dd {
+    margin: 0 0 0.6rem;
+  }
+}
+`;
+
+// src/admin/theme.ts
+var FORBIDDEN_CHARS = ["<", ">", "{", "}", '"'];
+function assertSafe(field, value) {
+  if (value === void 0) return;
+  const bad = FORBIDDEN_CHARS.filter((char) => value.includes(char));
+  if (bad.length > 0) {
+    throw new Error(
+      `AdminTheme.${field} contains forbidden character(s) ${bad.join(" ")}; these would break the injected <style>/HTML. Got: ${value}`
+    );
+  }
+}
+function resolveAdminTheme(theme = {}) {
+  for (const [field, value] of Object.entries(theme)) {
+    if (typeof value === "string") assertSafe(field, value);
+  }
+  const headerBg = theme.headerBg ?? "#0f172a";
+  return {
+    accent: theme.accent ?? "#2563eb",
+    accentHover: theme.accentHover ?? "#1d4ed8",
+    danger: theme.danger ?? "#b91c1c",
+    headerBg,
+    sidebarBg: theme.sidebarBg ?? headerBg,
+    pageBg: theme.pageBg ?? null,
+    radius: theme.radius ?? "6px",
+    fontFamily: theme.fontFamily ?? null,
+    logoUrl: theme.logoUrl ?? null,
+    logoAlt: theme.logoAlt ?? "Logo",
+    faviconUrl: theme.faviconUrl ?? null,
+    footerText: theme.footerText ?? "Powered by tempest-express-sdk",
+    darkMode: theme.darkMode ?? false,
+    customCssUrl: theme.customCssUrl ?? null
+  };
+}
+function adminThemeCss(theme) {
+  const variables = {
+    "--tempest-accent": theme.accent,
+    "--tempest-accent-hover": theme.accentHover,
+    "--tempest-danger": theme.danger,
+    "--tempest-bg": theme.headerBg,
+    "--tempest-bg-soft": theme.sidebarBg,
+    "--tempest-radius": theme.radius
+  };
+  if (theme.fontFamily !== null) variables["--tempest-font"] = theme.fontFamily;
+  if (theme.pageBg !== null) variables["--tempest-page-bg"] = theme.pageBg;
+  const rootLines = Object.entries(variables).map(([name, value]) => `  ${name}: ${value};`).join("\n");
+  const blocks = [`:root {
+${rootLines}
+}`];
+  if (theme.darkMode && theme.pageBg === null) {
+    blocks.push(
+      [
+        ":root {",
+        "  --tempest-page-bg: #0b1120;",
+        "  --tempest-bg-row: #1e293b;",
+        "  --tempest-bg-row-alt: #172033;",
+        "  --tempest-fg: #e2e8f0;",
+        "  --tempest-fg-soft: #94a3b8;",
+        "}",
+        "body { color: var(--tempest-fg); }",
+        "input, select, textarea {",
+        "  background: #1e293b;",
+        "  color: var(--tempest-fg);",
+        "  border-color: #334155;",
+        "}"
+      ].join("\n")
+    );
+  }
+  if (theme.fontFamily !== null) {
+    blocks.push("body { font-family: var(--tempest-font); }");
+  }
+  return blocks.join("\n");
+}
+
+// src/admin/templates.ts
+function escapeHtml(value) {
+  return String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function renderLayout(context, title, body) {
+  const { site, theme, prefix, session, currentPath, navModels, messages } = context;
+  const authed = session !== null;
+  const indexUrl = `${prefix}/`;
+  const navLink = (url, label, active) => `<a href="${escapeHtml(url)}" class="tempest-admin-sidebar__link${active ? " tempest-admin-sidebar__link--active" : ""}">${escapeHtml(label)}</a>`;
+  const sidebar = authed ? `<label for="tempest-nav-toggle" class="tempest-admin-scrim" aria-hidden="true"></label>
+    <aside class="tempest-admin-sidebar">
+      <nav class="tempest-admin-sidebar__nav" aria-label="Admin navigation">
+        ${navLink(indexUrl, "Dashboard", currentPath === indexUrl)}
+        ${navModels.length > 0 ? `<span class="tempest-admin-sidebar__heading">Models</span>${navModels.map(
+    (entry) => navLink(entry.url, entry.label, currentPath.startsWith(entry.url))
+  ).join("")}` : ""}
+      </nav>
+    </aside>` : "";
+  const brand = theme.logoUrl !== null ? `<img src="${escapeHtml(theme.logoUrl)}" alt="${escapeHtml(theme.logoAlt)}" class="tempest-admin-header__logo">` : escapeHtml(site.brandText());
+  const headerNav = authed ? `<nav class="tempest-admin-header__nav">
+      <span class="tempest-admin-header__user">${escapeHtml(session.displayName)}</span>
+      ${site.siteUrl !== null ? `<a href="${escapeHtml(site.siteUrl)}">View site</a>` : ""}
+      <form method="post" action="${escapeHtml(`${prefix}/logout`)}" class="tempest-admin-header__logout">
+        <input type="hidden" name="csrf_token" value="${escapeHtml(session.csrfToken)}">
+        <button type="submit">Logout</button>
+      </form>
+    </nav>` : "";
+  const banners = messages.length > 0 ? `<ul class="tempest-admin-messages">${messages.map(
+    (message) => `<li class="tempest-admin-messages__item tempest-admin-messages__item--${escapeHtml(
+      message.level
+    )}">${escapeHtml(message.text)}</li>`
+  ).join("")}</ul>` : "";
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${escapeHtml(title)}</title>
+  ${theme.faviconUrl !== null ? `<link rel="icon" href="${escapeHtml(theme.faviconUrl)}">` : ""}
+  <link rel="stylesheet" href="${escapeHtml(`${prefix}/static/admin.css`)}">
+  <style>${adminThemeCss(theme)}</style>
+  ${theme.customCssUrl !== null ? `<link rel="stylesheet" href="${escapeHtml(theme.customCssUrl)}">` : ""}
+</head>
+<body>
+  ${authed ? '<input type="checkbox" id="tempest-nav-toggle" class="tempest-admin-navtoggle" hidden>' : ""}
+  <header class="tempest-admin-header">
+    <div class="tempest-admin-header__left">
+      ${authed ? `<label for="tempest-nav-toggle" class="tempest-admin-burger" aria-label="Toggle navigation"><span></span><span></span><span></span></label>` : ""}
+      <div class="tempest-admin-header__brand"><a href="${escapeHtml(indexUrl)}">${brand}</a></div>
+    </div>
+    ${headerNav}
+  </header>
+  <div class="tempest-admin-layout">
+    ${sidebar}
+    <main class="tempest-admin-main">
+      ${banners}
+      ${body}
+    </main>
+  </div>
+  <footer class="tempest-admin-footer"><small>${escapeHtml(theme.footerText)}</small></footer>
+</body>
+</html>`;
+}
+function renderLoginPage(context, error) {
+  const body = `<section class="tempest-admin-login">
+  <h1>Sign in</h1>
+  <p>${escapeHtml(context.site.indexSubtitle)}</p>
+  ${error !== null ? `<p class="tempest-admin-login__error" role="alert">${escapeHtml(error)}</p>` : ""}
+  <form method="post" action="${escapeHtml(`${context.prefix}/login`)}" class="tempest-admin-login__form">
+    <label><span>Email</span><input type="email" name="identifier" autocomplete="username" required autofocus></label>
+    <label><span>Password</span><input type="password" name="password" autocomplete="current-password" required></label>
+    <button type="submit">Sign in</button>
+  </form>
+</section>`;
+  return renderLayout(context, `Sign in \xB7 ${context.site.title}`, body);
+}
+function renderMfaPage(context, error) {
+  const body = `<section class="tempest-admin-login">
+  <h1>Two-factor code</h1>
+  <p>Enter the 6-digit code from your authenticator app.</p>
+  ${error !== null ? `<p class="tempest-admin-login__error" role="alert">${escapeHtml(error)}</p>` : ""}
+  <form method="post" action="${escapeHtml(`${context.prefix}/mfa`)}" class="tempest-admin-login__form">
+    <label><span>Code</span><input type="text" name="code" inputmode="numeric" autocomplete="one-time-code" required autofocus></label>
+    <button type="submit">Verify</button>
+  </form>
+</section>`;
+  return renderLayout(context, `Two-factor \xB7 ${context.site.title}`, body);
+}
+function renderDashboardPage(context, cards, metrics) {
+  const metricsPanel = metrics === null ? "" : `<div class="tempest-admin-stats" aria-label="System metrics">
+    <div class="tempest-admin-stat">
+      <span class="tempest-admin-stat__label">CPU</span>
+      <span class="tempest-admin-stat__value">${escapeHtml(metrics.cpuPercent)}%</span>
+    </div>
+    <div class="tempest-admin-stat">
+      <span class="tempest-admin-stat__label">Memory</span>
+      <span class="tempest-admin-stat__value">${escapeHtml(metrics.memoryPercent)}%</span>
+      <span class="tempest-admin-stat__sub">${escapeHtml(metrics.memoryUsedGb)} / ${escapeHtml(metrics.memoryTotalGb)} GB</span>
+    </div>
+  </div>`;
+  const models = cards.length > 0 ? `<div class="tempest-admin-models">${cards.map(
+    (card) => `<article class="tempest-admin-model-card">
+      <header class="tempest-admin-model-card__head">
+        <h2>${escapeHtml(card.label)}</h2>
+        ${card.count !== null ? `<span class="tempest-admin-model-card__count">${escapeHtml(card.count)}</span>` : ""}
+      </header>
+      <div class="tempest-admin-model-card__actions">
+        <a href="${escapeHtml(card.url)}">Browse</a>
+        ${card.newUrl !== null ? `<a href="${escapeHtml(card.newUrl)}">+ New</a>` : ""}
+      </div>
+    </article>`
+  ).join("")}</div>` : "<p>No models registered. Register an <code>AdminModel</code> on the <code>AdminSite</code> to populate this dashboard.</p>";
+  const body = `<section class="tempest-admin-dashboard">
+  <h1>${escapeHtml(context.site.title)}</h1>
+  <p>${escapeHtml(context.site.indexSubtitle)}</p>
+  ${metricsPanel}
+  ${models}
+</section>`;
+  return renderLayout(context, context.site.title, body);
+}
+function renderFilter(filter) {
+  const name = `filter_${filter.field}`;
+  if (filter.kind === "select") {
+    const options = filter.options.map(
+      (option) => `<option value="${escapeHtml(option.value)}"${option.selected ? " selected" : ""}>${escapeHtml(option.label)}</option>`
+    ).join("");
+    return `<label><span>${escapeHtml(filter.label)}</span><select name="${escapeHtml(name)}"><option value="">\u2014 any \u2014</option>${options}</select></label>`;
+  }
+  if (filter.kind === "daterange") {
+    return `<label><span>${escapeHtml(filter.label)}</span><span class="tempest-admin-list__daterange">
+      <input type="date" name="${escapeHtml(`${name}_from`)}" value="${escapeHtml(filter.valueFrom)}" aria-label="${escapeHtml(filter.label)} from">
+      <input type="date" name="${escapeHtml(`${name}_to`)}" value="${escapeHtml(filter.valueTo)}" aria-label="${escapeHtml(filter.label)} to">
+    </span></label>`;
+  }
+  return `<label><span>${escapeHtml(filter.label)}</span><input type="text" name="${escapeHtml(name)}" value="${escapeHtml(filter.value)}"></label>`;
+}
+function renderListPage(context, view) {
+  const bulk = view.bulkActions.length > 0 && context.session !== null;
+  const checkColumn = bulk ? 1 : 0;
+  const headers = view.columns.map((column6) => {
+    const state = view.sort[column6];
+    if (state === void 0) return `<th>${escapeHtml(column6)}</th>`;
+    const arrow = state.active ? state.ascending ? "\u25B2" : "\u25BC" : "\u2195";
+    return `<th><a class="tempest-sort${state.active ? " tempest-sort--active" : ""}" href="${escapeHtml(state.url)}"><span>${escapeHtml(column6)}</span><span class="tempest-sort__arrow" aria-hidden="true">${arrow}</span></a></th>`;
+  }).join("");
+  const rows = view.rows.length > 0 ? view.rows.map((row) => {
+    const check = bulk ? `<td class="tempest-admin-list__check"><input type="checkbox" name="ids" value="${escapeHtml(row.identity)}" data-row-check aria-label="Select row"></td>` : "";
+    const cells = row.cells.map((cell) => `<td>${escapeHtml(cell)}</td>`).join("");
+    return `<tr>${check}${cells}<td><a href="${escapeHtml(row.url)}">View</a></td></tr>`;
+  }).join("") : `<tr><td colspan="${view.columns.length + 1 + checkColumn}">No records.</td></tr>`;
+  const bulkBar = bulk ? `<form method="post" action="${escapeHtml(view.bulkUrl)}" class="tempest-admin-bulk" onsubmit="return confirm('Apply the selected action to the checked rows?');">
+    <input type="hidden" name="csrf_token" value="${escapeHtml(context.session?.csrfToken)}">
+    <div class="tempest-admin-bulk__bar">
+      <select name="action" aria-label="Bulk action">
+        ${view.bulkActions.map(
+    (action) => `<option value="${escapeHtml(action.value)}">${escapeHtml(action.label)}${action.dangerous ? " \u26A0" : ""}</option>`
+  ).join("")}
+      </select>
+      <button type="submit">Apply to selected</button>
+    </div>` : "";
+  const selectAllScript = bulk ? `<script>
+    (function () {
+      var master = document.querySelector('[data-select-all]');
+      if (!master) return;
+      master.addEventListener('change', function () {
+        document.querySelectorAll('[data-row-check]').forEach(function (box) {
+          box.checked = master.checked;
+        });
+      });
+    })();
+  </script>` : "";
+  const hasControls = view.searchable || view.filters.length > 0;
+  const body = `<section class="tempest-admin-list">
+  <header class="tempest-admin-list__header">
+    <h1>${escapeHtml(view.title)}</h1>
+    <p>${escapeHtml(view.total)} record${view.total === 1 ? "" : "s"}.</p>
+  </header>
+  <div class="tempest-admin-list__toolbar">
+    <form method="get" class="tempest-admin-list__filters">
+      ${view.searchable ? `<input type="search" name="q" value="${escapeHtml(view.searchValue)}" placeholder="Search\u2026" aria-label="Search">` : ""}
+      ${view.filters.map(renderFilter).join("")}
+      ${hasControls ? '<button type="submit">Apply</button>' : ""}
+    </form>
+    <div class="tempest-admin-list__actions">
+      ${view.newUrl !== null ? `<a class="tempest-admin-list__new" href="${escapeHtml(view.newUrl)}">+ New</a>` : ""}
+      <a href="${escapeHtml(view.exportCsvUrl)}">Export CSV</a>
+      <a href="${escapeHtml(view.exportJsonUrl)}">Export JSON</a>
+    </div>
+  </div>
+  ${bulkBar}
+  <div class="tempest-admin-table-wrap">
+    <table class="tempest-admin-list__table">
+      <thead><tr>${bulk ? '<th class="tempest-admin-list__check"><input type="checkbox" data-select-all aria-label="Select all"></th>' : ""}${headers}<th>Actions</th></tr></thead>
+      <tbody>${rows}</tbody>
+    </table>
+  </div>
+  ${bulk ? "</form>" : ""}
+  ${selectAllScript}
+  ${view.pages > 1 ? `<nav class="tempest-admin-list__pagination" aria-label="Pagination">
+    ${view.prevUrl !== null ? `<a href="${escapeHtml(view.prevUrl)}">\u2190 Prev</a>` : ""}
+    <span>Page ${escapeHtml(view.page)} of ${escapeHtml(view.pages)}</span>
+    ${view.nextUrl !== null ? `<a href="${escapeHtml(view.nextUrl)}">Next \u2192</a>` : ""}
+  </nav>` : ""}
+</section>`;
+  return renderLayout(context, `${view.title} \xB7 ${context.site.title}`, body);
+}
+function renderDetailPage(context, view) {
+  if (context.session === null) throw new Error("The detail view requires a session");
+  const csrf = escapeHtml(context.session.csrfToken);
+  const fields = view.fields.map(
+    (field) => `<dt>${escapeHtml(field.label)}</dt><dd>${field.value === "" ? "<em>\u2014</em>" : escapeHtml(field.value)}</dd>`
+  ).join("");
+  const body = `<section class="tempest-admin-detail">
+  <header class="tempest-admin-detail__header">
+    <h1>${escapeHtml(view.title)} \xB7 ${escapeHtml(view.identity)}</h1>
+    <div class="tempest-admin-detail__actions">
+      <a href="${escapeHtml(view.backUrl)}">\u2190 Back to list</a>
+      ${view.editUrl !== null ? `<a class="tempest-admin-btn" href="${escapeHtml(view.editUrl)}">Edit</a>` : ""}
+      ${view.deleteUrl !== null ? `<form method="post" action="${escapeHtml(view.deleteUrl)}" class="tempest-admin-detail__delete" onsubmit="return confirm('Delete this record? This cannot be undone.');">
+        <input type="hidden" name="csrf_token" value="${csrf}">
+        <button type="submit" class="tempest-admin-btn--danger">Delete</button>
+      </form>` : ""}
+    </div>
+  </header>
+  <dl class="tempest-admin-detail__fields">${fields}</dl>
+</section>`;
+  return renderLayout(context, `${view.title} \xB7 ${view.identity}`, body);
+}
+function renderFormField(field) {
+  const required = field.required ? " required" : "";
+  const name = escapeHtml(field.name);
+  const value = escapeHtml(field.value);
+  const label = escapeHtml(field.label);
+  let control;
+  switch (field.widget) {
+    case "checkbox":
+      control = `<label class="tempest-admin-form__check"><input type="checkbox" name="${name}" value="true"${field.checked ? " checked" : ""}><span>${label}</span></label>`;
+      break;
+    case "textarea":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><textarea name="${name}" rows="4"${required}>${value}</textarea></label>`;
+      break;
+    case "json":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><textarea name="${name}" rows="6" class="tempest-admin-form__json" spellcheck="false"${required}>${value}</textarea><small class="tempest-admin-form__hint">JSON \u2014 must parse (e.g. <code>{}</code>, <code>[]</code>, <code>"text"</code>).</small></label>`;
+      break;
+    case "select": {
+      const blank = field.required ? "" : '<option value="">\u2014 none \u2014</option>';
+      const options = field.options.map(
+        (option) => `<option value="${escapeHtml(option.value)}"${option.value === field.value ? " selected" : ""}>${escapeHtml(option.label)}</option>`
+      ).join("");
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><select name="${name}"${required}>${blank}${options}</select></label>`;
+      break;
+    }
+    case "number":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="number" name="${name}" value="${value}"${field.step !== null ? ` step="${escapeHtml(field.step)}"` : ""}${required}></label>`;
+      break;
+    case "datetime":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="datetime-local" name="${name}" value="${value}"${required}></label>`;
+      break;
+    case "date":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="date" name="${name}" value="${value}"${required}></label>`;
+      break;
+    case "time":
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="time" name="${name}" value="${value}"${required}></label>`;
+      break;
+    default:
+      control = `<label><span>${label}${field.required ? " *" : ""}</span><input type="text" name="${name}" value="${value}"${required}></label>`;
+  }
+  const error = field.error !== null ? `<small class="tempest-admin-form__field-error">${escapeHtml(field.error)}</small>` : "";
+  return `<div class="tempest-admin-form__field${field.error !== null ? " tempest-admin-form__field--error" : ""}">${control}${error}</div>`;
+}
+function renderFormPage(context, view) {
+  if (context.session === null) throw new Error("The admin form requires a session");
+  const heading = view.mode === "create" ? `New ${view.title}` : `Edit ${view.title}`;
+  const body = `<section class="tempest-admin-form">
+  <header class="tempest-admin-detail__header">
+    <h1>${escapeHtml(heading)}</h1>
+    <a href="${escapeHtml(view.backUrl)}">\u2190 Back</a>
+  </header>
+  ${view.error !== null ? `<p class="tempest-admin-form__error">${escapeHtml(view.error)}</p>` : ""}
+  <form method="post" action="${escapeHtml(view.actionUrl)}" class="tempest-admin-form__form">
+    <input type="hidden" name="csrf_token" value="${escapeHtml(context.session.csrfToken)}">
+    ${view.fields.map(renderFormField).join("")}
+    <div class="tempest-admin-form__actions">
+      <button type="submit">${view.mode === "create" ? "Create" : "Save"}</button>
+      <a href="${escapeHtml(view.backUrl)}" class="tempest-admin-form__cancel">Cancel</a>
+    </div>
+  </form>
+</section>`;
+  return renderLayout(context, `${heading} \xB7 ${context.site.title}`, body);
+}
+var logger2 = new JSONLogger("tempest_express_sdk.admin.router");
+var FK_OPTION_CAP = 1e3;
+var FLASH_MAX_LENGTH = 300;
+var FLASH_MESSAGES = {
+  created: { text: "Record created.", level: "success" },
+  updated: { text: "Record updated.", level: "success" },
+  deleted: { text: "Record deleted.", level: "success" }
+};
+async function runCustomAction(action, context) {
+  return await action.handler(context) ?? null;
+}
+function queryString(value) {
+  if (typeof value === "string") return value.trim();
+  if (Array.isArray(value) && typeof value[0] === "string") return value[0].trim();
+  return "";
+}
+function buildQuery(entries) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(entries)) {
+    if (value === void 0 || value === "") continue;
+    params.set(key, String(value));
+  }
+  return params.toString();
+}
+function makeAdminRouter(site, options) {
+  const prefix = (options.prefix ?? "/admin").replace(/\/$/, "");
+  const theme = resolveAdminTheme(site.theme);
+  const showMetrics = options.showMetrics ?? true;
+  const exportMaxRows = options.exportMaxRows ?? 5e3;
+  const sessions = new AdminSessionStore({
+    secret: options.secretKey,
+    ...options.cookieName === void 0 ? {} : { cookieName: options.cookieName },
+    ...options.sessionMaxAgeSeconds === void 0 ? {} : { maxAgeSeconds: options.sessionMaxAgeSeconds },
+    ...options.cookieSecure === void 0 ? {} : { cookieSecure: options.cookieSecure },
+    cookiePath: prefix === "" ? "/" : prefix
+  });
+  const backend = options.authBackend;
+  const router = express3.Router();
+  router.use(prefix, express3.urlencoded({ extended: false }));
+  const context = (req, session) => ({
+    site,
+    theme,
+    prefix,
+    session,
+    currentPath: req.originalUrl.split("?")[0] ?? req.path,
+    navModels: site.list().map((admin) => ({
+      label: admin.verboseNamePlural(),
+      url: `${prefix}/m/${admin.slug()}`
+    })),
+    messages: flashFor(req)
+  });
+  const flashFor = (req) => {
+    const fixed = FLASH_MESSAGES[queryString(req.query.ok)];
+    if (fixed !== void 0) return [fixed];
+    const text = queryString(req.query.flash);
+    if (text === "") return [];
+    const level = queryString(req.query.level);
+    return [
+      {
+        text: text.slice(0, FLASH_MAX_LENGTH),
+        level: level === "error" || level === "warning" ? level : "success"
+      }
+    ];
+  };
+  const html = (res, body, status = 200) => {
+    res.status(status).type("html").send(body);
+  };
+  const guarded = (handler) => (req, res) => {
+    handler(req, res).catch((error) => {
+      logger2.error("Admin request failed", {
+        path: req.originalUrl,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      if (res.headersSent) return;
+      html(
+        res,
+        renderLoginPage(context(req, null), "Something went wrong. Please try again."),
+        500
+      );
+    });
+  };
+  const authenticate = async (req, res) => {
+    const session = sessions.load(req);
+    if (session === null) {
+      res.redirect(`${prefix}/login`);
+      return null;
+    }
+    const dbSession = options.engine.session();
+    const principal = await backend.loadPrincipal(dbSession, session.subject);
+    if (principal === null) {
+      sessions.clear(res);
+      res.redirect(`${prefix}/login`);
+      return null;
+    }
+    if (!session.mfaPassed) {
+      res.redirect(`${prefix}/mfa`);
+      return null;
+    }
+    return { session, dbSession, principal };
+  };
+  const resolveAdmin = (req, res, state) => {
+    const admin = site.get(String(req.params.slug));
+    if (admin === null) {
+      html(res, renderNotFound(context(req, state.session)), 404);
+      return null;
+    }
+    return admin;
+  };
+  const renderNotFound = (ctx) => renderDashboardPage(
+    { ...ctx, messages: [{ text: "Not found.", level: "error" }] },
+    [],
+    null
+  );
+  const checkCsrf = (req, res, state) => {
+    const body = req.body;
+    if (csrfTokenMatches(state.session, body?.csrf_token)) return true;
+    html(res, renderNotFound(context(req, state.session)), 403);
+    return false;
+  };
+  router.get(`${prefix}/static/admin.css`, (_req, res) => {
+    res.type("css").set("cache-control", "public, max-age=3600").send(ADMIN_CSS);
+  });
+  router.get(`${prefix}/login`, (req, res) => {
+    html(res, renderLoginPage(context(req, null), null));
+  });
+  router.post(
+    `${prefix}/login`,
+    guarded(async (req, res) => {
+      const body = req.body;
+      const identifier = typeof body.identifier === "string" ? body.identifier : "";
+      const password = typeof body.password === "string" ? body.password : "";
+      const dbSession = options.engine.session();
+      const principal = await backend.authenticate(dbSession, identifier, password);
+      if (principal === null) {
+        html(res, renderLoginPage(context(req, null), "Invalid credentials."), 401);
+        return;
+      }
+      const needsMfa = await backend.mfaEnabled?.(principal) ?? false;
+      const session = sessions.issue(
+        backend.principalId(principal),
+        backend.displayName(principal),
+        !needsMfa
+      );
+      sessions.save(res, session);
+      res.redirect(needsMfa ? `${prefix}/mfa` : `${prefix}/`);
+    })
+  );
+  router.get(`${prefix}/mfa`, (req, res) => {
+    const session = sessions.load(req);
+    if (session === null) {
+      res.redirect(`${prefix}/login`);
+      return;
+    }
+    if (session.mfaPassed) {
+      res.redirect(`${prefix}/`);
+      return;
+    }
+    html(res, renderMfaPage(context(req, null), null));
+  });
+  router.post(
+    `${prefix}/mfa`,
+    guarded(async (req, res) => {
+      const session = sessions.load(req);
+      if (session === null) {
+        res.redirect(`${prefix}/login`);
+        return;
+      }
+      const body = req.body;
+      const code = typeof body.code === "string" ? body.code : "";
+      const dbSession = options.engine.session();
+      const principal = await backend.loadPrincipal(dbSession, session.subject);
+      const verified = principal !== null && (await backend.verifyMfa?.(principal, code) ?? false);
+      if (!verified) {
+        html(res, renderMfaPage(context(req, null), "Invalid code."), 401);
+        return;
+      }
+      sessions.save(res, { ...session, mfaPassed: true });
+      res.redirect(`${prefix}/`);
+    })
+  );
+  router.post(
+    `${prefix}/logout`,
+    guarded(async (req, res) => {
+      const session = sessions.load(req);
+      if (session !== null && !csrfTokenMatches(session, req.body?.csrf_token)) {
+        html(res, renderLoginPage(context(req, null), "Invalid request."), 403);
+        return;
+      }
+      sessions.clear(res);
+      res.redirect(`${prefix}/login`);
+    })
+  );
+  router.get(
+    `${prefix}/`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const cards = [];
+      for (const admin of site.list()) {
+        let count = null;
+        try {
+          count = await admin.repository(state.dbSession).count();
+        } catch (error) {
+          logger2.warning("Admin dashboard count failed", {
+            slug: admin.slug(),
+            error: error instanceof Error ? error.message : String(error)
+          });
+        }
+        cards.push({
+          label: admin.verboseNamePlural(),
+          count,
+          url: `${prefix}/m/${admin.slug()}`,
+          newUrl: admin.canCreate ? `${prefix}/m/${admin.slug()}/new` : null
+        });
+      }
+      let metrics = null;
+      if (showMetrics) {
+        const snapshot2 = MetricsUtils.system();
+        metrics = {
+          cpuPercent: Math.round(snapshot2.cpu.loadPercent),
+          memoryPercent: Math.round(snapshot2.memory.usedPercent),
+          memoryUsedGb: (snapshot2.memory.used / 1024 ** 3).toFixed(1),
+          memoryTotalGb: (snapshot2.memory.total / 1024 ** 3).toFixed(1)
+        };
+      }
+      html(res, renderDashboardPage(context(req, state.session), cards, metrics));
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      html(res, await renderList(req, admin, state));
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug/new`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      if (!admin.canCreate) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      html(
+        res,
+        renderFormPage(context(req, state.session), {
+          mode: "create",
+          title: admin.verboseName(),
+          fields: buildFormFields(admin, {
+            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession)
+          }),
+          actionUrl: `${prefix}/m/${admin.slug()}/new`,
+          backUrl: `${prefix}/m/${admin.slug()}`,
+          error: null
+        })
+      );
+    })
+  );
+  router.post(
+    `${prefix}/m/:slug/new`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      if (!admin.canCreate) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      if (!checkCsrf(req, res, state)) return;
+      const body = req.body;
+      const parsed = parseFormBody(admin, body);
+      const foreignKeyOptions = await foreignKeyOptionsFor(admin, state.dbSession);
+      const rerender = (error, status) => {
+        html(
+          res,
+          renderFormPage(context(req, state.session), {
+            mode: "create",
+            title: admin.verboseName(),
+            fields: buildFormFields(admin, {
+              values: body,
+              errors: parsed.errors,
+              foreignKeyOptions
+            }),
+            actionUrl: `${prefix}/m/${admin.slug()}/new`,
+            backUrl: `${prefix}/m/${admin.slug()}`,
+            error
+          }),
+          status
+        );
+      };
+      if (Object.keys(parsed.errors).length > 0) {
+        rerender("Please fix the highlighted fields.", 400);
+        return;
+      }
+      try {
+        await admin.repository(state.dbSession).create(parsed.data);
+      } catch (error) {
+        rerender(describeWriteFailure(admin, error), 400);
+        return;
+      }
+      res.redirect(`${prefix}/m/${admin.slug()}?ok=created`);
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug/export.:format`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      const format = String(req.params.format);
+      if (format !== "csv" && format !== "json") {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      const query = await resolveListQuery(req, admin, state.dbSession);
+      const result = await admin.repository(state.dbSession).paginate({
+        page: 1,
+        pageSize: exportMaxRows,
+        ...query.orderBy === void 0 ? {} : { orderBy: query.orderBy },
+        ascending: query.ascending,
+        ...query.where === void 0 ? {} : { filters: query.where }
+      });
+      const columns = admin.listDisplayNames();
+      const rows = result.items;
+      const payload = format === "csv" ? toCsv(columns, rows) : toJson(columns, rows);
+      res.status(200).type(format === "csv" ? "text/csv; charset=utf-8" : "application/json").set("content-disposition", `attachment; filename="${admin.slug()}.${format}"`).send(payload);
+    })
+  );
+  router.post(
+    `${prefix}/m/:slug/bulk`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      if (!checkCsrf(req, res, state)) return;
+      const body = req.body;
+      const action = typeof body.action === "string" ? body.action : "";
+      const raw = body.ids;
+      const ids = (Array.isArray(raw) ? raw : raw === void 0 ? [] : [raw]).filter((value) => typeof value === "string").filter((value) => value !== "");
+      const listUrl = `${prefix}/m/${admin.slug()}`;
+      const back = (message, level) => {
+        res.redirect(`${listUrl}?${buildQuery({ flash: message, level })}`);
+      };
+      if (ids.length === 0) {
+        back("No rows were selected.", "warning");
+        return;
+      }
+      if (!bulkActionsFor(admin).some((option) => option.value === action)) {
+        html(res, renderNotFound(context(req, state.session)), 400);
+        return;
+      }
+      const repository = admin.repository(state.dbSession);
+      const scope = { [admin.identityField]: { in: ids } };
+      if (action.startsWith("custom:")) {
+        const custom = admin.getAction(action.slice("custom:".length));
+        if (custom === null) {
+          html(res, renderNotFound(context(req, state.session)), 400);
+          return;
+        }
+        let result;
+        try {
+          result = await runCustomAction(custom, {
+            ids,
+            repository,
+            dbSession: state.dbSession,
+            request: req,
+            session: state.session,
+            principal: state.principal
+          });
+        } catch (error) {
+          logger2.error("Admin action failed", {
+            slug: admin.slug(),
+            action: custom.name,
+            error: error instanceof Error ? error.message : String(error)
+          });
+          back(
+            `${custom.label} failed: ${error instanceof Error ? error.message : String(error)}`,
+            "error"
+          );
+          return;
+        }
+        if (result === null) {
+          res.redirect(listUrl);
+          return;
+        }
+        back(result.message, result.category ?? "success");
+        return;
+      }
+      if (action === "delete") {
+        const removed = await repository.delete(scope);
+        back(`Deleted ${removed} record${removed === 1 ? "" : "s"}.`, "success");
+        return;
+      }
+      const active = action === "activate";
+      const changed = await repository.update(scope, { isActive: active });
+      back(
+        `${active ? "Activated" : "Deactivated"} ${changed} record${changed === 1 ? "" : "s"}.`,
+        "success"
+      );
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug/:identity`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      const row = await findRow(admin, state.dbSession, String(req.params.identity));
+      if (row === null) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      const identity = String(row[admin.identityField]);
+      html(
+        res,
+        renderDetailPage(context(req, state.session), {
+          title: admin.verboseName(),
+          identity,
+          fields: admin.detailFieldNames().map((name) => ({ label: name, value: formatCellValue(row[name]) })),
+          backUrl: `${prefix}/m/${admin.slug()}`,
+          editUrl: admin.canEdit ? `${prefix}/m/${admin.slug()}/${identity}/edit` : null,
+          deleteUrl: admin.canDelete ? `${prefix}/m/${admin.slug()}/${identity}/delete` : null
+        })
+      );
+    })
+  );
+  router.get(
+    `${prefix}/m/:slug/:identity/edit`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      const identity = String(req.params.identity);
+      const row = admin.canEdit ? await findRow(admin, state.dbSession, identity) : null;
+      if (row === null) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      html(
+        res,
+        renderFormPage(context(req, state.session), {
+          mode: "edit",
+          title: admin.verboseName(),
+          fields: buildFormFields(admin, {
+            values: row,
+            foreignKeyOptions: await foreignKeyOptionsFor(admin, state.dbSession)
+          }),
+          actionUrl: `${prefix}/m/${admin.slug()}/${identity}/edit`,
+          backUrl: `${prefix}/m/${admin.slug()}/${identity}`,
+          error: null
+        })
+      );
+    })
+  );
+  router.post(
+    `${prefix}/m/:slug/:identity/edit`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      const identity = String(req.params.identity);
+      if (!admin.canEdit) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      if (!checkCsrf(req, res, state)) return;
+      const body = req.body;
+      const parsed = parseFormBody(admin, body);
+      const foreignKeyOptions = await foreignKeyOptionsFor(admin, state.dbSession);
+      const rerender = (error, status) => {
+        html(
+          res,
+          renderFormPage(context(req, state.session), {
+            mode: "edit",
+            title: admin.verboseName(),
+            fields: buildFormFields(admin, {
+              values: body,
+              errors: parsed.errors,
+              foreignKeyOptions
+            }),
+            actionUrl: `${prefix}/m/${admin.slug()}/${identity}/edit`,
+            backUrl: `${prefix}/m/${admin.slug()}/${identity}`,
+            error
+          }),
+          status
+        );
+      };
+      if (Object.keys(parsed.errors).length > 0) {
+        rerender("Please fix the highlighted fields.", 400);
+        return;
+      }
+      try {
+        const changed = await admin.repository(state.dbSession).update({ [admin.identityField]: identity }, parsed.data);
+        if (changed === 0) {
+          html(res, renderNotFound(context(req, state.session)), 404);
+          return;
+        }
+      } catch (error) {
+        rerender(describeWriteFailure(admin, error), 400);
+        return;
+      }
+      res.redirect(`${prefix}/m/${admin.slug()}/${identity}?ok=updated`);
+    })
+  );
+  router.post(
+    `${prefix}/m/:slug/:identity/delete`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = resolveAdmin(req, res, state);
+      if (admin === null) return;
+      if (!admin.canDelete) {
+        html(res, renderNotFound(context(req, state.session)), 404);
+        return;
+      }
+      if (!checkCsrf(req, res, state)) return;
+      await admin.repository(state.dbSession).delete({ [admin.identityField]: String(req.params.identity) });
+      res.redirect(`${prefix}/m/${admin.slug()}?ok=deleted`);
+    })
+  );
+  async function findRow(admin, dbSession, identity) {
+    const row = await admin.repository(dbSession).first({ [admin.identityField]: identity });
+    return row ?? null;
+  }
+  async function renderList(req, admin, state) {
+    const columns = adminColumns(admin.model);
+    const query = await resolveListQuery(req, admin, state.dbSession);
+    const page2 = Math.max(1, Number.parseInt(queryString(req.query.page), 10) || 1);
+    const result = await admin.repository(state.dbSession).paginate({
+      page: page2,
+      pageSize: admin.pageSize,
+      ...query.orderBy === void 0 ? {} : { orderBy: query.orderBy },
+      ascending: query.ascending,
+      ...query.where === void 0 ? {} : { filters: query.where }
+    });
+    const displayed = admin.listDisplayNames();
+    const sort = {};
+    for (const column6 of displayed) {
+      if (!(column6 in columns)) continue;
+      const active = (query.sortColumn ?? admin.orderKey) === column6;
+      const nextAscending = active ? !query.ascending : true;
+      sort[column6] = {
+        url: `?${buildQuery({
+          ...query.baseQuery,
+          sort: column6,
+          dir: nextAscending ? "asc" : "desc"
+        })}`,
+        active,
+        ascending: query.ascending
+      };
+    }
+    const sortParams = {
+      sort: query.sortColumn ?? void 0,
+      dir: query.sortColumn === null ? void 0 : query.ascending ? "asc" : "desc"
+    };
+    const pageUrl = (target) => `?${buildQuery({ ...query.baseQuery, ...sortParams, page: target })}`;
+    const exportQuery = buildQuery({ ...query.baseQuery, ...sortParams });
+    const exportUrl = (format) => `${prefix}/m/${admin.slug()}/export.${format}${exportQuery === "" ? "" : `?${exportQuery}`}`;
+    const view = {
+      title: admin.verboseNamePlural(),
+      columns: displayed,
+      rows: result.items.map((row) => {
+        const identity = String(row[admin.identityField]);
+        return {
+          identity,
+          cells: displayed.map((column6) => formatCellValue(row[column6])),
+          url: `${prefix}/m/${admin.slug()}/${identity}`
+        };
+      }),
+      total: result.total,
+      page: result.page,
+      pages: result.pages,
+      prevUrl: result.page > 1 ? pageUrl(result.page - 1) : null,
+      nextUrl: result.page < result.pages ? pageUrl(result.page + 1) : null,
+      searchable: query.searchable.length > 0,
+      searchValue: query.search,
+      filters: query.filterViews,
+      sort,
+      newUrl: admin.canCreate ? `${prefix}/m/${admin.slug()}/new` : null,
+      bulkActions: bulkActionsFor(admin),
+      bulkUrl: `${prefix}/m/${admin.slug()}/bulk`,
+      exportCsvUrl: exportUrl("csv"),
+      exportJsonUrl: exportUrl("json")
+    };
+    return renderListPage(context(req, state.session), view);
+  }
+  async function resolveListQuery(req, admin, dbSession) {
+    const columns = adminColumns(admin.model);
+    const search = queryString(req.query.q);
+    const sortField = queryString(req.query.sort);
+    const sortColumn = sortField in columns ? sortField : null;
+    const ascending = sortColumn === null ? admin.orderAscending : queryString(req.query.dir) !== "desc";
+    const conditions = [];
+    const filterViews = [];
+    for (const field of admin.listFilter) {
+      const column6 = columns[field];
+      if (column6 === void 0) continue;
+      const spec = filterForColumn(column6);
+      if (spec.kind === "daterange") {
+        const from = queryString(req.query[`filter_${field}_from`]);
+        const to = queryString(req.query[`filter_${field}_to`]);
+        const bounds = {};
+        if (from !== "") bounds.gte = new Date(from);
+        if (to !== "") bounds.lte = /* @__PURE__ */ new Date(`${to}T23:59:59.999Z`);
+        if (Object.keys(bounds).length > 0) conditions.push({ [field]: bounds });
+        filterViews.push({
+          field,
+          label: humanizeField(field),
+          kind: "daterange",
+          value: "",
+          valueFrom: from,
+          valueTo: to,
+          options: []
+        });
+        continue;
+      }
+      const related = await relatedOptions(column6, dbSession);
+      const options2 = related ?? spec.options;
+      const value = queryString(req.query[`filter_${field}`]);
+      if (value !== "") {
+        conditions.push({
+          [field]: column6.type.kind === "boolean" ? value === "true" : value
+        });
+      }
+      filterViews.push({
+        field,
+        label: humanizeField(field),
+        kind: related === null ? spec.kind : "select",
+        value,
+        valueFrom: "",
+        valueTo: "",
+        options: options2.map((option) => ({
+          value: option.value,
+          label: option.label,
+          selected: option.value === value
+        }))
+      });
+    }
+    const searchable = admin.searchFields.filter((field) => {
+      const column6 = columns[field];
+      return column6 !== void 0 && isSearchableColumn(column6);
+    });
+    if (search !== "" && searchable.length > 0) {
+      conditions.push(
+        or(...searchable.map((field) => ({ [field]: { ilike: `%${search}%` } })))
+      );
+    }
+    const baseQuery = { q: search };
+    for (const view of filterViews) {
+      if (view.kind === "daterange") {
+        baseQuery[`filter_${view.field}_from`] = view.valueFrom;
+        baseQuery[`filter_${view.field}_to`] = view.valueTo;
+      } else {
+        baseQuery[`filter_${view.field}`] = view.value;
+      }
+    }
+    return {
+      search,
+      searchable,
+      where: conditions.length === 0 ? void 0 : and(...conditions),
+      orderBy: sortColumn ?? admin.orderKey ?? void 0,
+      ascending,
+      sortColumn,
+      filterViews,
+      baseQuery
+    };
+  }
+  async function relatedOptions(column6, dbSession) {
+    const table = foreignKeyTable(column6);
+    if (table === null) return null;
+    const referenced = site.get(table);
+    if (referenced === null) return null;
+    const rows = await referenced.repository(dbSession).list();
+    return rows.slice(0, FK_OPTION_CAP).map((row) => ({
+      value: String(row[referenced.identityField]),
+      label: foreignKeyLabel(referenced, row)
+    }));
+  }
+  async function foreignKeyOptionsFor(admin, dbSession) {
+    const columns = adminColumns(admin.model);
+    const options2 = {};
+    for (const field of Object.keys(foreignKeyFields(admin))) {
+      const column6 = columns[field];
+      if (column6 === void 0) continue;
+      const related = await relatedOptions(column6, dbSession);
+      if (related !== null) options2[field] = related;
+    }
+    return options2;
+  }
+  return router;
+}
+function bulkActionsFor(admin) {
+  const actions = [];
+  const hasActiveFlag = "isActive" in adminColumns(admin.model);
+  if (admin.canEdit && hasActiveFlag) {
+    actions.push({ value: "activate", label: "Activate", dangerous: false });
+    actions.push({ value: "deactivate", label: "Deactivate", dangerous: false });
+  }
+  if (admin.canDelete) {
+    actions.push({ value: "delete", label: "Delete", dangerous: true });
+  }
+  for (const action of admin.customActions()) {
+    actions.push({
+      value: `custom:${action.name}`,
+      label: action.label,
+      dangerous: action.dangerous
+    });
+  }
+  return actions;
+}
+function exportValue(value) {
+  if (value instanceof Date) return value.toISOString();
+  if (typeof value === "bigint") return value.toString();
+  if (value instanceof Uint8Array) return Buffer.from(value).toString("base64");
+  return value;
+}
+function csvField(value) {
+  if (value === null || value === void 0) return "";
+  const text = typeof value === "object" ? JSON.stringify(value) : String(value);
+  if (/[",\r\n]/.test(text)) return `"${text.replace(/"/g, '""')}"`;
+  return text;
+}
+function toCsv(columns, rows) {
+  const lines = [columns.map(csvField).join(",")];
+  for (const row of rows) {
+    lines.push(columns.map((column6) => csvField(exportValue(row[column6]))).join(","));
+  }
+  return `${lines.join("\r\n")}\r
+`;
+}
+function toJson(columns, rows) {
+  return JSON.stringify(
+    rows.map(
+      (row) => Object.fromEntries(columns.map((column6) => [column6, exportValue(row[column6])]))
+    ),
+    null,
+    2
+  );
+}
+function describeWriteFailure(admin, error) {
+  const detail = error instanceof Error ? error.message : String(error);
+  return `The database refused this ${admin.verboseName().toLowerCase()}: ${detail}`;
+}
+
+// src/admin/json/site.ts
+var AdminJsonSite = class {
   /**
    * @param brand - Display name surfaced under `GET {prefix}/`.
    */
@@ -9359,7 +12859,7 @@ function requireResource(site, name) {
   if (!resource) throw new NotFoundException({ message: `Unknown resource: ${name}` });
   return resource;
 }
-function makeAdminRouter(site, options = {}) {
+function makeAdminJsonRouter(site, options = {}) {
   const prefix = (options.prefix ?? "/admin").replace(/\/$/, "");
   const router = Router();
   if (options.guard) router.use(prefix, options.guard);
@@ -9998,7 +13498,7 @@ function renderPasswordResetFormPage(options) {
      </form>`
   );
 }
-var logger2 = new JSONLogger("tempest_express_sdk.api.handlers");
+var logger3 = new JSONLogger("tempest_express_sdk.api.handlers");
 var REQUEST_ID_HEADER = "X-Request-ID";
 var VALID_REQUEST_ID = /^[A-Za-z0-9._\-:+/=]{1,128}$/;
 function requestIdMiddleware() {
@@ -10040,7 +13540,7 @@ function makeAppExceptionHandler(options = {}) {
       return;
     }
     const isServerError = exc.statusCode >= 500;
-    logger2.log(isServerError ? serverErrorLevel : "info", "AppException handled", {
+    logger3.log(isServerError ? serverErrorLevel : "info", "AppException handled", {
       path: req.path,
       method: req.method,
       statusCode: exc.statusCode,
@@ -10064,7 +13564,7 @@ function makeUnhandledExceptionHandler(options = {}) {
   const { includeStack = false, logLevel = "error" } = options;
   return (err, req, res, _next) => {
     const error = err instanceof Error ? err : new Error(String(err));
-    logger2.log(logLevel, "Unhandled exception", {
+    logger3.log(logLevel, "Unhandled exception", {
       path: req.path,
       method: req.method,
       [HTTP_500_MARKER]: true,
@@ -10118,7 +13618,7 @@ function generateOpenApiDocument(registry, options) {
 var DEFAULT_DOCS_FAVICON = "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAzMiAzMiI+PHJlY3Qgd2lkdGg9IjMyIiBoZWlnaHQ9IjMyIiByeD0iNyIgZmlsbD0iIzRjNmVmNSIvPjxwYXRoIGQ9Ik0xNy45IDQuNSA4LjYgMTguNGg1LjJMMTMgMjcuNWw5LjQtMTMuOWgtNS4zeiIgZmlsbD0iI2ZmZiIvPjwvc3ZnPg==";
 var REDOC_CDN_URL = "https://cdn.jsdelivr.net/npm/redoc@2/bundles/redoc.standalone.js";
 var REDOC_BUNDLE_SPECIFIER = "redoc/bundles/redoc.standalone.js";
-function escapeHtml(value) {
+function escapeHtml2(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 function scriptLiteral(value) {
@@ -10127,7 +13627,7 @@ function scriptLiteral(value) {
 function faviconTag(favicon) {
   if (favicon === false) return "";
   return `
-    <link rel="icon" href="${escapeHtml(favicon)}" />`;
+    <link rel="icon" href="${escapeHtml2(favicon)}" />`;
 }
 function mountOpenApiJson(app, path, document) {
   app.get(path, (_req, res) => {
@@ -10171,19 +13671,19 @@ function swaggerHtml(options) {
   };
   const standalone = merged.layout === "StandaloneLayout";
   const presetScript = standalone ? `
-    <script src="${escapeHtml(assetsBase)}/swagger-ui-standalone-preset.js"></script>` : "";
+    <script src="${escapeHtml2(assetsBase)}/swagger-ui-standalone-preset.js"></script>` : "";
   const presets = standalone ? "[SwaggerUIBundle.presets.apis, SwaggerUIStandalonePreset]" : "[SwaggerUIBundle.presets.apis]";
   return `<!doctype html>
 <html lang="en">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>${escapeHtml(title)}</title>${faviconTag(favicon)}
-    <link rel="stylesheet" href="${escapeHtml(assetsBase)}/swagger-ui.css" />
+    <title>${escapeHtml2(title)}</title>${faviconTag(favicon)}
+    <link rel="stylesheet" href="${escapeHtml2(assetsBase)}/swagger-ui.css" />
   </head>
   <body>
     <div id="swagger-ui"></div>
-    <script src="${escapeHtml(assetsBase)}/swagger-ui-bundle.js"></script>${presetScript}
+    <script src="${escapeHtml2(assetsBase)}/swagger-ui-bundle.js"></script>${presetScript}
     <script>
       var options = ${scriptLiteral(merged)};
       options.presets = ${presets};
@@ -10198,7 +13698,7 @@ function mountSwaggerUi(app, path, specUrl, options = {}) {
   const ui = options.ui ?? {};
   assertSerializableUiOptions(ui);
   const assetsPath = `${path.replace(/\/$/, "")}/assets`;
-  app.use(assetsPath, express2.static(getAbsoluteFSPath()));
+  app.use(assetsPath, express3.static(getAbsoluteFSPath()));
   const handler = (_req, res) => {
     res.type("html").send(swaggerHtml({ specUrl, title, assetsBase: assetsPath, favicon, ui }));
   };
@@ -10218,7 +13718,7 @@ function redocHtml(specUrl, title, scriptUrl, favicon) {
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>${escapeHtml(title)}</title>${faviconTag(favicon)}
+    <title>${escapeHtml2(title)}</title>${faviconTag(favicon)}
     <style>
       body { margin: 0; padding: 0; }
       #redoc-load-error {
@@ -10250,7 +13750,7 @@ function redocHtml(specUrl, title, scriptUrl, favicon) {
         <code>scriptUrl</code> at a copy you host.
       </p>
     </div>
-    <redoc spec-url="${escapeHtml(specUrl)}"></redoc>
+    <redoc spec-url="${escapeHtml2(specUrl)}"></redoc>
     <script>
       window.__redocLoadFailed = function () {
         document.getElementById("redoc-script-url").textContent = ${scriptLiteral(scriptUrl)};
@@ -10260,7 +13760,7 @@ function redocHtml(specUrl, title, scriptUrl, favicon) {
         if (element) element.style.display = "none";
       };
     </script>
-    <script src="${escapeHtml(scriptUrl)}" onerror="window.__redocLoadFailed()"></script>
+    <script src="${escapeHtml2(scriptUrl)}" onerror="window.__redocLoadFailed()"></script>
   </body>
 </html>`;
 }
@@ -10323,7 +13823,7 @@ function makeMetricsRouter(options = {}) {
   });
   return router;
 }
-var logger3 = new JSONLogger("tempest_express_sdk.api.server");
+var logger4 = new JSONLogger("tempest_express_sdk.api.server");
 function corsMiddleware(origins) {
   const allowAll = origins === "*";
   const allowList = new Set(Array.isArray(origins) ? origins : [origins]);
@@ -10348,9 +13848,9 @@ function corsMiddleware(origins) {
   };
 }
 async function createApp(options = {}) {
-  const app = express2();
-  app.use(express2.json({ limit: options.jsonLimit ?? "100kb" }));
-  app.use(express2.urlencoded({ extended: true }));
+  const app = express3();
+  app.use(express3.json({ limit: options.jsonLimit ?? "100kb" }));
+  app.use(express3.urlencoded({ extended: true }));
   app.use(requestIdMiddleware());
   if (options.corsOrigins) {
     app.use(corsMiddleware(options.corsOrigins));
@@ -10382,7 +13882,7 @@ function runServer(app, options = {}) {
   const port = options.port ?? 8e3;
   return new Promise((resolve) => {
     const server = app.listen(port, host, () => {
-      logger3.info("Server listening", { host, port });
+      logger4.info("Server listening", { host, port });
       resolve(server);
     });
   });
@@ -10924,7 +14424,7 @@ function rateLimitMiddleware(options = {}) {
 
 // src/api/middlewares/tracing.ts
 function requestTracingMiddleware(options = {}) {
-  const logger4 = new JSONLogger(options.loggerName ?? "tempest_express_sdk.api.tracing");
+  const logger5 = new JSONLogger(options.loggerName ?? "tempest_express_sdk.api.tracing");
   const level = options.level ?? "info";
   const exempt = new Set(options.exemptPaths ?? []);
   return (req, res, next) => {
@@ -10935,7 +14435,7 @@ function requestTracingMiddleware(options = {}) {
     const start = process.hrtime.bigint();
     res.on("finish", () => {
       const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
-      logger4.log(level, "request", {
+      logger5.log(level, "request", {
         method: req.method,
         path: req.path,
         statusCode: res.statusCode,
@@ -11315,6 +14815,6 @@ async function withTestDatabase(models, fn) {
   }
 }
 
-export { ActivationService, AdminSite, AppException, AttemptThrottle, AuditAction, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_DOCS_FAVICON, DEFAULT_LOCALE, EmailProvider, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, HTTPClient, HTTP_500_LOG_FILE, HTTP_500_MARKER, HttpMetrics, IDEMPOTENCY_HEADER, InvalidTokenException, JSONLogger, JWTUtils, LEVEL_LOG_FILES, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MessagingHub, MetricsUtils, MfaService, NotFoundException, OAuthError, OIDCProvider, OutboxRelay, OutboxStatus, PHONE_BR_PATTERN, PasswordResetService, REDOC_CDN_URL, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisIdempotencyStore, RedisRateLimitStore, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, S3UploadStorage, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TenantScopedRepository, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, UserTokenPurpose, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WebhookSignatureVerifier, WhatsAppProvider, activationSchema, addLogSink, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildPaginationLinkHeader, cached2 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, cursorPaginationFilterSchema, cursorPaginationSchema, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, envList, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, idempotencyMiddleware, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, listStates, logEntrySchema, logSettingsShape, loginSchema, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderPasswordResetFormPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveDownloadPath, resolveRedocBundle, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };
+export { ADMIN_CSS, ActivationService, AdminJsonSite, AdminModel, AdminSessionStore, AdminSite, AppException, AttemptThrottle, AuditAction, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_DOCS_FAVICON, DEFAULT_LOCALE, EmailProvider, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, HTTPClient, HTTP_500_LOG_FILE, HTTP_500_MARKER, HttpMetrics, IDEMPOTENCY_HEADER, InvalidTokenException, JSONLogger, JWTUtils, LEVEL_LOG_FILES, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MessagingHub, MetricsUtils, MfaService, NotFoundException, OAuthError, OIDCProvider, OutboxRelay, OutboxStatus, PHONE_BR_PATTERN, PasswordResetService, REDOC_CDN_URL, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisIdempotencyStore, RedisRateLimitStore, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, S3UploadStorage, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TenantScopedRepository, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, UserModelAuthBackend, UserTokenPurpose, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WebhookSignatureVerifier, WhatsAppProvider, activationSchema, addLogSink, adminAction, adminColumns, adminThemeCss, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildFormFields, buildPaginationLinkHeader, cached2 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, csrfTokenMatches, cursorPaginationFilterSchema, cursorPaginationSchema, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, envList, escapeHtml, filterForColumn, foreignKeyFields, foreignKeyLabel, foreignKeyTable, formatCellValue, formatFieldValue, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, humanizeField, idempotencyMiddleware, inboundMessageSchema, isColumnOptional, isSearchableColumn, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, listStates, logEntrySchema, logSettingsShape, loginSchema, makeAdminJsonRouter, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, parseFormBody, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderDashboardPage, renderDetailPage, renderFormPage, renderLayout, renderListPage, renderLoginPage, renderMfaPage, renderPasswordResetFormPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveAdminTheme, resolveDownloadPath, resolveRedocBundle, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, widgetForColumn, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map