commit dd700d02ad8fe57ec3036e4ac561bd658997520e
Author: Matthew L McPeak <m.mcpeak98@icloud.com>
Date:   Thu Jul 16 12:36:14 2026 -0400

    Inital Commit

diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..63dc40d
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,13 @@
+DATABASE_URL=postgres://mercury:mercury@db:5432/mercury
+JWT_SECRET=change_me_in_production
+JWT_EXPIRY_SECS=3600
+CACHE_MAX_CAPACITY=10000
+CACHE_IDLE_TIMEOUT_SECS=300
+CACHE_SWEEP_INTERVAL_SECS=60
+# Comma-separated allowed CORS origins, or * for permissive. Empty = no CORS headers.
+CORS_ORIGINS=
+
+# CDN (MinIO object storage) — credentials and bucket are pre-configured internally.
+# When registering CDN objects in the admin UI, use this URL prefix:
+#   docker-compose:  http://cdn:9000/mercury/<filename>
+#   standalone:      http://localhost:9000/mercury/<filename>
diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
new file mode 100644
index 0000000..59e96c3
--- /dev/null
+++ b/.forgejo/workflows/ci.yml
@@ -0,0 +1,96 @@
+name: ci
+
+on:
+    push:
+        tags:
+            - "v*"
+    pull_request:
+
+jobs:
+    test:
+        runs-on: self-hosted
+        container: git.mcpeakdev.com/mcpeakdev/rust-ci:latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+
+            - name: Cache cargo registry
+              uses: actions/cache@v4
+              with:
+                  path: |
+                      ~/.cargo/registry
+                      ~/.cargo/git
+                      target
+                  key: ${{ runner.os }}-cargo-${{ hashFiles('Cargo.lock') }}
+                  restore-keys: |
+                      ${{ runner.os }}-cargo-
+
+            - name: Check formatting
+              run: cargo fmt --check
+
+            - name: Clippy
+              run: cargo clippy -- -D warnings
+
+            - name: Run tests
+              run: cargo test
+
+    build-ui:
+        runs-on: self-hosted
+        container: git.mcpeakdev.com/mcpeakdev/bun-ci:latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+
+            - name: Install dependencies
+              run: |
+                  printf '@nychthemeron:registry=https://git.mcpeakdev.com/api/packages/McPeakDev/npm/\n//git.mcpeakdev.com/api/packages/McPeakDev/npm/:_authToken=%s\n' "$BUN_AUTH_TOKEN" > .npmrc
+                  bun install --frozen-lockfile
+                  rm .npmrc
+              working-directory: ui
+              env:
+                  BUN_AUTH_TOKEN: ${{ secrets.BUN_AUTH_TOKEN }}
+
+            - name: Audit dependencies
+              run: bun audit || true
+              working-directory: ui
+
+            - name: Type check
+              run: bun run build
+              working-directory: ui
+
+    publish:
+        needs: [test, build-ui]
+        if: startsWith(github.ref, 'refs/tags/v')
+        runs-on: self-hosted
+        container: git.mcpeakdev.com/mcpeakdev/docker-pub:latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@v3
+
+            - name: Log in to registry
+              uses: docker/login-action@v3
+              with:
+                  registry: git.mcpeakdev.com
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.BUN_AUTH_TOKEN }}
+
+            - name: Extract image tag
+              id: meta
+              run: echo "tag=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+            - name: Build and push
+              uses: docker/build-push-action@v6
+              with:
+                  context: .
+                  file: Dockerfile
+                  push: true
+                  tags: |
+                      git.mcpeakdev.com/mcpeakdev/mercury:${{ steps.meta.outputs.tag }}
+                      git.mcpeakdev.com/mcpeakdev/mercury:latest
+                  cache-from: type=registry,ref=git.mcpeakdev.com/mcpeakdev/mercury:latest
+                  cache-to: type=inline
+                  secrets: |
+                      bun_auth_token=${{ secrets.BUN_AUTH_TOKEN }}
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..82b43ff
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,25 @@
+# ---> Rust
+# Generated by Cargo
+# will have compiled files and executables
+debug/
+target/
+
+
+# These are backup files generated by rustfmt
+**/*.rs.bk
+
+# MSVC Windows builds of rustc generate these, which store debugging information
+*.pdb
+
+# RustRover
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+#.idea/
+
+# Git worktrees
+.worktrees/
+
+# Subagent-driven-development scratch state
+.superpowers/
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 0000000..131827e
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,3306 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "getrandom 0.3.4",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "axum"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
+dependencies = [
+ "async-trait",
+ "axum-core",
+ "axum-macros",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "multer",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustversion",
+ "serde",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tower 0.5.3",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "rustversion",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-macros"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57d123550fa8d071b7255cb0cc04dc302baa6c8c4a79f55701552684d8399bce"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bcrypt"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e65938ed058ef47d92cf8b346cc76ef48984572ade631927e9937b5ffc7662c7"
+dependencies = [
+ "base64 0.22.1",
+ "blowfish",
+ "getrandom 0.2.17",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "blowfish"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7"
+dependencies = [
+ "byteorder",
+ "cipher",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "cc"
+version = "1.2.64"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dad887fd958be91b5098c0248def011f4523ab786cd411be668777e55063501f"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f58bbc28f91df819d0aa2a2c00cd19754769c2fad90579b3592b1c9ba7a3115"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "dashmap"
+version = "5.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"
+dependencies = [
+ "cfg-if",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
+[[package]]
+name = "either"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "etcetera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "event-listener"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
+
+[[package]]
+name = "fastrand"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "flume"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "spin",
+]
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+ "allocator-api2",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "hashlink"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8094feaf31ff591f651a2664fb9cfd92bba7a60ce3197265e9482ebe753c8f7"
+dependencies = [
+ "hashbrown 0.14.5",
+]
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "http"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-range-header"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls 0.23.40",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots 1.0.8",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "js-sys"
+version = "0.3.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03d04c30968dffe80775bd4d7fb676131cd04a1fb46d2686dbffbaec2d9dfd31"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "jsonwebtoken"
+version = "9.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a87cc7a48537badeae96744432de36f4be2b4a34a05a5ef32e9dd8a1c169dde"
+dependencies = [
+ "base64 0.22.1",
+ "js-sys",
+ "pem",
+ "ring",
+ "serde",
+ "serde_json",
+ "simple_asn1",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin",
+]
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libredox"
+version = "0.1.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
+dependencies = [
+ "bitflags",
+ "libc",
+ "plain",
+ "redox_syscall 0.8.1",
+]
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf4e226dcd58b4be396f7bd3c20da8fdee2911400705297ba7d2d7cc2c30f716"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matchit"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
+
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
+
+[[package]]
+name = "mercury"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "axum",
+ "bcrypt",
+ "chrono",
+ "dashmap",
+ "dotenvy",
+ "glob",
+ "http-body-util",
+ "jsonwebtoken",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2",
+ "sqlx",
+ "tokio",
+ "tower 0.4.13",
+ "tower-http 0.5.2",
+ "tracing",
+ "tracing-subscriber",
+ "uuid",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "mio"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "multer"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83e87776546dc87511aa5ee218730c92b666d7264ab6ed41f9d215af9cd5224b"
+dependencies = [
+ "bytes",
+ "encoding_rs",
+ "futures-util",
+ "http",
+ "httparse",
+ "memchr",
+ "mime",
+ "spin",
+ "version_check",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.6",
+ "smallvec",
+ "zeroize",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.5.18",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64 0.22.1",
+ "serde_core",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls 0.23.40",
+ "socket2",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.4",
+ "ring",
+ "rustc-hash",
+ "rustls 0.23.40",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b44b894f2a6e36457d665d1e08c3866add6ed5e70050c1b4ba8a8ddedb02ce7"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls 0.23.40",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tower 0.5.3",
+ "tower-http 0.6.11",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams",
+ "web-sys",
+ "webpki-roots 1.0.8",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rsa"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
+dependencies = [
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.21.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
+dependencies = [
+ "ring",
+ "rustls-webpki 0.101.7",
+ "sct",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki 0.103.13",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+dependencies = [
+ "base64 0.21.7",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.101.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "sct"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "simple_asn1"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d585997b0ac10be3c5ee635f1bab02d512760d14b7c468801ac8a01d9ae5f1d"
+dependencies = [
+ "num-bigint",
+ "num-traits",
+ "thiserror 2.0.18",
+ "time",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "socket2"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "sqlformat"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bba3a93db0cc4f7bdece8bb09e77e2e785c20bfebf79eb8340ed80708048790"
+dependencies = [
+ "nom",
+ "unicode_categories",
+]
+
+[[package]]
+name = "sqlx"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9a2ccff1a000a5a59cd33da541d9f2fdcd9e6e8229cc200565942bff36d0aaa"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24ba59a9342a3d9bab6c56c118be528b27c9b60e490080e9711a04dccac83ef6"
+dependencies = [
+ "ahash",
+ "atoi",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "crc",
+ "crossbeam-queue",
+ "either",
+ "event-listener",
+ "futures-channel",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashlink",
+ "hex",
+ "indexmap",
+ "log",
+ "memchr",
+ "once_cell",
+ "paste",
+ "percent-encoding",
+ "rustls 0.21.12",
+ "rustls-pemfile",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "sqlformat",
+ "thiserror 1.0.69",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+ "uuid",
+ "webpki-roots 0.25.4",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea40e2345eb2faa9e1e5e326db8c34711317d2b5e08d0d5741619048a803127"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "sqlx-macros-core"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5833ef53aaa16d860e92123292f1f6a3d53c34ba8b1969f152ef1a7bb803f3c8"
+dependencies = [
+ "dotenvy",
+ "either",
+ "heck 0.4.1",
+ "hex",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2",
+ "sqlx-core",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+ "syn 1.0.109",
+ "tempfile",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "sqlx-mysql"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ed31390216d20e538e447a7a9b959e06ed9fc51c37b514b46eb758016ecd418"
+dependencies = [
+ "atoi",
+ "base64 0.21.7",
+ "bitflags",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "crc",
+ "digest",
+ "dotenvy",
+ "either",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "generic-array",
+ "hex",
+ "hkdf",
+ "hmac",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rand 0.8.6",
+ "rsa",
+ "serde",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 1.0.69",
+ "tracing",
+ "uuid",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c824eb80b894f926f89a0b9da0c7f435d27cdd35b8c655b114e58223918577e"
+dependencies = [
+ "atoi",
+ "base64 0.21.7",
+ "bitflags",
+ "byteorder",
+ "chrono",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac",
+ "home",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "rand 0.8.6",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 1.0.69",
+ "tracing",
+ "uuid",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-sqlite"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b244ef0a8414da0bed4bb1910426e890b19e5e9bccc27ada6b797d05c55ae0aa"
+dependencies = [
+ "atoi",
+ "chrono",
+ "flume",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "sqlx-core",
+ "tracing",
+ "url",
+ "urlencoding",
+ "uuid",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.118"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.2",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "time"
+version = "0.3.49"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "711a53c2d47bbd818258c498c8dbfe186a2526c631495cfe7e078567f86b8469"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71c652a3727a9cbb9a02f707f530b618ce00d0ccd762009c8c23bd191df3c17d"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls 0.23.40",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tower"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project",
+ "pin-project-lite",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "http-range-header",
+ "httpdate",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower 0.5.3",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "unicode_categories"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "uuid"
+version = "1.23.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "144d6b123cef80b301b8f72a9e2ca4370ddec21950d0a103dd22c437006d2db7"
+dependencies = [
+ "getrandom 0.4.2",
+ "js-sys",
+ "serde_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen 0.57.1",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen 0.51.0",
+]
+
+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.125"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ddb3f79143bced6de84270411622a2699cee572fc0875aeaf1e7867cf9fca1a"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.75"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "503b14d284f2c8dac03b819967e155ea753f573586193b2b2c95990cb5d69280"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.125"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e21a184b13fb19e157296e2c46056aec9092264fab83e4ba59e68c61b323c3d"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.125"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fecefd9c35bd935a20fc3fc344b5f29138961e4f47fb03297d88f2587afb5ebd"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.125"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23939e44bb9a5d7576fa2b563dc2e136628f1224e88a8deed09e04858b77871f"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6430a72df5eb332242960fe84b3002a241163998241eb596d4f739b9757061d"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.25.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "whoami"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
+dependencies = [
+ "libredox",
+ "wasite",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck 0.5.0",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck 0.5.0",
+ "indexmap",
+ "prettyplease",
+ "syn 2.0.118",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 0000000..d6bed48
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,33 @@
+[package]
+name = "mercury"
+version = "0.1.0"
+edition = "2021"
+
+[[bin]]
+name = "mercury"
+path = "src/main.rs"
+
+[dependencies]
+axum = { version = "0.7", features = ["macros", "multipart"] }
+tokio = { version = "1", features = ["full"] }
+sqlx = { version = "0.7", features = ["runtime-tokio-rustls", "postgres", "uuid", "chrono", "migrate"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+jsonwebtoken = "9"
+bcrypt = "0.15"
+dashmap = "5"
+glob = "0.3"
+tower-http = { version = "0.5", features = ["fs", "cors"] }
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "stream"] }
+tower = { version = "0.4", features = ["util"] }
+uuid = { version = "1", features = ["v4", "serde"] }
+chrono = { version = "0.4", features = ["serde"] }
+dotenvy = "0.15"
+anyhow = "1"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+sha2 = "0.10"
+
+[dev-dependencies]
+tower = { version = "0.4", features = ["util"] }
+http-body-util = "0.1"
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..a84c57e
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,48 @@
+# Stage 1: Build Vue UI
+FROM oven/bun:1-alpine AS ui-builder
+WORKDIR /ui
+COPY ui/ .
+RUN --mount=type=secret,id=bun_auth_token \
+    printf '//git.mcpeakdev.com/api/packages/McPeakDev/npm/:_authToken=%s\n@nychthemeron:registry=https://git.mcpeakdev.com/api/packages/McPeakDev/npm/\n' \
+    "$(cat /run/secrets/bun_auth_token)" > .npmrc && \
+    bun install --frozen-lockfile
+RUN bun run build
+
+# Stage 2: Build Rust API
+FROM rust:1.96-slim AS api-builder
+RUN apt-get update && apt-get install -y pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY Cargo.toml Cargo.lock ./
+COPY src/ src/
+RUN cargo build --release
+
+# Stage 3: Download MinIO and mc binaries
+FROM alpine:3 AS minio-download
+ARG TARGETARCH=amd64
+RUN wget -q "https://dl.min.io/server/minio/release/linux-${TARGETARCH}/minio" -O /minio && \
+    chmod +x /minio && \
+    wget -q "https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc" -O /mc && \
+    chmod +x /mc
+
+# Stage 4: Final image
+FROM postgres:16
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*
+
+ENV PGDATA=/var/lib/postgresql/data
+ENV DATABASE_URL=postgres://mercury:mercury@127.0.0.1/mercury
+ENV MINIO_ROOT_USER=mercury
+ENV MINIO_ROOT_PASSWORD=mercurycdn
+ENV MINIO_VOLUMES=/var/lib/minio/data
+ENV CDN_ENDPOINT=http://localhost:9000
+ENV CDN_BUCKET=mercury
+
+WORKDIR /app
+COPY --from=api-builder /app/target/release/mercury .
+COPY --from=ui-builder /ui/dist ./ui/dist
+COPY --from=minio-download /minio /usr/local/bin/minio
+COPY --from=minio-download /mc /usr/local/bin/mc
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+EXPOSE 3000
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..2781a6a
--- /dev/null
+++ b/README.md
@@ -0,0 +1,174 @@
+# Mercury
+
+A high-performance, monolithic Rust API with a dynamic CRUD engine, query registry cache, JWT bitmask permissions, and a Vue 3 admin frontend.
+
+![Login](pics/Mercury-Login.png)
+![Permissions](pics/Mercury.png)
+
+## Quick Start
+
+```bash
+cp .env.example .env          # set JWT_SECRET
+docker compose up --build
+```
+
+API: http://localhost:3000/api  
+Admin UI: http://localhost:3000  
+Default credentials: `admin` / `admin`
+
+---
+
+## API Contract
+
+### Authentication
+
+```
+POST /auth/login
+Body: { "username": "...", "password": "..." }
+Returns: { "token": "<JWT>" }
+```
+
+All admin routes require `Authorization: Bearer <token>`.
+
+---
+
+### CRUD — Dynamic Table Access
+
+Requests are mapped to the named PostgreSQL table. The SQL is generated, cached, and executed automatically.
+
+```
+GET    /api/{table}              List all rows (supports ?col=val filters)
+GET    /api/{table}/{id}         Get row by id
+POST   /api/{table}              Insert row (JSON body)
+PUT    /api/{table}/{id}         Update row by id (JSON body)
+DELETE /api/{table}/{id}         Delete row by id
+```
+
+**Notes:**
+- `users` and `permissions` tables are blacklisted from public CRUD — use the admin suite.
+- Filters are ANDed together: `GET /api/orders?status=open&priority=high`
+
+---
+
+### Admin — Query Registry
+
+Requires JWT with `ADMIN_QUERY` permission (bit 8).
+
+```
+GET    /admin/queries                          List all registered queries
+POST   /admin/queries                          Register a raw SQL template
+GET    /admin/queries/{identifier}             Get query by slug
+PUT    /admin/queries/{identifier}             Update SQL template or description
+DELETE /admin/queries/{identifier}             Remove query (evicts from cache)
+GET    /admin/queries/{identifier}/execute     Execute query with ?param=val bindings
+```
+
+SQL templates use `:param_name` placeholders:
+```sql
+SELECT * FROM orders WHERE user_id = :user_id AND status = :status
+```
+
+---
+
+### Admin — Cache
+
+Requires JWT with `ADMIN_CACHE` permission (bit 16).
+
+```
+GET    /admin/cache/stats    Cache size, hit count, miss count
+DELETE /admin/cache          Flush entire cache
+```
+
+---
+
+### Admin — Users
+
+Requires JWT with `SUPER_ADMIN` permission (bit 32).
+
+```
+GET    /admin/users                                   List users
+POST   /admin/users                                   Create user
+GET    /admin/users/{id}                              Get user
+PUT    /admin/users/{id}                              Update user
+DELETE /admin/users/{id}                              Delete user
+POST   /admin/users/{id}/permissions/grant/{bit}      OR bit into permissions mask
+DELETE /admin/users/{id}/permissions/revoke/{bit}     AND NOT bit from permissions mask
+```
+
+---
+
+### Admin — Permissions
+
+Requires JWT with `SUPER_ADMIN` permission (bit 32).
+
+```
+GET    /admin/permissions          List permission definitions
+POST   /admin/permissions          Create custom permission (auto-assigns next bit)
+PUT    /admin/permissions/{id}     Update name/description
+DELETE /admin/permissions/{id}     Remove permission
+```
+
+---
+
+### Admin — Route Blacklist
+
+Requires JWT with `SUPER_ADMIN` permission (bit 32). Changes take effect immediately in memory.
+
+```
+GET    /admin/blacklist          List all entries
+POST   /admin/blacklist          Add glob pattern
+PUT    /admin/blacklist/{id}     Update entry (set active: false to disable)
+DELETE /admin/blacklist/{id}     Remove entry
+```
+
+Pattern syntax: `*` matches one path segment, `**` matches many.  
+Example: `/api/sensitive/**` blocks all methods under that path.
+
+---
+
+## Permission Bitmask
+
+| Name        | Bit | Value |
+|-------------|-----|-------|
+| READ        | 0   | 1     |
+| WRITE       | 1   | 2     |
+| DELETE      | 2   | 4     |
+| ADMIN_QUERY | 3   | 8     |
+| ADMIN_CACHE | 4   | 16    |
+| SUPER_ADMIN | 5   | 32    |
+
+Custom permissions are added via the admin suite and assigned the next available power-of-2 bit. Masks support up to 128 bits (u128).
+
+---
+
+## Configuration
+
+| Variable | Default | Description |
+|---|---|---|
+| `DATABASE_URL` | required | PostgreSQL connection string |
+| `JWT_SECRET` | required | HMAC-HS256 signing secret |
+| `JWT_EXPIRY_SECS` | 3600 | Token lifetime in seconds |
+| `CACHE_MAX_CAPACITY` | 10000 | Max query templates in memory |
+| `CACHE_IDLE_TIMEOUT_SECS` | 300 | Evict after N seconds idle |
+| `CACHE_SWEEP_INTERVAL_SECS` | 60 | Sweep interval for eviction task |
+
+---
+
+## Development
+
+```bash
+# API only (requires local Postgres)
+cargo run
+
+# UI dev server (proxies to local API)
+cd ui && npm install && npm run dev
+
+# Full stack
+docker compose up --build
+```
+
+## Stack
+
+- **API:** Rust, Axum, SQLx, PostgreSQL, DashMap, jsonwebtoken, bcrypt
+- **Frontend:** Vue 3, Vite, @nychthemeron/library (dark mode default)
+- **Infra:** Docker multi-stage build, docker compose
diff --git a/dev.sh b/dev.sh
new file mode 100755
index 0000000..b959777
--- /dev/null
+++ b/dev.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+cd $SCRIPT_DIR/ui/ && bun i
+
+cd "$SCRIPT_DIR"
+
+cleanup() {
+  docker compose down
+}
+trap cleanup INT TERM
+
+docker compose up --build
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
new file mode 100644
index 0000000..96aa935
--- /dev/null
+++ b/docker-compose.dev.yml
@@ -0,0 +1,4 @@
+# Reserved for future dev overrides.
+# Port mapping omitted — dev.sh connects to the container's internal IP directly
+# to avoid Docker Desktop WSL2 port-forwarding limitations.
+services: {}
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..392bed6
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,69 @@
+services:
+  db:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: mercury
+      POSTGRES_PASSWORD: mercury
+      POSTGRES_DB: mercury
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U mercury"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  cdn:
+    image: minio/minio
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: mercury
+      MINIO_ROOT_PASSWORD: mercurycdn
+    volumes:
+      - cdn_data:/data
+    healthcheck:
+      test: ["CMD", "mc", "ready", "local"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  cdn-init:
+    image: minio/mc
+    depends_on:
+      cdn:
+        condition: service_healthy
+    entrypoint: >
+      /bin/sh -c "
+        mc alias set local http://cdn:9000 mercury mercurycdn &&
+        mc mb --ignore-existing local/mercury &&
+        mc anonymous set public local/mercury &&
+        echo 'CDN bucket ready'
+      "
+    restart: on-failure
+
+  api:
+    build: .
+    ports:
+      - "3000:3000"
+    environment:
+      DATABASE_URL: postgres://mercury:mercury@db:5432/mercury
+      JWT_SECRET: ${JWT_SECRET:-change_me_in_production}
+      JWT_EXPIRY_SECS: ${JWT_EXPIRY_SECS:-3600}
+      CACHE_MAX_CAPACITY: ${CACHE_MAX_CAPACITY:-10000}
+      CACHE_IDLE_TIMEOUT_SECS: ${CACHE_IDLE_TIMEOUT_SECS:-300}
+      CACHE_SWEEP_INTERVAL_SECS: ${CACHE_SWEEP_INTERVAL_SECS:-60}
+      CDN_ENDPOINT: http://cdn:9000
+      CDN_BUCKET: mercury
+      MERCURY_ADMIN_USER: test
+      MERCURY_ADMIN_PASSWORD: test
+    depends_on:
+      db:
+        condition: service_healthy
+      cdn:
+        condition: service_healthy
+    mem_limit: 512m
+    mem_reservation: 256m
+
+volumes:
+  postgres_data:
+  cdn_data:
diff --git a/docs/superpowers/plans/2026-06-16-mercury-implementation.md b/docs/superpowers/plans/2026-06-16-mercury-implementation.md
new file mode 100644
index 0000000..98a116f
--- /dev/null
+++ b/docs/superpowers/plans/2026-06-16-mercury-implementation.md
@@ -0,0 +1,3438 @@
+# Mercury Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Build Mercury — a monolithic Rust API with dynamic CRUD, a JWT bitmask permission system, a query registry cache, an admin suite, and a Vue 3 frontend — runnable via a single `docker compose up`.
+
+**Architecture:** Axum handles HTTP routing behind two middleware layers: a glob-based blacklist check and a JWT permission-bit validator. The CRUD engine auto-generates parameterized SQL from route + HTTP method, caches templates in a DashMap with TTI eviction, and persists named queries in PostgreSQL. Vue 3 is built by Vite and served as static files by `tower-http::ServeDir`.
+
+**Tech Stack:** Rust 1.75+, Axum 0.7, SQLx 0.7, PostgreSQL 16, DashMap 5, glob 0.3, jsonwebtoken 9, bcrypt 0.15, Vue 3, Vite, @nychthemeron/library, tower-http 0.5, Docker multi-stage build.
+
+---
+
+## File Map
+
+```
+Mercury/
+  Cargo.toml
+  .env.example
+  Dockerfile
+  docker-compose.yml
+  README.md
+  src/
+    main.rs                        startup: config, pool, caches, router, static files
+    config.rs                      Config struct from env vars
+    state.rs                       AppState, QueryCache, BlacklistCache types
+    auth/
+      mod.rs                       JWT Claims, encode/decode helpers
+      middleware.rs                 RequirePermission extractor
+    cache/
+      mod.rs                       pub use re-exports
+      query_cache.rs               DashMap + sweep task + hit/miss counters
+      blacklist_cache.rs           Arc<RwLock<Vec<CompiledEntry>>> + reload fn
+    db/
+      mod.rs                       pub use re-exports
+      pool.rs                      PgPool init + run migrations
+      migrations/
+        001_initial.sql            schema, seed permissions, seed blacklist
+    models/
+      mod.rs                       pub use re-exports
+      user.rs                      User, CreateUser, UpdateUser
+      permission.rs                Permission, CreatePermission, UpdatePermission
+      query.rs                     StoredQuery, CreateQuery, UpdateQuery
+      blacklist.rs                 BlacklistEntry, CreateBlacklistEntry, UpdateBlacklistEntry
+    routes/
+      mod.rs                       pub use re-exports
+      auth.rs                      POST /auth/login
+      crud.rs                      generic /api/{table} + query builder + row→JSON
+      admin/
+        mod.rs                     admin Router assembly
+        queries.rs                 query registry CRUD
+        cache.rs                   cache stats + flush
+        users.rs                   user management + grant/revoke
+        permissions.rs             permission definitions CRUD
+        blacklist.rs               blacklist CRUD + trigger reload
+  ui/
+    .npmrc
+    package.json
+    vite.config.ts
+    src/
+      main.ts
+      App.vue
+      router/index.ts
+      stores/auth.ts
+      views/
+        Login.vue
+        admin/
+          Layout.vue
+          Queries.vue
+          Users.vue
+          Permissions.vue
+          Blacklist.vue
+          Cache.vue
+  tests/
+    integration/
+      auth_test.rs
+      crud_test.rs
+      admin_test.rs
+```
+
+---
+
+## Task 1: Cargo.toml + project skeleton
+
+**Files:**
+- Create: `Cargo.toml`
+- Create: `src/main.rs` (stub)
+
+- [ ] **Step 1: Write Cargo.toml**
+
+```toml
+[package]
+name = "mercury"
+version = "0.1.0"
+edition = "2021"
+
+[[bin]]
+name = "mercury"
+path = "src/main.rs"
+
+[dependencies]
+axum = { version = "0.7", features = ["macros"] }
+tokio = { version = "1", features = ["full"] }
+sqlx = { version = "0.7", features = ["runtime-tokio-rustls", "postgres", "uuid", "chrono", "migrate"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+jsonwebtoken = "9"
+bcrypt = "0.15"
+dashmap = "5"
+glob = "0.3"
+tower-http = { version = "0.5", features = ["fs", "cors"] }
+tower = { version = "0.4", features = ["util"] }
+uuid = { version = "1", features = ["v4", "serde"] }
+chrono = { version = "0.4", features = ["serde"] }
+dotenvy = "0.15"
+anyhow = "1"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+
+[dev-dependencies]
+tower = { version = "0.4", features = ["util"] }
+http-body-util = "0.1"
+```
+
+- [ ] **Step 2: Write src/main.rs stub**
+
+```rust
+#[tokio::main]
+async fn main() {
+    println!("Mercury starting...");
+}
+```
+
+- [ ] **Step 3: Verify it compiles**
+
+```bash
+cargo build
+```
+Expected: `Compiling mercury v0.1.0` then `Finished`.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add Cargo.toml src/main.rs
+git commit -m "chore: init Mercury project scaffold"
+```
+
+---
+
+## Task 2: Config
+
+**Files:**
+- Create: `src/config.rs`
+- Create: `.env.example`
+
+- [ ] **Step 1: Write failing test**
+
+In `src/config.rs`:
+
+```rust
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_config_defaults() {
+        std::env::set_var("DATABASE_URL", "postgres://test");
+        std::env::set_var("JWT_SECRET", "secret");
+        let cfg = Config::from_env().unwrap();
+        assert_eq!(cfg.jwt_expiry_secs, 3600);
+        assert_eq!(cfg.cache_max_capacity, 10_000);
+        assert_eq!(cfg.cache_idle_timeout_secs, 300);
+        assert_eq!(cfg.cache_sweep_interval_secs, 60);
+    }
+}
+```
+
+- [ ] **Step 2: Run test — expect compile failure**
+
+```bash
+cargo test config
+```
+Expected: `error[E0433]: failed to resolve: use of undeclared crate or module`
+
+- [ ] **Step 3: Implement Config**
+
+```rust
+use anyhow::Result;
+
+#[derive(Clone, Debug)]
+pub struct Config {
+    pub database_url: String,
+    pub jwt_secret: String,
+    pub jwt_expiry_secs: u64,
+    pub cache_max_capacity: usize,
+    pub cache_idle_timeout_secs: u64,
+    pub cache_sweep_interval_secs: u64,
+}
+
+impl Config {
+    pub fn from_env() -> Result<Self> {
+        Ok(Self {
+            database_url: std::env::var("DATABASE_URL")?,
+            jwt_secret: std::env::var("JWT_SECRET")?,
+            jwt_expiry_secs: std::env::var("JWT_EXPIRY_SECS")
+                .unwrap_or_else(|_| "3600".into())
+                .parse()?,
+            cache_max_capacity: std::env::var("CACHE_MAX_CAPACITY")
+                .unwrap_or_else(|_| "10000".into())
+                .parse()?,
+            cache_idle_timeout_secs: std::env::var("CACHE_IDLE_TIMEOUT_SECS")
+                .unwrap_or_else(|_| "300".into())
+                .parse()?,
+            cache_sweep_interval_secs: std::env::var("CACHE_SWEEP_INTERVAL_SECS")
+                .unwrap_or_else(|_| "60".into())
+                .parse()?,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_config_defaults() {
+        std::env::set_var("DATABASE_URL", "postgres://test");
+        std::env::set_var("JWT_SECRET", "secret");
+        let cfg = Config::from_env().unwrap();
+        assert_eq!(cfg.jwt_expiry_secs, 3600);
+        assert_eq!(cfg.cache_max_capacity, 10_000);
+        assert_eq!(cfg.cache_idle_timeout_secs, 300);
+        assert_eq!(cfg.cache_sweep_interval_secs, 60);
+    }
+}
+```
+
+- [ ] **Step 4: Add to main.rs and run test**
+
+Add `mod config;` to `src/main.rs`. Then:
+
+```bash
+cargo test config
+```
+Expected: `test config::tests::test_config_defaults ... ok`
+
+- [ ] **Step 5: Write .env.example**
+
+```env
+DATABASE_URL=postgres://mercury:mercury@db:5432/mercury
+JWT_SECRET=change_me_in_production
+JWT_EXPIRY_SECS=3600
+CACHE_MAX_CAPACITY=10000
+CACHE_IDLE_TIMEOUT_SECS=300
+CACHE_SWEEP_INTERVAL_SECS=60
+```
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/config.rs src/main.rs .env.example
+git commit -m "feat: add Config struct loaded from env vars"
+```
+
+---
+
+## Task 3: Models
+
+**Files:**
+- Create: `src/models/mod.rs`
+- Create: `src/models/user.rs`
+- Create: `src/models/permission.rs`
+- Create: `src/models/query.rs`
+- Create: `src/models/blacklist.rs`
+
+- [ ] **Step 1: Write src/models/user.rs**
+
+```rust
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct User {
+    pub id: i32,
+    pub username: String,
+    #[serde(skip_serializing)]
+    pub password_hash: String,
+    pub permissions_mask: String,
+    pub created_at: DateTime<Utc>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateUser {
+    pub username: String,
+    pub password: String,
+    pub permissions_mask: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UpdateUser {
+    pub username: Option<String>,
+    pub password: Option<String>,
+    pub permissions_mask: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct LoginRequest {
+    pub username: String,
+    pub password: String,
+}
+```
+
+- [ ] **Step 2: Write src/models/permission.rs**
+
+```rust
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct Permission {
+    pub id: i32,
+    pub name: String,
+    pub bit_value: String,
+    pub description: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreatePermission {
+    pub name: String,
+    pub description: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UpdatePermission {
+    pub name: Option<String>,
+    pub description: Option<String>,
+}
+```
+
+- [ ] **Step 3: Write src/models/query.rs**
+
+```rust
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct StoredQuery {
+    pub id: Uuid,
+    pub identifier: String,
+    pub sql_template: String,
+    pub description: Option<String>,
+    pub created_at: DateTime<Utc>,
+    pub updated_at: DateTime<Utc>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateQuery {
+    pub identifier: String,
+    pub sql_template: String,
+    pub description: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UpdateQuery {
+    pub sql_template: Option<String>,
+    pub description: Option<String>,
+}
+```
+
+- [ ] **Step 4: Write src/models/blacklist.rs**
+
+```rust
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct BlacklistEntry {
+    pub id: i32,
+    pub pattern: String,
+    pub method: Option<String>,
+    pub reason: Option<String>,
+    pub active: bool,
+    pub created_at: DateTime<Utc>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateBlacklistEntry {
+    pub pattern: String,
+    pub method: Option<String>,
+    pub reason: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UpdateBlacklistEntry {
+    pub pattern: Option<String>,
+    pub method: Option<String>,
+    pub reason: Option<String>,
+    pub active: Option<bool>,
+}
+```
+
+- [ ] **Step 5: Write src/models/mod.rs**
+
+```rust
+pub mod blacklist;
+pub mod permission;
+pub mod query;
+pub mod user;
+```
+
+- [ ] **Step 6: Add mod to main.rs and compile**
+
+Add `mod models;` to `src/main.rs`.
+
+```bash
+cargo build
+```
+Expected: `Finished` with no errors.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add src/models/
+git commit -m "feat: add domain models for user, permission, query, blacklist"
+```
+
+---
+
+## Task 4: Database pool + migration
+
+**Files:**
+- Create: `src/db/mod.rs`
+- Create: `src/db/pool.rs`
+- Create: `src/db/migrations/001_initial.sql`
+
+- [ ] **Step 1: Write src/db/migrations/001_initial.sql**
+
+```sql
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+CREATE TABLE users (
+    id SERIAL PRIMARY KEY,
+    username VARCHAR(255) UNIQUE NOT NULL,
+    password_hash TEXT NOT NULL,
+    permissions_mask TEXT NOT NULL DEFAULT '0',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE permissions (
+    id SERIAL PRIMARY KEY,
+    name VARCHAR(255) UNIQUE NOT NULL,
+    bit_value TEXT UNIQUE NOT NULL,
+    description TEXT
+);
+
+CREATE TABLE queries (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    identifier VARCHAR(255) UNIQUE NOT NULL,
+    sql_template TEXT NOT NULL,
+    description TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE blacklist (
+    id SERIAL PRIMARY KEY,
+    pattern VARCHAR(500) NOT NULL,
+    method VARCHAR(10),
+    reason TEXT,
+    active BOOLEAN NOT NULL DEFAULT true,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Seed permissions
+INSERT INTO permissions (name, bit_value, description) VALUES
+    ('READ',        '1',  'Can read via CRUD endpoints'),
+    ('WRITE',       '2',  'Can insert/update via CRUD'),
+    ('DELETE',      '4',  'Can delete via CRUD'),
+    ('ADMIN_QUERY', '8',  'Can manage query registry'),
+    ('ADMIN_CACHE', '16', 'Can manage cache'),
+    ('SUPER_ADMIN', '32', 'Full access');
+
+-- Seed blacklist (users and permissions tables are admin-only)
+INSERT INTO blacklist (pattern, method, reason, active) VALUES
+    ('/api/users/**',       NULL, 'admin-only table', true),
+    ('/api/permissions/**', NULL, 'admin-only table', true);
+```
+
+- [ ] **Step 2: Write src/db/pool.rs**
+
+```rust
+use anyhow::Result;
+use sqlx::{postgres::PgPoolOptions, PgPool};
+
+pub async fn create_pool(database_url: &str) -> Result<PgPool> {
+    let pool = PgPoolOptions::new()
+        .max_connections(10)
+        .connect(database_url)
+        .await?;
+    sqlx::migrate!("src/db/migrations").run(&pool).await?;
+    Ok(pool)
+}
+```
+
+- [ ] **Step 3: Write src/db/mod.rs**
+
+```rust
+pub mod pool;
+pub use pool::create_pool;
+```
+
+- [ ] **Step 4: Add mod to main.rs and compile**
+
+Add `mod db;` to `src/main.rs`.
+
+```bash
+cargo build
+```
+Expected: `Finished` with no errors.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/db/ 
+git commit -m "feat: add database pool and initial migration"
+```
+
+---
+
+## Task 5: AppState
+
+**Files:**
+- Create: `src/state.rs`
+
+- [ ] **Step 1: Write src/state.rs**
+
+```rust
+use std::sync::{
+    atomic::{AtomicU64, Ordering},
+    Arc,
+};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use dashmap::DashMap;
+use glob::Pattern;
+use sqlx::PgPool;
+use tokio::sync::RwLock;
+
+use crate::config::Config;
+use crate::models::blacklist::BlacklistEntry;
+
+pub fn unix_now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_secs()
+}
+
+#[derive(Clone)]
+pub struct AppState {
+    pub pool: PgPool,
+    pub query_cache: QueryCache,
+    pub blacklist_cache: BlacklistCache,
+    pub config: Arc<Config>,
+}
+
+#[derive(Clone)]
+pub struct QueryCache {
+    pub map: Arc<DashMap<String, CacheEntry>>,
+    pub hits: Arc<AtomicU64>,
+    pub misses: Arc<AtomicU64>,
+}
+
+#[derive(Clone, Debug)]
+pub struct CacheEntry {
+    pub sql: String,
+    pub param_order: Vec<String>,
+    pub last_accessed_secs: Arc<AtomicU64>,
+}
+
+impl CacheEntry {
+    pub fn new(sql: String, param_order: Vec<String>) -> Self {
+        Self {
+            sql,
+            param_order,
+            last_accessed_secs: Arc::new(AtomicU64::new(unix_now())),
+        }
+    }
+
+    pub fn touch(&self) {
+        self.last_accessed_secs.store(unix_now(), Ordering::Relaxed);
+    }
+
+    pub fn last_accessed(&self) -> u64 {
+        self.last_accessed_secs.load(Ordering::Relaxed)
+    }
+}
+
+impl QueryCache {
+    pub fn new() -> Self {
+        Self {
+            map: Arc::new(DashMap::new()),
+            hits: Arc::new(AtomicU64::new(0)),
+            misses: Arc::new(AtomicU64::new(0)),
+        }
+    }
+
+    pub fn get(&self, key: &str) -> Option<CacheEntry> {
+        if let Some(entry) = self.map.get(key) {
+            entry.touch();
+            self.hits.fetch_add(1, Ordering::Relaxed);
+            Some(entry.clone())
+        } else {
+            self.misses.fetch_add(1, Ordering::Relaxed);
+            None
+        }
+    }
+
+    pub fn insert(&self, key: String, entry: CacheEntry, max_capacity: usize) {
+        if self.map.len() >= max_capacity {
+            let oldest_key = self
+                .map
+                .iter()
+                .min_by_key(|e| e.last_accessed())
+                .map(|e| e.key().clone());
+            if let Some(k) = oldest_key {
+                self.map.remove(&k);
+            }
+        }
+        self.map.insert(key, entry);
+    }
+
+    pub fn remove(&self, key: &str) {
+        self.map.remove(key);
+    }
+
+    pub fn hits(&self) -> u64 {
+        self.hits.load(Ordering::Relaxed)
+    }
+
+    pub fn misses(&self) -> u64 {
+        self.misses.load(Ordering::Relaxed)
+    }
+
+    pub fn len(&self) -> usize {
+        self.map.len()
+    }
+
+    pub fn flush(&self) {
+        self.map.clear();
+    }
+}
+
+#[derive(Clone)]
+pub struct BlacklistCache {
+    pub inner: Arc<RwLock<Vec<CompiledEntry>>>,
+}
+
+#[derive(Clone)]
+pub struct CompiledEntry {
+    pub entry: BlacklistEntry,
+    pub pattern: Pattern,
+}
+
+impl BlacklistCache {
+    pub fn new() -> Self {
+        Self {
+            inner: Arc::new(RwLock::new(Vec::new())),
+        }
+    }
+
+    pub async fn load(&self, entries: Vec<BlacklistEntry>) {
+        let compiled: Vec<CompiledEntry> = entries
+            .into_iter()
+            .filter_map(|e| {
+                Pattern::new(&e.pattern)
+                    .ok()
+                    .map(|pattern| CompiledEntry { entry: e, pattern })
+            })
+            .collect();
+        let mut guard = self.inner.write().await;
+        *guard = compiled;
+    }
+
+    pub async fn is_blocked(&self, method: &str, path: &str) -> bool {
+        let guard = self.inner.read().await;
+        guard.iter().any(|compiled| {
+            if !compiled.entry.active {
+                return false;
+            }
+            let method_matches = compiled
+                .entry
+                .method
+                .as_deref()
+                .map(|m| m.eq_ignore_ascii_case(method))
+                .unwrap_or(true);
+            method_matches && compiled.pattern.matches(path)
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_cache_insert_and_get() {
+        let cache = QueryCache::new();
+        let entry = CacheEntry::new("SELECT 1".into(), vec![]);
+        cache.insert("key1".into(), entry, 100);
+        let got = cache.get("key1");
+        assert!(got.is_some());
+        assert_eq!(got.unwrap().sql, "SELECT 1");
+        assert_eq!(cache.hits(), 1);
+        assert_eq!(cache.misses(), 0);
+    }
+
+    #[test]
+    fn test_cache_miss() {
+        let cache = QueryCache::new();
+        let got = cache.get("missing");
+        assert!(got.is_none());
+        assert_eq!(cache.misses(), 1);
+    }
+
+    #[test]
+    fn test_cache_capacity_evicts_oldest() {
+        let cache = QueryCache::new();
+        let e1 = CacheEntry::new("SELECT 1".into(), vec![]);
+        // force e1 to be older
+        e1.last_accessed_secs.store(1, Ordering::Relaxed);
+        cache.map.insert("old".into(), e1);
+        let e2 = CacheEntry::new("SELECT 2".into(), vec![]);
+        cache.insert("new".into(), e2, 1); // capacity=1, should evict "old"
+        assert!(cache.map.get("old").is_none());
+        assert!(cache.map.get("new").is_some());
+    }
+
+    #[tokio::test]
+    async fn test_blacklist_blocks_pattern() {
+        use chrono::Utc;
+        let cache = BlacklistCache::new();
+        let entry = BlacklistEntry {
+            id: 1,
+            pattern: "/api/users/**".into(),
+            method: None,
+            reason: None,
+            active: true,
+            created_at: Utc::now(),
+        };
+        cache.load(vec![entry]).await;
+        assert!(cache.is_blocked("GET", "/api/users/42").await);
+        assert!(!cache.is_blocked("GET", "/api/orders/1").await);
+    }
+
+    #[tokio::test]
+    async fn test_blacklist_method_specific() {
+        use chrono::Utc;
+        let cache = BlacklistCache::new();
+        let entry = BlacklistEntry {
+            id: 2,
+            pattern: "/api/secrets".into(),
+            method: Some("GET".into()),
+            reason: None,
+            active: true,
+            created_at: Utc::now(),
+        };
+        cache.load(vec![entry]).await;
+        assert!(cache.is_blocked("GET", "/api/secrets").await);
+        assert!(!cache.is_blocked("POST", "/api/secrets").await);
+    }
+}
+```
+
+- [ ] **Step 2: Add mod to main.rs**
+
+Add `mod state;` to `src/main.rs`.
+
+- [ ] **Step 3: Run tests**
+
+```bash
+cargo test state
+```
+Expected: 4 tests pass.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add src/state.rs src/main.rs
+git commit -m "feat: add AppState with QueryCache and BlacklistCache"
+```
+
+---
+
+## Task 6: Cache sweep background task
+
+**Files:**
+- Create: `src/cache/mod.rs`
+- Create: `src/cache/sweep.rs`
+
+- [ ] **Step 1: Write src/cache/sweep.rs**
+
+```rust
+use std::time::Duration;
+use crate::state::QueryCache;
+
+pub fn spawn_sweep_task(cache: QueryCache, idle_timeout_secs: u64, sweep_interval_secs: u64) {
+    tokio::spawn(async move {
+        let interval = Duration::from_secs(sweep_interval_secs);
+        loop {
+            tokio::time::sleep(interval).await;
+            let now = crate::state::unix_now();
+            cache.map.retain(|_, entry| {
+                now.saturating_sub(entry.last_accessed()) < idle_timeout_secs
+            });
+        }
+    });
+}
+```
+
+- [ ] **Step 2: Write src/cache/mod.rs**
+
+```rust
+pub mod sweep;
+pub use sweep::spawn_sweep_task;
+```
+
+- [ ] **Step 3: Add mod to main.rs and compile**
+
+Add `mod cache;` to `src/main.rs`.
+
+```bash
+cargo build
+```
+Expected: `Finished` with no errors.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add src/cache/
+git commit -m "feat: add cache sweep background task for TTI eviction"
+```
+
+---
+
+## Task 7: JWT auth module
+
+**Files:**
+- Create: `src/auth/mod.rs`
+
+- [ ] **Step 1: Write failing tests**
+
+```rust
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_encode_decode_roundtrip() {
+        let secret = "test_secret";
+        let token = encode_jwt("alice", 63u128, secret, 3600).unwrap();
+        let claims = decode_jwt(&token, secret).unwrap();
+        assert_eq!(claims.sub, "alice");
+        assert_eq!(claims.permissions_mask(), 63u128);
+    }
+
+    #[test]
+    fn test_expired_token_rejected() {
+        let secret = "test_secret";
+        let token = encode_jwt("alice", 1u128, secret, 0).unwrap();
+        // exp=0 means already expired
+        let result = decode_jwt(&token, secret);
+        assert!(result.is_err());
+    }
+}
+```
+
+- [ ] **Step 2: Run test — expect compile failure**
+
+```bash
+cargo test auth
+```
+
+- [ ] **Step 3: Implement src/auth/mod.rs**
+
+```rust
+pub mod middleware;
+
+use anyhow::Result;
+use chrono::Utc;
+use jsonwebtoken::{decode, encode, DecodingKey, EncodingKey, Header, Validation};
+use serde::{Deserialize, Serialize};
+
+pub mod permissions {
+    pub const READ: u128 = 1;
+    pub const WRITE: u128 = 2;
+    pub const DELETE: u128 = 4;
+    pub const ADMIN_QUERY: u128 = 8;
+    pub const ADMIN_CACHE: u128 = 16;
+    pub const SUPER_ADMIN: u128 = 32;
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Claims {
+    pub sub: String,
+    pub permissions: String, // u128 stored as decimal string
+    pub exp: usize,
+}
+
+impl Claims {
+    pub fn permissions_mask(&self) -> u128 {
+        self.permissions.parse().unwrap_or(0)
+    }
+
+    pub fn has_permission(&self, bit: u128) -> bool {
+        self.permissions_mask() & bit != 0
+    }
+}
+
+pub fn encode_jwt(username: &str, mask: u128, secret: &str, expiry_secs: u64) -> Result<String> {
+    let exp = (Utc::now().timestamp() as u64 + expiry_secs) as usize;
+    let claims = Claims {
+        sub: username.to_string(),
+        permissions: mask.to_string(),
+        exp,
+    };
+    let token = encode(
+        &Header::default(),
+        &claims,
+        &EncodingKey::from_secret(secret.as_bytes()),
+    )?;
+    Ok(token)
+}
+
+pub fn decode_jwt(token: &str, secret: &str) -> Result<Claims> {
+    let data = decode::<Claims>(
+        token,
+        &DecodingKey::from_secret(secret.as_bytes()),
+        &Validation::default(),
+    )?;
+    Ok(data.claims)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_encode_decode_roundtrip() {
+        let secret = "test_secret";
+        let token = encode_jwt("alice", 63u128, secret, 3600).unwrap();
+        let claims = decode_jwt(&token, secret).unwrap();
+        assert_eq!(claims.sub, "alice");
+        assert_eq!(claims.permissions_mask(), 63u128);
+    }
+
+    #[test]
+    fn test_has_permission() {
+        let claims = Claims {
+            sub: "bob".into(),
+            permissions: "9".into(), // READ (1) + ADMIN_QUERY (8)
+            exp: 9999999999,
+        };
+        assert!(claims.has_permission(permissions::READ));
+        assert!(claims.has_permission(permissions::ADMIN_QUERY));
+        assert!(!claims.has_permission(permissions::SUPER_ADMIN));
+    }
+}
+```
+
+- [ ] **Step 4: Create stub for middleware (needed for mod declaration)**
+
+Create `src/auth/middleware.rs` as an empty stub:
+
+```rust
+// filled in Task 8
+```
+
+- [ ] **Step 5: Add mod to main.rs and run tests**
+
+Add `mod auth;` to `src/main.rs`.
+
+```bash
+cargo test auth::tests
+```
+Expected: 2 tests pass (`test_encode_decode_roundtrip`, `test_has_permission`).
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/auth/
+git commit -m "feat: add JWT encode/decode with u128 bitmask permissions"
+```
+
+---
+
+## Task 8: Auth middleware + blacklist middleware
+
+**Files:**
+- Modify: `src/auth/middleware.rs`
+
+- [ ] **Step 1: Write src/auth/middleware.rs**
+
+```rust
+use axum::{
+    extract::{Request, State},
+    http::StatusCode,
+    middleware::Next,
+    response::Response,
+};
+
+use crate::{auth::decode_jwt, state::AppState};
+
+pub async fn blacklist_layer(
+    State(state): State<AppState>,
+    req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let method = req.method().as_str().to_uppercase();
+    let path = req.uri().path().to_string();
+    if state.blacklist_cache.is_blocked(&method, &path).await {
+        return Err(StatusCode::FORBIDDEN);
+    }
+    Ok(next.run(req).await)
+}
+
+pub fn extract_bearer(req: &Request) -> Option<String> {
+    req.headers()
+        .get("authorization")
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.strip_prefix("Bearer "))
+        .map(|s| s.to_string())
+}
+
+pub async fn require_auth(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let token = extract_bearer(&req).ok_or(StatusCode::UNAUTHORIZED)?;
+    let claims = decode_jwt(&token, &state.config.jwt_secret)
+        .map_err(|_| StatusCode::UNAUTHORIZED)?;
+    req.extensions_mut().insert(claims);
+    Ok(next.run(req).await)
+}
+
+pub async fn require_super_admin(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let token = extract_bearer(&req).ok_or(StatusCode::UNAUTHORIZED)?;
+    let claims = decode_jwt(&token, &state.config.jwt_secret)
+        .map_err(|_| StatusCode::UNAUTHORIZED)?;
+    if !claims.has_permission(crate::auth::permissions::SUPER_ADMIN) {
+        return Err(StatusCode::FORBIDDEN);
+    }
+    req.extensions_mut().insert(claims);
+    Ok(next.run(req).await)
+}
+
+pub async fn require_admin_query(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let token = extract_bearer(&req).ok_or(StatusCode::UNAUTHORIZED)?;
+    let claims = decode_jwt(&token, &state.config.jwt_secret)
+        .map_err(|_| StatusCode::UNAUTHORIZED)?;
+    if !claims.has_permission(crate::auth::permissions::ADMIN_QUERY) {
+        return Err(StatusCode::FORBIDDEN);
+    }
+    req.extensions_mut().insert(claims);
+    Ok(next.run(req).await)
+}
+
+pub async fn require_admin_cache(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let token = extract_bearer(&req).ok_or(StatusCode::UNAUTHORIZED)?;
+    let claims = decode_jwt(&token, &state.config.jwt_secret)
+        .map_err(|_| StatusCode::UNAUTHORIZED)?;
+    if !claims.has_permission(crate::auth::permissions::ADMIN_CACHE) {
+        return Err(StatusCode::FORBIDDEN);
+    }
+    req.extensions_mut().insert(claims);
+    Ok(next.run(req).await)
+}
+```
+
+- [ ] **Step 2: Compile**
+
+```bash
+cargo build
+```
+Expected: `Finished` with no errors.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/auth/middleware.rs
+git commit -m "feat: add blacklist and JWT permission middlewares"
+```
+
+---
+
+## Task 9: Auth login route
+
+**Files:**
+- Create: `src/routes/mod.rs`
+- Create: `src/routes/auth.rs`
+
+- [ ] **Step 1: Write src/routes/auth.rs**
+
+```rust
+use axum::{extract::State, http::StatusCode, Json};
+use serde_json::{json, Value};
+
+use crate::{
+    auth::encode_jwt,
+    models::user::LoginRequest,
+    state::AppState,
+};
+
+pub async fn login(
+    State(state): State<AppState>,
+    Json(body): Json<LoginRequest>,
+) -> Result<Json<Value>, StatusCode> {
+    let user = sqlx::query_as!(
+        crate::models::user::User,
+        "SELECT id, username, password_hash, permissions_mask, created_at FROM users WHERE username = $1",
+        body.username
+    )
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    .ok_or(StatusCode::UNAUTHORIZED)?;
+
+    let valid = bcrypt::verify(&body.password, &user.password_hash)
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    if !valid {
+        return Err(StatusCode::UNAUTHORIZED);
+    }
+
+    let mask: u128 = user.permissions_mask.parse().unwrap_or(0);
+    let token = encode_jwt(&user.username, mask, &state.config.jwt_secret, state.config.jwt_expiry_secs)
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    Ok(Json(json!({ "token": token })))
+}
+```
+
+- [ ] **Step 2: Write src/routes/mod.rs**
+
+```rust
+pub mod admin;
+pub mod auth;
+pub mod crud;
+```
+
+- [ ] **Step 3: Create stub files to satisfy mod declarations**
+
+Create `src/routes/crud.rs`:
+```rust
+// filled in Task 10
+```
+
+Create `src/routes/admin/mod.rs`:
+```rust
+// filled in Task 15
+```
+
+- [ ] **Step 4: Add mod to main.rs and compile**
+
+Add `mod routes;` to `src/main.rs`.
+
+```bash
+cargo build
+```
+Expected: `Finished`.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/routes/
+git commit -m "feat: add /auth/login route with bcrypt verification"
+```
+
+---
+
+## Task 10: CRUD route + query builder
+
+**Files:**
+- Modify: `src/routes/crud.rs`
+
+- [ ] **Step 1: Write failing test**
+
+In `src/routes/crud.rs`:
+
+```rust
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_build_select_all() {
+        let (sql, params, key) = build_query("GET", "orders", None, &[], &[]).unwrap();
+        assert_eq!(sql, "SELECT * FROM orders");
+        assert!(params.is_empty());
+        assert_eq!(key, "GET:orders:");
+    }
+
+    #[test]
+    fn test_build_select_by_id() {
+        let (sql, params, key) = build_query("GET", "orders", Some("42"), &[], &[]).unwrap();
+        assert_eq!(sql, "SELECT * FROM orders WHERE id = $1");
+        assert_eq!(params, vec!["42".to_string()]);
+        assert_eq!(key, "GET:orders:by_id");
+    }
+
+    #[test]
+    fn test_build_insert() {
+        let cols = vec![("email".into(), "a@b.com".into()), ("name".into(), "Alice".into())];
+        let (sql, params, key) = build_query("POST", "users", None, &cols, &[]).unwrap();
+        assert_eq!(sql, "INSERT INTO users (email, name) VALUES ($1, $2) RETURNING *");
+        assert_eq!(params, vec!["a@b.com", "Alice"]);
+        assert_eq!(key, "POST:users:email,name");
+    }
+
+    #[test]
+    fn test_build_update() {
+        let cols = vec![("name".into(), "Bob".into())];
+        let (sql, params, key) = build_query("PUT", "users", Some("7"), &cols, &[]).unwrap();
+        assert_eq!(sql, "UPDATE users SET name = $1 WHERE id = $2 RETURNING *");
+        assert_eq!(params, vec!["Bob", "7"]);
+        assert_eq!(key, "PUT:users:name:by_id");
+    }
+
+    #[test]
+    fn test_build_delete() {
+        let (sql, params, key) = build_query("DELETE", "users", Some("3"), &[], &[]).unwrap();
+        assert_eq!(sql, "DELETE FROM users WHERE id = $1");
+        assert_eq!(params, vec!["3"]);
+        assert_eq!(key, "DELETE:users:by_id");
+    }
+
+    #[test]
+    fn test_build_select_with_filters() {
+        let filters = vec![("status".into(), "active".into()), ("role".into(), "admin".into())];
+        let (sql, params, key) = build_query("GET", "users", None, &[], &filters).unwrap();
+        assert_eq!(sql, "SELECT * FROM users WHERE role = $1 AND status = $2");
+        assert_eq!(params, vec!["admin", "active"]);
+        assert_eq!(key, "GET:users:role,status");
+    }
+
+    #[test]
+    fn test_rejects_invalid_table_name() {
+        let result = build_query("GET", "users; DROP TABLE users--", None, &[], &[]);
+        assert!(result.is_err());
+    }
+}
+```
+
+- [ ] **Step 2: Run test — expect compile failure**
+
+```bash
+cargo test crud
+```
+
+- [ ] **Step 3: Implement src/routes/crud.rs**
+
+```rust
+use anyhow::{anyhow, Result};
+use axum::{
+    extract::{Path, Query, State},
+    http::{Method, StatusCode},
+    Json,
+};
+use serde_json::Value;
+use sqlx::postgres::PgRow;
+use sqlx::Row;
+use std::collections::HashMap;
+
+use crate::state::{AppState, CacheEntry};
+
+fn validate_identifier(name: &str) -> Result<()> {
+    if name.chars().all(|c| c.is_alphanumeric() || c == '_') {
+        Ok(())
+    } else {
+        Err(anyhow!("invalid identifier: {}", name))
+    }
+}
+
+/// Returns (sql, ordered_param_values, cache_key)
+/// body_cols: sorted (col, val) pairs from request body
+/// filter_cols: sorted (col, val) pairs from query params
+pub fn build_query(
+    method: &str,
+    table: &str,
+    id: Option<&str>,
+    body_cols: &[(String, String)],
+    filter_cols: &[(String, String)],
+) -> Result<(String, Vec<String>, String)> {
+    validate_identifier(table)?;
+    for (col, _) in body_cols.iter().chain(filter_cols.iter()) {
+        validate_identifier(col)?;
+    }
+
+    let mut sorted_body = body_cols.to_vec();
+    sorted_body.sort_by(|a, b| a.0.cmp(&b.0));
+    let mut sorted_filters = filter_cols.to_vec();
+    sorted_filters.sort_by(|a, b| a.0.cmp(&b.0));
+
+    match method.to_uppercase().as_str() {
+        "GET" => {
+            if let Some(id_val) = id {
+                let sql = format!("SELECT * FROM {} WHERE id = $1", table);
+                let key = format!("GET:{}:by_id", table);
+                Ok((sql, vec![id_val.to_string()], key))
+            } else if sorted_filters.is_empty() {
+                let sql = format!("SELECT * FROM {}", table);
+                let key = format!("GET:{}:", table);
+                Ok((sql, vec![], key))
+            } else {
+                let col_names: Vec<String> = sorted_filters.iter().map(|(c, _)| c.clone()).collect();
+                let where_clause: Vec<String> = col_names
+                    .iter()
+                    .enumerate()
+                    .map(|(i, c)| format!("{} = ${}", c, i + 1))
+                    .collect();
+                let sql = format!("SELECT * FROM {} WHERE {}", table, where_clause.join(" AND "));
+                let params: Vec<String> = sorted_filters.iter().map(|(_, v)| v.clone()).collect();
+                let key = format!("GET:{}:{}", table, col_names.join(","));
+                Ok((sql, params, key))
+            }
+        }
+        "POST" => {
+            if sorted_body.is_empty() {
+                return Err(anyhow!("POST requires a body with at least one field"));
+            }
+            let cols: Vec<String> = sorted_body.iter().map(|(c, _)| c.clone()).collect();
+            let placeholders: Vec<String> = (1..=cols.len()).map(|i| format!("${}", i)).collect();
+            let sql = format!(
+                "INSERT INTO {} ({}) VALUES ({}) RETURNING *",
+                table,
+                cols.join(", "),
+                placeholders.join(", ")
+            );
+            let params: Vec<String> = sorted_body.iter().map(|(_, v)| v.clone()).collect();
+            let key = format!("POST:{}:{}", table, cols.join(","));
+            Ok((sql, params, key))
+        }
+        "PUT" => {
+            let id_val = id.ok_or_else(|| anyhow!("PUT requires an id"))?;
+            if sorted_body.is_empty() {
+                return Err(anyhow!("PUT requires a body with at least one field"));
+            }
+            let cols: Vec<String> = sorted_body.iter().map(|(c, _)| c.clone()).collect();
+            let set_clause: Vec<String> = cols
+                .iter()
+                .enumerate()
+                .map(|(i, c)| format!("{} = ${}", c, i + 1))
+                .collect();
+            let id_placeholder = cols.len() + 1;
+            let sql = format!(
+                "UPDATE {} SET {} WHERE id = ${} RETURNING *",
+                table,
+                set_clause.join(", "),
+                id_placeholder
+            );
+            let mut params: Vec<String> = sorted_body.iter().map(|(_, v)| v.clone()).collect();
+            params.push(id_val.to_string());
+            let key = format!("PUT:{}:{}:by_id", table, cols.join(","));
+            Ok((sql, params, key))
+        }
+        "DELETE" => {
+            let id_val = id.ok_or_else(|| anyhow!("DELETE requires an id"))?;
+            let sql = format!("DELETE FROM {} WHERE id = $1", table);
+            let key = format!("DELETE:{}:by_id", table);
+            Ok((sql, vec![id_val.to_string()], key))
+        }
+        m => Err(anyhow!("unsupported method: {}", m)),
+    }
+}
+
+pub fn pg_row_to_json(row: PgRow) -> Value {
+    let columns = row.columns();
+    let mut map = serde_json::Map::new();
+    for col in columns {
+        let name = col.name().to_string();
+        let type_name = col.type_info().name();
+        let val = match type_name {
+            "INT2" | "INT4" | "INT8" | "SERIAL" => row
+                .try_get::<i64, _>(col.ordinal())
+                .map(|v| Value::Number(v.into()))
+                .unwrap_or(Value::Null),
+            "FLOAT4" | "FLOAT8" => row
+                .try_get::<f64, _>(col.ordinal())
+                .ok()
+                .and_then(|v| serde_json::Number::from_f64(v))
+                .map(Value::Number)
+                .unwrap_or(Value::Null),
+            "BOOL" => row
+                .try_get::<bool, _>(col.ordinal())
+                .map(Value::Bool)
+                .unwrap_or(Value::Null),
+            "UUID" => row
+                .try_get::<uuid::Uuid, _>(col.ordinal())
+                .map(|v| Value::String(v.to_string()))
+                .unwrap_or(Value::Null),
+            "TIMESTAMPTZ" | "TIMESTAMP" => row
+                .try_get::<chrono::DateTime<chrono::Utc>, _>(col.ordinal())
+                .map(|v| Value::String(v.to_rfc3339()))
+                .unwrap_or(Value::Null),
+            _ => row
+                .try_get::<String, _>(col.ordinal())
+                .map(Value::String)
+                .unwrap_or(Value::Null),
+        };
+        map.insert(name, val);
+    }
+    Value::Object(map)
+}
+
+pub async fn handle_crud(
+    State(state): State<AppState>,
+    method: Method,
+    Path(params): Path<HashMap<String, String>>,
+    Query(query_params): Query<HashMap<String, String>>,
+    body: Option<Json<HashMap<String, Value>>>,
+) -> Result<Json<Value>, StatusCode> {
+    let table = params.get("table").ok_or(StatusCode::BAD_REQUEST)?;
+    let id = params.get("id").map(|s| s.as_str());
+    let method_str = method.as_str();
+
+    let body_cols: Vec<(String, String)> = body
+        .map(|Json(b)| {
+            b.into_iter()
+                .filter_map(|(k, v)| match v {
+                    Value::String(s) => Some((k, s)),
+                    Value::Number(n) => Some((k, n.to_string())),
+                    Value::Bool(b) => Some((k, b.to_string())),
+                    _ => None,
+                })
+                .collect()
+        })
+        .unwrap_or_default();
+
+    let filter_cols: Vec<(String, String)> = query_params.into_iter().collect();
+
+    let (sql, params_vals, cache_key) =
+        build_query(method_str, table, id, &body_cols, &filter_cols)
+            .map_err(|_| StatusCode::BAD_REQUEST)?;
+
+    let cached = state.query_cache.get(&cache_key);
+    let _entry = if cached.is_none() {
+        let entry = CacheEntry::new(sql.clone(), vec![]);
+        state
+            .query_cache
+            .insert(cache_key, entry.clone(), state.config.cache_max_capacity);
+        entry
+    } else {
+        cached.unwrap()
+    };
+
+    let mut q = sqlx::query(&sql);
+    for val in &params_vals {
+        q = q.bind(val.as_str());
+    }
+
+    match method_str.to_uppercase().as_str() {
+        "GET" => {
+            let rows = q
+                .fetch_all(&state.pool)
+                .await
+                .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+            let json_rows: Vec<Value> = rows.into_iter().map(pg_row_to_json).collect();
+            Ok(Json(Value::Array(json_rows)))
+        }
+        "POST" | "PUT" => {
+            let row = q
+                .fetch_one(&state.pool)
+                .await
+                .map_err(|e| {
+                    if e.to_string().contains("no rows") {
+                        StatusCode::NOT_FOUND
+                    } else {
+                        StatusCode::INTERNAL_SERVER_ERROR
+                    }
+                })?;
+            Ok(Json(pg_row_to_json(row)))
+        }
+        "DELETE" => {
+            q.execute(&state.pool)
+                .await
+                .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+            Ok(Json(serde_json::json!({ "deleted": true })))
+        }
+        _ => Err(StatusCode::METHOD_NOT_ALLOWED),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_build_select_all() {
+        let (sql, params, key) = build_query("GET", "orders", None, &[], &[]).unwrap();
+        assert_eq!(sql, "SELECT * FROM orders");
+        assert!(params.is_empty());
+        assert_eq!(key, "GET:orders:");
+    }
+
+    #[test]
+    fn test_build_select_by_id() {
+        let (sql, params, key) = build_query("GET", "orders", Some("42"), &[], &[]).unwrap();
+        assert_eq!(sql, "SELECT * FROM orders WHERE id = $1");
+        assert_eq!(params, vec!["42".to_string()]);
+        assert_eq!(key, "GET:orders:by_id");
+    }
+
+    #[test]
+    fn test_build_insert() {
+        let cols = vec![("email".into(), "a@b.com".into()), ("name".into(), "Alice".into())];
+        let (sql, params, key) = build_query("POST", "users", None, &cols, &[]).unwrap();
+        assert_eq!(sql, "INSERT INTO users (email, name) VALUES ($1, $2) RETURNING *");
+        assert_eq!(params, vec!["a@b.com", "Alice"]);
+        assert_eq!(key, "POST:users:email,name");
+    }
+
+    #[test]
+    fn test_build_update() {
+        let cols = vec![("name".into(), "Bob".into())];
+        let (sql, params, key) = build_query("PUT", "users", Some("7"), &cols, &[]).unwrap();
+        assert_eq!(sql, "UPDATE users SET name = $1 WHERE id = $2 RETURNING *");
+        assert_eq!(params, vec!["Bob", "7"]);
+        assert_eq!(key, "PUT:users:name:by_id");
+    }
+
+    #[test]
+    fn test_build_delete() {
+        let (sql, params, key) = build_query("DELETE", "users", Some("3"), &[], &[]).unwrap();
+        assert_eq!(sql, "DELETE FROM users WHERE id = $1");
+        assert_eq!(params, vec!["3"]);
+        assert_eq!(key, "DELETE:users:by_id");
+    }
+
+    #[test]
+    fn test_build_select_with_filters() {
+        let filters = vec![("status".into(), "active".into()), ("role".into(), "admin".into())];
+        let (sql, params, key) = build_query("GET", "users", None, &[], &filters).unwrap();
+        assert_eq!(sql, "SELECT * FROM users WHERE role = $1 AND status = $2");
+        assert_eq!(params, vec!["admin", "active"]);
+        assert_eq!(key, "GET:users:role,status");
+    }
+
+    #[test]
+    fn test_rejects_invalid_table_name() {
+        let result = build_query("GET", "users; DROP TABLE users--", None, &[], &[]);
+        assert!(result.is_err());
+    }
+}
+```
+
+- [ ] **Step 4: Run tests**
+
+```bash
+cargo test crud::tests
+```
+Expected: 7 tests pass.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/routes/crud.rs
+git commit -m "feat: add dynamic CRUD query builder with cache integration"
+```
+
+---
+
+## Task 11: Admin routes — queries
+
+**Files:**
+- Create: `src/routes/admin/queries.rs`
+
+- [ ] **Step 1: Write src/routes/admin/queries.rs**
+
+```rust
+use axum::{
+    extract::{Extension, Path, Query, State},
+    http::StatusCode,
+    Json,
+};
+use serde_json::{json, Value};
+use std::collections::HashMap;
+
+use crate::{
+    auth::Claims,
+    models::query::{CreateQuery, StoredQuery, UpdateQuery},
+    state::AppState,
+};
+
+pub async fn list_queries(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+) -> Result<Json<Vec<StoredQuery>>, StatusCode> {
+    let queries = sqlx::query_as!(
+        StoredQuery,
+        "SELECT id, identifier, sql_template, description, created_at, updated_at FROM queries ORDER BY created_at DESC"
+    )
+    .fetch_all(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(queries))
+}
+
+pub async fn get_query(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path(identifier): Path<String>,
+) -> Result<Json<StoredQuery>, StatusCode> {
+    let q = sqlx::query_as!(
+        StoredQuery,
+        "SELECT id, identifier, sql_template, description, created_at, updated_at FROM queries WHERE identifier = $1",
+        identifier
+    )
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    .ok_or(StatusCode::NOT_FOUND)?;
+    Ok(Json(q))
+}
+
+pub async fn create_query(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Json(body): Json<CreateQuery>,
+) -> Result<Json<StoredQuery>, StatusCode> {
+    let q = sqlx::query_as!(
+        StoredQuery,
+        "INSERT INTO queries (identifier, sql_template, description) VALUES ($1, $2, $3) RETURNING id, identifier, sql_template, description, created_at, updated_at",
+        body.identifier,
+        body.sql_template,
+        body.description
+    )
+    .fetch_one(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(q))
+}
+
+pub async fn update_query(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path(identifier): Path<String>,
+    Json(body): Json<UpdateQuery>,
+) -> Result<Json<StoredQuery>, StatusCode> {
+    let existing = sqlx::query_as!(
+        StoredQuery,
+        "SELECT id, identifier, sql_template, description, created_at, updated_at FROM queries WHERE identifier = $1",
+        identifier
+    )
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    .ok_or(StatusCode::NOT_FOUND)?;
+
+    let new_sql = body.sql_template.as_deref().unwrap_or(&existing.sql_template);
+    let new_desc = body.description.as_deref().or(existing.description.as_deref());
+
+    let q = sqlx::query_as!(
+        StoredQuery,
+        "UPDATE queries SET sql_template = $1, description = $2, updated_at = now() WHERE identifier = $3 RETURNING id, identifier, sql_template, description, created_at, updated_at",
+        new_sql,
+        new_desc,
+        identifier
+    )
+    .fetch_one(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    state.query_cache.remove(&identifier);
+    Ok(Json(q))
+}
+
+pub async fn delete_query(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path(identifier): Path<String>,
+) -> Result<Json<Value>, StatusCode> {
+    sqlx::query!("DELETE FROM queries WHERE identifier = $1", identifier)
+        .execute(&state.pool)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    state.query_cache.remove(&identifier);
+    Ok(Json(json!({ "deleted": true })))
+}
+
+pub async fn execute_query(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path(identifier): Path<String>,
+    Query(params): Query<HashMap<String, String>>,
+) -> Result<Json<Value>, StatusCode> {
+    let stored = sqlx::query_as!(
+        StoredQuery,
+        "SELECT id, identifier, sql_template, description, created_at, updated_at FROM queries WHERE identifier = $1",
+        identifier
+    )
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    .ok_or(StatusCode::NOT_FOUND)?;
+
+    let mut sql = stored.sql_template.clone();
+    let mut bound_vals: Vec<String> = Vec::new();
+    let mut idx = 1usize;
+    let mut sorted_params: Vec<(String, String)> = params.into_iter().collect();
+    sorted_params.sort_by(|a, b| a.0.cmp(&b.0));
+    for (name, val) in &sorted_params {
+        let placeholder = format!(":{}", name);
+        if sql.contains(&placeholder) {
+            sql = sql.replace(&placeholder, &format!("${}", idx));
+            bound_vals.push(val.clone());
+            idx += 1;
+        }
+    }
+
+    let mut q = sqlx::query(&sql);
+    for val in &bound_vals {
+        q = q.bind(val.as_str());
+    }
+
+    let rows = q
+        .fetch_all(&state.pool)
+        .await
+        .map_err(|e| {
+            tracing::error!("query execution error: {}", e);
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+
+    let json_rows: Vec<Value> = rows
+        .into_iter()
+        .map(crate::routes::crud::pg_row_to_json)
+        .collect();
+
+    Ok(Json(Value::Array(json_rows)))
+}
+```
+
+- [ ] **Step 2: Compile**
+
+```bash
+cargo build
+```
+Expected: `Finished`.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/routes/admin/queries.rs
+git commit -m "feat: add admin query registry CRUD routes"
+```
+
+---
+
+## Task 12: Admin routes — cache, users, permissions, blacklist
+
+**Files:**
+- Create: `src/routes/admin/cache.rs`
+- Create: `src/routes/admin/users.rs`
+- Create: `src/routes/admin/permissions.rs`
+- Create: `src/routes/admin/blacklist.rs`
+- Modify: `src/routes/admin/mod.rs`
+
+- [ ] **Step 1: Write src/routes/admin/cache.rs**
+
+```rust
+use axum::{extract::State, http::StatusCode, Json};
+use serde_json::{json, Value};
+
+use crate::{auth::Claims, state::AppState};
+use axum::extract::Extension;
+
+pub async fn cache_stats(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+) -> Json<Value> {
+    Json(json!({
+        "size": state.query_cache.len(),
+        "hits": state.query_cache.hits(),
+        "misses": state.query_cache.misses(),
+    }))
+}
+
+pub async fn flush_cache(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+) -> Result<Json<Value>, StatusCode> {
+    state.query_cache.flush();
+    Ok(Json(json!({ "flushed": true })))
+}
+```
+
+- [ ] **Step 2: Write src/routes/admin/users.rs**
+
+```rust
+use axum::{
+    extract::{Extension, Path, State},
+    http::StatusCode,
+    Json,
+};
+use serde_json::{json, Value};
+
+use crate::{
+    auth::{encode_jwt, Claims},
+    models::user::{CreateUser, UpdateUser, User},
+    state::AppState,
+};
+
+pub async fn list_users(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+) -> Result<Json<Vec<User>>, StatusCode> {
+    let users = sqlx::query_as!(
+        User,
+        "SELECT id, username, password_hash, permissions_mask, created_at FROM users ORDER BY id"
+    )
+    .fetch_all(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(users))
+}
+
+pub async fn get_user(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path(id): Path<i32>,
+) -> Result<Json<User>, StatusCode> {
+    let user = sqlx::query_as!(
+        User,
+        "SELECT id, username, password_hash, permissions_mask, created_at FROM users WHERE id = $1",
+        id
+    )
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    .ok_or(StatusCode::NOT_FOUND)?;
+    Ok(Json(user))
+}
+
+pub async fn create_user(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Json(body): Json<CreateUser>,
+) -> Result<Json<User>, StatusCode> {
+    let hash = bcrypt::hash(&body.password, bcrypt::DEFAULT_COST)
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    let mask = body.permissions_mask.unwrap_or_else(|| "0".into());
+    let user = sqlx::query_as!(
+        User,
+        "INSERT INTO users (username, password_hash, permissions_mask) VALUES ($1, $2, $3) RETURNING id, username, password_hash, permissions_mask, created_at",
+        body.username,
+        hash,
+        mask
+    )
+    .fetch_one(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(user))
+}
+
+pub async fn update_user(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path(id): Path<i32>,
+    Json(body): Json<UpdateUser>,
+) -> Result<Json<User>, StatusCode> {
+    let existing = sqlx::query_as!(
+        User,
+        "SELECT id, username, password_hash, permissions_mask, created_at FROM users WHERE id = $1",
+        id
+    )
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    .ok_or(StatusCode::NOT_FOUND)?;
+
+    let new_username = body.username.as_deref().unwrap_or(&existing.username);
+    let new_hash = if let Some(pw) = &body.password {
+        bcrypt::hash(pw, bcrypt::DEFAULT_COST).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    } else {
+        existing.password_hash.clone()
+    };
+    let new_mask = body.permissions_mask.as_deref().unwrap_or(&existing.permissions_mask);
+
+    let user = sqlx::query_as!(
+        User,
+        "UPDATE users SET username = $1, password_hash = $2, permissions_mask = $3 WHERE id = $4 RETURNING id, username, password_hash, permissions_mask, created_at",
+        new_username,
+        new_hash,
+        new_mask,
+        id
+    )
+    .fetch_one(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(user))
+}
+
+pub async fn delete_user(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path(id): Path<i32>,
+) -> Result<Json<Value>, StatusCode> {
+    sqlx::query!("DELETE FROM users WHERE id = $1", id)
+        .execute(&state.pool)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(json!({ "deleted": true })))
+}
+
+pub async fn grant_permission(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path((id, bit_value)): Path<(i32, String)>,
+) -> Result<Json<User>, StatusCode> {
+    let user = sqlx::query_as!(
+        User,
+        "SELECT id, username, password_hash, permissions_mask, created_at FROM users WHERE id = $1",
+        id
+    )
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    .ok_or(StatusCode::NOT_FOUND)?;
+
+    let current: u128 = user.permissions_mask.parse().unwrap_or(0);
+    let bit: u128 = bit_value.parse().map_err(|_| StatusCode::BAD_REQUEST)?;
+    let new_mask = (current | bit).to_string();
+
+    let updated = sqlx::query_as!(
+        User,
+        "UPDATE users SET permissions_mask = $1 WHERE id = $2 RETURNING id, username, password_hash, permissions_mask, created_at",
+        new_mask,
+        id
+    )
+    .fetch_one(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(updated))
+}
+
+pub async fn revoke_permission(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path((id, bit_value)): Path<(i32, String)>,
+) -> Result<Json<User>, StatusCode> {
+    let user = sqlx::query_as!(
+        User,
+        "SELECT id, username, password_hash, permissions_mask, created_at FROM users WHERE id = $1",
+        id
+    )
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    .ok_or(StatusCode::NOT_FOUND)?;
+
+    let current: u128 = user.permissions_mask.parse().unwrap_or(0);
+    let bit: u128 = bit_value.parse().map_err(|_| StatusCode::BAD_REQUEST)?;
+    let new_mask = (current & !bit).to_string();
+
+    let updated = sqlx::query_as!(
+        User,
+        "UPDATE users SET permissions_mask = $1 WHERE id = $2 RETURNING id, username, password_hash, permissions_mask, created_at",
+        new_mask,
+        id
+    )
+    .fetch_one(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(updated))
+}
+```
+
+- [ ] **Step 3: Write src/routes/admin/permissions.rs**
+
+```rust
+use axum::{
+    extract::{Extension, Path, State},
+    http::StatusCode,
+    Json,
+};
+use serde_json::{json, Value};
+
+use crate::{
+    auth::Claims,
+    models::permission::{CreatePermission, Permission, UpdatePermission},
+    state::AppState,
+};
+
+pub async fn list_permissions(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+) -> Result<Json<Vec<Permission>>, StatusCode> {
+    let perms = sqlx::query_as!(
+        Permission,
+        "SELECT id, name, bit_value, description FROM permissions ORDER BY id"
+    )
+    .fetch_all(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(perms))
+}
+
+pub async fn create_permission(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Json(body): Json<CreatePermission>,
+) -> Result<Json<Permission>, StatusCode> {
+    let existing: Vec<String> = sqlx::query_scalar!("SELECT bit_value FROM permissions")
+        .fetch_all(&state.pool)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .into_iter()
+        .flatten()
+        .collect();
+
+    let next_bit = (0u128..)
+        .map(|i| 1u128 << i)
+        .find(|bit| !existing.contains(&bit.to_string()))
+        .ok_or(StatusCode::INSUFFICIENT_STORAGE)?;
+
+    let perm = sqlx::query_as!(
+        Permission,
+        "INSERT INTO permissions (name, bit_value, description) VALUES ($1, $2, $3) RETURNING id, name, bit_value, description",
+        body.name,
+        next_bit.to_string(),
+        body.description
+    )
+    .fetch_one(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(perm))
+}
+
+pub async fn update_permission(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path(id): Path<i32>,
+    Json(body): Json<UpdatePermission>,
+) -> Result<Json<Permission>, StatusCode> {
+    let existing = sqlx::query_as!(
+        Permission,
+        "SELECT id, name, bit_value, description FROM permissions WHERE id = $1",
+        id
+    )
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    .ok_or(StatusCode::NOT_FOUND)?;
+
+    let new_name = body.name.as_deref().unwrap_or(&existing.name);
+    let new_desc = body.description.as_deref().or(existing.description.as_deref());
+
+    let perm = sqlx::query_as!(
+        Permission,
+        "UPDATE permissions SET name = $1, description = $2 WHERE id = $3 RETURNING id, name, bit_value, description",
+        new_name,
+        new_desc,
+        id
+    )
+    .fetch_one(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(perm))
+}
+
+pub async fn delete_permission(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path(id): Path<i32>,
+) -> Result<Json<Value>, StatusCode> {
+    sqlx::query!("DELETE FROM permissions WHERE id = $1", id)
+        .execute(&state.pool)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(json!({ "deleted": true })))
+}
+```
+
+- [ ] **Step 4: Write src/routes/admin/blacklist.rs**
+
+```rust
+use axum::{
+    extract::{Extension, Path, State},
+    http::StatusCode,
+    Json,
+};
+use serde_json::{json, Value};
+
+use crate::{
+    auth::Claims,
+    models::blacklist::{BlacklistEntry, CreateBlacklistEntry, UpdateBlacklistEntry},
+    state::AppState,
+};
+
+async fn reload_blacklist(state: &AppState) -> Result<(), StatusCode> {
+    let entries = sqlx::query_as!(
+        BlacklistEntry,
+        "SELECT id, pattern, method, reason, active, created_at FROM blacklist ORDER BY id"
+    )
+    .fetch_all(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    state.blacklist_cache.load(entries).await;
+    Ok(())
+}
+
+pub async fn list_blacklist(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+) -> Result<Json<Vec<BlacklistEntry>>, StatusCode> {
+    let entries = sqlx::query_as!(
+        BlacklistEntry,
+        "SELECT id, pattern, method, reason, active, created_at FROM blacklist ORDER BY id"
+    )
+    .fetch_all(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(entries))
+}
+
+pub async fn create_blacklist_entry(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Json(body): Json<CreateBlacklistEntry>,
+) -> Result<Json<BlacklistEntry>, StatusCode> {
+    let entry = sqlx::query_as!(
+        BlacklistEntry,
+        "INSERT INTO blacklist (pattern, method, reason) VALUES ($1, $2, $3) RETURNING id, pattern, method, reason, active, created_at",
+        body.pattern,
+        body.method,
+        body.reason
+    )
+    .fetch_one(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    reload_blacklist(&state).await?;
+    Ok(Json(entry))
+}
+
+pub async fn update_blacklist_entry(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path(id): Path<i32>,
+    Json(body): Json<UpdateBlacklistEntry>,
+) -> Result<Json<BlacklistEntry>, StatusCode> {
+    let existing = sqlx::query_as!(
+        BlacklistEntry,
+        "SELECT id, pattern, method, reason, active, created_at FROM blacklist WHERE id = $1",
+        id
+    )
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    .ok_or(StatusCode::NOT_FOUND)?;
+
+    let new_pattern = body.pattern.as_deref().unwrap_or(&existing.pattern);
+    let new_method = body.method.as_deref().or(existing.method.as_deref());
+    let new_reason = body.reason.as_deref().or(existing.reason.as_deref());
+    let new_active = body.active.unwrap_or(existing.active);
+
+    let entry = sqlx::query_as!(
+        BlacklistEntry,
+        "UPDATE blacklist SET pattern = $1, method = $2, reason = $3, active = $4 WHERE id = $5 RETURNING id, pattern, method, reason, active, created_at",
+        new_pattern,
+        new_method,
+        new_reason,
+        new_active,
+        id
+    )
+    .fetch_one(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    reload_blacklist(&state).await?;
+    Ok(Json(entry))
+}
+
+pub async fn delete_blacklist_entry(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path(id): Path<i32>,
+) -> Result<Json<Value>, StatusCode> {
+    sqlx::query!("DELETE FROM blacklist WHERE id = $1", id)
+        .execute(&state.pool)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    reload_blacklist(&state).await?;
+    Ok(Json(json!({ "deleted": true })))
+}
+```
+
+- [ ] **Step 5: Write src/routes/admin/mod.rs**
+
+```rust
+pub mod blacklist;
+pub mod cache;
+pub mod permissions;
+pub mod queries;
+pub mod users;
+
+use axum::{
+    middleware,
+    routing::{delete, get, post, put},
+    Router,
+};
+
+use crate::{
+    auth::middleware::{require_admin_cache, require_admin_query, require_super_admin},
+    state::AppState,
+};
+
+pub fn admin_router(state: AppState) -> Router<AppState> {
+    let query_routes = Router::new()
+        .route("/", get(queries::list_queries).post(queries::create_query))
+        .route(
+            "/:identifier",
+            get(queries::get_query)
+                .put(queries::update_query)
+                .delete(queries::delete_query),
+        )
+        .route("/:identifier/execute", get(queries::execute_query))
+        .route_layer(middleware::from_fn_with_state(
+            state.clone(),
+            require_admin_query,
+        ));
+
+    let cache_routes = Router::new()
+        .route("/stats", get(cache::cache_stats))
+        .route("/", delete(cache::flush_cache))
+        .route_layer(middleware::from_fn_with_state(
+            state.clone(),
+            require_admin_cache,
+        ));
+
+    let super_routes = Router::new()
+        .route("/users", get(users::list_users).post(users::create_user))
+        .route(
+            "/users/:id",
+            get(users::get_user)
+                .put(users::update_user)
+                .delete(users::delete_user),
+        )
+        .route(
+            "/users/:id/permissions/grant/:bit_value",
+            post(users::grant_permission),
+        )
+        .route(
+            "/users/:id/permissions/revoke/:bit_value",
+            delete(users::revoke_permission),
+        )
+        .route(
+            "/permissions",
+            get(permissions::list_permissions).post(permissions::create_permission),
+        )
+        .route(
+            "/permissions/:id",
+            put(permissions::update_permission).delete(permissions::delete_permission),
+        )
+        .route(
+            "/blacklist",
+            get(blacklist::list_blacklist).post(blacklist::create_blacklist_entry),
+        )
+        .route(
+            "/blacklist/:id",
+            put(blacklist::update_blacklist_entry).delete(blacklist::delete_blacklist_entry),
+        )
+        .route_layer(middleware::from_fn_with_state(
+            state.clone(),
+            require_super_admin,
+        ));
+
+    Router::new()
+        .nest("/queries", query_routes)
+        .nest("/cache", cache_routes)
+        .merge(super_routes)
+}
+```
+
+- [ ] **Step 6: Compile**
+
+```bash
+cargo build
+```
+Expected: `Finished`.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add src/routes/admin/
+git commit -m "feat: add admin routes for cache, users, permissions, and blacklist"
+```
+
+---
+
+## Task 13: main.rs — full wiring
+
+**Files:**
+- Modify: `src/main.rs`
+
+- [ ] **Step 1: Write full src/main.rs**
+
+```rust
+mod auth;
+mod cache;
+mod config;
+mod db;
+mod models;
+mod routes;
+mod state;
+
+use std::sync::Arc;
+
+use axum::{middleware, routing::{delete, get, post, put}, Router};
+use tower_http::{cors::CorsLayer, services::ServeDir};
+use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
+
+use crate::{
+    auth::middleware::blacklist_layer,
+    cache::spawn_sweep_task,
+    config::Config,
+    db::create_pool,
+    models::blacklist::BlacklistEntry,
+    routes::{
+        admin::admin_router,
+        auth::login,
+        crud::handle_crud,
+    },
+    state::{AppState, BlacklistCache, QueryCache},
+};
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    dotenvy::dotenv().ok();
+
+    tracing_subscriber::registry()
+        .with(tracing_subscriber::EnvFilter::try_from_default_env()
+            .unwrap_or_else(|_| "mercury=info".into()))
+        .with(tracing_subscriber::fmt::layer())
+        .init();
+
+    let config = Arc::new(Config::from_env()?);
+    let pool = create_pool(&config.database_url).await?;
+
+    // Seed admin user if not present
+    let count: i64 = sqlx::query_scalar!("SELECT COUNT(*) FROM users WHERE username = 'admin'")
+        .fetch_one(&pool)
+        .await?
+        .unwrap_or(0);
+    if count == 0 {
+        let hash = bcrypt::hash("admin", bcrypt::DEFAULT_COST)?;
+        sqlx::query!(
+            "INSERT INTO users (username, password_hash, permissions_mask) VALUES ('admin', $1, '63')",
+            hash
+        )
+        .execute(&pool)
+        .await?;
+        tracing::info!("seeded admin user");
+    }
+
+    let query_cache = QueryCache::new();
+    let blacklist_cache = BlacklistCache::new();
+
+    // Load blacklist from DB into memory
+    let entries = sqlx::query_as!(
+        BlacklistEntry,
+        "SELECT id, pattern, method, reason, active, created_at FROM blacklist ORDER BY id"
+    )
+    .fetch_all(&pool)
+    .await?;
+    blacklist_cache.load(entries).await;
+
+    // Start cache sweep
+    spawn_sweep_task(
+        query_cache.clone(),
+        config.cache_idle_timeout_secs,
+        config.cache_sweep_interval_secs,
+    );
+
+    let state = AppState {
+        pool,
+        query_cache,
+        blacklist_cache,
+        config: config.clone(),
+    };
+
+    let crud_routes = Router::new()
+        .route("/api/:table", get(handle_crud).post(handle_crud))
+        .route("/api/:table/:id", get(handle_crud).put(handle_crud).delete(handle_crud))
+        .route_layer(middleware::from_fn_with_state(state.clone(), blacklist_layer));
+
+    let app = Router::new()
+        .route("/auth/login", post(login))
+        .merge(crud_routes)
+        .nest("/admin", admin_router(state.clone()))
+        .nest_service("/", ServeDir::new("ui/dist"))
+        .layer(CorsLayer::permissive())
+        .with_state(state);
+
+    let addr = std::net::SocketAddr::from(([0, 0, 0, 0], 3000));
+    tracing::info!("listening on {}", addr);
+    let listener = tokio::net::TcpListener::bind(addr).await?;
+    axum::serve(listener, app).await?;
+    Ok(())
+}
+```
+
+- [ ] **Step 2: Compile**
+
+```bash
+cargo build
+```
+Expected: `Finished`.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/main.rs
+git commit -m "feat: wire full Axum router with middleware, CRUD, admin, and static file serving"
+```
+
+---
+
+## Task 14: Docker setup
+
+**Files:**
+- Create: `Dockerfile`
+- Create: `docker-compose.yml`
+
+- [ ] **Step 1: Write Dockerfile**
+
+```dockerfile
+# Stage 1: Build Vue UI
+FROM node:20-alpine AS ui-builder
+WORKDIR /ui
+COPY ui/.npmrc .
+COPY ui/package*.json .
+RUN npm install
+COPY ui/ .
+RUN npm run build
+
+# Stage 2: Build Rust API
+FROM rust:1.75-slim AS api-builder
+RUN apt-get update && apt-get install -y pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY Cargo.toml Cargo.lock ./
+COPY src/ src/
+RUN cargo build --release
+
+# Stage 3: Final image
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY --from=api-builder /app/target/release/mercury .
+COPY --from=ui-builder /ui/dist ./ui/dist
+EXPOSE 3000
+CMD ["./mercury"]
+```
+
+- [ ] **Step 2: Write docker-compose.yml**
+
+```yaml
+services:
+  db:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: mercury
+      POSTGRES_PASSWORD: mercury
+      POSTGRES_DB: mercury
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U mercury"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  api:
+    build: .
+    ports:
+      - "3000:3000"
+    environment:
+      DATABASE_URL: postgres://mercury:mercury@db:5432/mercury
+      JWT_SECRET: ${JWT_SECRET:-change_me_in_production}
+      JWT_EXPIRY_SECS: ${JWT_EXPIRY_SECS:-3600}
+      CACHE_MAX_CAPACITY: ${CACHE_MAX_CAPACITY:-10000}
+      CACHE_IDLE_TIMEOUT_SECS: ${CACHE_IDLE_TIMEOUT_SECS:-300}
+      CACHE_SWEEP_INTERVAL_SECS: ${CACHE_SWEEP_INTERVAL_SECS:-60}
+    depends_on:
+      db:
+        condition: service_healthy
+    mem_limit: 512m
+    mem_reservation: 256m
+
+volumes:
+  postgres_data:
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add Dockerfile docker-compose.yml
+git commit -m "feat: add multi-stage Dockerfile and docker-compose"
+```
+
+---
+
+## Task 15: Vue UI scaffold
+
+**Files:**
+- Create: `ui/.npmrc`
+- Create: `ui/package.json`
+- Create: `ui/vite.config.ts`
+- Create: `ui/src/main.ts`
+- Create: `ui/src/App.vue`
+- Create: `ui/src/router/index.ts`
+- Create: `ui/src/stores/auth.ts`
+
+- [ ] **Step 1: Write ui/.npmrc**
+
+```
+@nychthemeron:registry=https://git.mcpeakdev.com/api/packages/McPeakDev/npm/
+```
+
+- [ ] **Step 2: Write ui/package.json**
+
+```json
+{
+  "name": "mercury-ui",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vue-tsc && vite build",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@nychthemeron/library": "latest",
+    "pinia": "^2.1.0",
+    "vue": "^3.4.0",
+    "vue-router": "^4.3.0"
+  },
+  "devDependencies": {
+    "@vitejs/plugin-vue": "^5.0.0",
+    "typescript": "^5.3.0",
+    "vite": "^5.0.0",
+    "vue-tsc": "^2.0.0"
+  }
+}
+```
+
+- [ ] **Step 3: Write ui/vite.config.ts**
+
+```typescript
+import { defineConfig } from 'vite'
+import vue from '@vitejs/plugin-vue'
+
+export default defineConfig({
+  plugins: [vue()],
+  server: {
+    proxy: {
+      '/api': 'http://localhost:3000',
+      '/auth': 'http://localhost:3000',
+      '/admin': 'http://localhost:3000',
+    },
+  },
+  build: {
+    outDir: 'dist',
+  },
+})
+```
+
+- [ ] **Step 4: Write ui/src/stores/auth.ts**
+
+```typescript
+import { defineStore } from 'pinia'
+import { ref, computed } from 'vue'
+
+interface Claims {
+  sub: string
+  permissions: string
+  exp: number
+}
+
+function parseJwt(token: string): Claims | null {
+  try {
+    const payload = token.split('.')[1]
+    return JSON.parse(atob(payload)) as Claims
+  } catch {
+    return null
+  }
+}
+
+export const useAuthStore = defineStore('auth', () => {
+  const token = ref<string | null>(localStorage.getItem('mercury_token'))
+  const claims = computed<Claims | null>(() =>
+    token.value ? parseJwt(token.value) : null
+  )
+  const isAuthenticated = computed(() => {
+    if (!claims.value) return false
+    return claims.value.exp * 1000 > Date.now()
+  })
+  const username = computed(() => claims.value?.sub ?? '')
+
+  function hasPermission(bit: bigint): boolean {
+    if (!claims.value) return false
+    const mask = BigInt(claims.value.permissions)
+    return (mask & bit) !== 0n
+  }
+
+  const isSuperAdmin = computed(() => hasPermission(32n))
+
+  async function login(username: string, password: string): Promise<void> {
+    const res = await fetch('/auth/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ username, password }),
+    })
+    if (!res.ok) throw new Error('Invalid credentials')
+    const data = await res.json()
+    token.value = data.token
+    localStorage.setItem('mercury_token', data.token)
+  }
+
+  function logout() {
+    token.value = null
+    localStorage.removeItem('mercury_token')
+  }
+
+  function authHeaders(): Record<string, string> {
+    return token.value ? { Authorization: `Bearer ${token.value}` } : {}
+  }
+
+  return { token, claims, isAuthenticated, username, isSuperAdmin, hasPermission, login, logout, authHeaders }
+})
+```
+
+- [ ] **Step 5: Write ui/src/router/index.ts**
+
+```typescript
+import { createRouter, createWebHistory } from 'vue-router'
+import { useAuthStore } from '../stores/auth'
+
+const router = createRouter({
+  history: createWebHistory(),
+  routes: [
+    { path: '/login', component: () => import('../views/Login.vue') },
+    {
+      path: '/admin',
+      component: () => import('../views/admin/Layout.vue'),
+      children: [
+        { path: 'queries', component: () => import('../views/admin/Queries.vue') },
+        { path: 'users', component: () => import('../views/admin/Users.vue') },
+        { path: 'permissions', component: () => import('../views/admin/Permissions.vue') },
+        { path: 'blacklist', component: () => import('../views/admin/Blacklist.vue') },
+        { path: 'cache', component: () => import('../views/admin/Cache.vue') },
+      ],
+      meta: { requiresAuth: true },
+    },
+    { path: '/', redirect: '/admin/queries' },
+  ],
+})
+
+router.beforeEach((to) => {
+  const auth = useAuthStore()
+  if (to.meta.requiresAuth && !auth.isAuthenticated) {
+    return '/login'
+  }
+  if (to.path === '/login' && auth.isAuthenticated) {
+    return '/admin/queries'
+  }
+})
+
+export default router
+```
+
+- [ ] **Step 6: Write ui/src/main.ts**
+
+```typescript
+import { createApp } from 'vue'
+import { createPinia } from 'pinia'
+import NychthemeronLibrary from '@nychthemeron/library'
+import App from './App.vue'
+import router from './router'
+
+const app = createApp(App)
+app.use(createPinia())
+app.use(router)
+app.use(NychthemeronLibrary, { theme: 'dark' })
+app.mount('#app')
+```
+
+- [ ] **Step 7: Write ui/src/App.vue**
+
+```vue
+<template>
+  <RouterView />
+</template>
+```
+
+- [ ] **Step 8: Create ui/src/views/Login.vue**
+
+```vue
+<template>
+  <div class="login-page">
+    <div class="login-card">
+      <h1>Mercury</h1>
+      <form @submit.prevent="handleLogin">
+        <NInput v-model="username" placeholder="Username" />
+        <NInput v-model="password" type="password" placeholder="Password" />
+        <NButton type="submit" :loading="loading">Sign In</NButton>
+        <p v-if="error" class="error">{{ error }}</p>
+      </form>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref } from 'vue'
+import { useRouter } from 'vue-router'
+import { useAuthStore } from '../stores/auth'
+
+const auth = useAuthStore()
+const router = useRouter()
+const username = ref('')
+const password = ref('')
+const loading = ref(false)
+const error = ref('')
+
+async function handleLogin() {
+  loading.value = true
+  error.value = ''
+  try {
+    await auth.login(username.value, password.value)
+    router.push('/admin/queries')
+  } catch {
+    error.value = 'Invalid username or password'
+  } finally {
+    loading.value = false
+  }
+}
+</script>
+
+<style scoped>
+.login-page {
+  display: flex;
+  height: 100vh;
+  align-items: center;
+  justify-content: center;
+}
+.login-card {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+  padding: 2rem;
+  min-width: 320px;
+}
+form {
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+}
+.error {
+  color: var(--color-error, #f44);
+}
+</style>
+```
+
+- [ ] **Step 9: Commit**
+
+```bash
+git add ui/
+git commit -m "feat: scaffold Vue 3 UI with auth store, router, and login view"
+```
+
+---
+
+## Task 16: Admin views
+
+**Files:**
+- Create: `ui/src/views/admin/Layout.vue`
+- Create: `ui/src/views/admin/Queries.vue`
+- Create: `ui/src/views/admin/Users.vue`
+- Create: `ui/src/views/admin/Permissions.vue`
+- Create: `ui/src/views/admin/Blacklist.vue`
+- Create: `ui/src/views/admin/Cache.vue`
+
+- [ ] **Step 1: Write ui/src/views/admin/Layout.vue**
+
+```vue
+<template>
+  <div class="admin-layout">
+    <nav class="sidebar">
+      <h2>Mercury</h2>
+      <ul>
+        <li><RouterLink to="/admin/queries">Queries</RouterLink></li>
+        <li><RouterLink to="/admin/users">Users</RouterLink></li>
+        <li><RouterLink to="/admin/permissions">Permissions</RouterLink></li>
+        <li><RouterLink to="/admin/blacklist">Blacklist</RouterLink></li>
+        <li><RouterLink to="/admin/cache">Cache</RouterLink></li>
+      </ul>
+      <NButton @click="handleLogout" variant="ghost">Logout</NButton>
+    </nav>
+    <main class="content">
+      <RouterView />
+    </main>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useRouter } from 'vue-router'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const router = useRouter()
+function handleLogout() {
+  auth.logout()
+  router.push('/login')
+}
+</script>
+
+<style scoped>
+.admin-layout { display: flex; height: 100vh; }
+.sidebar { width: 220px; padding: 1.5rem; display: flex; flex-direction: column; gap: 1rem; border-right: 1px solid var(--color-border, #333); }
+.sidebar ul { list-style: none; padding: 0; display: flex; flex-direction: column; gap: 0.5rem; flex: 1; }
+.content { flex: 1; padding: 2rem; overflow-y: auto; }
+</style>
+```
+
+- [ ] **Step 2: Write ui/src/views/admin/Queries.vue**
+
+```vue
+<template>
+  <div>
+    <h2>Query Registry</h2>
+    <NButton @click="showCreate = true">+ New Query</NButton>
+
+    <NTable :data="queries" :columns="columns" />
+
+    <NModal v-model="showCreate" title="New Query">
+      <form @submit.prevent="submitCreate">
+        <NInput v-model="form.identifier" placeholder="identifier-slug" />
+        <NInput v-model="form.description" placeholder="Description (optional)" />
+        <NTextarea v-model="form.sql_template" placeholder="SELECT * FROM ... WHERE id = :id" rows="6" />
+        <NButton type="submit">Save</NButton>
+      </form>
+    </NModal>
+
+    <NModal v-model="showEdit" title="Edit Query">
+      <form @submit.prevent="submitEdit">
+        <NTextarea v-model="editForm.sql_template" rows="6" />
+        <NInput v-model="editForm.description" placeholder="Description" />
+        <NButton type="submit">Update</NButton>
+      </form>
+    </NModal>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const queries = ref<any[]>([])
+const showCreate = ref(false)
+const showEdit = ref(false)
+const editIdentifier = ref('')
+const form = ref({ identifier: '', sql_template: '', description: '' })
+const editForm = ref({ sql_template: '', description: '' })
+
+const columns = [
+  { key: 'identifier', label: 'Identifier' },
+  { key: 'description', label: 'Description' },
+  { key: 'updated_at', label: 'Updated' },
+  {
+    key: 'actions', label: 'Actions',
+    render: (row: any) => ({
+      edit: () => openEdit(row),
+      delete: () => deleteQuery(row.identifier),
+    }),
+  },
+]
+
+async function load() {
+  const res = await fetch('/admin/queries', { headers: auth.authHeaders() })
+  queries.value = await res.json()
+}
+
+async function submitCreate() {
+  await fetch('/admin/queries', {
+    method: 'POST',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify(form.value),
+  })
+  showCreate.value = false
+  form.value = { identifier: '', sql_template: '', description: '' }
+  load()
+}
+
+function openEdit(row: any) {
+  editIdentifier.value = row.identifier
+  editForm.value = { sql_template: row.sql_template, description: row.description ?? '' }
+  showEdit.value = true
+}
+
+async function submitEdit() {
+  await fetch(`/admin/queries/${editIdentifier.value}`, {
+    method: 'PUT',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify(editForm.value),
+  })
+  showEdit.value = false
+  load()
+}
+
+async function deleteQuery(identifier: string) {
+  if (!confirm(`Delete query "${identifier}"?`)) return
+  await fetch(`/admin/queries/${identifier}`, { method: 'DELETE', headers: auth.authHeaders() })
+  load()
+}
+
+onMounted(load)
+</script>
+```
+
+- [ ] **Step 3: Write ui/src/views/admin/Users.vue**
+
+```vue
+<template>
+  <div>
+    <h2>Users</h2>
+    <NButton @click="showCreate = true">+ New User</NButton>
+    <NTable :data="users" :columns="columns" />
+
+    <NModal v-model="showCreate" title="New User">
+      <form @submit.prevent="submitCreate">
+        <NInput v-model="form.username" placeholder="Username" />
+        <NInput v-model="form.password" type="password" placeholder="Password" />
+        <NInput v-model="form.permissions_mask" placeholder="Permissions mask (default: 0)" />
+        <NButton type="submit">Create</NButton>
+      </form>
+    </NModal>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const users = ref<any[]>([])
+const showCreate = ref(false)
+const form = ref({ username: '', password: '', permissions_mask: '0' })
+
+const columns = [
+  { key: 'id', label: 'ID' },
+  { key: 'username', label: 'Username' },
+  { key: 'permissions_mask', label: 'Permissions Mask' },
+  { key: 'created_at', label: 'Created' },
+  {
+    key: 'actions', label: 'Actions',
+    render: (row: any) => ({ delete: () => deleteUser(row.id) }),
+  },
+]
+
+async function load() {
+  const res = await fetch('/admin/users', { headers: auth.authHeaders() })
+  users.value = await res.json()
+}
+
+async function submitCreate() {
+  await fetch('/admin/users', {
+    method: 'POST',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify(form.value),
+  })
+  showCreate.value = false
+  form.value = { username: '', password: '', permissions_mask: '0' }
+  load()
+}
+
+async function deleteUser(id: number) {
+  if (!confirm('Delete this user?')) return
+  await fetch(`/admin/users/${id}`, { method: 'DELETE', headers: auth.authHeaders() })
+  load()
+}
+
+onMounted(load)
+</script>
+```
+
+- [ ] **Step 4: Write ui/src/views/admin/Permissions.vue**
+
+```vue
+<template>
+  <div>
+    <h2>Permissions</h2>
+    <NButton @click="showCreate = true">+ New Permission</NButton>
+    <NTable :data="permissions" :columns="columns" />
+
+    <NModal v-model="showCreate" title="New Permission">
+      <form @submit.prevent="submitCreate">
+        <NInput v-model="form.name" placeholder="PERMISSION_NAME" />
+        <NInput v-model="form.description" placeholder="Description" />
+        <NButton type="submit">Create</NButton>
+      </form>
+    </NModal>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const permissions = ref<any[]>([])
+const showCreate = ref(false)
+const form = ref({ name: '', description: '' })
+
+const columns = [
+  { key: 'id', label: 'ID' },
+  { key: 'name', label: 'Name' },
+  { key: 'bit_value', label: 'Bit Value' },
+  { key: 'description', label: 'Description' },
+  {
+    key: 'actions', label: 'Actions',
+    render: (row: any) => ({ delete: () => deletePermission(row.id) }),
+  },
+]
+
+async function load() {
+  const res = await fetch('/admin/permissions', { headers: auth.authHeaders() })
+  permissions.value = await res.json()
+}
+
+async function submitCreate() {
+  await fetch('/admin/permissions', {
+    method: 'POST',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify(form.value),
+  })
+  showCreate.value = false
+  form.value = { name: '', description: '' }
+  load()
+}
+
+async function deletePermission(id: number) {
+  if (!confirm('Delete this permission?')) return
+  await fetch(`/admin/permissions/${id}`, { method: 'DELETE', headers: auth.authHeaders() })
+  load()
+}
+
+onMounted(load)
+</script>
+```
+
+- [ ] **Step 5: Write ui/src/views/admin/Blacklist.vue**
+
+```vue
+<template>
+  <div>
+    <h2>Route Blacklist</h2>
+    <NButton @click="showCreate = true">+ Add Pattern</NButton>
+    <NTable :data="entries" :columns="columns" />
+
+    <NModal v-model="showCreate" title="New Blacklist Entry">
+      <form @submit.prevent="submitCreate">
+        <NInput v-model="form.pattern" placeholder="/api/sensitive/**" />
+        <NInput v-model="form.method" placeholder="HTTP method (blank = all)" />
+        <NInput v-model="form.reason" placeholder="Reason" />
+        <NButton type="submit">Add</NButton>
+      </form>
+    </NModal>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const entries = ref<any[]>([])
+const showCreate = ref(false)
+const form = ref({ pattern: '', method: '', reason: '' })
+
+const columns = [
+  { key: 'id', label: 'ID' },
+  { key: 'pattern', label: 'Pattern' },
+  { key: 'method', label: 'Method' },
+  { key: 'active', label: 'Active' },
+  { key: 'reason', label: 'Reason' },
+  {
+    key: 'actions', label: 'Actions',
+    render: (row: any) => ({
+      toggle: () => toggleEntry(row),
+      delete: () => deleteEntry(row.id),
+    }),
+  },
+]
+
+async function load() {
+  const res = await fetch('/admin/blacklist', { headers: auth.authHeaders() })
+  entries.value = await res.json()
+}
+
+async function submitCreate() {
+  await fetch('/admin/blacklist', {
+    method: 'POST',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      pattern: form.value.pattern,
+      method: form.value.method || null,
+      reason: form.value.reason || null,
+    }),
+  })
+  showCreate.value = false
+  form.value = { pattern: '', method: '', reason: '' }
+  load()
+}
+
+async function toggleEntry(row: any) {
+  await fetch(`/admin/blacklist/${row.id}`, {
+    method: 'PUT',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify({ active: !row.active }),
+  })
+  load()
+}
+
+async function deleteEntry(id: number) {
+  if (!confirm('Delete this blacklist entry?')) return
+  await fetch(`/admin/blacklist/${id}`, { method: 'DELETE', headers: auth.authHeaders() })
+  load()
+}
+
+onMounted(load)
+</script>
+```
+
+- [ ] **Step 6: Write ui/src/views/admin/Cache.vue**
+
+```vue
+<template>
+  <div>
+    <h2>Cache</h2>
+    <div v-if="stats" class="stats">
+      <NCard>
+        <p>Size: {{ stats.size }}</p>
+        <p>Hits: {{ stats.hits }}</p>
+        <p>Misses: {{ stats.misses }}</p>
+        <p>Hit rate: {{ hitRate }}%</p>
+      </NCard>
+    </div>
+    <NButton @click="load">Refresh</NButton>
+    <NButton variant="danger" @click="flushCache">Flush Cache</NButton>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, computed, onMounted } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const stats = ref<{ size: number; hits: number; misses: number } | null>(null)
+
+const hitRate = computed(() => {
+  if (!stats.value) return 0
+  const total = stats.value.hits + stats.value.misses
+  return total === 0 ? 0 : Math.round((stats.value.hits / total) * 100)
+})
+
+async function load() {
+  const res = await fetch('/admin/cache/stats', { headers: auth.authHeaders() })
+  stats.value = await res.json()
+}
+
+async function flushCache() {
+  if (!confirm('Flush the entire query cache?')) return
+  await fetch('/admin/cache', { method: 'DELETE', headers: auth.authHeaders() })
+  load()
+}
+
+onMounted(load)
+</script>
+
+<style scoped>
+.stats { margin-bottom: 1rem; }
+</style>
+```
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add ui/src/views/
+git commit -m "feat: add admin views for queries, users, permissions, blacklist, cache"
+```
+
+---
+
+## Task 17: README update
+
+**Files:**
+- Modify: `README.md`
+
+- [ ] **Step 1: Write README.md**
+
+```markdown
+# Mercury
+
+A high-performance, monolithic Rust API with a dynamic CRUD engine, query registry cache, JWT bitmask permissions, and a Vue 3 admin frontend.
+
+## Quick Start
+
+```bash
+cp .env.example .env          # set JWT_SECRET
+docker compose up --build
+```
+
+API: http://localhost:3000/api  
+Admin UI: http://localhost:3000  
+Default credentials: `admin` / `admin`
+
+---
+
+## API Contract
+
+### Authentication
+
+```
+POST /auth/login
+Body: { "username": "...", "password": "..." }
+Returns: { "token": "<JWT>" }
+```
+
+All admin routes require `Authorization: Bearer <token>`.
+
+---
+
+### CRUD — Dynamic Table Access
+
+Requests are mapped to the named PostgreSQL table. The SQL is generated, cached, and executed automatically.
+
+```
+GET    /api/{table}              List all rows (supports ?col=val filters)
+GET    /api/{table}/{id}         Get row by id
+POST   /api/{table}              Insert row (JSON body)
+PUT    /api/{table}/{id}         Update row by id (JSON body)
+DELETE /api/{table}/{id}         Delete row by id
+```
+
+**Notes:**
+- `users` and `permissions` tables are blacklisted from public CRUD — use the admin suite.
+- Filters are ANDed together: `GET /api/orders?status=open&priority=high`
+
+---
+
+### Admin — Query Registry
+
+Requires JWT with `ADMIN_QUERY` permission (bit 8).
+
+```
+GET    /admin/queries                          List all registered queries
+POST   /admin/queries                          Register a raw SQL template
+GET    /admin/queries/{identifier}             Get query by slug
+PUT    /admin/queries/{identifier}             Update SQL template or description
+DELETE /admin/queries/{identifier}             Remove query (evicts from cache)
+GET    /admin/queries/{identifier}/execute     Execute query with ?param=val bindings
+```
+
+SQL templates use `:param_name` placeholders:
+```sql
+SELECT * FROM orders WHERE user_id = :user_id AND status = :status
+```
+
+---
+
+### Admin — Cache
+
+Requires JWT with `ADMIN_CACHE` permission (bit 16).
+
+```
+GET    /admin/cache/stats    Cache size, hit count, miss count
+DELETE /admin/cache          Flush entire cache
+```
+
+---
+
+### Admin — Users
+
+Requires JWT with `SUPER_ADMIN` permission (bit 32).
+
+```
+GET    /admin/users                                   List users
+POST   /admin/users                                   Create user
+GET    /admin/users/{id}                              Get user
+PUT    /admin/users/{id}                              Update user
+DELETE /admin/users/{id}                              Delete user
+POST   /admin/users/{id}/permissions/grant/{bit}      OR bit into permissions mask
+DELETE /admin/users/{id}/permissions/revoke/{bit}     AND NOT bit from permissions mask
+```
+
+---
+
+### Admin — Permissions
+
+Requires JWT with `SUPER_ADMIN` permission (bit 32).
+
+```
+GET    /admin/permissions          List permission definitions
+POST   /admin/permissions          Create custom permission (auto-assigns next bit)
+PUT    /admin/permissions/{id}     Update name/description
+DELETE /admin/permissions/{id}     Remove permission
+```
+
+---
+
+### Admin — Route Blacklist
+
+Requires JWT with `SUPER_ADMIN` permission (bit 32). Changes take effect immediately in memory.
+
+```
+GET    /admin/blacklist          List all entries
+POST   /admin/blacklist          Add glob pattern
+PUT    /admin/blacklist/{id}     Update entry (set active: false to disable)
+DELETE /admin/blacklist/{id}     Remove entry
+```
+
+Pattern syntax: `*` matches one path segment, `**` matches many.  
+Example: `/api/sensitive/**` blocks all methods under that path.
+
+---
+
+## Permission Bitmask
+
+| Name        | Bit | Value |
+|-------------|-----|-------|
+| READ        | 0   | 1     |
+| WRITE       | 1   | 2     |
+| DELETE      | 2   | 4     |
+| ADMIN_QUERY | 3   | 8     |
+| ADMIN_CACHE | 4   | 16    |
+| SUPER_ADMIN | 5   | 32    |
+
+Custom permissions are added via the admin suite and assigned the next available power-of-2 bit. Masks support up to 128 bits (u128).
+
+---
+
+## Configuration
+
+| Variable | Default | Description |
+|---|---|---|
+| `DATABASE_URL` | required | PostgreSQL connection string |
+| `JWT_SECRET` | required | HMAC-HS256 signing secret |
+| `JWT_EXPIRY_SECS` | 3600 | Token lifetime in seconds |
+| `CACHE_MAX_CAPACITY` | 10000 | Max query templates in memory |
+| `CACHE_IDLE_TIMEOUT_SECS` | 300 | Evict after N seconds idle |
+| `CACHE_SWEEP_INTERVAL_SECS` | 60 | Sweep interval for eviction task |
+
+---
+
+## Development
+
+```bash
+# API only (requires local Postgres)
+cargo run
+
+# UI dev server (proxies to local API)
+cd ui && npm install && npm run dev
+
+# Full stack
+docker compose up --build
+```
+
+## Stack
+
+- **API:** Rust, Axum, SQLx, PostgreSQL, DashMap, jsonwebtoken, bcrypt
+- **Frontend:** Vue 3, Vite, @nychthemeron/library (dark mode default)
+- **Infra:** Docker multi-stage build, docker compose
+```
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add README.md
+git commit -m "docs: update README with full API contract and configuration"
+```
+
+---
+
+## Self-Review Checklist
+
+### Spec Coverage
+
+| Spec requirement | Task |
+|---|---|
+| Axum + SQLx + PostgreSQL | Task 1, 4 |
+| Config from env vars | Task 2 |
+| DashMap TTI cache with sweep | Task 5, 6 |
+| Blacklist in-memory with glob | Task 5 |
+| JWT with u128 bitmask | Task 7 |
+| Auth + blacklist middleware | Task 8 |
+| CRUD query builder | Task 10 |
+| /auth/login | Task 9 |
+| Admin query registry CRUD | Task 11 |
+| Admin cache stats + flush | Task 12 |
+| Admin user management | Task 12 |
+| Admin permission definitions | Task 12 |
+| Admin blacklist CRUD + reload | Task 12 |
+| Router assembly + main.rs | Task 13 |
+| Dockerfile multi-stage | Task 14 |
+| docker-compose with mem_limit | Task 14 |
+| Admin seeded in migration | Task 4 (schema) + Task 13 (seed on startup) |
+| Vue 3 + @nychthemeron/library | Task 15 |
+| Dark mode default | Task 15 (main.ts) |
+| Login view | Task 15 |
+| Admin views (5 pages) | Task 16 |
+| README with API contract | Task 17 |
+| `users`/`permissions` blacklisted | Task 4 (migration seed) |
+| Blacklist reloads on write | Task 12 (blacklist.rs) |
+| Permission grant/revoke endpoints | Task 12 (users.rs) |
+| Custom permissions auto-assign bit | Task 12 (permissions.rs) |
+
+All spec requirements covered. No gaps found.
diff --git a/docs/superpowers/plans/2026-06-17-security-fixes.md b/docs/superpowers/plans/2026-06-17-security-fixes.md
new file mode 100644
index 0000000..0c7736d
--- /dev/null
+++ b/docs/superpowers/plans/2026-06-17-security-fixes.md
@@ -0,0 +1,1072 @@
+# Security Fixes Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Fix all Critical, Important, and Minor security/robustness issues identified in the June 2026 code review.
+
+**Architecture:** Fixes are applied in dependency order — shared utilities first, then middleware, then handlers, then startup. No new crates required except `rpassword` is intentionally avoided (plain stdin for first-user prompt is acceptable).
+
+**Tech Stack:** Rust, Axum 0.7, SQLx 0.7, jsonwebtoken 9, bcrypt 0.15, DashMap 5, tower-http 0.5
+
+---
+
+## File Map
+
+| File | Changes |
+|------|---------|
+| `src/state.rs` | Fix `unix_now()` panic |
+| `src/routes/mod.rs` | Add shared `is_valid_identifier()` |
+| `src/routes/admin/tables.rs` | Use shared validator, add `PROTECTED_TABLES` denylist |
+| `src/routes/admin/queries.rs` | Sort params longest-first before substitution |
+| `src/routes/crud.rs` | Fix cache key, drop NULL_SENTINEL, enforce R/W/D bits, use shared validator |
+| `src/auth/middleware.rs` | Stash Claims in extensions in `blacklist_layer`; add `authenticate()` helper |
+| `src/config.rs` | Add `cors_origins: Vec<String>` field |
+| `src/main.rs` | First-user interactive prompt, body size limit, configured CORS |
+
+---
+
+## Task 1: Fix `unix_now()` panic on sub-epoch clock
+
+**Files:**
+- Modify: `src/state.rs:16-19`
+
+- [ ] **Step 1: Apply the fix**
+
+Change `src/state.rs`:
+```rust
+pub fn unix_now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+```
+
+- [ ] **Step 2: Run tests**
+
+```bash
+cargo test
+```
+Expected: all tests pass.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/state.rs
+git commit -m "fix: don't panic in unix_now() when clock is before epoch"
+```
+
+---
+
+## Task 2: Fix stored query prefix-substitution bug
+
+**Files:**
+- Modify: `src/routes/admin/queries.rs:29-30`
+
+**The bug:** When sorted alphabetically, `:user` is replaced before `:username`, turning `:username` into `$1name` — invalid SQL.
+
+- [ ] **Step 1: Write a failing test**
+
+Add to `src/routes/admin/queries.rs` (at the bottom, inside a `#[cfg(test)]` block — create the block if it doesn't exist):
+
+```rust
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn test_prefix_param_substitution_order() {
+        // Simulate the substitution logic with a prefix-conflicting pair.
+        let template = "SELECT * FROM t WHERE user_id = :user_id AND username = :username";
+        let mut params: Vec<(String, String)> = vec![
+            ("user_id".into(), "42".into()),
+            ("username".into(), "alice".into()),
+        ];
+        // Sort longest-first (the fix)
+        params.sort_by(|a, b| b.0.len().cmp(&a.0.len()));
+        let mut sql = template.to_string();
+        for (i, (name, _)) in params.iter().enumerate() {
+            sql = sql.replace(&format!(":{}", name), &format!("${}", i + 1));
+        }
+        assert!(sql.contains("$1") && sql.contains("$2"), "sql: {}", sql);
+        assert!(!sql.contains(":username"), "placeholder not replaced: {}", sql);
+        assert!(!sql.contains(":user_id"), "placeholder not replaced: {}", sql);
+        // username (len 8) should be $1, user_id (len 7) should be $2
+        assert_eq!(sql, "SELECT * FROM t WHERE user_id = $2 AND username = $1");
+    }
+}
+```
+
+- [ ] **Step 2: Run test to confirm it fails before the fix**
+
+```bash
+cargo test test_prefix_param_substitution_order
+```
+Expected: FAIL (currently sorts alphabetically, not by length).
+
+- [ ] **Step 3: Apply the fix in `execute_query`**
+
+In `src/routes/admin/queries.rs`, change line 30 from:
+```rust
+sorted_params.sort_by(|a, b| a.0.cmp(&b.0));
+```
+to:
+```rust
+sorted_params.sort_by(|a, b| b.0.len().cmp(&a.0.len()).then(a.0.cmp(&b.0)));
+```
+
+- [ ] **Step 4: Run test to confirm it passes**
+
+```bash
+cargo test test_prefix_param_substitution_order
+```
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/routes/admin/queries.rs
+git commit -m "fix: sort stored query params longest-first to prevent prefix substitution corruption"
+```
+
+---
+
+## Task 3: Fix cache key collision between by-id lookup and column filter
+
+**Files:**
+- Modify: `src/routes/crud.rs:48`
+
+**The bug:** `GET /api/users/by_id` and `GET /api/users?by_id=foo` both produce key `"GET:users:by_id"`. Tilde (`~`) is not a valid identifier character so `"~id"` can never collide with a column name.
+
+- [ ] **Step 1: Update the existing test to expect the new key**
+
+In `src/routes/crud.rs` tests, change `test_build_select_by_id`:
+```rust
+#[test]
+fn test_build_select_by_id() {
+    let (sql, params, key) = build_query("GET", "orders", Some("42"), &[], &[]).unwrap();
+    assert_eq!(sql, "SELECT * FROM orders WHERE id = $1");
+    assert_eq!(params, vec![Value::String("42".into())]);
+    assert_eq!(key, "GET:orders:~id");
+}
+```
+
+> Note: `params` type changes to `Vec<Value>` in Task 6. For now, keep as `Vec<String>` and update `"by_id"` → `"~id"` only.
+>
+> If doing this task before Task 6, the test assertion for params stays `vec!["42".to_string()]`. Just change the key assertion to `"GET:orders:~id"`.
+
+- [ ] **Step 2: Apply the fix**
+
+In `src/routes/crud.rs:48`, change:
+```rust
+let key = format!("GET:{}:by_id", table);
+```
+to:
+```rust
+let key = format!("GET:{}:~id", table);
+```
+
+- [ ] **Step 3: Run tests**
+
+```bash
+cargo test
+```
+Expected: all tests pass.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add src/routes/crud.rs
+git commit -m "fix: change by-id cache key to ~id to prevent column name collision"
+```
+
+---
+
+## Task 4: Extract shared `is_valid_identifier` to eliminate duplication
+
+**Files:**
+- Modify: `src/routes/mod.rs`
+- Modify: `src/routes/crud.rs:16-22`
+- Modify: `src/routes/admin/tables.rs:17-23`
+
+- [ ] **Step 1: Add the shared function to `src/routes/mod.rs`**
+
+Replace the current content of `src/routes/mod.rs`:
+```rust
+pub mod admin;
+pub mod auth;
+pub mod crud;
+
+/// Returns true if `name` is a safe SQL identifier (non-empty, alphanumeric + underscore only).
+pub fn is_valid_identifier(name: &str) -> bool {
+    !name.is_empty() && name.chars().all(|c| c.is_alphanumeric() || c == '_')
+}
+```
+
+- [ ] **Step 2: Update `src/routes/crud.rs` to use the shared function**
+
+Remove the local `validate_identifier` (lines 16-22):
+```rust
+// DELETE this function entirely:
+fn validate_identifier(name: &str) -> Result<()> {
+    if name.chars().all(|c| c.is_alphanumeric() || c == '_') {
+        Ok(())
+    } else {
+        Err(anyhow!("invalid identifier: {}", name))
+    }
+}
+```
+
+Replace the two call sites in `build_query`:
+```rust
+// Line 34 — was: validate_identifier(table)?;
+if !crate::routes::is_valid_identifier(table) {
+    return Err(anyhow!("invalid identifier: {}", table));
+}
+// Line 35-37 — was: for (col, _) in ... { validate_identifier(col)?; }
+for (col, _) in body_cols.iter().chain(filter_cols.iter()) {
+    if !crate::routes::is_valid_identifier(col) {
+        return Err(anyhow!("invalid identifier: {}", col));
+    }
+}
+```
+
+- [ ] **Step 3: Update `src/routes/admin/tables.rs` to use the shared function**
+
+Remove the local `validate_identifier` (lines 17-23):
+```rust
+// DELETE this function entirely:
+fn validate_identifier(name: &str) -> Result<(), StatusCode> {
+    if !name.is_empty() && name.chars().all(|c| c.is_alphanumeric() || c == '_') {
+        Ok(())
+    } else {
+        Err(StatusCode::BAD_REQUEST)
+    }
+}
+```
+
+Replace all three call sites:
+```rust
+// In get_table_preview, create_table, drop_table — replace validate_identifier(&name)? with:
+if !crate::routes::is_valid_identifier(&name) {
+    return Err(StatusCode::BAD_REQUEST);
+}
+// In create_table column loop — replace validate_identifier(&col.name)? with:
+if !crate::routes::is_valid_identifier(&col.name) {
+    return Err(StatusCode::BAD_REQUEST);
+}
+```
+
+- [ ] **Step 4: Run tests**
+
+```bash
+cargo test
+```
+Expected: all tests pass.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/routes/mod.rs src/routes/crud.rs src/routes/admin/tables.rs
+git commit -m "refactor: extract shared is_valid_identifier to eliminate duplication"
+```
+
+---
+
+## Task 5: Add protected-table denylist to DDL operations
+
+**Files:**
+- Modify: `src/routes/admin/tables.rs`
+
+- [ ] **Step 1: Write failing tests**
+
+Add to `src/routes/admin/tables.rs` at the bottom:
+
+```rust
+#[cfg(test)]
+mod tests {
+    use super::PROTECTED_TABLES;
+
+    #[test]
+    fn test_protected_tables_list() {
+        assert!(PROTECTED_TABLES.contains(&"users"));
+        assert!(PROTECTED_TABLES.contains(&"blacklist"));
+        assert!(PROTECTED_TABLES.contains(&"api_keys"));
+        assert!(PROTECTED_TABLES.contains(&"queries"));
+        assert!(PROTECTED_TABLES.contains(&"permissions"));
+    }
+
+    #[test]
+    fn test_is_protected() {
+        assert!(is_protected("users"));
+        assert!(is_protected("USERS"));  // case-insensitive
+        assert!(!is_protected("orders"));
+    }
+}
+```
+
+- [ ] **Step 2: Run test to confirm it fails**
+
+```bash
+cargo test test_protected_tables_list test_is_protected
+```
+Expected: FAIL — `PROTECTED_TABLES` and `is_protected` not defined yet.
+
+- [ ] **Step 3: Add the denylist and helper**
+
+At the top of `src/routes/admin/tables.rs`, after the `use` imports, add:
+
+```rust
+const PROTECTED_TABLES: &[&str] = &["users", "blacklist", "api_keys", "queries", "permissions"];
+
+fn is_protected(name: &str) -> bool {
+    let lower = name.to_lowercase();
+    PROTECTED_TABLES.iter().any(|&t| t == lower)
+}
+```
+
+- [ ] **Step 4: Guard `drop_table`**
+
+In `drop_table`, after `validate_identifier(&name)?;`, add:
+```rust
+if is_protected(&name) {
+    return Err(StatusCode::FORBIDDEN);
+}
+```
+
+- [ ] **Step 5: Guard `create_table`**
+
+In `create_table`, after `validate_identifier(&body.name)?;`, add:
+```rust
+if is_protected(&body.name) {
+    return Err(StatusCode::FORBIDDEN);
+}
+```
+
+- [ ] **Step 6: Run tests**
+
+```bash
+cargo test
+```
+Expected: all tests pass.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add src/routes/admin/tables.rs
+git commit -m "fix: block DDL operations on protected system tables"
+```
+
+---
+
+## Task 6: Eliminate NULL_SENTINEL — thread `serde_json::Value` through `build_query`
+
+**Files:**
+- Modify: `src/routes/crud.rs` (signature of `build_query`, binding loop, password hashing)
+
+**The bug:** `"\x00NULL"` is an in-band sentinel — a real string field containing those bytes would be silently written as SQL NULL.
+
+- [ ] **Step 1: Update `build_query` signature and return type**
+
+Change the function signature and all `Vec<String>` params returns to `Vec<Value>`. Full new function (replace lines 27-114):
+
+```rust
+/// Returns (sql, ordered_param_values, cache_key)
+pub fn build_query(
+    method: &str,
+    table: &str,
+    id: Option<&str>,
+    body_cols: &[(String, Value)],
+    filter_cols: &[(String, String)],
+) -> Result<(String, Vec<Value>, String)> {
+    if !crate::routes::is_valid_identifier(table) {
+        return Err(anyhow!("invalid identifier: {}", table));
+    }
+    for (col, _) in body_cols.iter() {
+        if !crate::routes::is_valid_identifier(col) {
+            return Err(anyhow!("invalid identifier: {}", col));
+        }
+    }
+    for (col, _) in filter_cols.iter() {
+        if !crate::routes::is_valid_identifier(col) {
+            return Err(anyhow!("invalid identifier: {}", col));
+        }
+    }
+
+    let mut sorted_body = body_cols.to_vec();
+    sorted_body.sort_by(|a, b| a.0.cmp(&b.0));
+    let mut sorted_filters = filter_cols.to_vec();
+    sorted_filters.sort_by(|a, b| a.0.cmp(&b.0));
+
+    match method.to_uppercase().as_str() {
+        "GET" => {
+            if let Some(id_val) = id {
+                let sql = format!("SELECT * FROM {} WHERE id = $1", table);
+                let key = format!("GET:{}:~id", table);
+                Ok((sql, vec![Value::String(id_val.to_string())], key))
+            } else if sorted_filters.is_empty() {
+                let sql = format!("SELECT * FROM {}", table);
+                let key = format!("GET:{}:", table);
+                Ok((sql, vec![], key))
+            } else {
+                let col_names: Vec<String> = sorted_filters.iter().map(|(c, _)| c.clone()).collect();
+                let where_clause: Vec<String> = col_names
+                    .iter()
+                    .enumerate()
+                    .map(|(i, c)| format!("{} = ${}", c, i + 1))
+                    .collect();
+                let sql = format!("SELECT * FROM {} WHERE {}", table, where_clause.join(" AND "));
+                let params: Vec<Value> = sorted_filters.iter().map(|(_, v)| Value::String(v.clone())).collect();
+                let key = format!("GET:{}:{}", table, col_names.join(","));
+                Ok((sql, params, key))
+            }
+        }
+        "POST" => {
+            if sorted_body.is_empty() {
+                return Err(anyhow!("POST requires a body with at least one field"));
+            }
+            let cols: Vec<String> = sorted_body.iter().map(|(c, _)| c.clone()).collect();
+            let placeholders: Vec<String> = (1..=cols.len()).map(|i| format!("${}", i)).collect();
+            let sql = format!(
+                "INSERT INTO {} ({}) VALUES ({}) RETURNING *",
+                table,
+                cols.join(", "),
+                placeholders.join(", ")
+            );
+            let params: Vec<Value> = sorted_body.iter().map(|(_, v)| v.clone()).collect();
+            let key = format!("POST:{}:{}", table, cols.join(","));
+            Ok((sql, params, key))
+        }
+        "PUT" => {
+            let id_val = id.ok_or_else(|| anyhow!("PUT requires an id"))?;
+            if sorted_body.is_empty() {
+                return Err(anyhow!("PUT requires a body with at least one field"));
+            }
+            let cols: Vec<String> = sorted_body.iter().map(|(c, _)| c.clone()).collect();
+            let set_clause: Vec<String> = cols
+                .iter()
+                .enumerate()
+                .map(|(i, c)| format!("{} = ${}", c, i + 1))
+                .collect();
+            let id_placeholder = cols.len() + 1;
+            let sql = format!(
+                "UPDATE {} SET {} WHERE id = ${} RETURNING *",
+                table,
+                set_clause.join(", "),
+                id_placeholder
+            );
+            let mut params: Vec<Value> = sorted_body.iter().map(|(_, v)| v.clone()).collect();
+            params.push(Value::String(id_val.to_string()));
+            let key = format!("PUT:{}:{}:by_id", table, cols.join(","));
+            Ok((sql, params, key))
+        }
+        "DELETE" => {
+            let id_val = id.ok_or_else(|| anyhow!("DELETE requires an id"))?;
+            let sql = format!("DELETE FROM {} WHERE id = $1", table);
+            let key = format!("DELETE:{}:by_id", table);
+            Ok((sql, vec![Value::String(id_val.to_string())], key))
+        }
+        m => Err(anyhow!("unsupported method: {}", m)),
+    }
+}
+```
+
+- [ ] **Step 2: Update `handle_crud` — simplify body collection and remove sentinel**
+
+Replace the body collection block (lines 206-234) in `handle_crud`:
+
+```rust
+// Body params: collect as typed Values directly
+let mut body_cols: Vec<(String, Value)> = body
+    .map(|Json(b)| b.into_iter().collect())
+    .unwrap_or_default();
+
+// Hash the password field for the users table before building the query.
+if table == "users" && matches!(method_str.to_uppercase().as_str(), "POST" | "PUT") {
+    if let Some(pos) = body_cols.iter().position(|(k, _)| k == "password") {
+        let (_, val) = body_cols.remove(pos);
+        if let Value::String(plaintext) = val {
+            let hash = bcrypt::hash(&plaintext, bcrypt::DEFAULT_COST)
+                .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+            body_cols.push(("password_hash".to_string(), Value::String(hash)));
+        }
+    }
+}
+```
+
+- [ ] **Step 3: Update the binding loop in `handle_crud`**
+
+Replace the binding loop (after `let mut q = sqlx::query(&sql);`):
+
+```rust
+let mut q = sqlx::query(&sql);
+for val in &params_vals {
+    match val {
+        Value::Null => q = q.bind(Option::<String>::None),
+        Value::Bool(b) => q = q.bind(*b),
+        Value::Number(n) => {
+            if let Some(i) = n.as_i64() {
+                q = q.bind(i);
+            } else if let Some(f) = n.as_f64() {
+                q = q.bind(f);
+            } else {
+                q = q.bind(n.to_string());
+            }
+        }
+        Value::String(s) => q = q.bind(s.as_str()),
+        other => q = q.bind(other.to_string()),
+    }
+}
+```
+
+- [ ] **Step 4: Update unit tests for `build_query` to use `Value`**
+
+In the `#[cfg(test)]` block at the bottom of `src/routes/crud.rs`, update all `build_query` calls (the signature now takes `&[(String, Value)]` for body_cols and returns `Vec<Value>`).
+
+Update `test_build_insert`:
+```rust
+#[test]
+fn test_build_insert() {
+    let cols = vec![
+        ("email".into(), Value::String("a@b.com".into())),
+        ("name".into(), Value::String("Alice".into())),
+    ];
+    let (sql, params, key) = build_query("POST", "users", None, &cols, &[]).unwrap();
+    assert_eq!(sql, "INSERT INTO users (email, name) VALUES ($1, $2) RETURNING *");
+    assert_eq!(params, vec![Value::String("a@b.com".into()), Value::String("Alice".into())]);
+    assert_eq!(key, "POST:users:email,name");
+}
+```
+
+Update `test_build_update`:
+```rust
+#[test]
+fn test_build_update() {
+    let cols = vec![("name".into(), Value::String("Bob".into()))];
+    let (sql, params, key) = build_query("PUT", "users", Some("7"), &cols, &[]).unwrap();
+    assert_eq!(sql, "UPDATE users SET name = $1 WHERE id = $2 RETURNING *");
+    assert_eq!(params, vec![Value::String("Bob".into()), Value::String("7".into())]);
+    assert_eq!(key, "PUT:users:name:by_id");
+}
+```
+
+Update `test_build_select_by_id` (already changed key in Task 3):
+```rust
+#[test]
+fn test_build_select_by_id() {
+    let (sql, params, key) = build_query("GET", "orders", Some("42"), &[], &[]).unwrap();
+    assert_eq!(sql, "SELECT * FROM orders WHERE id = $1");
+    assert_eq!(params, vec![Value::String("42".into())]);
+    assert_eq!(key, "GET:orders:~id");
+}
+```
+
+Update `test_build_delete`:
+```rust
+#[test]
+fn test_build_delete() {
+    let (sql, params, key) = build_query("DELETE", "users", Some("3"), &[], &[]).unwrap();
+    assert_eq!(sql, "DELETE FROM users WHERE id = $1");
+    assert_eq!(params, vec![Value::String("3".into())]);
+    assert_eq!(key, "DELETE:users:by_id");
+}
+```
+
+Update `test_build_select_all` (no body/filter params, just check it compiles):
+```rust
+#[test]
+fn test_build_select_all() {
+    let (sql, params, key) = build_query("GET", "orders", None, &[], &[]).unwrap();
+    assert_eq!(sql, "SELECT * FROM orders");
+    assert!(params.is_empty());
+    assert_eq!(key, "GET:orders:");
+}
+```
+
+Update `test_build_select_with_filters`:
+```rust
+#[test]
+fn test_build_select_with_filters() {
+    let filters = vec![("status".into(), "active".into()), ("role".into(), "admin".into())];
+    let (sql, params, key) = build_query("GET", "users", None, &[], &filters).unwrap();
+    assert_eq!(sql, "SELECT * FROM users WHERE role = $1 AND status = $2");
+    assert_eq!(params, vec![Value::String("admin".into()), Value::String("active".into())]);
+    assert_eq!(key, "GET:users:role,status");
+}
+```
+
+`test_rejects_invalid_table_name` needs no change.
+
+- [ ] **Step 5: Run tests**
+
+```bash
+cargo test
+```
+Expected: all tests pass.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/routes/crud.rs
+git commit -m "fix: eliminate NULL_SENTINEL by threading serde_json::Value through build_query"
+```
+
+---
+
+## Task 7: Stash Claims in `blacklist_layer` to eliminate double DB hit
+
+**Files:**
+- Modify: `src/auth/middleware.rs`
+
+**The fix:** Add an `authenticate()` helper. `blacklist_layer` stashes resolved `Claims` in request extensions. All `require_*` functions check extensions first, skipping the DB call if already authenticated.
+
+- [ ] **Step 1: Rewrite `src/auth/middleware.rs`**
+
+Replace the entire file:
+
+```rust
+use axum::{
+    extract::{Request, State},
+    http::StatusCode,
+    middleware::Next,
+    response::Response,
+};
+
+use crate::{auth::{decode_jwt, resolve_api_key, Claims}, state::AppState};
+
+/// Resolves a Bearer token to Claims, trying JWT then API key.
+/// On success, inserts Claims into request extensions so downstream middleware
+/// can reuse them without hitting the database again.
+async fn authenticate(
+    token: &str,
+    state: &AppState,
+    req: &mut Request,
+) -> Option<Claims> {
+    if let Some(existing) = req.extensions().get::<Claims>().cloned() {
+        return Some(existing);
+    }
+    let claims = if let Ok(c) = decode_jwt(token, &state.config.jwt_secret) {
+        c
+    } else {
+        resolve_api_key(token, &state.pool).await?
+    };
+    req.extensions_mut().insert(claims.clone());
+    Some(claims)
+}
+
+pub async fn blacklist_layer(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let method = req.method().as_str().to_uppercase();
+    let path = req.uri().path().to_string();
+    let caller_mask = if let Some(token) = extract_bearer(&req) {
+        authenticate(&token, &state, &mut req)
+            .await
+            .map(|c| c.permissions_mask())
+            .unwrap_or(0)
+    } else {
+        0
+    };
+    if state.blacklist_cache.is_blocked(&method, &path, caller_mask).await {
+        return Err(StatusCode::FORBIDDEN);
+    }
+    Ok(next.run(req).await)
+}
+
+pub fn extract_bearer(req: &Request) -> Option<String> {
+    req.headers()
+        .get("authorization")
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.strip_prefix("Bearer "))
+        .map(|s| s.to_string())
+}
+
+pub async fn require_auth(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let token = extract_bearer(&req).ok_or(StatusCode::UNAUTHORIZED)?;
+    authenticate(&token, &state, &mut req).await.ok_or(StatusCode::UNAUTHORIZED)?;
+    Ok(next.run(req).await)
+}
+
+pub async fn require_super_admin(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let token = extract_bearer(&req).ok_or(StatusCode::UNAUTHORIZED)?;
+    let claims = authenticate(&token, &state, &mut req).await.ok_or(StatusCode::UNAUTHORIZED)?;
+    if !claims.has_permission(crate::auth::permissions::SUPER_ADMIN) {
+        return Err(StatusCode::FORBIDDEN);
+    }
+    Ok(next.run(req).await)
+}
+
+pub async fn require_admin_query(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let token = extract_bearer(&req).ok_or(StatusCode::UNAUTHORIZED)?;
+    let claims = authenticate(&token, &state, &mut req).await.ok_or(StatusCode::UNAUTHORIZED)?;
+    if !claims.has_permission(crate::auth::permissions::ADMIN_QUERY) {
+        return Err(StatusCode::FORBIDDEN);
+    }
+    Ok(next.run(req).await)
+}
+
+pub async fn require_admin_cache(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let token = extract_bearer(&req).ok_or(StatusCode::UNAUTHORIZED)?;
+    let claims = authenticate(&token, &state, &mut req).await.ok_or(StatusCode::UNAUTHORIZED)?;
+    if !claims.has_permission(crate::auth::permissions::ADMIN_CACHE) {
+        return Err(StatusCode::FORBIDDEN);
+    }
+    Ok(next.run(req).await)
+}
+```
+
+- [ ] **Step 2: Run tests**
+
+```bash
+cargo test
+```
+Expected: all tests pass.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/auth/middleware.rs
+git commit -m "fix: stash Claims in request extensions to eliminate double DB hit per API key request"
+```
+
+---
+
+## Task 8: Enforce READ/WRITE/DELETE permission bits in CRUD handler
+
+**Files:**
+- Modify: `src/routes/crud.rs`
+
+- [ ] **Step 1: Add `Extension(claims)` to `handle_crud` and check permissions**
+
+Change the `handle_crud` signature to extract `Claims`:
+
+```rust
+pub async fn handle_crud(
+    State(state): State<AppState>,
+    method: Method,
+    Extension(claims): Extension<Claims>,
+    Path(params): Path<HashMap<String, String>>,
+    Query(query_params): Query<HashMap<String, String>>,
+    body: Option<Json<HashMap<String, Value>>>,
+) -> Result<Json<Value>, StatusCode> {
+```
+
+Then add permission check immediately after extracting `method_str`:
+
+```rust
+let method_str = method.as_str();
+
+// Enforce permission bits before doing any work.
+let required_bit = match method_str.to_uppercase().as_str() {
+    "GET"            => crate::auth::permissions::READ,
+    "POST" | "PUT"   => crate::auth::permissions::WRITE,
+    "DELETE"         => crate::auth::permissions::DELETE,
+    _                => return Err(StatusCode::METHOD_NOT_ALLOWED),
+};
+if !claims.has_permission(required_bit) {
+    return Err(StatusCode::FORBIDDEN);
+}
+```
+
+- [ ] **Step 2: Run tests**
+
+```bash
+cargo test
+```
+Expected: all tests pass. (`build_query` unit tests don't call `handle_crud`, so they're unaffected.)
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/routes/crud.rs
+git commit -m "fix: enforce READ/WRITE/DELETE permission bits in CRUD handler"
+```
+
+---
+
+## Task 9: Add configurable CORS and body size limit
+
+**Files:**
+- Modify: `src/config.rs`
+- Modify: `src/main.rs`
+
+- [ ] **Step 1: Add `cors_origins` to `Config`**
+
+In `src/config.rs`, add the field and parsing:
+
+```rust
+use anyhow::Result;
+
+#[derive(Clone, Debug)]
+pub struct Config {
+    pub database_url: String,
+    pub jwt_secret: String,
+    pub jwt_expiry_secs: u64,
+    pub cache_max_capacity: usize,
+    pub cache_idle_timeout_secs: u64,
+    pub cache_sweep_interval_secs: u64,
+    /// Comma-separated list of allowed CORS origins, or "*" for permissive.
+    /// If empty, no CORS headers are added.
+    pub cors_origins: Vec<String>,
+}
+
+impl Config {
+    pub fn from_env() -> Result<Self> {
+        Ok(Self {
+            database_url: std::env::var("DATABASE_URL")?,
+            jwt_secret: std::env::var("JWT_SECRET")?,
+            jwt_expiry_secs: std::env::var("JWT_EXPIRY_SECS")
+                .unwrap_or_else(|_| "3600".into())
+                .parse()?,
+            cache_max_capacity: std::env::var("CACHE_MAX_CAPACITY")
+                .unwrap_or_else(|_| "10000".into())
+                .parse()?,
+            cache_idle_timeout_secs: std::env::var("CACHE_IDLE_TIMEOUT_SECS")
+                .unwrap_or_else(|_| "300".into())
+                .parse()?,
+            cache_sweep_interval_secs: std::env::var("CACHE_SWEEP_INTERVAL_SECS")
+                .unwrap_or_else(|_| "60".into())
+                .parse()?,
+            cors_origins: std::env::var("CORS_ORIGINS")
+                .unwrap_or_default()
+                .split(',')
+                .map(|s| s.trim().to_string())
+                .filter(|s| !s.is_empty())
+                .collect(),
+        })
+    }
+}
+```
+
+- [ ] **Step 2: Update `.env.example`**
+
+Add `CORS_ORIGINS=` (empty, no CORS by default) to `.env.example`.
+
+- [ ] **Step 3: Update `src/main.rs` imports and app builder**
+
+Add imports at the top of `src/main.rs`:
+```rust
+use axum::extract::DefaultBodyLimit;
+use axum::http::{header, HeaderValue, Method};
+use tower_http::cors::{Any, CorsLayer};
+```
+
+Replace `CorsLayer::permissive()` in the app builder with a configured layer. The CRUD routes also get a body size limit. Replace the `crud_routes` and `app` blocks:
+
+```rust
+let crud_routes = Router::new()
+    .route("/api/:table", get(handle_crud).post(handle_crud))
+    .route("/api/:table/", get(handle_crud).post(handle_crud))
+    .route("/api/:table/:id", get(handle_crud).put(handle_crud).delete(handle_crud))
+    .route("/api/:table/:id/", get(handle_crud).put(handle_crud).delete(handle_crud))
+    .layer(DefaultBodyLimit::max(1 * 1024 * 1024))  // 1 MB
+    .route_layer(middleware::from_fn_with_state(state.clone(), require_auth))
+    .route_layer(middleware::from_fn_with_state(state.clone(), blacklist_layer));
+
+let cors_layer = build_cors(&config.cors_origins);
+
+let app = Router::new()
+    .route("/auth/login", post(login))
+    .merge(crud_routes)
+    .nest("/api/admin", admin_router(state.clone()))
+    .nest_service("/", ServeDir::new("ui/dist").fallback(ServeFile::new("ui/dist/index.html")))
+    .layer(cors_layer)
+    .with_state(state);
+```
+
+Add the `build_cors` helper function (before `main`):
+
+```rust
+fn build_cors(origins: &[String]) -> CorsLayer {
+    if origins.is_empty() {
+        return CorsLayer::new();
+    }
+    if origins.iter().any(|o| o == "*") {
+        return CorsLayer::permissive();
+    }
+    let parsed: Vec<HeaderValue> = origins
+        .iter()
+        .filter_map(|o| o.parse().ok())
+        .collect();
+    CorsLayer::new()
+        .allow_origin(parsed)
+        .allow_methods([Method::GET, Method::POST, Method::PUT, Method::DELETE, Method::OPTIONS])
+        .allow_headers([header::CONTENT_TYPE, header::AUTHORIZATION])
+}
+```
+
+- [ ] **Step 4: Run tests**
+
+```bash
+cargo test
+```
+Expected: all tests pass.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/config.rs src/main.rs .env.example
+git commit -m "fix: replace permissive CORS with configured origins; add 1MB body size limit"
+```
+
+---
+
+## Task 10: First-user interactive setup (replace hardcoded admin/admin)
+
+**Files:**
+- Modify: `src/main.rs`
+
+**Behavior:** On startup, if no users exist in the database, the server prompts on stdin for a username and password, creates that user with full permissions (mask=63), then starts serving. Routes are locked down by auth from the first request — there is no magic credential.
+
+- [ ] **Step 1: Add `use std::io::Write;` import to `src/main.rs`**
+
+In `src/main.rs` imports, add:
+```rust
+use std::io::{self, Write};
+```
+
+- [ ] **Step 2: Replace the admin seed block**
+
+Remove lines 42-56 in `src/main.rs` (the current admin seed):
+```rust
+// DELETE all of this:
+let count: i64 = sqlx::query_scalar::<_, Option<i64>>("SELECT COUNT(*) FROM users WHERE username = 'admin'")
+    .fetch_one(&pool)
+    .await?
+    .unwrap_or(0);
+if count == 0 {
+    let hash = bcrypt::hash("admin", bcrypt::DEFAULT_COST)?;
+    sqlx::query(
+        "INSERT INTO users (username, password_hash, permissions_mask) VALUES ('admin', $1, '63')"
+    )
+    .bind(hash)
+    .execute(&pool)
+    .await?;
+    tracing::info!("seeded admin user");
+}
+```
+
+Replace with:
+```rust
+// If no users exist, prompt to create the first admin.
+let user_count: i64 = sqlx::query_scalar::<_, Option<i64>>("SELECT COUNT(*) FROM users")
+    .fetch_one(&pool)
+    .await?
+    .unwrap_or(0);
+if user_count == 0 {
+    println!("\nNo users found. Create the first admin account.");
+    print!("Username: ");
+    io::stdout().flush()?;
+    let mut username = String::new();
+    io::stdin().read_line(&mut username)?;
+    let username = username.trim().to_string();
+    if username.is_empty() {
+        anyhow::bail!("username cannot be empty");
+    }
+
+    print!("Password: ");
+    io::stdout().flush()?;
+    let mut password = String::new();
+    io::stdin().read_line(&mut password)?;
+    let password = password.trim().to_string();
+    if password.is_empty() {
+        anyhow::bail!("password cannot be empty");
+    }
+
+    let hash = bcrypt::hash(&password, bcrypt::DEFAULT_COST)?;
+    sqlx::query(
+        "INSERT INTO users (username, password_hash, permissions_mask) VALUES ($1, $2, '63')",
+    )
+    .bind(&username)
+    .bind(hash)
+    .execute(&pool)
+    .await?;
+    tracing::info!("created first admin user: {}", username);
+    println!("Admin user '{}' created. Starting server...\n", username);
+}
+```
+
+- [ ] **Step 3: Run tests**
+
+```bash
+cargo test
+```
+Expected: all tests pass (this is startup logic, not unit-testable without a DB).
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add src/main.rs
+git commit -m "fix: replace hardcoded admin/admin seed with interactive first-user setup on empty DB"
+```
+
+---
+
+## Task 11: Remove spurious `mut` on `body_cols_typed`
+
+> **Note:** After Task 6, `body_cols_typed` no longer exists — this was eliminated when the body collection was simplified. Verify the `mut` warning is gone.
+
+- [ ] **Step 1: Confirm no `mut` warning**
+
+```bash
+cargo build 2>&1 | grep "unused_mut\|body_cols_typed"
+```
+Expected: no output (variable was removed in Task 6).
+
+If the warning still appears for another variable, find and remove the `mut`:
+```bash
+cargo build 2>&1 | grep "warning.*mut"
+```
+Fix any remaining spurious `mut` annotations.
+
+- [ ] **Step 2: Commit if any change was needed**
+
+```bash
+git add src/routes/crud.rs
+git commit -m "fix: remove spurious mut annotations"
+```
+
+---
+
+## Self-Review
+
+**Spec coverage check:**
+- C1 (CRUD permissions) → Task 8 ✓
+- C2 (admin/admin seed) → Task 10 ✓
+- C3 (protected tables) → Task 5 ✓
+- C4 (prefix substitution) → Task 2 ✓
+- I1 (cache key collision) → Task 3 ✓
+- I2 (double DB hit) → Task 7 ✓
+- I3 (NULL_SENTINEL) → Task 6 ✓
+- I4 (unix_now panic) → Task 1 ✓
+- M1 (duplicate validator) → Task 4 ✓
+- M3 (permissive CORS) → Task 9 ✓
+- M5 (body size limit) → Task 9 ✓
+- M6 (spurious mut) → Task 11 ✓
+
+**Dependency order:**
+- Task 4 (shared validator) must run before Task 5 (it uses `is_valid_identifier`)
+- Task 6 (Value params) must run before Task 8 (handle_crud signature stabilizes)
+- Task 7 (stash Claims) must run before Task 8 (handle_crud reads claims from extensions)
+- All other tasks are independent
+
+**Type consistency check:**
+- `build_query` returns `Vec<Value>` after Task 6; all callers updated in the same task ✓
+- `is_valid_identifier` returns `bool` (added Task 4); callers in Tasks 4 and 5 check `!is_valid_identifier(...)` ✓
+- `authenticate()` returns `Option<Claims>` (Task 7); all require_* callers use `.ok_or(UNAUTHORIZED)?` ✓
diff --git a/docs/superpowers/plans/2026-06-18-cors-cdn-implementation.md b/docs/superpowers/plans/2026-06-18-cors-cdn-implementation.md
new file mode 100644
index 0000000..f42c1a7
--- /dev/null
+++ b/docs/superpowers/plans/2026-06-18-cors-cdn-implementation.md
@@ -0,0 +1,1638 @@
+# Dynamic CORS + CDN Proxy Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add runtime-editable CORS origins backed by PostgreSQL (managed via CRUD API, protected by super_admin bypass mask) and a CDN proxy that maps keys to local container URLs with a DB registry; add loading spinners to all admin views.
+
+**Architecture:** CORS uses a custom async Axum middleware (`cors_layer`) that reads from an `Arc<RwLock<CorsState>>` in-memory cache, populated from the `cors_origins` table and reloaded after every mutation via the CRUD hook. The CDN adds dedicated routes at `/api/cdn` and `/api/cdn/:key` that read from `cdn_objects` and proxy to internal URLs via `reqwest`; write operations are blocked for non-super-admins by blacklist migration. Both features get Vue admin views.
+
+**Tech Stack:** Rust/axum 0.7, sqlx 0.7, tokio, reqwest 0.12, Vue 3/TypeScript
+
+## Global Constraints
+
+- All DB access uses `sqlx::query_as` / `sqlx::query` (not `sqlx::query!` macro — no compile-time DB required).
+- Blacklist super-admin bypass bit is `'32'` (string, matches existing migrations).
+- All new Rust modules follow existing `pub mod` declaration in their parent `mod.rs`.
+- Vue components import auth store via `import { useAuthStore } from '../../stores/auth'`.
+- No new npm dependencies — existing NychButton, NychDialog, NychInputText, NychSelect are available globally.
+- `cargo test` must pass after every Rust task.
+
+---
+
+## File Map
+
+| File | Action |
+|---|---|
+| `docker-compose.yml` | Modify — add `cdn` (MinIO), `cdn-init`, `cdn_data` volume; `api` depends on `cdn` |
+| `Dockerfile` | Modify — add `minio-download` stage; copy `minio` + `mc` binaries to final image |
+| `entrypoint.sh` | Modify — start MinIO in background, wait for health, create bucket before Postgres |
+| `.env.example` | Modify — add `CDN_ACCESS_KEY`, `CDN_SECRET_KEY`, `CDN_BUCKET` |
+| `src/db/migrations/007_cors_origins.sql` | Create |
+| `src/db/migrations/008_cdn_objects.sql` | Create |
+| `src/state.rs` | Modify — add `CorsCache`, `CorsState`, `http_client`; update `AppState` |
+| `src/models/cdn.rs` | Create |
+| `src/models/mod.rs` | Modify — add `pub mod cdn` |
+| `src/auth/middleware.rs` | Modify — add `cors_layer` |
+| `src/routes/cdn.rs` | Create |
+| `src/routes/mod.rs` | Modify — add `pub mod cdn` |
+| `src/routes/crud.rs` | Modify — add `reload_cors`, hook |
+| `src/routes/admin/tables.rs` | Modify — add `cors_origins`, `cdn_objects` to `PROTECTED_TABLES` |
+| `src/main.rs` | Modify — remove `build_cors`, wire `cors_cache`, `http_client`, `cors_layer`, CDN routes |
+| `Cargo.toml` | Modify — add `reqwest`, remove `cors` feature from `tower-http` |
+| `ui/src/assets/main.css` | Modify — add spinner keyframe + classes |
+| `ui/src/views/admin/Blacklist.vue` | Modify — add loading state |
+| `ui/src/views/admin/ApiKeys.vue` | Modify — add loading state |
+| `ui/src/views/admin/Cache.vue` | Modify — add loading state |
+| `ui/src/views/admin/Queries.vue` | Modify — add loading state |
+| `ui/src/views/admin/Tables.vue` | Modify — add loading state |
+| `ui/src/views/admin/Users.vue` | Modify — add loading state |
+| `ui/src/views/admin/Permissions.vue` | Modify — add loading state |
+| `ui/src/views/admin/Cors.vue` | Create |
+| `ui/src/views/admin/Cdn.vue` | Create |
+| `ui/src/router/index.ts` | Modify — add `/admin/cors` and `/admin/cdn` routes |
+| `ui/src/views/admin/Layout.vue` | Modify — add CORS and CDN nav items |
+
+---
+
+### Task 0: Infrastructure — Docker Compose + Dockerfile + Entrypoint
+
+> **Already done** — these files were updated during planning. Mark complete and move to Task 1.
+
+**Files (already modified):**
+- `docker-compose.yml` — `cdn` (MinIO) + `cdn-init` services; `cdn_data` volume; `api` `depends_on` cdn healthy
+- `Dockerfile` — `minio-download` stage (`alpine:3`, downloads `minio` + `mc` via `TARGETARCH`); copies binaries to final image; exposes 9000/9001
+- `entrypoint.sh` — starts MinIO in background, loops `mc alias set` until ready, creates `$CDN_BUCKET` with anonymous download policy, then starts Postgres + Mercury
+- `.env.example` — documents `CDN_ACCESS_KEY`, `CDN_SECRET_KEY`, `CDN_BUCKET`, and the URL prefix pattern
+
+**CDN URL pattern (important for admin users registering objects):**
+- docker-compose stack: `http://cdn:9000/mercury/<filename>`
+- standalone image: `http://localhost:9000/mercury/<filename>`
+
+The bucket is created with anonymous read (`mc anonymous set download`), so the Mercury proxy makes unauthenticated GET requests — no credentials needed in the API.
+
+- [ ] **Mark complete — files already written.**
+
+---
+
+### Task 1: DB Migrations
+
+**Files:**
+- Create: `src/db/migrations/007_cors_origins.sql`
+- Create: `src/db/migrations/008_cdn_objects.sql`
+
+**Interfaces:**
+- Produces: `cors_origins(id, origin, created_at)` and `cdn_objects(id, key, url, content_type, description, created_at)` tables; blacklist seeds for both.
+
+- [ ] **Step 1: Write 007_cors_origins.sql**
+
+```sql
+CREATE TABLE cors_origins (
+    id         SERIAL PRIMARY KEY,
+    origin     TEXT NOT NULL UNIQUE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Restrict CRUD mutations to super-admins (bit 32). Mirrors blacklist/queries pattern.
+INSERT INTO blacklist (pattern, method, reason, active, bypass_mask) VALUES
+    ('/api/cors_origins',    NULL, 'admin-only table', true, '32'),
+    ('/api/cors_origins/**', NULL, 'admin-only table', true, '32');
+```
+
+- [ ] **Step 2: Write 008_cdn_objects.sql**
+
+```sql
+CREATE TABLE cdn_objects (
+    id           SERIAL PRIMARY KEY,
+    key          TEXT NOT NULL UNIQUE,
+    url          TEXT NOT NULL,
+    content_type TEXT,
+    description  TEXT,
+    created_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Block mutations to /api/cdn for non-super-admins. GET is unblocked (no entry).
+INSERT INTO blacklist (pattern, method, reason, active, bypass_mask) VALUES
+    ('/api/cdn',    'POST,PUT,PATCH,DELETE', 'CDN write operations are super-admin only', true, '32'),
+    ('/api/cdn/**', 'POST,PUT,PATCH,DELETE', 'CDN write operations are super-admin only', true, '32');
+```
+
+- [ ] **Step 3: Verify migrations compile**
+
+```bash
+cd /home/mcpeakml/code/rust/Mercury && cargo build 2>&1 | tail -3
+```
+Expected: `Finished dev` (sqlx migrate! scans the directory; new files are included automatically).
+
+---
+
+### Task 2: CorsCache + AppState
+
+**Files:**
+- Modify: `src/state.rs`
+- Modify: `Cargo.toml`
+
+**Interfaces:**
+- Produces:
+  - `CorsCache::new() -> CorsCache`
+  - `CorsCache::load(origins: Vec<String>) -> ()` (async)
+  - `AppState.cors_cache: CorsCache`
+  - `AppState.http_client: reqwest::Client`
+
+- [ ] **Step 1: Add reqwest to Cargo.toml**
+
+Replace the tower-http line and add reqwest:
+
+```toml
+tower-http = { version = "0.5", features = ["fs"] }
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json"] }
+```
+
+- [ ] **Step 2: Write the failing tests**
+
+Add to the `#[cfg(test)]` block at the bottom of `src/state.rs`:
+
+```rust
+#[tokio::test]
+async fn test_cors_cache_wildcard() {
+    let cache = CorsCache::new();
+    cache.load(vec!["*".to_string()]).await;
+    let guard = cache.inner.read().await;
+    assert!(guard.wildcard);
+    assert!(guard.origins.is_empty());
+}
+
+#[tokio::test]
+async fn test_cors_cache_specific_origin() {
+    let cache = CorsCache::new();
+    cache.load(vec!["https://example.com".to_string()]).await;
+    let guard = cache.inner.read().await;
+    assert!(!guard.wildcard);
+    assert_eq!(guard.origins.len(), 1);
+    assert_eq!(guard.origins[0], "https://example.com");
+}
+
+#[tokio::test]
+async fn test_cors_cache_empty() {
+    let cache = CorsCache::new();
+    cache.load(vec![]).await;
+    let guard = cache.inner.read().await;
+    assert!(!guard.wildcard);
+    assert!(guard.origins.is_empty());
+}
+
+#[tokio::test]
+async fn test_cors_cache_load_replaces() {
+    let cache = CorsCache::new();
+    cache.load(vec!["https://a.com".to_string()]).await;
+    cache.load(vec!["https://b.com".to_string()]).await;
+    let guard = cache.inner.read().await;
+    assert_eq!(guard.origins.len(), 1);
+    assert_eq!(guard.origins[0], "https://b.com");
+}
+```
+
+- [ ] **Step 3: Run tests to verify they fail**
+
+```bash
+cd /home/mcpeakml/code/rust/Mercury && cargo test cors_cache 2>&1 | tail -5
+```
+Expected: compile error — `CorsCache` not defined yet.
+
+- [ ] **Step 4: Add CorsCache + CorsState structs and update AppState**
+
+In `src/state.rs`, add these imports at the top:
+
+```rust
+use axum::http::HeaderValue;
+```
+
+Add after the `BlacklistCache` impl block:
+
+```rust
+#[derive(Clone)]
+pub struct CorsCache {
+    pub inner: Arc<RwLock<CorsState>>,
+}
+
+#[derive(Clone, Default)]
+pub struct CorsState {
+    pub wildcard: bool,
+    pub origins: Vec<HeaderValue>,
+}
+
+impl CorsCache {
+    pub fn new() -> Self {
+        Self {
+            inner: Arc::new(RwLock::new(CorsState::default())),
+        }
+    }
+
+    pub async fn load(&self, origins: Vec<String>) {
+        let wildcard = origins.iter().any(|o| o == "*");
+        let parsed: Vec<HeaderValue> = origins
+            .iter()
+            .filter(|o| *o != "*")
+            .filter_map(|o| o.parse().ok())
+            .collect();
+        let mut guard = self.inner.write().await;
+        *guard = CorsState { wildcard, origins: parsed };
+    }
+}
+```
+
+Update `AppState`:
+
+```rust
+#[derive(Clone)]
+pub struct AppState {
+    pub pool: PgPool,
+    pub query_cache: QueryCache,
+    pub blacklist_cache: BlacklistCache,
+    pub cors_cache: CorsCache,
+    pub http_client: reqwest::Client,
+    pub config: Arc<Config>,
+}
+```
+
+- [ ] **Step 5: Run tests to verify they pass**
+
+```bash
+cd /home/mcpeakml/code/rust/Mercury && cargo test cors_cache 2>&1 | tail -5
+```
+Expected: `test result: ok. 4 passed`
+
+---
+
+### Task 3: CdnObject Model
+
+**Files:**
+- Create: `src/models/cdn.rs`
+- Modify: `src/models/mod.rs`
+
+**Interfaces:**
+- Produces: `CdnObject`, `CreateCdnObject`, `UpdateCdnObject` — used by `routes/cdn.rs`
+
+- [ ] **Step 1: Create src/models/cdn.rs**
+
+```rust
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct CdnObject {
+    pub id: i32,
+    pub key: String,
+    pub url: String,
+    pub content_type: Option<String>,
+    pub description: Option<String>,
+    pub created_at: DateTime<Utc>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateCdnObject {
+    pub key: String,
+    pub url: String,
+    pub content_type: Option<String>,
+    pub description: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UpdateCdnObject {
+    pub key: Option<String>,
+    pub url: Option<String>,
+    pub content_type: Option<String>,
+    pub description: Option<String>,
+}
+```
+
+- [ ] **Step 2: Add to src/models/mod.rs**
+
+```rust
+pub mod api_key;
+pub mod blacklist;
+pub mod cdn;
+pub mod permission;
+pub mod query;
+pub mod user;
+```
+
+- [ ] **Step 3: Verify compilation**
+
+```bash
+cd /home/mcpeakml/code/rust/Mercury && cargo build 2>&1 | tail -3
+```
+Expected: `Finished dev`
+
+---
+
+### Task 4: cors_layer Middleware
+
+**Files:**
+- Modify: `src/auth/middleware.rs`
+
+**Interfaces:**
+- Consumes: `AppState.cors_cache: CorsCache`
+- Produces: `cors_layer(State<AppState>, Request, Next) -> Response` — applied globally in `main.rs`
+
+- [ ] **Step 1: Update imports in src/auth/middleware.rs**
+
+Replace the existing imports block with:
+
+```rust
+use axum::{
+    extract::{Request, State},
+    http::{header, HeaderMap, HeaderValue, Method, StatusCode},
+    middleware::Next,
+    response::{IntoResponse, Response},
+};
+
+use crate::{
+    auth::{decode_jwt, resolve_api_key, Claims},
+    state::AppState,
+};
+```
+
+- [ ] **Step 2: Add cors_layer function**
+
+Add after the `require_admin_cache` function:
+
+```rust
+pub async fn cors_layer(
+    State(state): State<AppState>,
+    req: Request,
+    next: Next,
+) -> Response {
+    let is_preflight = req.method() == Method::OPTIONS;
+    let origin_header = req.headers().get(header::ORIGIN).cloned();
+
+    enum CorsDecision {
+        None,
+        Wildcard,
+        Specific(HeaderValue),
+    }
+
+    let decision = {
+        let guard = state.cors_cache.inner.read().await;
+        if guard.wildcard {
+            CorsDecision::Wildcard
+        } else if let Some(origin) = origin_header.as_ref() {
+            if guard.origins.contains(origin) {
+                CorsDecision::Specific(origin.clone())
+            } else {
+                CorsDecision::None
+            }
+        } else {
+            CorsDecision::None
+        }
+    };
+
+    let (cors_origin, vary) = match &decision {
+        CorsDecision::None => (None, false),
+        CorsDecision::Wildcard => (Some(HeaderValue::from_static("*")), false),
+        CorsDecision::Specific(v) => (Some(v.clone()), true),
+    };
+
+    if is_preflight {
+        let mut headers = HeaderMap::new();
+        if let Some(origin) = cors_origin {
+            headers.insert(header::ACCESS_CONTROL_ALLOW_ORIGIN, origin);
+            headers.insert(
+                header::ACCESS_CONTROL_ALLOW_METHODS,
+                HeaderValue::from_static("GET, POST, PUT, DELETE, OPTIONS"),
+            );
+            headers.insert(
+                header::ACCESS_CONTROL_ALLOW_HEADERS,
+                HeaderValue::from_static("content-type, authorization"),
+            );
+            if vary {
+                headers.insert(header::VARY, HeaderValue::from_static("Origin"));
+            }
+        }
+        return (StatusCode::NO_CONTENT, headers).into_response();
+    }
+
+    let mut response = next.run(req).await;
+    if let Some(origin) = cors_origin {
+        response
+            .headers_mut()
+            .insert(header::ACCESS_CONTROL_ALLOW_ORIGIN, origin);
+        if vary {
+            response
+                .headers_mut()
+                .append(header::VARY, HeaderValue::from_static("Origin"));
+        }
+    }
+    response
+}
+```
+
+- [ ] **Step 3: Verify compilation**
+
+```bash
+cd /home/mcpeakml/code/rust/Mercury && cargo build 2>&1 | tail -3
+```
+Expected: `Finished dev`
+
+---
+
+### Task 5: CDN Route Handlers
+
+**Files:**
+- Create: `src/routes/cdn.rs`
+- Modify: `src/routes/mod.rs`
+
+**Interfaces:**
+- Consumes: `AppState.pool`, `AppState.http_client`, `CdnObject`, `CreateCdnObject`, `UpdateCdnObject`
+- Produces: `cdn_list`, `cdn_proxy`, `cdn_create`, `cdn_update`, `cdn_delete` — registered in `main.rs`
+
+- [ ] **Step 1: Create src/routes/cdn.rs**
+
+```rust
+use axum::{
+    extract::{Path, State},
+    http::{header, StatusCode},
+    response::IntoResponse,
+    Json,
+};
+use serde_json::Value;
+use sqlx::Row;
+
+use crate::{
+    models::cdn::{CdnObject, CreateCdnObject, UpdateCdnObject},
+    state::AppState,
+};
+
+pub async fn cdn_list(
+    State(state): State<AppState>,
+) -> Result<Json<Vec<CdnObject>>, StatusCode> {
+    let objects = sqlx::query_as::<_, CdnObject>(
+        "SELECT id, key, url, content_type, description, created_at \
+         FROM cdn_objects ORDER BY id",
+    )
+    .fetch_all(&state.pool)
+    .await
+    .map_err(|e| {
+        tracing::error!("cdn_list: {}", e);
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+    Ok(Json(objects))
+}
+
+pub async fn cdn_proxy(
+    State(state): State<AppState>,
+    Path(key): Path<String>,
+) -> Result<impl IntoResponse, StatusCode> {
+    let row = sqlx::query(
+        "SELECT url, content_type FROM cdn_objects WHERE key = $1",
+    )
+    .bind(&key)
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    .ok_or(StatusCode::NOT_FOUND)?;
+
+    let url: String = row.try_get("url").map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    let content_type: Option<String> = row.try_get::<Option<String>, _>("content_type").ok().flatten();
+
+    let upstream = state
+        .http_client
+        .get(&url)
+        .send()
+        .await
+        .map_err(|e| {
+            tracing::error!("cdn_proxy upstream error for key={}: {}", key, e);
+            StatusCode::BAD_GATEWAY
+        })?;
+
+    let status =
+        StatusCode::from_u16(upstream.status().as_u16()).unwrap_or(StatusCode::BAD_GATEWAY);
+
+    let bytes = upstream
+        .bytes()
+        .await
+        .map_err(|_| StatusCode::BAD_GATEWAY)?;
+
+    let ct = content_type.unwrap_or_else(|| "application/octet-stream".to_string());
+
+    Ok((status, [(header::CONTENT_TYPE, ct)], bytes))
+}
+
+pub async fn cdn_create(
+    State(state): State<AppState>,
+    Json(body): Json<CreateCdnObject>,
+) -> Result<Json<CdnObject>, StatusCode> {
+    let obj = sqlx::query_as::<_, CdnObject>(
+        "INSERT INTO cdn_objects (key, url, content_type, description) \
+         VALUES ($1, $2, $3, $4) \
+         RETURNING id, key, url, content_type, description, created_at",
+    )
+    .bind(&body.key)
+    .bind(&body.url)
+    .bind(&body.content_type)
+    .bind(&body.description)
+    .fetch_one(&state.pool)
+    .await
+    .map_err(|e| {
+        tracing::error!("cdn_create: {}", e);
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+    Ok(Json(obj))
+}
+
+pub async fn cdn_update(
+    State(state): State<AppState>,
+    Path(key): Path<String>,
+    Json(body): Json<UpdateCdnObject>,
+) -> Result<Json<CdnObject>, StatusCode> {
+    let obj = sqlx::query_as::<_, CdnObject>(
+        "UPDATE cdn_objects \
+         SET key          = COALESCE($2, key), \
+             url          = COALESCE($3, url), \
+             content_type = COALESCE($4, content_type), \
+             description  = COALESCE($5, description) \
+         WHERE key = $1 \
+         RETURNING id, key, url, content_type, description, created_at",
+    )
+    .bind(&key)
+    .bind(&body.key)
+    .bind(&body.url)
+    .bind(&body.content_type)
+    .bind(&body.description)
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    .ok_or(StatusCode::NOT_FOUND)?;
+    Ok(Json(obj))
+}
+
+pub async fn cdn_delete(
+    State(state): State<AppState>,
+    Path(key): Path<String>,
+) -> Result<Json<Value>, StatusCode> {
+    let rows = sqlx::query("DELETE FROM cdn_objects WHERE key = $1")
+        .bind(&key)
+        .execute(&state.pool)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .rows_affected();
+    if rows == 0 {
+        return Err(StatusCode::NOT_FOUND);
+    }
+    Ok(Json(serde_json::json!({ "deleted": true })))
+}
+```
+
+- [ ] **Step 2: Add pub mod cdn to src/routes/mod.rs**
+
+```rust
+pub mod admin;
+pub mod auth;
+pub mod cdn;
+pub mod crud;
+
+pub fn is_valid_identifier(name: &str) -> bool {
+    !name.is_empty() && name.chars().all(|c| c.is_alphanumeric() || c == '_')
+}
+```
+
+- [ ] **Step 3: Verify compilation**
+
+```bash
+cd /home/mcpeakml/code/rust/Mercury && cargo build 2>&1 | tail -3
+```
+Expected: `Finished dev`
+
+---
+
+### Task 6: reload_cors Hook + Protected Tables
+
+**Files:**
+- Modify: `src/routes/crud.rs`
+- Modify: `src/routes/admin/tables.rs`
+
+**Interfaces:**
+- Consumes: `AppState.cors_cache: CorsCache`
+- Produces: `reload_cors` called after every non-GET mutation to `cors_origins` table
+
+- [ ] **Step 1: Add reload_cors to src/routes/crud.rs**
+
+Add after the existing `reload_blacklist` function (around line 193):
+
+```rust
+async fn reload_cors(state: &AppState) -> Result<(), StatusCode> {
+    let origins: Vec<String> = sqlx::query_scalar::<_, String>(
+        "SELECT origin FROM cors_origins ORDER BY id",
+    )
+    .fetch_all(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    state.cors_cache.load(origins).await;
+    Ok(())
+}
+```
+
+- [ ] **Step 2: Add cors_origins hook in handle_crud**
+
+Find the block starting at line 335 (the blacklist reload hook) and update it to:
+
+```rust
+    // Reload in-memory caches after mutations to their backing tables.
+    if table == "blacklist" && method_str != "GET" {
+        reload_blacklist(&state).await?;
+    }
+    if table == "cors_origins" && method_str != "GET" {
+        reload_cors(&state).await?;
+    }
+```
+
+- [ ] **Step 3: Add cors_origins + cdn_objects to PROTECTED_TABLES in src/routes/admin/tables.rs**
+
+Find line 27:
+```rust
+const PROTECTED_TABLES: &[&str] = &["users", "blacklist", "api_keys", "queries", "permissions"];
+```
+Replace with:
+```rust
+const PROTECTED_TABLES: &[&str] = &[
+    "users", "blacklist", "api_keys", "queries", "permissions",
+    "cors_origins", "cdn_objects",
+];
+```
+
+- [ ] **Step 4: Run tests**
+
+```bash
+cd /home/mcpeakml/code/rust/Mercury && cargo test 2>&1 | tail -5
+```
+Expected: all tests pass.
+
+---
+
+### Task 7: main.rs Wiring
+
+**Files:**
+- Modify: `src/main.rs`
+
+**Interfaces:**
+- Consumes: `CorsCache`, `cors_layer`, `cdn_list`, `cdn_proxy`, `cdn_create`, `cdn_update`, `cdn_delete`
+- Produces: running server with dynamic CORS + CDN proxy routes
+
+- [ ] **Step 1: Update imports in src/main.rs**
+
+Replace the current imports block with:
+
+```rust
+mod auth;
+mod cache;
+mod config;
+mod db;
+mod models;
+mod routes;
+mod state;
+
+use std::io::{self, Write};
+use std::sync::Arc;
+
+use axum::{
+    extract::DefaultBodyLimit,
+    middleware,
+    routing::{delete, get, post, put},
+    Router,
+};
+use tower_http::services::{ServeDir, ServeFile};
+use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
+
+use crate::{
+    auth::middleware::{blacklist_layer, cors_layer, require_auth},
+    cache::spawn_sweep_task,
+    config::Config,
+    db::create_pool,
+    models::blacklist::BlacklistEntry,
+    routes::{
+        admin::admin_router,
+        auth::login,
+        cdn::{cdn_create, cdn_delete, cdn_list, cdn_proxy, cdn_update},
+        crud::handle_crud,
+    },
+    state::{AppState, BlacklistCache, CorsCache, QueryCache},
+};
+```
+
+- [ ] **Step 2: Remove build_cors function**
+
+Delete the entire `fn build_cors(origins: &[String]) -> CorsLayer` function (lines 35–53 in the original file).
+
+- [ ] **Step 3: Add cors_origins seeding + cors_cache + http_client after the blacklist load block**
+
+Find the existing blacklist load block (around line 127) and add after `blacklist_cache.load(entries).await;`:
+
+```rust
+    // Load CORS origins; seed from CORS_ORIGINS env var if table is empty.
+    let cors_count: i64 = sqlx::query_scalar::<_, Option<i64>>("SELECT COUNT(*) FROM cors_origins")
+        .fetch_one(&pool)
+        .await?
+        .unwrap_or(0);
+    if cors_count == 0 && !config.cors_origins.is_empty() {
+        for origin in &config.cors_origins {
+            sqlx::query(
+                "INSERT INTO cors_origins (origin) VALUES ($1) ON CONFLICT DO NOTHING",
+            )
+            .bind(origin)
+            .execute(&pool)
+            .await?;
+        }
+        tracing::info!(
+            "seeded {} CORS origin(s) from CORS_ORIGINS env var",
+            config.cors_origins.len()
+        );
+    }
+    let cors_origins: Vec<String> =
+        sqlx::query_scalar::<_, String>("SELECT origin FROM cors_origins ORDER BY id")
+            .fetch_all(&pool)
+            .await?;
+    let cors_cache = CorsCache::new();
+    cors_cache.load(cors_origins).await;
+
+    let http_client = reqwest::Client::new();
+```
+
+- [ ] **Step 4: Update AppState construction**
+
+Find `let state = AppState { ... }` and update to:
+
+```rust
+    let state = AppState {
+        pool,
+        query_cache,
+        blacklist_cache,
+        cors_cache,
+        http_client,
+        config: config.clone(),
+    };
+```
+
+- [ ] **Step 5: Update router construction**
+
+Replace the entire `let crud_routes = ...`, `let cors_layer = ...`, and `let app = ...` block with:
+
+```rust
+    let crud_routes = Router::new()
+        .route("/api/:table", get(handle_crud).post(handle_crud))
+        .route("/api/:table/", get(handle_crud).post(handle_crud))
+        .route(
+            "/api/:table/:id",
+            get(handle_crud).put(handle_crud).delete(handle_crud),
+        )
+        .route(
+            "/api/:table/:id/",
+            get(handle_crud).put(handle_crud).delete(handle_crud),
+        )
+        .layer(DefaultBodyLimit::max(1024 * 1024))
+        .route_layer(middleware::from_fn_with_state(state.clone(), require_auth))
+        .route_layer(middleware::from_fn_with_state(state.clone(), blacklist_layer));
+
+    // CDN routes: GET is public; POST/PUT/DELETE are blacklisted for non-super-admins.
+    let cdn_routes = Router::new()
+        .route("/api/cdn", get(cdn_list).post(cdn_create))
+        .route("/api/cdn/:key", get(cdn_proxy).put(cdn_update).delete(cdn_delete))
+        .route_layer(middleware::from_fn_with_state(state.clone(), blacklist_layer));
+
+    let app = Router::new()
+        .route("/auth/login", post(login))
+        .merge(cdn_routes)
+        .merge(crud_routes)
+        .nest("/api/admin", admin_router(state.clone()))
+        .nest_service(
+            "/",
+            ServeDir::new("ui/dist").fallback(ServeFile::new("ui/dist/index.html")),
+        )
+        .layer(middleware::from_fn_with_state(state.clone(), cors_layer))
+        .with_state(state);
+```
+
+Note: `cdn_routes` is merged before `crud_routes` so `/api/cdn` literal paths take precedence over the `/api/:table` parameterised CRUD routes.
+
+- [ ] **Step 6: Run full test suite**
+
+```bash
+cd /home/mcpeakml/code/rust/Mercury && cargo test 2>&1 | tail -5
+```
+Expected: all tests pass.
+
+---
+
+### Task 8: Spinner CSS
+
+**Files:**
+- Modify: `ui/src/assets/main.css`
+
+**Interfaces:**
+- Produces: `.loading-overlay` and `.loading-spinner` classes available globally to all Vue views
+
+- [ ] **Step 1: Append spinner styles to ui/src/assets/main.css**
+
+Add at the end of the file:
+
+```css
+/* ── Loading spinner ─────────────────────────────────────── */
+@keyframes mercury-spin {
+  to { transform: rotate(360deg); }
+}
+
+.loading-spinner {
+  width: 1.25rem;
+  height: 1.25rem;
+  border: 2px solid var(--border);
+  border-top-color: var(--primary);
+  border-radius: 50%;
+  animation: mercury-spin 0.7s linear infinite;
+  flex-shrink: 0;
+}
+
+.loading-overlay {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.6rem;
+  padding: 3rem 2rem;
+  color: var(--text-muted);
+  font-size: 0.85rem;
+  font-family: var(--font-sans);
+}
+```
+
+---
+
+### Task 9: Loading State — Existing Admin Views
+
+**Files:**
+- Modify: `ui/src/views/admin/Blacklist.vue`
+- Modify: `ui/src/views/admin/ApiKeys.vue`
+- Modify: `ui/src/views/admin/Cache.vue`
+- Modify: `ui/src/views/admin/Queries.vue`
+- Modify: `ui/src/views/admin/Tables.vue`
+- Modify: `ui/src/views/admin/Users.vue`
+- Modify: `ui/src/views/admin/Permissions.vue`
+
+**Interfaces:**
+- Consumes: `.loading-overlay` + `.loading-spinner` from `main.css`
+
+---
+
+#### 9a — Blacklist.vue
+
+- [ ] **Step 1: Add loading ref to script**
+
+In the `<script setup>` block, after `const form = ref(...)`, add:
+
+```ts
+const loading = ref(false)
+```
+
+- [ ] **Step 2: Wrap load() with loading state**
+
+Replace:
+```ts
+async function load() {
+  const res = await fetch('/api/blacklist', { headers: auth.authHeaders() })
+  entries.value = await res.json()
+}
+```
+With:
+```ts
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/blacklist', { headers: auth.authHeaders() })
+    entries.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+```
+
+- [ ] **Step 3: Add spinner to template**
+
+In the `<div class="table-card">`, insert the loading overlay immediately after `<div class="table-card-header">...</div>`:
+
+```html
+<div v-if="loading" class="loading-overlay">
+  <div class="loading-spinner"></div>
+  <span>Loading…</span>
+</div>
+```
+
+Also change `<template v-if="entries.length">` to `<template v-else-if="entries.length">` and `<div class="empty-state" v-else>` stays as-is (it will only show if not loading and no entries).
+
+---
+
+#### 9b — ApiKeys.vue
+
+- [ ] **Step 1: Add loading ref**
+
+In `<script setup>`, after `const form = ref(...)`, add:
+
+```ts
+const loading = ref(false)
+```
+
+- [ ] **Step 2: Wrap load()**
+
+Replace:
+```ts
+async function load() {
+  const res = await fetch('/api/admin/api-keys', { headers: auth.authHeaders() })
+  keys.value = await res.json()
+}
+```
+With:
+```ts
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/admin/api-keys', { headers: auth.authHeaders() })
+    keys.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+```
+
+- [ ] **Step 3: Add spinner to template**
+
+After `<div class="table-card-header">...</div>`, insert:
+```html
+<div v-if="loading" class="loading-overlay">
+  <div class="loading-spinner"></div>
+  <span>Loading…</span>
+</div>
+```
+Change `<template v-if="keys.length">` → `<template v-else-if="keys.length">`.
+
+---
+
+#### 9c — Cache.vue
+
+- [ ] **Step 1: Add loading ref**
+
+In `<script setup>`, add after `const stats = ref(...)`:
+
+```ts
+const loading = ref(false)
+```
+
+- [ ] **Step 2: Wrap load()**
+
+Replace:
+```ts
+async function load() {
+  const res = await fetch('/api/admin/cache/stats', { headers: auth.authHeaders() })
+  stats.value = await res.json()
+}
+```
+With:
+```ts
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/admin/cache/stats', { headers: auth.authHeaders() })
+    stats.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+```
+
+- [ ] **Step 3: Add spinner to template**
+
+Change the existing template block:
+```html
+<div class="stats-grid" v-if="stats">
+  ...
+</div>
+
+<div class="no-stats" v-else>
+  ...
+</div>
+```
+To:
+```html
+<div v-if="loading" class="loading-overlay">
+  <div class="loading-spinner"></div>
+  <span>Loading…</span>
+</div>
+
+<div class="stats-grid" v-else-if="stats">
+  ...
+</div>
+
+<div class="no-stats" v-else>
+  ...
+</div>
+```
+
+---
+
+#### 9d — Queries.vue
+
+- [ ] **Step 1: Add loading ref**
+
+In `<script setup>`, after `const editForm = ref(...)`, add:
+
+```ts
+const loading = ref(false)
+```
+
+- [ ] **Step 2: Wrap load()**
+
+Replace:
+```ts
+async function load() {
+  const res = await fetch('/api/queries', { headers: auth.authHeaders() })
+  queries.value = await res.json()
+}
+```
+With:
+```ts
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/queries', { headers: auth.authHeaders() })
+    queries.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+```
+
+- [ ] **Step 3: Add spinner to template**
+
+After `<div class="table-card-header">...</div>`, insert:
+```html
+<div v-if="loading" class="loading-overlay">
+  <div class="loading-spinner"></div>
+  <span>Loading…</span>
+</div>
+```
+Change `<template v-if="queries.length">` → `<template v-else-if="queries.length">`.
+
+---
+
+#### 9e — Tables.vue
+
+- [ ] **Step 1: Add loading ref**
+
+In `<script setup>`, after the existing `ref` declarations, add:
+
+```ts
+const loading = ref(false)
+```
+
+- [ ] **Step 2: Find the load() function for tables and wrap it**
+
+Find `async function load()` (the one that fetches `/api/admin/tables`) and replace:
+```ts
+async function load() {
+  const res = await fetch('/api/admin/tables', { headers: auth.authHeaders() })
+  tables.value = await res.json()
+}
+```
+With:
+```ts
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/admin/tables', { headers: auth.authHeaders() })
+    tables.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+```
+
+- [ ] **Step 3: Add spinner to template**
+
+After `<div class="table-card-header">...</div>`, insert:
+```html
+<div v-if="loading" class="loading-overlay">
+  <div class="loading-spinner"></div>
+  <span>Loading…</span>
+</div>
+```
+Change `<template v-if="tables.length">` → `<template v-else-if="tables.length">`.
+
+---
+
+#### 9f — Users.vue
+
+- [ ] **Step 1: Add loading ref**
+
+In `<script setup>`, after `const form = ref(...)`, add:
+
+```ts
+const loading = ref(false)
+```
+
+- [ ] **Step 2: Wrap load()**
+
+Replace:
+```ts
+async function load() {
+  const res = await fetch('/api/users', { headers: auth.authHeaders() })
+  users.value = (await res.json()).filter((u: any) => !u.password_hash)
+}
+```
+
+Check the exact fetch URL by reading the file. Wrap it:
+```ts
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/users', { headers: auth.authHeaders() })
+    users.value = (await res.json()).filter((u: any) => !u.password_hash)
+  } finally {
+    loading.value = false
+  }
+}
+```
+
+- [ ] **Step 3: Add spinner to template**
+
+After `<div class="table-card-header">...</div>`, insert:
+```html
+<div v-if="loading" class="loading-overlay">
+  <div class="loading-spinner"></div>
+  <span>Loading…</span>
+</div>
+```
+Change `<template v-if="users.length">` → `<template v-else-if="users.length">`.
+
+---
+
+#### 9g — Permissions.vue
+
+- [ ] **Step 1: Add loading ref**
+
+In `<script setup>`, after `const form = ref(...)`, add:
+
+```ts
+const loading = ref(false)
+```
+
+- [ ] **Step 2: Wrap load()**
+
+Replace:
+```ts
+async function load() {
+  const res = await fetch('/api/permissions', { headers: auth.authHeaders() })
+  permissions.value = await res.json()
+}
+```
+With:
+```ts
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/permissions', { headers: auth.authHeaders() })
+    permissions.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+```
+
+- [ ] **Step 3: Add spinner to template**
+
+After `<div class="table-card-header">...</div>`, insert:
+```html
+<div v-if="loading" class="loading-overlay">
+  <div class="loading-spinner"></div>
+  <span>Loading…</span>
+</div>
+```
+Change `<template v-if="permissions.length">` → `<template v-else-if="permissions.length">`.
+
+---
+
+### Task 10: Cors.vue
+
+**Files:**
+- Create: `ui/src/views/admin/Cors.vue`
+
+**Interfaces:**
+- Consumes: `GET /api/cors_origins`, `POST /api/cors_origins`, `DELETE /api/cors_origins/:id`
+
+- [ ] **Step 1: Create ui/src/views/admin/Cors.vue**
+
+```vue
+<template>
+  <div>
+    <div class="page-header">
+      <div class="page-title">
+        <h2>CORS Origins</h2>
+        <span class="subtitle">Allowed cross-origin request sources — matched against the request Origin header</span>
+      </div>
+      <NychButton @click="showCreate = true" label="+ Add Origin" />
+    </div>
+
+    <div class="table-card">
+      <div class="table-card-header">
+        <span class="count">{{ origins.length }} {{ origins.length === 1 ? 'origin' : 'origins' }}</span>
+      </div>
+      <div v-if="loading" class="loading-overlay">
+        <div class="loading-spinner"></div>
+        <span>Loading…</span>
+      </div>
+      <template v-else-if="origins.length">
+        <div class="table-scroll">
+          <table class="data-table">
+            <thead>
+              <tr>
+                <th>Origin</th>
+                <th>Added</th>
+                <th>Actions</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr v-for="o in origins" :key="o.id">
+                <td><code>{{ o.origin }}</code></td>
+                <td class="date-cell">{{ fmtDate(o.created_at) }}</td>
+                <td class="actions-cell">
+                  <NychButton size="small" severity="danger" @click="deleteOrigin(o.id)" label="Delete" />
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </div>
+      </template>
+      <div class="empty-state" v-else>
+        <span class="empty-icon">✦</span>
+        <span class="empty-label">No origins configured</span>
+        <span class="empty-hint">Cross-origin requests will be rejected until an origin is added.</span>
+      </div>
+    </div>
+
+    <NychDialog v-model:visible="showCreate" header="Add CORS Origin" :modal="true" :draggable="false" style="width: min(480px, 95vw)">
+      <form @submit.prevent="submitCreate" class="dialog-form">
+        <div class="field">
+          <label>Origin</label>
+          <NychInputText v-model="form.origin" placeholder="https://app.example.com" fluid />
+          <p class="hint">Use <code>*</code> to allow all origins (permissive mode).</p>
+        </div>
+        <NychButton type="submit" fluid label="Add Origin" :disabled="!form.origin || loading" />
+      </form>
+    </NychDialog>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const origins = ref<any[]>([])
+const showCreate = ref(false)
+const loading = ref(false)
+const form = ref({ origin: '' })
+
+function fmtDate(s: string) {
+  return new Date(s).toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' })
+}
+
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/cors_origins', { headers: auth.authHeaders() })
+    origins.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+
+async function submitCreate() {
+  loading.value = true
+  try {
+    await fetch('/api/cors_origins', {
+      method: 'POST',
+      headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+      body: JSON.stringify({ origin: form.value.origin }),
+    })
+    showCreate.value = false
+    form.value = { origin: '' }
+    await load()
+  } finally {
+    loading.value = false
+  }
+}
+
+async function deleteOrigin(id: number) {
+  if (!confirm('Remove this CORS origin?')) return
+  loading.value = true
+  try {
+    await fetch(`/api/cors_origins/${id}`, { method: 'DELETE', headers: auth.authHeaders() })
+    await load()
+  } finally {
+    loading.value = false
+  }
+}
+
+onMounted(load)
+</script>
+
+<style scoped>
+.date-cell { color: var(--text-muted); font-size: 0.85rem; }
+.hint { font-size: 0.78rem; color: var(--text-dim); margin: 0.25rem 0 0; font-family: var(--font-sans); }
+</style>
+```
+
+---
+
+### Task 11: Cdn.vue
+
+**Files:**
+- Create: `ui/src/views/admin/Cdn.vue`
+
+**Interfaces:**
+- Consumes: `GET /api/cdn`, `POST /api/cdn`, `PUT /api/cdn/:key`, `DELETE /api/cdn/:key`
+
+- [ ] **Step 1: Create ui/src/views/admin/Cdn.vue**
+
+```vue
+<template>
+  <div>
+    <div class="page-header">
+      <div class="page-title">
+        <h2>CDN Objects</h2>
+        <span class="subtitle">Object storage registry — keys proxied through the API to the local CDN</span>
+      </div>
+      <NychButton @click="showCreate = true" label="+ Add Object" />
+    </div>
+
+    <div class="table-card">
+      <div class="table-card-header">
+        <span class="count">{{ objects.length }} {{ objects.length === 1 ? 'object' : 'objects' }}</span>
+      </div>
+      <div v-if="loading" class="loading-overlay">
+        <div class="loading-spinner"></div>
+        <span>Loading…</span>
+      </div>
+      <template v-else-if="objects.length">
+        <div class="table-scroll">
+          <table class="data-table">
+            <thead>
+              <tr>
+                <th>Key</th>
+                <th>URL</th>
+                <th>Content Type</th>
+                <th>Description</th>
+                <th>Actions</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr v-for="o in objects" :key="o.id">
+                <td><code>{{ o.key }}</code></td>
+                <td class="url-cell"><code>{{ o.url }}</code></td>
+                <td class="ct-cell">{{ o.content_type ?? '—' }}</td>
+                <td class="desc-cell">{{ o.description ?? '—' }}</td>
+                <td class="actions-cell">
+                  <NychButton size="small" @click="openEdit(o)" label="Edit" />
+                  <NychButton size="small" severity="danger" @click="deleteObject(o.key)" label="Delete" />
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </div>
+      </template>
+      <div class="empty-state" v-else>
+        <span class="empty-icon">▣</span>
+        <span class="empty-label">No CDN objects</span>
+        <span class="empty-hint">Add objects to expose local CDN assets through the API.</span>
+      </div>
+    </div>
+
+    <NychDialog v-model:visible="showCreate" header="Add CDN Object" :modal="true" :draggable="false" style="width: min(560px, 95vw)">
+      <form @submit.prevent="submitCreate" class="dialog-form">
+        <div class="field">
+          <label>Key</label>
+          <NychInputText v-model="form.key" placeholder="logo.png" fluid />
+          <p class="hint">Accessed at <code>/api/cdn/&lt;key&gt;</code></p>
+        </div>
+        <div class="field">
+          <label>URL</label>
+          <NychInputText v-model="form.url" placeholder="http://cdn-service:9000/bucket/logo.png" fluid />
+          <p class="hint">Internal URL the API will proxy to.</p>
+        </div>
+        <div class="field">
+          <label>Content Type <span class="optional">(optional)</span></label>
+          <NychInputText v-model="form.content_type" placeholder="image/png" fluid />
+        </div>
+        <div class="field">
+          <label>Description <span class="optional">(optional)</span></label>
+          <NychInputText v-model="form.description" placeholder="App logo" fluid />
+        </div>
+        <NychButton type="submit" fluid label="Add Object" :disabled="!form.key || !form.url || loading" />
+      </form>
+    </NychDialog>
+
+    <NychDialog v-model:visible="showEdit" :header="`Edit — ${editKey}`" :modal="true" :draggable="false" style="width: min(560px, 95vw)">
+      <form @submit.prevent="submitEdit" class="dialog-form">
+        <div class="field">
+          <label>Key</label>
+          <NychInputText v-model="editForm.key" fluid />
+        </div>
+        <div class="field">
+          <label>URL</label>
+          <NychInputText v-model="editForm.url" fluid />
+        </div>
+        <div class="field">
+          <label>Content Type <span class="optional">(optional)</span></label>
+          <NychInputText v-model="editForm.content_type" fluid />
+        </div>
+        <div class="field">
+          <label>Description <span class="optional">(optional)</span></label>
+          <NychInputText v-model="editForm.description" fluid />
+        </div>
+        <NychButton type="submit" fluid label="Save Changes" :disabled="loading" />
+      </form>
+    </NychDialog>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const objects = ref<any[]>([])
+const showCreate = ref(false)
+const showEdit = ref(false)
+const editKey = ref('')
+const loading = ref(false)
+const form = ref({ key: '', url: '', content_type: '', description: '' })
+const editForm = ref({ key: '', url: '', content_type: '', description: '' })
+
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/cdn', { headers: auth.authHeaders() })
+    objects.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+
+async function submitCreate() {
+  loading.value = true
+  try {
+    await fetch('/api/cdn', {
+      method: 'POST',
+      headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        key: form.value.key,
+        url: form.value.url,
+        content_type: form.value.content_type || null,
+        description: form.value.description || null,
+      }),
+    })
+    showCreate.value = false
+    form.value = { key: '', url: '', content_type: '', description: '' }
+    await load()
+  } finally {
+    loading.value = false
+  }
+}
+
+function openEdit(o: any) {
+  editKey.value = o.key
+  editForm.value = {
+    key: o.key,
+    url: o.url,
+    content_type: o.content_type ?? '',
+    description: o.description ?? '',
+  }
+  showEdit.value = true
+}
+
+async function submitEdit() {
+  loading.value = true
+  try {
+    await fetch(`/api/cdn/${editKey.value}`, {
+      method: 'PUT',
+      headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        key: editForm.value.key || null,
+        url: editForm.value.url || null,
+        content_type: editForm.value.content_type || null,
+        description: editForm.value.description || null,
+      }),
+    })
+    showEdit.value = false
+    await load()
+  } finally {
+    loading.value = false
+  }
+}
+
+async function deleteObject(key: string) {
+  if (!confirm(`Delete CDN object "${key}"?`)) return
+  loading.value = true
+  try {
+    await fetch(`/api/cdn/${key}`, { method: 'DELETE', headers: auth.authHeaders() })
+    await load()
+  } finally {
+    loading.value = false
+  }
+}
+
+onMounted(load)
+</script>
+
+<style scoped>
+.url-cell  { font-size: 0.8rem; max-width: 240px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.ct-cell   { color: var(--text-muted); font-size: 0.85rem; font-family: var(--font-mono); }
+.desc-cell { color: var(--text-muted); font-size: 0.85rem; }
+.hint { font-size: 0.78rem; color: var(--text-dim); margin: 0.25rem 0 0; font-family: var(--font-sans); }
+</style>
+```
+
+---
+
+### Task 12: Router + Nav Updates
+
+**Files:**
+- Modify: `ui/src/router/index.ts`
+- Modify: `ui/src/views/admin/Layout.vue`
+
+**Interfaces:**
+- Produces: `/admin/cors` and `/admin/cdn` routed and visible in sidebar
+
+- [ ] **Step 1: Add routes to ui/src/router/index.ts**
+
+Replace the children array:
+```ts
+children: [
+  { path: 'queries',     component: () => import('../views/admin/Queries.vue') },
+  { path: 'tables',      component: () => import('../views/admin/Tables.vue') },
+  { path: 'users',       component: () => import('../views/admin/Users.vue') },
+  { path: 'permissions', component: () => import('../views/admin/Permissions.vue') },
+  { path: 'blacklist',   component: () => import('../views/admin/Blacklist.vue') },
+  { path: 'api-keys',    component: () => import('../views/admin/ApiKeys.vue') },
+  { path: 'cache',       component: () => import('../views/admin/Cache.vue') },
+  { path: 'cors',        component: () => import('../views/admin/Cors.vue') },
+  { path: 'cdn',         component: () => import('../views/admin/Cdn.vue') },
+],
+```
+
+- [ ] **Step 2: Add nav items to Layout.vue**
+
+Replace the `navItems` array:
+```ts
+const navItems = [
+    { to: "/admin/queries",     label: "Queries",     icon: "⌗" },
+    { to: "/admin/tables",      label: "Tables",      icon: "▦" },
+    { to: "/admin/users",       label: "Users",       icon: "◉" },
+    { to: "/admin/permissions", label: "Permissions", icon: "⬡" },
+    { to: "/admin/blacklist",   label: "Blacklist",   icon: "⊘" },
+    { to: "/admin/api-keys",    label: "API Keys",    icon: "⚿" },
+    { to: "/admin/cache",       label: "Cache",       icon: "◈" },
+    { to: "/admin/cors",        label: "CORS",        icon: "✦" },
+    { to: "/admin/cdn",         label: "CDN Objects", icon: "▣" },
+];
+```
+
+- [ ] **Step 3: Build the frontend**
+
+```bash
+cd /home/mcpeakml/code/rust/Mercury/ui && bun run build 2>&1 | tail -5
+```
+Expected: `dist/` rebuilt successfully with no errors.
+
+---
+
+## Self-Review
+
+**Spec coverage check:**
+- ✅ CORS origins stored in DB (`cors_origins` table) — Task 1
+- ✅ CORS in-memory cache (`CorsCache`) — Task 2
+- ✅ Custom async `cors_layer` middleware (replaces static `CorsLayer`) — Task 4
+- ✅ CORS reload after CRUD mutation — Task 6
+- ✅ CORS_ORIGINS env var seeds DB on first startup — Task 7
+- ✅ CDN DB table (`cdn_objects`) — Task 1
+- ✅ CDN proxy handler (`cdn_proxy`) — Task 5
+- ✅ CDN CRUD handlers — Task 5
+- ✅ CDN blacklist for mutations (POST/PUT/DELETE), GET unblocked — Task 1 + Task 7
+- ✅ `cors_origins` + `cdn_objects` in PROTECTED_TABLES (drop-safe) — Task 6
+- ✅ Spinner CSS — Task 8
+- ✅ Loading state across 7 existing views — Task 9
+- ✅ Cors.vue admin view — Task 10
+- ✅ Cdn.vue admin view — Task 11
+- ✅ Router + nav for both views — Task 12
+
+**Type consistency check:**
+- `CorsCache` defined in Task 2, consumed in Task 4 (middleware) and Task 6 (reload_cors) and Task 7 (AppState init) — consistent.
+- `CdnObject`, `CreateCdnObject`, `UpdateCdnObject` defined in Task 3, consumed in Task 5 — consistent.
+- `cdn_list`, `cdn_proxy`, `cdn_create`, `cdn_update`, `cdn_delete` defined in Task 5, imported in Task 7 — consistent.
+- `cors_layer` defined in Task 4, imported in Task 7 — consistent.
+- `AppState.http_client: reqwest::Client` added in Task 2, used in Task 5 (`state.http_client`) — consistent.
+- Vue views use `GET /api/cdn` (not `/api/cdn_objects`) for list — matches CDN route defined in Task 7.
+- Vue Cors.vue uses `GET /api/cors_origins` — matches CRUD route (blacklist allows super_admin GET via bypass_mask) — consistent.
diff --git a/docs/superpowers/plans/2026-07-15-nychthemeron-shadcn-migration.md b/docs/superpowers/plans/2026-07-15-nychthemeron-shadcn-migration.md
new file mode 100644
index 0000000..7063622
--- /dev/null
+++ b/docs/superpowers/plans/2026-07-15-nychthemeron-shadcn-migration.md
@@ -0,0 +1,1986 @@
+# Nychthemeron shadcn-vue Migration Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Port Mercury UI from the old PrimeVue-based `@nychthemeron/library@0.0.1` to the new shadcn-vue-based `@nychthemeron/library@0.0.1` (same version, contents replaced on the registry — already installed and lockfile-consistent as of this plan).
+
+**Architecture:** Two phases. Phase 1 fixes build/plugin wiring so the app compiles and runs against the new library (no view changes yet — the app will render unstyled/broken between Phase 1 and the first view task, which is expected). Phase 2 migrates each view file natively to the new component API, one file at a time, each independently testable via type-check + manual browser verification.
+
+**Tech Stack:** Vue 3.5, Vite 5, TypeScript, `@nychthemeron/library` (shadcn-vue + Tailwind v4 + CVA under the hood, consumed only through its `Nych*` global components — this app never imports shadcn-vue/Tailwind/CVA directly).
+
+> **Amendment (during Task 1 execution):** the library moved again, from
+> `0.0.1` to `0.0.3`, while this plan was being executed (maintainer-owned
+> registry, confirmed intentional). Two things changed that affect Task 1
+> only — Phase 2's component-level API (Button/Dialog/Select/Alert props)
+> is unaffected:
+> - The `"./theme"` export subpath was dropped. `main.ts` must import
+>   `@nychthemeron/library/style` instead of `.../theme` — same
+>   `tailwind.css` content, different subpath.
+> - The library's `"."` export declares a `"development"` condition
+>   pointing at `./src/index.ts`, which isn't in the published files
+>   (`dist/`, `src/assets/`, `src/components/` only). Vite's dev server
+>   picks that condition first and fails to resolve the bare
+>   `@nychthemeron/library` specifier. `vite.config.ts` needs a
+>   `resolve.alias` entry anchored to the exact bare specifier (regex
+>   `/^@nychthemeron\/library$/`, not a plain string — plain-string
+>   aliases prefix-match and break the `/style`/`/components` subpath
+>   imports) pointing straight at `./node_modules/@nychthemeron/library/dist/index.js`.
+>
+> Both fixes already landed in commit `86a715e` on `main`. Tasks 2+ can
+> assume `bun run dev` and `bun run build` both work cleanly at the
+
+> config/plugin level — nothing in this amendment affects Phase 2 view
+> migrations.
+
+## Global Constraints
+
+- Every `Nych*` tag is a **globally registered component** via `app.use(createNychthemeron())` in `src/main.ts` — view files never `import` them individually. Don't add per-file imports.
+- Button `variant` values: `primary` (default), `secondary`, `info`, `success`, `warning`, `danger`. `size` values: `default`, `sm`, `lg`, `icon`.
+- Alert `variant` values: `info` (default), `success`, `warning`, `danger`, `secondary`.
+- There is no `fluid` prop anywhere in the new library — full-width is always `class="w-full"`.
+- There is no `label` prop on `NychButton` — button text is the default slot.
+- `NychDialog` is `v-model:open` (boolean), not `v-model:visible`. Header text goes in `<NychDialogHeader><NychDialogTitle>...</NychDialogTitle></NychDialogHeader>`, not a `header` prop. Width goes on `NychDialogContent`'s `class`, not a `style` attribute on `NychDialog`.
+- `NychSelect` takes a plain string `v-model` and `NychSelectItem` children — there is no `:options`/`optionLabel`/`optionValue` array API, and **values must be strings** (no boolean/number option values).
+- No test framework exists in this repo (`package.json` has no `test` script). Verification is `bun run build` (runs `vue-tsc --noEmit && vite build`) for type-correctness, plus manual browser verification for visual/behavioral correctness — do not add a test framework as part of this plan (out of scope, not requested).
+- Run all commands from `/home/mcpeakml/code/rust/Mercury/ui`.
+
+---
+
+### Task 1: Foundation — build and plugin wiring
+
+**Files:**
+- Modify: `src/main.ts`
+- Modify: `vite.config.ts`
+- Modify: `package.json`
+- Modify: `src/assets/main.css`
+
+**Interfaces:**
+- Produces: a working `bun run dev` server with the new `@nychthemeron/library` theme CSS loaded and no PrimeVue references left anywhere in the app. Every later task depends on this.
+
+- [ ] **Step 1: Remove PrimeVue from `src/main.ts`**
+
+Current content:
+```ts
+import { createApp } from "vue";
+import '@nychthemeron/library/theme'
+import './assets/main.css'
+import './stores/theme'
+import { createPinia } from "pinia";
+import PrimeVue from "@primevue/core/config";
+import { createNychthemeron } from "@nychthemeron/library";
+import App from "./App.vue";
+import router from "./router";
+
+const app = createApp(App);
+app.use(createPinia());
+app.use(router);
+app.use(PrimeVue, { unstyled: true });
+app.use(createNychthemeron());
+app.mount("#app");
+```
+
+Replace with:
+```ts
+import { createApp } from "vue";
+import '@nychthemeron/library/theme'
+import './assets/main.css'
+import './stores/theme'
+import { createPinia } from "pinia";
+import { createNychthemeron } from "@nychthemeron/library";
+import App from "./App.vue";
+import router from "./router";
+
+const app = createApp(App);
+app.use(createPinia());
+app.use(router);
+app.use(createNychthemeron());
+app.mount("#app");
+```
+
+- [ ] **Step 2: Add the Tailwind v4 Vite plugin and drop the PrimeVue chunk in `vite.config.ts`**
+
+Current content:
+```ts
+import { defineConfig } from "vite";
+import vue from "@vitejs/plugin-vue";
+
+export default defineConfig({
+    plugins: [vue()],
+    server: {
+        proxy: {
+            "/api": "http://localhost:3000",
+            "/auth": "http://localhost:3000",
+            "/admin": "http://localhost:3000",
+        },
+    },
+    build: {
+        outDir: "dist",
+        rollupOptions: {
+            output: {
+                manualChunks: {
+                    vue: ["vue", "vue-router", "pinia"],
+                    primevue: ["@primevue/core"],
+                    nychthemeron: ["@nychthemeron/library"],
+                },
+                entryFileNames: "js/[name]-[hash].js",
+                chunkFileNames: "js/[name]-[hash].js",
+                assetFileNames: "assets/[name]-[hash][extname]",
+            },
+        },
+    },
+});
+```
+
+Replace with:
+```ts
+import { defineConfig } from "vite";
+import vue from "@vitejs/plugin-vue";
+import tailwindcss from "@tailwindcss/vite";
+
+export default defineConfig({
+    plugins: [vue(), tailwindcss()],
+    server: {
+        proxy: {
+            "/api": "http://localhost:3000",
+            "/auth": "http://localhost:3000",
+            "/admin": "http://localhost:3000",
+        },
+    },
+    build: {
+        outDir: "dist",
+        rollupOptions: {
+            output: {
+                manualChunks: {
+                    vue: ["vue", "vue-router", "pinia"],
+                    nychthemeron: ["@nychthemeron/library"],
+                },
+                entryFileNames: "js/[name]-[hash].js",
+                chunkFileNames: "js/[name]-[hash].js",
+                assetFileNames: "assets/[name]-[hash][extname]",
+            },
+        },
+    },
+});
+```
+
+- [ ] **Step 3: Add direct devDependencies and bump the `vue` peer range in `package.json`**
+
+Current content:
+```json
+{
+  "name": "mercury-ui",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vue-tsc --noEmit && vite build",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@nychthemeron/library": "^0.0.1",
+    "pinia": "^2.1.0",
+    "vue": "^3.4.0",
+    "vue-router": "^4.3.0"
+  },
+  "devDependencies": {
+    "@vitejs/plugin-vue": "^5.0.0",
+    "typescript": "^5.3.0",
+    "vite": "^5.0.0",
+    "vue-tsc": "^2.0.0"
+  }
+}
+```
+
+Replace with:
+```json
+{
+  "name": "mercury-ui",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vue-tsc --noEmit && vite build",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@nychthemeron/library": "^0.0.1",
+    "pinia": "^2.1.0",
+    "vue": "^3.5.0",
+    "vue-router": "^4.3.0"
+  },
+  "devDependencies": {
+    "@tailwindcss/vite": "^4.3.2",
+    "@vitejs/plugin-vue": "^5.0.0",
+    "tailwindcss": "^4.3.2",
+    "typescript": "^5.3.0",
+    "vite": "^5.0.0",
+    "vue-tsc": "^2.0.0"
+  }
+}
+```
+
+- [ ] **Step 4: Run `bun install` to sync the lockfile with the `package.json` edits**
+
+Run: `bun install`
+Expected: exits 0, no version conflicts reported. (`@tailwindcss/vite`, `tailwindcss`, and `vue@3.5.x` are already present in `bun.lock` as transitive dependencies of `@nychthemeron/library`, so this should only re-link them as direct deps, not download anything new.)
+
+- [ ] **Step 5: Remove the dead unstyled-PrimeVue overrides from `src/assets/main.css`**
+
+Find:
+```css
+.nych-dialog {
+    min-width: 500px;
+}
+
+[class^="nych-button"] {
+    box-shadow: unset !important;
+    justify-content: center !important;
+}
+
+[class^="nych-button"]:hover {
+    box-shadow: 0 0 5px var(--text-high);
+}
+
+.nych-loading-icon .wreath {
+    transform-box: fill-box;
+    transform-origin: center;
+}
+```
+
+Replace with:
+```css
+.nych-loading-icon .wreath {
+    transform-box: fill-box;
+    transform-origin: center;
+}
+```
+
+(`.nych-dialog` and `[class^="nych-button"]` matched classnames the old unstyled-PrimeVue passthrough emitted. The new `NychDialog`/`NychButton` don't emit any classname starting with `nych-dialog`/`nych-button` — they use Tailwind utility classes and `data-slot` attributes instead — so these two rules can no longer match anything. `.nych-loading-icon .wreath` stays: `NychLoadingIcon`'s markup is unchanged in the new library.)
+
+- [ ] **Step 6: Verify the app boots**
+
+Run: `bun run dev` (leave running in the background, or run and check output then stop it)
+Expected: Vite starts with no errors. Open `http://localhost:5173` (or whatever port Vite prints) in a browser — the login page should load without console errors. It will look broken/unstyled in places until Phase 2 migrates `Login.vue` and the other views (raw `Nych*` global components render, but with old PrimeVue-style props like `label`/`fluid`/`header` that the new components silently ignore, so buttons show no text and dialogs show no visible chrome) — that's expected at this point, not a regression to fix here.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add src/main.ts vite.config.ts package.json bun.lock src/assets/main.css
+git commit -m "Wire Mercury UI build to the shadcn-vue nychthemeron library"
+```
+
+---
+
+### Task 2: Migrate `src/views/Login.vue`
+
+**Files:**
+- Modify: `src/views/Login.vue`
+
+**Interfaces:**
+- Consumes: `NychInput` (rename of `NychInputText`), `NychButton` — both globally registered per Task 1.
+
+- [ ] **Step 1: Update the template**
+
+Find:
+```html
+                <div class="login-field">
+                    <label>Username</label>
+                    <NychInputText
+                        v-model="username"
+                        placeholder="username"
+                        fluid
+                        autocomplete="username"
+                    />
+                </div>
+                <div class="login-field">
+                    <label>Password</label>
+                    <NychInputText
+                        v-model="password"
+                        type="password"
+                        placeholder="••••••••"
+                        fluid
+                        autocomplete="current-password"
+                    />
+                </div>
+                <p v-if="error" class="login-error">{{ error }}</p>
+                <NychButton type="submit" :loading="loading" label="Sign In" fluid />
+```
+
+Replace with:
+```html
+                <div class="login-field">
+                    <label>Username</label>
+                    <NychInput
+                        v-model="username"
+                        placeholder="username"
+                        class="w-full"
+                        autocomplete="username"
+                    />
+                </div>
+                <div class="login-field">
+                    <label>Password</label>
+                    <NychInput
+                        v-model="password"
+                        type="password"
+                        placeholder="••••••••"
+                        class="w-full"
+                        autocomplete="current-password"
+                    />
+                </div>
+                <p v-if="error" class="login-error">{{ error }}</p>
+                <NychButton type="submit" :loading="loading" class="w-full">Sign In</NychButton>
+```
+
+- [ ] **Step 2: Update the leftover `<style>` selector**
+
+Find:
+```css
+.nych-button-primary {
+    margin-top: 2px;
+}
+```
+
+Replace with:
+```css
+[data-slot="button"] {
+    margin-top: 2px;
+}
+```
+
+(The new `NychButton` root element carries `data-slot="button"` instead of a `nych-button-primary` classname — this preserves the same 2px top margin on the sign-in button.)
+
+- [ ] **Step 3: Type-check**
+
+Run: `bun run build`
+Expected: no TypeScript errors referencing `Login.vue`. (The build may still fail on other unmigrated views — only check that `Login.vue` isn't in the error output.)
+
+- [ ] **Step 4: Manual browser check**
+
+Run `bun run dev`, open the login page. Verify: username/password fields render full-width with visible borders, typing works, submitting with empty fields still hits the API (existing validation is server-side), the "Sign In" button shows text and a loading spinner while `loading` is true, and a failed login shows the red error message.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/views/Login.vue
+git commit -m "Migrate Login.vue to the shadcn-vue nychthemeron components"
+```
+
+---
+
+### Task 3: Restyle `src/views/admin/MethodSelect.vue`
+
+This is a bespoke local multi-select component (not part of the library) that styled itself entirely off classnames the *old* `nychthemeron.css` defined (`.nych-select`, `.nych-select-label`, `.nych-select-dropdown`, `.nych-select-dropdownIcon`, `.nych-select-overlay`, `.nych-select-list`, `.nych-select-option`). The new theme CSS doesn't define those classnames at all, so without this fix `MethodSelect` renders as an unstyled native button/list as soon as Task 1 lands. It stays a bespoke component — the library's `NychSelect` is single-value only and has no multi-select equivalent, so there's nothing to swap it for.
+
+**Files:**
+- Modify: `src/views/admin/MethodSelect.vue`
+
+- [ ] **Step 1: Add the missing styles into the component's existing global `<style>` block**
+
+Find:
+```css
+<style>
+/* Must be global — teleported content renders outside this component's scoped tree */
+.ms-trigger {
+  display: flex;
+  width: 100%;
+  min-width: unset;
+  text-align: left;
+  font-family: var(--font-sans);
+  font-size: 14px;
+  cursor: pointer;
+}
+
+.ms-backdrop {
+  position: fixed;
+  inset: 0;
+  z-index: 9998;
+}
+
+.ms-panel {
+  z-index: 9999;
+}
+
+.ms-chevron {
+  transition: transform 0.15s ease;
+}
+.ms-chevron-open {
+  transform: rotate(180deg);
+}
+</style>
+```
+
+Replace with:
+```css
+<style>
+/* Must be global — teleported content renders outside this component's scoped tree.
+   These .nych-select-* rules used to come from the library's own CSS; the new
+   shadcn-vue build doesn't emit them (its Select uses Tailwind utility classes
+   instead), so this component now carries its own copy to keep the same look. */
+.nych-select {
+  display: inline-flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  min-width: 13rem;
+  font-family: var(--font-sans);
+  padding: 8px 11px;
+  color: var(--text-body);
+  background-color: var(--surface-1);
+  border: 1px solid var(--border);
+  border-radius: 5px;
+  cursor: pointer;
+  transition:
+    border-color 0.2s ease,
+    box-shadow 0.2s ease;
+}
+
+.nych-select:hover {
+  border-color: var(--border-hi);
+}
+
+.nych-select-label {
+  flex: 1;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.nych-select-label[data-p='placeholder'] {
+  color: var(--text-dim);
+}
+
+.nych-select-dropdown {
+  display: flex;
+  align-items: center;
+  color: var(--text-muted);
+}
+
+.nych-select-dropdownIcon {
+  width: 14px;
+  height: 14px;
+}
+
+.nych-select-overlay {
+  font-family: var(--font-sans);
+  margin-top: 4px;
+  background-color: var(--surface-2);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.35);
+  overflow: hidden;
+}
+
+.nych-select-list {
+  list-style: none;
+  margin: 0;
+  padding: 4px;
+  max-height: 14rem;
+  overflow-y: auto;
+}
+
+.nych-select-option {
+  padding: 8px 11px;
+  border-radius: 4px;
+  color: var(--text-body);
+  cursor: pointer;
+  transition: background-color 0.15s ease;
+}
+
+.nych-select-option:hover {
+  background-color: var(--surface-3);
+}
+
+.nych-select-option[data-p-selected='true'] {
+  background-color: var(--primary);
+  color: var(--primary-fg);
+}
+
+/* Must be global — teleported content renders outside this component's scoped tree */
+.ms-trigger {
+  display: flex;
+  width: 100%;
+  min-width: unset;
+  text-align: left;
+  font-family: var(--font-sans);
+  font-size: 14px;
+  cursor: pointer;
+}
+
+.ms-backdrop {
+  position: fixed;
+  inset: 0;
+  z-index: 9998;
+}
+
+.ms-panel {
+  z-index: 9999;
+}
+
+.ms-chevron {
+  transition: transform 0.15s ease;
+}
+.ms-chevron-open {
+  transform: rotate(180deg);
+}
+</style>
+```
+
+(Note: the old CSS also had `.nych-select[data-p~='focus']` / `.nych-select[data-p~='disabled']` / `.nych-select-option[data-p-focused='true']` rules — omitted here because this component's template never sets those `data-p` attributes, so they were always dead code for this usage.)
+
+- [ ] **Step 2: Type-check**
+
+Run: `bun run build`
+Expected: no TypeScript errors referencing `MethodSelect.vue` (this task is CSS-only, no template/script changes, so this should already pass).
+
+- [ ] **Step 3: Manual browser check**
+
+This component is only used from `Blacklist.vue`, which hasn't been migrated yet at this point in the plan — skip the browser check here and verify it as part of Task 7 (`Blacklist.vue`) instead, where it's actually reachable in the running app.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add src/views/admin/MethodSelect.vue
+git commit -m "Restyle MethodSelect.vue for the new theme CSS"
+```
+
+---
+
+### Task 4: Migrate `src/views/admin/Cache.vue`
+
+**Files:**
+- Modify: `src/views/admin/Cache.vue`
+
+- [ ] **Step 1: Update the template**
+
+Find:
+```html
+        <NychButton @click="load" label="Refresh" />
+        <NychButton severity="danger" @click="flushCache" label="Flush Cache" />
+```
+
+Replace with:
+```html
+        <NychButton @click="load">Refresh</NychButton>
+        <NychButton variant="danger" @click="flushCache">Flush Cache</NychButton>
+```
+
+- [ ] **Step 2: Type-check**
+
+Run: `bun run build`
+Expected: no errors referencing `Cache.vue`.
+
+- [ ] **Step 3: Manual browser check**
+
+Navigate to the Query Cache admin page. Verify: "Refresh" and "Flush Cache" buttons show their text, Refresh reloads stats, Flush Cache prompts a confirm dialog and clears stats on confirm.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add src/views/admin/Cache.vue
+git commit -m "Migrate Cache.vue to the shadcn-vue nychthemeron components"
+```
+
+---
+
+### Task 5: Migrate `src/views/admin/Cors.vue`
+
+**Files:**
+- Modify: `src/views/admin/Cors.vue`
+
+- [ ] **Step 1: Update the template**
+
+Find:
+```html
+      <NychButton @click="showCreate = true" label="+ Add Origin" />
+```
+
+Replace with:
+```html
+      <NychButton @click="showCreate = true">+ Add Origin</NychButton>
+```
+
+Find:
+```html
+                  <NychButton size="small" severity="danger" @click="deleteOrigin(o.id)" label="Delete" />
+```
+
+Replace with:
+```html
+                  <NychButton size="sm" variant="danger" @click="deleteOrigin(o.id)">Delete</NychButton>
+```
+
+Find:
+```html
+    <NychDialog v-model:visible="showCreate" header="Add CORS Origin" :modal="true" :draggable="false" style="width: min(480px, 95vw)">
+      <form @submit.prevent="submitCreate" class="dialog-form">
+        <div class="field">
+          <label>Origin</label>
+          <NychInputText v-model="form.origin" placeholder="https://app.example.com" fluid />
+          <p class="hint">Use <code>*</code> to allow all origins (permissive mode).</p>
+        </div>
+        <NychButton type="submit" fluid label="Add Origin" :disabled="!form.origin || loading" />
+      </form>
+    </NychDialog>
+```
+
+Replace with:
+```html
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(480px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Add CORS Origin</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>Origin</label>
+            <NychInput v-model="form.origin" placeholder="https://app.example.com" class="w-full" />
+            <p class="hint">Use <code>*</code> to allow all origins (permissive mode).</p>
+          </div>
+          <NychButton type="submit" class="w-full" :disabled="!form.origin || loading">Add Origin</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+```
+
+- [ ] **Step 2: Type-check**
+
+Run: `bun run build`
+Expected: no errors referencing `Cors.vue`.
+
+- [ ] **Step 3: Manual browser check**
+
+Navigate to CORS Origins. Verify: "+ Add Origin" opens a dialog titled "Add CORS Origin" with a visible border/backdrop, the input accepts text, "Add Origin" is disabled until the field is non-empty, submitting adds a row and closes the dialog, and the per-row "Delete" button removes a row after confirm.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add src/views/admin/Cors.vue
+git commit -m "Migrate Cors.vue to the shadcn-vue nychthemeron components"
+```
+
+---
+
+### Task 6: Migrate `src/views/admin/Queries.vue`
+
+**Files:**
+- Modify: `src/views/admin/Queries.vue`
+
+- [ ] **Step 1: Update the header button and table action buttons**
+
+Find:
+```html
+      <NychButton @click="showCreate = true" label="+ New Query" />
+```
+
+Replace with:
+```html
+      <NychButton @click="showCreate = true">+ New Query</NychButton>
+```
+
+Find:
+```html
+              <NychButton size="small" @click="openEdit(q)" label="Edit" />
+              <NychButton size="small" severity="danger" @click="deleteQuery(q)" label="Delete" />
+```
+
+Replace with:
+```html
+              <NychButton size="sm" @click="openEdit(q)">Edit</NychButton>
+              <NychButton size="sm" variant="danger" @click="deleteQuery(q)">Delete</NychButton>
+```
+
+- [ ] **Step 2: Update the create dialog**
+
+Find:
+```html
+    <NychDialog v-model:visible="showCreate" header="New Query" :modal="true" :draggable="false" style="width: min(800px, 95vw)">
+      <form @submit.prevent="submitCreate" class="dialog-form">
+        <div class="field">
+          <label>Identifier</label>
+          <NychInputText v-model="form.identifier" placeholder="e.g. get-user-orders" fluid />
+        </div>
+        <div class="field">
+          <label>Description <span class="optional">(optional)</span></label>
+          <NychInputText v-model="form.description" placeholder="Brief description of what this query does" fluid />
+        </div>
+        <div class="field">
+          <label>SQL Template</label>
+          <NychTextarea v-model="form.sql_template" placeholder="SELECT * FROM orders WHERE user_id = :user_id" :rows="12" fluid />
+          <p class="hint">Use <code>:param_name</code> for named bind parameters.</p>
+        </div>
+        <NychButton type="submit" fluid label="Save Query" />
+      </form>
+    </NychDialog>
+```
+
+Replace with:
+```html
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(800px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>New Query</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>Identifier</label>
+            <NychInput v-model="form.identifier" placeholder="e.g. get-user-orders" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Description <span class="optional">(optional)</span></label>
+            <NychInput v-model="form.description" placeholder="Brief description of what this query does" class="w-full" />
+          </div>
+          <div class="field">
+            <label>SQL Template</label>
+            <NychTextarea v-model="form.sql_template" placeholder="SELECT * FROM orders WHERE user_id = :user_id" :rows="12" class="w-full" />
+            <p class="hint">Use <code>:param_name</code> for named bind parameters.</p>
+          </div>
+          <NychButton type="submit" class="w-full">Save Query</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+```
+
+- [ ] **Step 3: Update the edit dialog**
+
+Find:
+```html
+    <NychDialog v-model:visible="showEdit" :header="`Edit — ${editIdentifier}`" :modal="true" :draggable="false" style="width: min(800px, 95vw)">
+      <form @submit.prevent="submitEdit" class="dialog-form">
+        <div class="field">
+          <label>SQL Template</label>
+          <NychTextarea v-model="editForm.sql_template" :rows="12" fluid />
+          <p class="hint">Use <code>:param_name</code> for named bind parameters.</p>
+        </div>
+        <div class="field">
+          <label>Description <span class="optional">(optional)</span></label>
+          <NychInputText v-model="editForm.description" placeholder="Brief description" fluid />
+        </div>
+        <NychButton type="submit" fluid label="Update Query" />
+      </form>
+    </NychDialog>
+```
+
+Replace with:
+```html
+    <NychDialog v-model:open="showEdit">
+      <NychDialogContent class="w-[min(800px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Edit — {{ editIdentifier }}</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitEdit" class="dialog-form">
+          <div class="field">
+            <label>SQL Template</label>
+            <NychTextarea v-model="editForm.sql_template" :rows="12" class="w-full" />
+            <p class="hint">Use <code>:param_name</code> for named bind parameters.</p>
+          </div>
+          <div class="field">
+            <label>Description <span class="optional">(optional)</span></label>
+            <NychInput v-model="editForm.description" placeholder="Brief description" class="w-full" />
+          </div>
+          <NychButton type="submit" class="w-full">Update Query</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+```
+
+- [ ] **Step 4: Type-check**
+
+Run: `bun run build`
+Expected: no errors referencing `Queries.vue`.
+
+- [ ] **Step 5: Manual browser check**
+
+Navigate to Query Registry. Verify: "+ New Query" opens a dialog, the SQL textarea is 12 rows tall and full width, saving adds a row; per-row "Edit" opens a dialog titled "Edit — &lt;identifier&gt;" pre-filled with the SQL and description, saving updates the row; "Delete" removes a row after confirm.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/views/admin/Queries.vue
+git commit -m "Migrate Queries.vue to the shadcn-vue nychthemeron components"
+```
+
+---
+
+### Task 7: Migrate `src/views/admin/Blacklist.vue`
+
+This file has the one boolean-valued `NychSelect` in the app (`Status: Active/Disabled`) — the new `NychSelect` only supports string `v-model`/`value`, so `editForm.active` needs to become a string internally, converted back to boolean at the API-call boundary.
+
+**Files:**
+- Modify: `src/views/admin/Blacklist.vue`
+
+- [ ] **Step 1: Update the header button and table action buttons**
+
+Find:
+```html
+      <NychButton @click="showCreate = true" label="+ Add Pattern" />
+```
+
+Replace with:
+```html
+      <NychButton @click="showCreate = true">+ Add Pattern</NychButton>
+```
+
+Find:
+```html
+              <NychButton size="small" @click="openEdit(e)" label="Edit" />
+              <NychButton size="small" severity="danger" @click="deleteEntry(e.id)" label="Delete" />
+```
+
+Replace with:
+```html
+              <NychButton size="sm" @click="openEdit(e)">Edit</NychButton>
+              <NychButton size="sm" variant="danger" @click="deleteEntry(e.id)">Delete</NychButton>
+```
+
+- [ ] **Step 2: Update the edit dialog**
+
+Find:
+```html
+    <NychDialog v-model:visible="showEdit" header="Edit Blacklist Entry" :modal="true" :draggable="false" style="width: min(640px, 95vw)">
+      <form @submit.prevent="submitEdit" class="dialog-form">
+        <div class="field">
+          <label>Pattern</label>
+          <NychInputText v-model="editForm.pattern" fluid />
+        </div>
+        <div class="field">
+          <label>HTTP Methods <span class="optional">(none = all methods)</span></label>
+          <MethodSelect v-model="editForm.methods" :options="HTTP_METHODS" placeholder="All methods" />
+        </div>
+        <div class="field">
+          <label>Reason <span class="optional">(optional)</span></label>
+          <NychInputText v-model="editForm.reason" fluid />
+        </div>
+        <div class="field">
+          <label>Bypass permission mask <span class="optional">(optional)</span></label>
+          <NychInputText v-model="editForm.bypass_mask" placeholder="32" fluid />
+        </div>
+        <div class="field">
+          <label>Status</label>
+          <NychSelect v-model="editForm.active" :options="[{ label: 'Active', value: true }, { label: 'Disabled', value: false }]" optionLabel="label" optionValue="value" fluid />
+        </div>
+        <NychButton type="submit" fluid label="Save Changes" />
+      </form>
+    </NychDialog>
+```
+
+Replace with:
+```html
+    <NychDialog v-model:open="showEdit">
+      <NychDialogContent class="w-[min(640px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Edit Blacklist Entry</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitEdit" class="dialog-form">
+          <div class="field">
+            <label>Pattern</label>
+            <NychInput v-model="editForm.pattern" class="w-full" />
+          </div>
+          <div class="field">
+            <label>HTTP Methods <span class="optional">(none = all methods)</span></label>
+            <MethodSelect v-model="editForm.methods" :options="HTTP_METHODS" placeholder="All methods" />
+          </div>
+          <div class="field">
+            <label>Reason <span class="optional">(optional)</span></label>
+            <NychInput v-model="editForm.reason" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Bypass permission mask <span class="optional">(optional)</span></label>
+            <NychInput v-model="editForm.bypass_mask" placeholder="32" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Status</label>
+            <NychSelect v-model="editForm.active" class="w-full">
+              <NychSelectTrigger class="w-full"><NychSelectValue /></NychSelectTrigger>
+              <NychSelectContent>
+                <NychSelectItem value="true">Active</NychSelectItem>
+                <NychSelectItem value="false">Disabled</NychSelectItem>
+              </NychSelectContent>
+            </NychSelect>
+          </div>
+          <NychButton type="submit" class="w-full">Save Changes</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+```
+
+- [ ] **Step 3: Update the create dialog**
+
+Find:
+```html
+    <NychDialog v-model:visible="showCreate" header="New Blacklist Entry" :modal="true" :draggable="false" style="width: min(640px, 95vw)">
+      <form @submit.prevent="submitCreate" class="dialog-form">
+        <div class="field">
+          <label>Pattern</label>
+          <NychInputText v-model="form.pattern" placeholder="/api/sensitive/**" fluid />
+          <p class="hint">Use <code>*</code> for one segment, <code>**</code> for any depth.</p>
+        </div>
+        <div class="field">
+          <label>HTTP Methods <span class="optional">(none = all methods)</span></label>
+          <MethodSelect v-model="form.methods" :options="HTTP_METHODS" placeholder="All methods" />
+        </div>
+        <div class="field">
+          <label>Reason <span class="optional">(optional)</span></label>
+          <NychInputText v-model="form.reason" placeholder="Why is this route blocked?" fluid />
+        </div>
+        <div class="field">
+          <label>Bypass permission mask <span class="optional">(optional)</span></label>
+          <NychInputText v-model="form.bypass_mask" placeholder="32" fluid />
+          <p class="hint">Permission bit that allows callers to bypass this rule. Leave blank to block everyone.</p>
+        </div>
+        <NychButton type="submit" fluid label="Add to Blacklist" />
+      </form>
+    </NychDialog>
+```
+
+Replace with:
+```html
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(640px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>New Blacklist Entry</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>Pattern</label>
+            <NychInput v-model="form.pattern" placeholder="/api/sensitive/**" class="w-full" />
+            <p class="hint">Use <code>*</code> for one segment, <code>**</code> for any depth.</p>
+          </div>
+          <div class="field">
+            <label>HTTP Methods <span class="optional">(none = all methods)</span></label>
+            <MethodSelect v-model="form.methods" :options="HTTP_METHODS" placeholder="All methods" />
+          </div>
+          <div class="field">
+            <label>Reason <span class="optional">(optional)</span></label>
+            <NychInput v-model="form.reason" placeholder="Why is this route blocked?" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Bypass permission mask <span class="optional">(optional)</span></label>
+            <NychInput v-model="form.bypass_mask" placeholder="32" class="w-full" />
+            <p class="hint">Permission bit that allows callers to bypass this rule. Leave blank to block everyone.</p>
+          </div>
+          <NychButton type="submit" class="w-full">Add to Blacklist</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+```
+
+- [ ] **Step 4: Convert `editForm.active` from boolean to string in the script**
+
+Find:
+```ts
+const editForm = ref({ pattern: '', methods: [] as string[], reason: '', bypass_mask: '', active: true })
+```
+
+Replace with:
+```ts
+const editForm = ref({ pattern: '', methods: [] as string[], reason: '', bypass_mask: '', active: 'true' })
+```
+
+Find:
+```ts
+function openEdit(e: any) {
+  editId.value = e.id
+  editForm.value = {
+    pattern: e.pattern,
+    methods: stringToMethods(e.method),
+    reason: e.reason ?? '',
+    bypass_mask: e.bypass_mask ?? '',
+    active: e.active,
+  }
+  showEdit.value = true
+}
+
+async function submitEdit() {
+  await fetch(`/api/blacklist/${editId.value}`, {
+    method: 'PUT',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      pattern: editForm.value.pattern,
+      method: methodsToString(editForm.value.methods),
+      reason: editForm.value.reason || null,
+      bypass_mask: editForm.value.bypass_mask || null,
+      active: editForm.value.active,
+    }),
+  })
+  showEdit.value = false
+  load()
+}
+```
+
+Replace with:
+```ts
+function openEdit(e: any) {
+  editId.value = e.id
+  editForm.value = {
+    pattern: e.pattern,
+    methods: stringToMethods(e.method),
+    reason: e.reason ?? '',
+    bypass_mask: e.bypass_mask ?? '',
+    active: String(e.active),
+  }
+  showEdit.value = true
+}
+
+async function submitEdit() {
+  await fetch(`/api/blacklist/${editId.value}`, {
+    method: 'PUT',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      pattern: editForm.value.pattern,
+      method: methodsToString(editForm.value.methods),
+      reason: editForm.value.reason || null,
+      bypass_mask: editForm.value.bypass_mask || null,
+      active: editForm.value.active === 'true',
+    }),
+  })
+  showEdit.value = false
+  load()
+}
+```
+
+- [ ] **Step 5: Type-check**
+
+Run: `bun run build`
+Expected: no errors referencing `Blacklist.vue`.
+
+- [ ] **Step 6: Manual browser check**
+
+Navigate to Route Blacklist. Verify: "+ Add Pattern" and per-row "Edit"/"Delete" all show text and work; the `MethodSelect` multi-select dropdown (checked in Task 3) now visually matches the rest of the form inside these dialogs; the edit dialog's "Status" select shows "Active"/"Disabled", changing it and saving persists the new value (check the row's status badge flips), and a fresh entry defaults to "Active".
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add src/views/admin/Blacklist.vue
+git commit -m "Migrate Blacklist.vue to the shadcn-vue nychthemeron components"
+```
+
+---
+
+### Task 8: Migrate `src/views/admin/Permissions.vue`
+
+**Files:**
+- Modify: `src/views/admin/Permissions.vue`
+
+- [ ] **Step 1: Update the header button and table action buttons**
+
+Find:
+```html
+      <NychButton @click="showCreate = true" label="+ New Permission" />
+```
+
+Replace with:
+```html
+      <NychButton @click="showCreate = true">+ New Permission</NychButton>
+```
+
+Find:
+```html
+              <NychButton size="small" @click="openEdit(p)" label="Edit" />
+              <NychButton size="small" severity="danger" @click="deletePermission(p.id)" label="Delete" />
+```
+
+Replace with:
+```html
+              <NychButton size="sm" @click="openEdit(p)">Edit</NychButton>
+              <NychButton size="sm" variant="danger" @click="deletePermission(p.id)">Delete</NychButton>
+```
+
+- [ ] **Step 2: Update the edit dialog**
+
+Find:
+```html
+    <NychDialog v-model:visible="showEdit" :header="`Edit — ${editForm.name}`" :modal="true" :draggable="false" style="width: min(600px, 95vw)">
+      <form @submit.prevent="submitEdit" class="dialog-form">
+        <div class="field">
+          <label>Name</label>
+          <NychInputText v-model="editForm.name" fluid />
+        </div>
+        <div class="field">
+          <label>Description</label>
+          <NychInputText v-model="editForm.description" fluid />
+        </div>
+        <NychButton type="submit" fluid label="Save Changes" />
+      </form>
+    </NychDialog>
+```
+
+Replace with:
+```html
+    <NychDialog v-model:open="showEdit">
+      <NychDialogContent class="w-[min(600px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Edit — {{ editForm.name }}</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitEdit" class="dialog-form">
+          <div class="field">
+            <label>Name</label>
+            <NychInput v-model="editForm.name" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Description</label>
+            <NychInput v-model="editForm.description" class="w-full" />
+          </div>
+          <NychButton type="submit" class="w-full">Save Changes</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+```
+
+- [ ] **Step 3: Update the create dialog**
+
+Find:
+```html
+    <NychDialog v-model:visible="showCreate" header="New Permission" :modal="true" :draggable="false" style="width: min(600px, 95vw)">
+      <form @submit.prevent="submitCreate" class="dialog-form">
+        <div class="field">
+          <label>Name</label>
+          <NychInputText v-model="form.name" placeholder="PERMISSION_NAME" fluid />
+        </div>
+        <div class="field">
+          <label>Bit value</label>
+          <NychInputText v-model="form.bit_value" placeholder="64" fluid />
+          <p class="hint">Must be a power of 2 not already in use (1, 2, 4, 8, 16, 32, 64 …)</p>
+        </div>
+        <div class="field">
+          <label>Description</label>
+          <NychInputText v-model="form.description" placeholder="What this permission grants" fluid />
+        </div>
+        <NychButton type="submit" fluid label="Create Permission" />
+      </form>
+    </NychDialog>
+```
+
+Replace with:
+```html
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(600px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>New Permission</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>Name</label>
+            <NychInput v-model="form.name" placeholder="PERMISSION_NAME" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Bit value</label>
+            <NychInput v-model="form.bit_value" placeholder="64" class="w-full" />
+            <p class="hint">Must be a power of 2 not already in use (1, 2, 4, 8, 16, 32, 64 …)</p>
+          </div>
+          <div class="field">
+            <label>Description</label>
+            <NychInput v-model="form.description" placeholder="What this permission grants" class="w-full" />
+          </div>
+          <NychButton type="submit" class="w-full">Create Permission</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+```
+
+- [ ] **Step 4: Type-check**
+
+Run: `bun run build`
+Expected: no errors referencing `Permissions.vue`.
+
+- [ ] **Step 5: Manual browser check**
+
+Navigate to Permissions. Verify: create/edit dialogs open with visible titles, inputs are full-width, save/create both work and refresh the table, delete works after confirm.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/views/admin/Permissions.vue
+git commit -m "Migrate Permissions.vue to the shadcn-vue nychthemeron components"
+```
+
+---
+
+### Task 9: Migrate `src/views/admin/Users.vue`
+
+**Files:**
+- Modify: `src/views/admin/Users.vue`
+
+- [ ] **Step 1: Update the header button and table action buttons**
+
+Find:
+```html
+      <NychButton @click="showCreate = true" label="+ New User" />
+```
+
+Replace with:
+```html
+      <NychButton @click="showCreate = true">+ New User</NychButton>
+```
+
+Find:
+```html
+              <NychButton size="small" @click="openEdit(u)" label="Edit" />
+              <NychButton size="small" severity="danger" @click="deleteUser(u.id)" label="Delete" />
+```
+
+Replace with:
+```html
+              <NychButton size="sm" @click="openEdit(u)">Edit</NychButton>
+              <NychButton size="sm" variant="danger" @click="deleteUser(u.id)">Delete</NychButton>
+```
+
+- [ ] **Step 2: Update the edit dialog**
+
+Find:
+```html
+    <NychDialog v-model:visible="showEdit" :header="`Edit — ${editForm.username}`" :modal="true" :draggable="false" style="width: min(680px, 95vw)">
+      <form @submit.prevent="submitEdit" class="dialog-form">
+        <div class="field">
+          <label>Username</label>
+          <NychInputText v-model="editForm.username" fluid autocomplete="off" />
+        </div>
+        <div class="field">
+          <label>New password <span class="optional">(leave blank to keep current)</span></label>
+          <NychInputText v-model="editForm.password" type="password" placeholder="••••••••" fluid autocomplete="new-password" />
+        </div>
+        <div class="field">
+          <label>Role</label>
+          <NychSelect v-model="editForm.permissions_mask" :options="ROLES" optionLabel="label" optionValue="value" fluid />
+          <p class="hint">{{ ROLES.find(r => r.value === editForm.permissions_mask)?.description ?? '' }}</p>
+        </div>
+        <NychButton type="submit" fluid label="Save Changes" />
+      </form>
+    </NychDialog>
+```
+
+Replace with:
+```html
+    <NychDialog v-model:open="showEdit">
+      <NychDialogContent class="w-[min(680px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Edit — {{ editForm.username }}</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitEdit" class="dialog-form">
+          <div class="field">
+            <label>Username</label>
+            <NychInput v-model="editForm.username" class="w-full" autocomplete="off" />
+          </div>
+          <div class="field">
+            <label>New password <span class="optional">(leave blank to keep current)</span></label>
+            <NychInput v-model="editForm.password" type="password" placeholder="••••••••" class="w-full" autocomplete="new-password" />
+          </div>
+          <div class="field">
+            <label>Role</label>
+            <NychSelect v-model="editForm.permissions_mask" class="w-full">
+              <NychSelectTrigger class="w-full"><NychSelectValue /></NychSelectTrigger>
+              <NychSelectContent>
+                <NychSelectItem v-for="r in ROLES" :key="r.value" :value="r.value">{{ r.label }}</NychSelectItem>
+              </NychSelectContent>
+            </NychSelect>
+            <p class="hint">{{ ROLES.find(r => r.value === editForm.permissions_mask)?.description ?? '' }}</p>
+          </div>
+          <NychButton type="submit" class="w-full">Save Changes</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+```
+
+- [ ] **Step 3: Update the create dialog**
+
+Find:
+```html
+    <NychDialog v-model:visible="showCreate" header="New User" :modal="true" :draggable="false" style="width: min(680px, 95vw)">
+      <form @submit.prevent="submitCreate" class="dialog-form">
+        <div class="field">
+          <label>Username</label>
+          <NychInputText v-model="form.username" placeholder="username" fluid autocomplete="off" />
+        </div>
+        <div class="field">
+          <label>Password</label>
+          <NychInputText v-model="form.password" type="password" placeholder="••••••••" fluid autocomplete="new-password" />
+        </div>
+        <div class="field">
+          <label>Role</label>
+          <NychSelect
+            v-model="selectedRole"
+            :options="ROLES"
+            optionLabel="label"
+            optionValue="value"
+            placeholder="Select a role"
+            fluid
+          />
+          <p class="hint">{{ roleDescription }}</p>
+        </div>
+        <NychButton type="submit" fluid label="Create User" />
+      </form>
+    </NychDialog>
+```
+
+Replace with:
+```html
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(680px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>New User</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>Username</label>
+            <NychInput v-model="form.username" placeholder="username" class="w-full" autocomplete="off" />
+          </div>
+          <div class="field">
+            <label>Password</label>
+            <NychInput v-model="form.password" type="password" placeholder="••••••••" class="w-full" autocomplete="new-password" />
+          </div>
+          <div class="field">
+            <label>Role</label>
+            <NychSelect v-model="selectedRole" class="w-full">
+              <NychSelectTrigger class="w-full"><NychSelectValue placeholder="Select a role" /></NychSelectTrigger>
+              <NychSelectContent>
+                <NychSelectItem v-for="r in ROLES" :key="r.value" :value="r.value">{{ r.label }}</NychSelectItem>
+              </NychSelectContent>
+            </NychSelect>
+            <p class="hint">{{ roleDescription }}</p>
+          </div>
+          <NychButton type="submit" class="w-full">Create User</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+```
+
+- [ ] **Step 4: Type-check**
+
+Run: `bun run build`
+Expected: no errors referencing `Users.vue`.
+
+- [ ] **Step 5: Manual browser check**
+
+Navigate to Users. Verify: create dialog's Role select shows a placeholder until a role is picked, and the hint text below updates as you pick different roles; edit dialog's Role select is pre-populated with the user's current role and its hint matches; save/create/delete all work.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/views/admin/Users.vue
+git commit -m "Migrate Users.vue to the shadcn-vue nychthemeron components"
+```
+
+---
+
+### Task 10: Migrate `src/views/admin/Cdn.vue`
+
+**Files:**
+- Modify: `src/views/admin/Cdn.vue`
+
+- [ ] **Step 1: Update the header button and table action buttons**
+
+Find:
+```html
+      <NychButton @click="showCreate = true" label="+ Add Object" />
+```
+
+Replace with:
+```html
+      <NychButton @click="showCreate = true">+ Add Object</NychButton>
+```
+
+Find:
+```html
+                  <NychButton size="small" @click="openEdit(o)" label="Edit" />
+                  <NychButton size="small" severity="danger" @click="deleteObject(o.key)" label="Delete" />
+```
+
+Replace with:
+```html
+                  <NychButton size="sm" @click="openEdit(o)">Edit</NychButton>
+                  <NychButton size="sm" variant="danger" @click="deleteObject(o.key)">Delete</NychButton>
+```
+
+- [ ] **Step 2: Update the create dialog**
+
+Find:
+```html
+    <NychDialog v-model:visible="showCreate" header="Upload CDN Object" :modal="true" :draggable="false" style="width: min(560px, 95vw)">
+      <form @submit.prevent="submitCreate" class="dialog-form">
+        <div class="field">
+          <label>File</label>
+          <input type="file" ref="fileInput" @change="onFileChange" class="file-input" />
+          <p class="hint">The filename becomes the key unless overridden below.</p>
+        </div>
+        <div class="field">
+          <label>Key <span class="optional">(optional — defaults to filename)</span></label>
+          <NychInputText v-model="form.key" placeholder="logo.png" fluid />
+        </div>
+        <div class="field">
+          <label>Content Type <span class="optional">(optional — auto-detected)</span></label>
+          <NychInputText v-model="form.content_type" placeholder="image/png" fluid />
+        </div>
+        <div class="field">
+          <label>Description <span class="optional">(optional)</span></label>
+          <NychInputText v-model="form.description" placeholder="App logo" fluid />
+        </div>
+        <NychButton type="submit" fluid label="Upload" :disabled="!selectedFile || loading" />
+      </form>
+    </NychDialog>
+```
+
+Replace with:
+```html
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(560px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Upload CDN Object</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>File</label>
+            <input type="file" ref="fileInput" @change="onFileChange" class="file-input" />
+            <p class="hint">The filename becomes the key unless overridden below.</p>
+          </div>
+          <div class="field">
+            <label>Key <span class="optional">(optional — defaults to filename)</span></label>
+            <NychInput v-model="form.key" placeholder="logo.png" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Content Type <span class="optional">(optional — auto-detected)</span></label>
+            <NychInput v-model="form.content_type" placeholder="image/png" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Description <span class="optional">(optional)</span></label>
+            <NychInput v-model="form.description" placeholder="App logo" class="w-full" />
+          </div>
+          <NychButton type="submit" class="w-full" :disabled="!selectedFile || loading">Upload</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+```
+
+- [ ] **Step 3: Update the edit dialog**
+
+Find:
+```html
+    <NychDialog v-model:visible="showEdit" :header="`Edit — ${editKey}`" :modal="true" :draggable="false" style="width: min(560px, 95vw)">
+      <form @submit.prevent="submitEdit" class="dialog-form">
+        <div class="field">
+          <label>Key</label>
+          <NychInputText v-model="editForm.key" fluid />
+        </div>
+        <div class="field">
+          <label>Content Type <span class="optional">(optional)</span></label>
+          <NychInputText v-model="editForm.content_type" fluid />
+        </div>
+        <div class="field">
+          <label>Description <span class="optional">(optional)</span></label>
+          <NychInputText v-model="editForm.description" fluid />
+        </div>
+        <NychButton type="submit" fluid label="Save Changes" :disabled="loading" />
+      </form>
+    </NychDialog>
+```
+
+Replace with:
+```html
+    <NychDialog v-model:open="showEdit">
+      <NychDialogContent class="w-[min(560px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Edit — {{ editKey }}</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitEdit" class="dialog-form">
+          <div class="field">
+            <label>Key</label>
+            <NychInput v-model="editForm.key" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Content Type <span class="optional">(optional)</span></label>
+            <NychInput v-model="editForm.content_type" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Description <span class="optional">(optional)</span></label>
+            <NychInput v-model="editForm.description" class="w-full" />
+          </div>
+          <NychButton type="submit" class="w-full" :disabled="loading">Save Changes</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+```
+
+- [ ] **Step 4: Type-check**
+
+Run: `bun run build`
+Expected: no errors referencing `Cdn.vue`.
+
+- [ ] **Step 5: Manual browser check**
+
+Navigate to CDN Objects. Verify: "+ Add Object" opens the upload dialog, "Upload" stays disabled until a file is picked, picking a file and submitting adds a row; per-row "Edit" opens pre-filled, saving updates the row; "Delete" removes a row after confirm.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/views/admin/Cdn.vue
+git commit -m "Migrate Cdn.vue to the shadcn-vue nychthemeron components"
+```
+
+---
+
+### Task 11: Migrate `src/views/admin/Tables.vue`
+
+The largest file — three dialogs (create, read-only inspect, drop-with-confirmation) plus a per-row column-type `NychSelect` inside a `v-for`.
+
+**Files:**
+- Modify: `src/views/admin/Tables.vue`
+
+- [ ] **Step 1: Update the header button and table action buttons**
+
+Find:
+```html
+      <NychButton @click="showCreate = true" label="+ New Table" />
+```
+
+Replace with:
+```html
+      <NychButton @click="showCreate = true">+ New Table</NychButton>
+```
+
+Find:
+```html
+              <NychButton size="small" severity="secondary" @click="openInspect(t.table_name)" label="Inspect" />
+              <NychButton size="small" severity="danger" @click="openDropPreview(t.table_name)" label="Drop" />
+```
+
+Replace with:
+```html
+              <NychButton size="sm" variant="secondary" @click="openInspect(t.table_name)">Inspect</NychButton>
+              <NychButton size="sm" variant="danger" @click="openDropPreview(t.table_name)">Drop</NychButton>
+```
+
+- [ ] **Step 2: Update the create dialog (header, inputs, and the per-column type select)**
+
+Find:
+```html
+    <!-- Create Table Dialog -->
+    <NychDialog v-model:visible="showCreate" header="New Table" :modal="true" :draggable="false" style="width: min(700px, 95vw)">
+      <form @submit.prevent="submitCreate" class="dialog-form">
+        <div class="field">
+          <label>Table Name</label>
+          <NychInputText v-model="createForm.name" placeholder="my_table" fluid autocomplete="off" />
+          <p class="hint">Lowercase letters, numbers, and underscores only.</p>
+        </div>
+
+        <div class="columns-section">
+          <div class="columns-header">
+            <label>Columns</label>
+            <NychButton type="button" size="small" @click="addColumn" label="+ Add Column" />
+          </div>
+          <div class="hint fixed-col-hint">An <code>id SERIAL PRIMARY KEY</code> column is always added automatically.</div>
+
+          <div class="column-row header-row">
+            <span>Name</span>
+            <span>Type</span>
+            <span>Nullable</span>
+            <span></span>
+          </div>
+
+          <div v-for="(col, i) in createForm.columns" :key="i" class="column-row">
+            <NychInputText v-model="col.name" placeholder="column_name" fluid />
+            <NychSelect
+              v-model="col.col_type"
+              :options="COLUMN_TYPES"
+              fluid
+            />
+            <div class="nullable-toggle">
+              <input type="checkbox" v-model="col.nullable" :id="`nullable-${i}`" />
+              <label :for="`nullable-${i}`">Yes</label>
+            </div>
+            <button type="button" class="remove-btn" @click="removeColumn(i)">✕</button>
+          </div>
+
+          <div class="empty-columns" v-if="createForm.columns.length === 0">
+            <span>Add at least one column.</span>
+          </div>
+        </div>
+
+        <NychButton type="submit" fluid :disabled="!canSubmitCreate" label="Create Table" />
+      </form>
+    </NychDialog>
+```
+
+Replace with:
+```html
+    <!-- Create Table Dialog -->
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(700px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>New Table</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>Table Name</label>
+            <NychInput v-model="createForm.name" placeholder="my_table" class="w-full" autocomplete="off" />
+            <p class="hint">Lowercase letters, numbers, and underscores only.</p>
+          </div>
+
+          <div class="columns-section">
+            <div class="columns-header">
+              <label>Columns</label>
+              <NychButton type="button" size="sm" @click="addColumn">+ Add Column</NychButton>
+            </div>
+            <div class="hint fixed-col-hint">An <code>id SERIAL PRIMARY KEY</code> column is always added automatically.</div>
+
+            <div class="column-row header-row">
+              <span>Name</span>
+              <span>Type</span>
+              <span>Nullable</span>
+              <span></span>
+            </div>
+
+            <div v-for="(col, i) in createForm.columns" :key="i" class="column-row">
+              <NychInput v-model="col.name" placeholder="column_name" class="w-full" />
+              <NychSelect v-model="col.col_type" class="w-full">
+                <NychSelectTrigger class="w-full"><NychSelectValue /></NychSelectTrigger>
+                <NychSelectContent>
+                  <NychSelectItem v-for="ct in COLUMN_TYPES" :key="ct" :value="ct">{{ ct }}</NychSelectItem>
+                </NychSelectContent>
+              </NychSelect>
+              <div class="nullable-toggle">
+                <input type="checkbox" v-model="col.nullable" :id="`nullable-${i}`" />
+                <label :for="`nullable-${i}`">Yes</label>
+              </div>
+              <button type="button" class="remove-btn" @click="removeColumn(i)">✕</button>
+            </div>
+
+            <div class="empty-columns" v-if="createForm.columns.length === 0">
+              <span>Add at least one column.</span>
+            </div>
+          </div>
+
+          <NychButton type="submit" class="w-full" :disabled="!canSubmitCreate">Create Table</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+```
+
+- [ ] **Step 3: Update the inspect dialog**
+
+Find:
+```html
+    <!-- Inspect Dialog (read-only) -->
+    <NychDialog v-model:visible="showInspect" :header="`Inspect — ${inspectPreview?.table_name ?? ''}`" :modal="true" :draggable="false" style="width: min(760px, 95vw)">
+      <div v-if="inspectLoading" class="preview-loading">Loading table data…</div>
+```
+
+Replace with:
+```html
+    <!-- Inspect Dialog (read-only) -->
+    <NychDialog v-model:open="showInspect">
+      <NychDialogContent class="w-[min(760px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Inspect — {{ inspectPreview?.table_name ?? '' }}</NychDialogTitle></NychDialogHeader>
+      <div v-if="inspectLoading" class="preview-loading">Loading table data…</div>
+```
+
+Find (the closing tag for this dialog — it's the one immediately before the `<!-- Drop Preview Dialog -->` comment):
+```html
+        <div class="empty-state sample-empty" v-else>
+          <span class="empty-icon">▦</span>
+          <span class="empty-label">Empty table</span>
+          <span class="empty-hint">Use <code>POST /api/{{ inspectPreview.table_name }}</code> to insert rows.</span>
+        </div>
+      </div>
+    </NychDialog>
+
+    <!-- Drop Preview Dialog -->
+```
+
+Replace with:
+```html
+        <div class="empty-state sample-empty" v-else>
+          <span class="empty-icon">▦</span>
+          <span class="empty-label">Empty table</span>
+          <span class="empty-hint">Use <code>POST /api/{{ inspectPreview.table_name }}</code> to insert rows.</span>
+        </div>
+      </div>
+      </NychDialogContent>
+    </NychDialog>
+
+    <!-- Drop Preview Dialog -->
+```
+
+- [ ] **Step 4: Update the drop-preview dialog**
+
+Find:
+```html
+    <!-- Drop Preview Dialog -->
+    <NychDialog v-model:visible="showDropPreview" header="Drop Table" :modal="true" :draggable="false" style="width: min(760px, 95vw)">
+      <div v-if="dropPreviewLoading" class="preview-loading">Loading table data…</div>
+```
+
+Replace with:
+```html
+    <!-- Drop Preview Dialog -->
+    <NychDialog v-model:open="showDropPreview">
+      <NychDialogContent class="w-[min(760px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Drop Table</NychDialogTitle></NychDialogHeader>
+      <div v-if="dropPreviewLoading" class="preview-loading">Loading table data…</div>
+```
+
+Find:
+```html
+        <div class="confirm-section">
+          <label class="confirm-label">Type <strong>{{ dropPreview.table_name }}</strong> to confirm:</label>
+          <NychInputText v-model="dropConfirmName" :placeholder="dropPreview.table_name" fluid />
+        </div>
+
+        <div class="drop-actions">
+          <NychButton severity="secondary" @click="showDropPreview = false" label="Cancel" />
+          <NychButton severity="danger" :disabled="dropConfirmName !== dropPreview.table_name" @click="confirmDrop" label="Drop Table" />
+        </div>
+      </div>
+    </NychDialog>
+  </div>
+</template>
+```
+
+Replace with:
+```html
+        <div class="confirm-section">
+          <label class="confirm-label">Type <strong>{{ dropPreview.table_name }}</strong> to confirm:</label>
+          <NychInput v-model="dropConfirmName" :placeholder="dropPreview.table_name" class="w-full" />
+        </div>
+
+        <div class="drop-actions">
+          <NychButton variant="secondary" @click="showDropPreview = false">Cancel</NychButton>
+          <NychButton variant="danger" :disabled="dropConfirmName !== dropPreview.table_name" @click="confirmDrop">Drop Table</NychButton>
+        </div>
+      </div>
+      </NychDialogContent>
+    </NychDialog>
+  </div>
+</template>
+```
+
+- [ ] **Step 5: Type-check**
+
+Run: `bun run build`
+Expected: no errors referencing `Tables.vue`.
+
+- [ ] **Step 6: Manual browser check**
+
+Navigate to Tables. Verify: "+ New Table" opens the create dialog; adding a column shows a type `NychSelect` per row (each opens independently, doesn't affect other rows), "Create Table" is disabled until name + at least one column are set, submitting creates the table and immediately opens its Inspect dialog; per-row "Inspect" shows schema + sample data read-only; "Drop" shows the warning banner when rows exist, and the "Drop Table" button stays disabled until the typed confirmation exactly matches the table name.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add src/views/admin/Tables.vue
+git commit -m "Migrate Tables.vue to the shadcn-vue nychthemeron components"
+```
+
+---
+
+### Task 12: Migrate `src/views/admin/ApiKeys.vue`
+
+Last file — includes the one `NychMessage` → `NychAlert` conversion, and the non-dismissible "key reveal" dialog that has no direct equivalent in the new library.
+
+> **Amendment (post-implementation):** Step 3's original `onRevealOpenChange`
+> guard (below) shipped in commit `b742f1f` but was Critical-flagged by task
+> review as a no-op: the library's Dialog drives visibility off an internal
+> ref that its dismiss handler sets directly, decoupled from the parent's
+> `open` prop via `useVModel`'s passive mode — the guard never actually
+> changed that prop, so the internal ref never resynced back to `true` and
+> the dialog would silently stay closed after any outside-click/Escape.
+>
+> The shipped fix (commit `0f77a5f`, independently verified against the
+> library's source and compiled bundle) instead uses standard
+> `v-model:open="showReveal"` plus a capture-phase `document` `pointerdown`
+> listener that calls `event.preventDefault()` for clicks outside
+> `[data-slot="dialog-content"]` — this preempts a `defaultPrevented` check
+> the library's own dismiss handler already makes for outside-clicks, so it
+> blocks that path with no flicker. Escape has no equivalent hook and still
+> closes the dialog early; the maintainer explicitly chose to accept that
+> gap rather than add a flicker-based workaround for it too.
+>
+> **This depends on the library's internal `data-slot="dialog-content"`
+> attribute** — re-check this dialog specifically if `@nychthemeron/library`
+> is ever bumped again. See `src/views/admin/ApiKeys.vue`'s
+> `blockOutsideDismiss` for the current implementation.
+
+**Files:**
+- Modify: `src/views/admin/ApiKeys.vue`
+
+- [ ] **Step 1: Update the header button and table action button**
+
+Find:
+```html
+      <NychButton @click="showCreate = true" label="+ New Key" />
+```
+
+Replace with:
+```html
+      <NychButton @click="showCreate = true">+ New Key</NychButton>
+```
+
+Find:
+```html
+              <NychButton size="small" severity="danger" @click="revoke(k.id, k.name)" label="Revoke" />
+```
+
+Replace with:
+```html
+              <NychButton size="sm" variant="danger" @click="revoke(k.id, k.name)">Revoke</NychButton>
+```
+
+- [ ] **Step 2: Update the create dialog**
+
+Find:
+```html
+    <!-- Create dialog -->
+    <NychDialog v-model:visible="showCreate" header="New API Key" :modal="true" :draggable="false" style="width: min(560px, 95vw)">
+      <form @submit.prevent="submitCreate" class="dialog-form">
+        <div class="field">
+          <label>Name</label>
+          <NychInputText v-model="form.name" placeholder="e.g. CI pipeline, data importer" fluid />
+        </div>
+        <div class="field">
+          <label>Role</label>
+          <NychSelect v-model="form.permissions_mask" :options="ROLES" optionLabel="label" optionValue="value" placeholder="Select a role" fluid />
+          <p class="hint">{{ ROLES.find(r => r.value === form.permissions_mask)?.description ?? '' }}</p>
+        </div>
+        <div class="field">
+          <label>Expires <span class="optional">(optional — leave blank for no expiry)</span></label>
+          <NychInputText v-model="form.expires_at" type="datetime-local" fluid />
+        </div>
+        <NychButton type="submit" :disabled="!form.name || !form.permissions_mask" fluid label="Generate Key" />
+      </form>
+    </NychDialog>
+```
+
+Replace with:
+```html
+    <!-- Create dialog -->
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(560px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>New API Key</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>Name</label>
+            <NychInput v-model="form.name" placeholder="e.g. CI pipeline, data importer" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Role</label>
+            <NychSelect v-model="form.permissions_mask" class="w-full">
+              <NychSelectTrigger class="w-full"><NychSelectValue placeholder="Select a role" /></NychSelectTrigger>
+              <NychSelectContent>
+                <NychSelectItem v-for="r in ROLES" :key="r.value" :value="r.value">{{ r.label }}</NychSelectItem>
+              </NychSelectContent>
+            </NychSelect>
+            <p class="hint">{{ ROLES.find(r => r.value === form.permissions_mask)?.description ?? '' }}</p>
+          </div>
+          <div class="field">
+            <label>Expires <span class="optional">(optional — leave blank for no expiry)</span></label>
+            <NychInput v-model="form.expires_at" type="datetime-local" class="w-full" />
+          </div>
+          <NychButton type="submit" :disabled="!form.name || !form.permissions_mask" class="w-full">Generate Key</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+```
+
+- [ ] **Step 3: Update the key-reveal dialog — `NychMessage` → `NychAlert`, and make it non-dismissible**
+
+The old `:closable="false"` prevented the user from closing this dialog any way other than clicking "I've saved the key". The new `NychDialogContent` accepts `:show-close-button="false"` to drop the X button, but its overlay/Escape dismiss isn't independently disableable — so we also ignore `update:open` events that would close it, via a guarded handler.
+
+Find:
+```html
+    <!-- Key reveal dialog — shown once after creation -->
+    <NychDialog v-model:visible="showReveal" header="API Key Created" :modal="true" :draggable="false" :closable="false" style="width: min(600px, 95vw)">
+      <div class="reveal-body">
+        <NychMessage severity="warn" class="reveal-warning">
+          Copy this key now — it will <strong>not</strong> be shown again.
+        </NychMessage>
+        <div class="key-display">
+          <code class="key-text">{{ newKey }}</code>
+          <button type="button" class="copy-btn" :class="{ copied }" @click="copyKey" title="Copy to clipboard">
+            {{ copied ? '✓' : '⎘' }}
+          </button>
+        </div>
+        <NychButton fluid @click="closeReveal" label="I've saved the key" />
+      </div>
+    </NychDialog>
+```
+
+Replace with:
+```html
+    <!-- Key reveal dialog — shown once after creation -->
+    <NychDialog :open="showReveal" @update:open="onRevealOpenChange">
+      <NychDialogContent class="w-[min(600px,95vw)]" :show-close-button="false">
+        <NychDialogHeader><NychDialogTitle>API Key Created</NychDialogTitle></NychDialogHeader>
+        <div class="reveal-body">
+          <NychAlert variant="warning" class="reveal-warning">
+            Copy this key now — it will <strong>not</strong> be shown again.
+          </NychAlert>
+          <div class="key-display">
+            <code class="key-text">{{ newKey }}</code>
+            <button type="button" class="copy-btn" :class="{ copied }" @click="copyKey" title="Copy to clipboard">
+              {{ copied ? '✓' : '⎘' }}
+            </button>
+          </div>
+          <NychButton class="w-full" @click="closeReveal">I've saved the key</NychButton>
+        </div>
+      </NychDialogContent>
+    </NychDialog>
+```
+
+- [ ] **Step 4: Add the `onRevealOpenChange` guard to the script**
+
+Find:
+```ts
+function closeReveal() {
+  showReveal.value = false
+  newKey.value = ''
+}
+```
+
+Replace with:
+```ts
+function closeReveal() {
+  showReveal.value = false
+  newKey.value = ''
+}
+
+// The reveal dialog must only close via the "I've saved the key" button
+// (closeReveal), never via outside-click/Escape — ignore any attempt to
+// set it back to false that didn't go through that path.
+function onRevealOpenChange(open: boolean) {
+  if (open) showReveal.value = true
+}
+```
+
+- [ ] **Step 5: Type-check**
+
+Run: `bun run build`
+Expected: no errors referencing `ApiKeys.vue`.
+
+- [ ] **Step 6: Manual browser check**
+
+Navigate to API Keys. Verify: "+ New Key" dialog's Role select works and its hint updates; submitting opens the "API Key Created" dialog with a visible warning alert (amber/warning-colored, not the default info-blue), no X close button in the corner, and clicking outside the dialog or pressing Escape does **not** close it; clicking the copy icon copies the key and shows a checkmark for 2 seconds; clicking "I've saved the key" closes it and the new key appears in the table; per-row "Revoke" works after confirm.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add src/views/admin/ApiKeys.vue
+git commit -m "Migrate ApiKeys.vue to the shadcn-vue nychthemeron components"
+```
+
+---
+
+### Task 13: Final full-app verification
+
+**Files:** none (verification only)
+
+- [ ] **Step 1: Full type-check and production build**
+
+Run: `bun run build`
+Expected: exits 0 with no TypeScript errors and a `dist/` build produced.
+
+- [ ] **Step 2: Full click-through**
+
+Run: `bun run dev`, log in, and walk every admin page (Cache, Cors, Queries, Blacklist, Permissions, Users, Cdn, Tables, ApiKeys) — for each, exercise its create, edit (where applicable), and delete/revoke flow once. Confirm the theme toggle (`useTheme().toggle()`, wired in `Layout.vue`) still switches between `apollo`/`hades` correctly across all the new components (dialogs, selects, alerts should all pick up the new theme's colors immediately, since they're driven by the same `data-theme` attribute and CSS custom properties as before).
+
+- [ ] **Step 3: Grep for anything left behind**
+
+Run: `grep -rn "primevue" src/ vite.config.ts package.json --include="*.vue" --include="*.ts" --include="*.json" -i`
+Expected: no matches.
+
+Run: `grep -rn "NychInputText\|severity=\|v-model:visible\|fluid\b\|label=\"" src/ --include="*.vue"`
+Expected: no matches (all old-API usages converted). If this turns up hits outside the 11 files this plan touched, treat that as a signal a call site was missed during the original inventory — fix it before closing out.
+
+- [ ] **Step 4: Commit (only if Step 3 found and fixed something; otherwise nothing to commit)**
+
+## Post-implementation note: what's unverified
+
+This migration shipped with `bun run build` clean across the whole app and
+every view resolving under the dev server, but no automated tests (none
+exist in this repo) and no live browser click-through (no chromium-cli/
+Playwright/Puppeteer available in the environment this was built in). A
+human should do a manual pass covering, at minimum:
+
+- The theme toggle (`useTheme().toggle()` in `Layout.vue`) across all the
+  new components — dialogs, selects, alerts should all repaint correctly
+  between `apollo`/`hades`.
+- **The ApiKeys reveal dialog's outside-click-blocked behavior specifically**
+  — the highest-value thing to check by hand, since it's the one piece of
+  runtime DOM-event logic in this migration (everything else is declarative
+  template conversion). Confirm clicking outside the "API Key Created"
+  dialog does nothing, and confirm Escape still closes it (accepted gap).
+- One create/edit/delete (or revoke) cycle per admin view, per the
+  per-task "Manual browser check" notes throughout this plan.
diff --git a/docs/superpowers/specs/2026-06-16-mercury-design.md b/docs/superpowers/specs/2026-06-16-mercury-design.md
new file mode 100644
index 0000000..b5a1549
--- /dev/null
+++ b/docs/superpowers/specs/2026-06-16-mercury-design.md
@@ -0,0 +1,323 @@
+# Mercury — Design Spec
+**Date:** 2026-06-16
+
+## Overview
+
+Mercury is a monolithic, high-performance universal CRUD API written in Rust. It accepts HTTP requests, maps them to PostgreSQL tables, generates and caches SQL dynamically, and exposes an admin suite (with a Vue 3 frontend) for managing queries, users, permissions, and route security. A JWT-based bitmask permission system gates all admin operations.
+
+---
+
+## Architecture
+
+```
+HTTP Request
+     ↓
+  Blacklist Middleware (in-memory glob match)
+     ↓
+  Auth Middleware (JWT decode + permission bit check, admin routes only)
+     ↓
+  Axum Router
+     ↓
+  Query Cache (DashMap<String, (CachedQuery, Instant)>)
+     ↓  cache miss
+  Query Registry (PostgreSQL: queries table)
+     ↓  query not yet registered
+  Query Builder (auto-generates SQL from route + HTTP method)
+     ↓
+  PostgreSQL (sqlx PgPool)
+```
+
+**Stack:**
+- `axum` — async HTTP framework (tokio-native)
+- `sqlx` — async PostgreSQL driver, raw query support, compile-time checked migrations
+- `DashMap` — concurrent hashmap for the query cache
+- `glob` — compiled pattern matching for the route blacklist
+- `jsonwebtoken` — JWT encode/decode
+- Vue 3 + Vite + `@nychthemeron/library` — frontend, served as static files by Rust
+- `tower-http::ServeDir` — serves `ui/dist/` at `/`
+
+---
+
+## Endpoints
+
+### Public
+
+```
+POST   /auth/login                    → returns JWT
+```
+
+### CRUD (no auth, blacklist-checked)
+
+```
+GET    /api/{table}                   → SELECT * FROM {table} [?col=val filters]
+GET    /api/{table}/{id}              → SELECT * FROM {table} WHERE id = {id}
+POST   /api/{table}                   → INSERT INTO {table}
+PUT    /api/{table}/{id}              → UPDATE {table} WHERE id = {id}
+DELETE /api/{table}/{id}              → DELETE FROM {table} WHERE id = {id}
+```
+
+`users` and `permissions` are blacklisted by default — only accessible via the admin suite.
+
+### Admin — Query Registry (JWT + `ADMIN_QUERY` bit)
+
+```
+GET    /admin/queries                          → list all registered queries
+POST   /admin/queries                          → register raw SQL template
+GET    /admin/queries/{identifier}             → get query by slug identifier
+PUT    /admin/queries/{identifier}             → update SQL template or metadata
+DELETE /admin/queries/{identifier}             → remove from registry + evict from cache
+GET    /admin/queries/{identifier}/execute     → execute query with ?param=val bindings
+```
+
+`{identifier}` is the human-readable slug (e.g. `get-user-orders`), not the internal UUID. The UUID is used internally only.
+
+### Admin — Cache (JWT + `ADMIN_CACHE` bit)
+
+```
+GET    /admin/cache/stats             → current size, hit count, miss count
+DELETE /admin/cache                   → flush entire cache
+```
+
+### Admin — Users (JWT + `SUPER_ADMIN` bit)
+
+```
+GET    /admin/users                   → list users
+POST   /admin/users                   → create user
+GET    /admin/users/{id}              → get user
+PUT    /admin/users/{id}              → update user
+DELETE /admin/users/{id}              → delete user
+POST   /admin/users/{id}/permissions/grant/{bit_value}    → OR bit into mask
+DELETE /admin/users/{id}/permissions/revoke/{bit_value}   → AND NOT bit from mask
+```
+
+### Admin — Permissions (JWT + `SUPER_ADMIN` bit)
+
+```
+GET    /admin/permissions             → list all permission definitions
+POST   /admin/permissions             → create custom permission (auto-assigns next available bit_value)
+PUT    /admin/permissions/{id}        → update name/description
+DELETE /admin/permissions/{id}        → remove permission definition
+```
+
+### Admin — Blacklist (JWT + `SUPER_ADMIN` bit)
+
+```
+GET    /admin/blacklist               → list all entries
+POST   /admin/blacklist               → add route pattern
+PUT    /admin/blacklist/{id}          → update entry
+DELETE /admin/blacklist/{id}          → remove entry
+```
+
+Any write to the blacklist immediately reloads the in-memory blacklist from the DB.
+
+### Frontend (served by Rust)
+
+```
+GET    /                              → serves ui/dist/index.html (SPA entry)
+GET    /assets/*                      → static assets
+```
+
+---
+
+## Database Schema
+
+### `users`
+| column | type | notes |
+|---|---|---|
+| id | SERIAL PRIMARY KEY | |
+| username | VARCHAR UNIQUE NOT NULL | |
+| password_hash | TEXT NOT NULL | bcrypt |
+| permissions_mask | NUMERIC NOT NULL DEFAULT 0 | u128 bitmask |
+| created_at | TIMESTAMPTZ NOT NULL DEFAULT now() | |
+
+### `permissions`
+| column | type | notes |
+|---|---|---|
+| id | SERIAL PRIMARY KEY | |
+| name | VARCHAR UNIQUE NOT NULL | e.g. `READ` |
+| bit_value | NUMERIC UNIQUE NOT NULL | power of 2, up to 2^127 |
+| description | TEXT | |
+
+### `queries`
+| column | type | notes |
+|---|---|---|
+| id | UUID PRIMARY KEY DEFAULT gen_random_uuid() | |
+| identifier | VARCHAR UNIQUE NOT NULL | human-readable slug |
+| sql_template | TEXT NOT NULL | raw SQL with :param placeholders |
+| description | TEXT | |
+| created_at | TIMESTAMPTZ NOT NULL DEFAULT now() | |
+| updated_at | TIMESTAMPTZ NOT NULL DEFAULT now() | |
+
+### `blacklist`
+| column | type | notes |
+|---|---|---|
+| id | SERIAL PRIMARY KEY | |
+| pattern | VARCHAR NOT NULL | glob-style, e.g. `/api/users/**` |
+| method | VARCHAR | NULL = all methods |
+| reason | TEXT | |
+| active | BOOLEAN NOT NULL DEFAULT true | |
+| created_at | TIMESTAMPTZ NOT NULL DEFAULT now() | |
+
+### Seed Data (migration)
+Default permission definitions:
+
+| name | bit_value |
+|---|---|
+| READ | 1 |
+| WRITE | 2 |
+| DELETE | 4 |
+| ADMIN_QUERY | 8 |
+| ADMIN_CACHE | 16 |
+| SUPER_ADMIN | 32 |
+
+Default user: `admin` / `admin`, `permissions_mask = 63` (all bits set).
+
+Default blacklist entries: `/api/users/**` and `/api/permissions/**` (method: NULL).
+
+---
+
+## Query Cache
+
+**Structure:** `DashMap<String, (CachedQuery, Instant)>`
+
+- Key: deterministic string derived from `{METHOD}:{table}:{params}` for auto-generated queries, or query `identifier` for named queries
+- Value: the compiled query + timestamp of last access
+- Hit/miss counters: two `AtomicU64` values on the shared state struct
+
+**Eviction:** a tokio background task runs every `CACHE_SWEEP_INTERVAL_SECS`. It iterates the map and removes entries where `last_accessed.elapsed() > CACHE_IDLE_TIMEOUT_SECS`.
+
+**Capacity:** before inserting a new entry, if `cache.len() >= CACHE_MAX_CAPACITY`, the entry with the oldest `last_accessed` is evicted first.
+
+**Cache invalidation:** deleting or updating a query via the admin suite immediately removes it from the DashMap.
+
+---
+
+## Blacklist Cache
+
+**Structure:** `Arc<RwLock<Vec<(BlacklistEntry, glob::Pattern)>>>`
+
+- Loaded from DB at startup
+- Reloaded (write lock, full rebuild from DB) on any admin write to the `blacklist` table
+- Checked in middleware on every request before routing: if any active entry matches `(method, path)`, return `403 Forbidden`
+
+---
+
+## Permission System
+
+Permissions are u128 bitmasks. The JWT claims embed the user's current `permissions_mask`. Middleware extracts the JWT and performs a bitwise AND check — no DB lookup per request.
+
+```
+READ        = 1
+WRITE       = 2
+DELETE      = 4
+ADMIN_QUERY = 8
+ADMIN_CACHE = 16
+SUPER_ADMIN = 32
+```
+
+Custom permissions auto-assign the next unused power-of-2 bit_value. Up to 128 distinct permission bits supported.
+
+`permissions_mask` stored as PostgreSQL `NUMERIC` (arbitrary precision), converted to/from `u128` in the Rust data layer.
+
+---
+
+## JWT
+
+- Algorithm: HS256
+- Claims: `sub` (username), `permissions` (u128 as string), `exp`
+- Secret: `JWT_SECRET` env var
+- Passed as `Authorization: Bearer <token>` header
+- Token expiry: configurable via `JWT_EXPIRY_SECS`
+
+---
+
+## Configuration (env vars)
+
+```env
+DATABASE_URL=postgres://mercury:mercury@db:5432/mercury
+JWT_SECRET=changeme
+JWT_EXPIRY_SECS=3600
+CACHE_MAX_CAPACITY=10000
+CACHE_IDLE_TIMEOUT_SECS=300
+CACHE_SWEEP_INTERVAL_SECS=60
+```
+
+---
+
+## Project Structure
+
+```
+Mercury/
+  src/
+    main.rs                   -- startup: config, DB pool, cache init, router mount
+    config.rs                 -- Config struct loaded from env
+    auth/
+      mod.rs                  -- JWT encode/decode, Claims struct
+      middleware.rs            -- axum middleware: validate JWT, check permission bit
+    cache/
+      query_cache.rs          -- DashMap cache + sweep task + hit/miss counters
+      blacklist_cache.rs      -- Arc<RwLock<...>> + glob::Pattern, reload fn
+    db/
+      pool.rs                 -- sqlx PgPool init
+      migrations/             -- .sql files, run via sqlx::migrate!()
+        001_initial.sql       -- all tables + seed data
+    routes/
+      crud.rs                 -- generic /api/{table} handler + query builder
+      auth.rs                 -- /auth/login
+      admin/
+        queries.rs
+        cache.rs
+        users.rs
+        permissions.rs
+        blacklist.rs
+    models/
+      query.rs
+      user.rs
+      permission.rs
+      blacklist.rs
+  ui/
+    .npmrc                    -- @nychthemeron:registry=https://git.mcpeakdev.com/api/packages/McPeakDev/npm/
+    package.json
+    vite.config.ts
+    src/
+      main.ts                 -- dark mode default, router, pinia init
+      App.vue
+      router/index.ts         -- route guards: redirect /login if no JWT
+      stores/auth.ts          -- JWT storage, permissions bitmask helpers
+      views/
+        Login.vue
+        admin/
+          Queries.vue
+          Users.vue
+          Permissions.vue
+          Blacklist.vue
+          Cache.vue
+  Cargo.toml
+  docker-compose.yml
+  Dockerfile                  -- multi-stage: Node build UI, Rust build API
+  .env.example
+```
+
+---
+
+## Docker
+
+**Multi-stage Dockerfile:**
+1. Stage 1 (node): install `@nychthemeron/library`, run `vite build` → `ui/dist/`
+2. Stage 2 (rust): compile API, copy `ui/dist/` into final image
+3. Final image runs the Rust binary; `tower-http::ServeDir` serves `ui/dist/` at `/`
+
+**docker-compose.yml:**
+- `db` service: `postgres:16-alpine`, persistent volume, health check
+- `api` service: built from Dockerfile, depends on `db`, `mem_limit` set, env vars from `.env`
+- Migrations run at API startup via `sqlx::migrate!()`
+
+---
+
+## Frontend Contract
+
+- Dark mode is the default; set via `@nychthemeron/library` theme config in `main.ts`
+- Login page at `/login` calls `POST /auth/login`, stores JWT in `localStorage`
+- All admin views require `SUPER_ADMIN` bit in JWT; route guard redirects to `/login` if absent
+- Permission bitmask helpers in `stores/auth.ts`: `hasPermission(bit: number): boolean`
+- Admin views wire directly to their respective admin endpoints
diff --git a/docs/superpowers/specs/2026-06-18-cors-dynamic-design.md b/docs/superpowers/specs/2026-06-18-cors-dynamic-design.md
new file mode 100644
index 0000000..d679712
--- /dev/null
+++ b/docs/superpowers/specs/2026-06-18-cors-dynamic-design.md
@@ -0,0 +1,199 @@
+# Mercury — Dynamic CORS Design Spec
+**Date:** 2026-06-18
+
+## Overview
+
+Replace the static startup-time `CorsLayer` with a DB-backed, in-memory CORS cache that can be edited at runtime through the standard CRUD API, mirroring the existing route blacklist pattern. Add a Vue admin view for managing origins and add loading state indicators across all admin views.
+
+---
+
+## Motivation
+
+CORS origins are currently loaded from the `CORS_ORIGINS` environment variable at server startup and baked into a static `tower_http::CorsLayer`. Changing origins requires a server restart. This feature makes CORS origins a first-class runtime configuration: stored in PostgreSQL, held in an in-memory cache, and editable by super-admins through the standard CRUD API without downtime.
+
+---
+
+## Data Layer
+
+### Migration `007_cors_origins.sql`
+
+Create a `cors_origins` table:
+
+```sql
+CREATE TABLE cors_origins (
+    id         SERIAL PRIMARY KEY,
+    origin     TEXT NOT NULL UNIQUE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+```
+
+Seed blacklist entries to restrict CRUD access to super-admins only (SUPER_ADMIN bit = 32), matching the existing pattern for `blacklist`, `queries`, `users`, and `permissions`:
+
+```sql
+INSERT INTO blacklist (pattern, method, reason, active, bypass_mask) VALUES
+    ('/api/cors_origins',     NULL, 'admin-only table', true, '32'),
+    ('/api/cors_origins/**',  NULL, 'admin-only table', true, '32');
+```
+
+### Startup Seeding
+
+On server startup, if the `cors_origins` table is empty and the `CORS_ORIGINS` environment variable is set, seed the table from the env var (splitting on `,`, trimming whitespace). This provides a smooth migration path from the env-var approach. Once the DB has entries, `CORS_ORIGINS` is ignored.
+
+---
+
+## In-Memory Cache
+
+### `CorsCache` in `state.rs`
+
+```rust
+pub struct CorsCache {
+    pub inner: Arc<RwLock<CorsState>>,
+}
+
+pub struct CorsState {
+    pub wildcard: bool,
+    pub origins: Vec<HeaderValue>,
+}
+```
+
+`CorsCache::load(origins: Vec<String>)`:
+- Sets `wildcard = true` if any origin is `"*"`
+- Parses each string into a `HeaderValue`, skipping malformed entries
+- Acquires a write lock and replaces the inner state
+
+`AppState` gains a `cors_cache: CorsCache` field alongside `blacklist_cache`.
+
+---
+
+## Middleware
+
+### `cors_layer` in `auth/middleware.rs`
+
+An async Axum middleware (`from_fn_with_state`) that runs on every request. Behavior:
+
+| Cache state | Request type | Action |
+|---|---|---|
+| Empty (no origins, no wildcard) | Any | Pass through — no CORS headers added |
+| Wildcard (`*`) | Non-OPTIONS | Add `Access-Control-Allow-Origin: *` to response |
+| Wildcard (`*`) | OPTIONS preflight | Return `204` with `Access-Control-Allow-Origin: *`, `Access-Control-Allow-Methods`, `Access-Control-Allow-Headers` |
+| Specific origins | Non-OPTIONS, Origin matches | Echo origin back as `Access-Control-Allow-Origin`, add `Vary: Origin` |
+| Specific origins | Non-OPTIONS, Origin no match | Pass through — no CORS headers |
+| Specific origins | OPTIONS preflight, Origin matches | Return `204` with echoed origin, `Vary: Origin`, `Access-Control-Allow-Methods`, `Access-Control-Allow-Headers` |
+| Specific origins | OPTIONS preflight, Origin no match | Return `204` with no CORS headers |
+
+Allowed methods: `GET, POST, PUT, DELETE, OPTIONS`.  
+Allowed headers: `Content-Type, Authorization`.
+
+The middleware is applied globally via `.layer(middleware::from_fn_with_state(state.clone(), cors_layer))` in `main.rs`, replacing the removed `build_cors()` call and static `CorsLayer`.
+
+### `reload_cors` in `routes/crud.rs`
+
+Called after any non-GET mutation to the `cors_origins` table, exactly mirroring `reload_blacklist`:
+
+```rust
+async fn reload_cors(state: &AppState) -> Result<(), StatusCode> {
+    // SELECT origin FROM cors_origins ORDER BY id
+    // state.cors_cache.load(origins).await
+}
+```
+
+The existing `handle_crud` hook block gains a `cors_origins` branch alongside the `blacklist` branch.
+
+---
+
+## Admin Interface
+
+### `Cors.vue`
+
+New Vue view at `ui/src/views/admin/Cors.vue`:
+
+- **Header:** "CORS Origins" with subtitle "Allowed cross-origin request sources — matched against the request Origin header"
+- **Table card:** lists all origins with `id`, `origin` (monospace), `created_at`, and a `Delete` button per row
+- **Create dialog:** single `Origin` text input with placeholder `https://app.example.com` or `*`, and an `Add Origin` submit button
+- **Empty state:** icon + "No origins configured — cross-origin requests will be rejected" label + hint
+- **API calls:** `GET /api/cors_origins` (list), `POST /api/cors_origins` (create), `DELETE /api/cors_origins/:id` (remove)
+
+### Router & Navigation
+
+- Route added to `ui/src/router/index.ts`: `{ path: 'cors', component: () => import('../views/admin/Cors.vue') }`
+- Nav item added to `Layout.vue` `navItems`: `{ to: '/admin/cors', label: 'CORS', icon: '✦' }`
+
+---
+
+## Loading State (All Admin Views)
+
+A consistent loading indicator is added to every admin view (`Queries.vue`, `Tables.vue`, `Users.vue`, `Permissions.vue`, `Blacklist.vue`, `ApiKeys.vue`, `Cache.vue`, and the new `Cors.vue`).
+
+### Pattern
+
+Each view gains a `loading` ref:
+
+```ts
+const loading = ref(false)
+
+async function load() {
+  loading.value = true
+  try {
+    // existing fetch logic
+  } finally {
+    loading.value = false
+  }
+}
+```
+
+Mutating operations (`submitCreate`, `submitEdit`, `deleteEntry`, etc.) also set `loading = true` for their duration.
+
+### Shared CSS Spinner
+
+A `.spinner` keyframe animation added once to `main.css`:
+
+```css
+@keyframes spin { to { transform: rotate(360deg); } }
+
+.loading-spinner {
+  width: 1.25rem;
+  height: 1.25rem;
+  border: 2px solid var(--border);
+  border-top-color: var(--primary);
+  border-radius: 50%;
+  animation: spin 0.7s linear infinite;
+}
+
+.loading-overlay {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.6rem;
+  padding: 3rem 2rem;
+  color: var(--text-muted);
+  font-size: 0.85rem;
+  font-family: var(--font-sans);
+}
+```
+
+Each view shows a `<div class="loading-overlay"><div class="loading-spinner"></div><span>Loading…</span></div>` in place of the table/content when `loading` is true.
+
+---
+
+## Files Changed
+
+| File | Change |
+|---|---|
+| `src/db/migrations/007_cors_origins.sql` | New migration |
+| `src/state.rs` | Add `CorsCache`, `CorsState`; add `cors_cache` to `AppState` |
+| `src/auth/middleware.rs` | Add `cors_layer` middleware |
+| `src/routes/crud.rs` | Add `reload_cors`, hook into `handle_crud` |
+| `src/main.rs` | Remove `build_cors`, remove static `CorsLayer`, seed `cors_origins` from env on startup, apply `cors_layer` |
+| `ui/src/views/admin/Cors.vue` | New view |
+| `ui/src/router/index.ts` | Add `/admin/cors` route |
+| `ui/src/views/admin/Layout.vue` | Add CORS nav item |
+| `ui/src/assets/main.css` | Add spinner CSS |
+| `ui/src/views/admin/*.vue` (all 7 existing) | Add `loading` ref and spinner display |
+
+---
+
+## Out of Scope
+
+- Credentials support (`Access-Control-Allow-Credentials`) — not currently used
+- Per-origin method/header overrides — uniform allow-list for all origins
+- Max-age preflight caching header — can be added later
diff --git a/docs/superpowers/specs/2026-07-15-nychthemeron-shadcn-migration-design.md b/docs/superpowers/specs/2026-07-15-nychthemeron-shadcn-migration-design.md
new file mode 100644
index 0000000..7b67813
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-15-nychthemeron-shadcn-migration-design.md
@@ -0,0 +1,172 @@
+# Migrate Mercury UI to the shadcn-vue version of @nychthemeron/library
+
+## Background
+
+`@nychthemeron/library` was rebuilt from PrimeVue (unstyled mode + a custom
+`ThemeEngine` passthrough layer) to shadcn-vue + Tailwind v4. PrimeVue moved
+to a paid licensing model, so the old build was replaced in place under the
+same `0.0.1` version on the private registry (`git.mcpeakdev.com`) rather
+than published as a new version — confirmed intentional by the maintainer.
+
+The consuming app (`Mercury/ui`) still targets the old PrimeVue-era API
+everywhere: `main.ts` wires up the PrimeVue plugin, and 10 admin views plus
+`Login.vue` use globally-registered `Nych*` components with PrimeVue-style
+props (`label`, `severity`, `fluid`, `v-model:visible`, `:options`/
+`optionLabel`/`optionValue`). None of that matches the new library's API, so
+this is a real port, not a version bump.
+
+## Scope
+
+**In scope:** everything needed to get Mercury UI running correctly against
+the new library — build/plugin wiring, and a native rewrite of every view
+that uses a `Nych*` component.
+
+**Out of scope:** any new features, any styling changes beyond what's needed
+to preserve current look/behavior, and the library's own source (it's an
+external package on a separate registry).
+
+## Current usage inventory
+
+| File | Button | InputText | Dialog | Select | Textarea | Message |
+|---|---|---|---|---|---|---|
+| Login.vue | 1 | 2 | | | | |
+| admin/ApiKeys.vue | 4 | 2 | 2 | 1 | | 1 |
+| admin/Blacklist.vue | 5 | 6 | 2 | 1 | | |
+| admin/Cache.vue | 2 | | | | | |
+| admin/Cdn.vue | 5 | 6 | 2 | | | |
+| admin/Cors.vue | 3 | 1 | 1 | | | |
+| admin/Permissions.vue | 5 | 5 | 2 | | | |
+| admin/Queries.vue | 5 | 3 | 2 | | 2 | |
+| admin/Tables.vue | 7 | 3 | 3 | 1 | | |
+| admin/Users.vue | 5 | 4 | 2 | 2 | | |
+| **Total** | **42** | **32** | **16** | **5** | **2** | **1** |
+
+## Component API mapping
+
+**Button** (`NychButton`) — low friction, variant names carry over almost
+1:1:
+- Content moves from `label="X"` prop to default slot: `<NychButton>X</NychButton>`
+- `severity="danger"` → `variant="danger"` (also: `primary` (default),
+  `secondary`, `info`, `success`, `warning`, `danger`)
+- `size="small"` → `size="sm"` (also: `default`, `lg`, `icon`)
+- `:loading`, `:disabled` — unchanged
+- `fluid` prop is gone — use `class="w-full"`
+
+**Input** (`NychInputText` → `NychInput`) — rename only, `v-model`,
+`type`, `placeholder`, `autocomplete` unchanged. `fluid` → `class="w-full"`.
+
+**Textarea** (`NychTextarea`) — same shape as Input, `fluid` →
+`class="w-full"`.
+
+**Dialog** — flat component becomes a compound one:
+```
+<!-- old -->
+<NychDialog v-model:visible="show" header="Title" :modal="true" :draggable="false">
+  ...body...
+</NychDialog>
+
+<!-- new -->
+<NychDialog v-model:open="show">
+  <NychDialogContent>
+    <NychDialogHeader><NychDialogTitle>Title</NychDialogTitle></NychDialogHeader>
+    ...body...
+  </NychDialogContent>
+</NychDialog>
+```
+- `:closable="false"` (used once, in ApiKeys.vue's key-reveal dialog, to
+  force the user to acknowledge before dismissing) → pass
+  `:show-close-button="false"` on `NychDialogContent` to drop the X button,
+  and ignore attempts to close via `@update:open="(v) => { if (v) show = v }"`
+  so outside-click/Escape can't dismiss it either.
+- `:draggable="false"` — no-op, the new Dialog isn't draggable to begin with.
+- Width customization (`style="width: min(560px, 95vw)"`) — pass through as
+  `class` on `NychDialogContent` since it accepts a `class` prop merged via
+  `cn()`.
+
+**Select** — flat `:options` array becomes compound children:
+```
+<!-- old -->
+<NychSelect v-model="x" :options="ROLES" optionLabel="label" optionValue="value" placeholder="Select a role" fluid />
+
+<!-- new -->
+<NychSelect v-model="x">
+  <NychSelectTrigger class="w-full"><NychSelectValue placeholder="Select a role" /></NychSelectTrigger>
+  <NychSelectContent>
+    <NychSelectItem v-for="r in ROLES" :key="r.value" :value="r.value">{{ r.label }}</NychSelectItem>
+  </NychSelectContent>
+</NychSelect>
+```
+
+**Message → Alert** — no `NychMessage` in the new library; `NychAlert` is
+the closest analog:
+- `severity="warn"` → `variant="warning"` (also: `info` (default),
+  `success`, `danger`, `secondary`)
+- Body goes in the default slot, same as before.
+
+## Phase 1 — Foundation (build/plugin wiring)
+
+1. **`src/main.ts`** — remove the `@primevue/core/config` import and
+   `app.use(PrimeVue, { unstyled: true })` call. Keep
+   `import '@nychthemeron/library/theme'` and `app.use(createNychthemeron())`
+   unchanged (both still resolve, just point at new content).
+2. **`vite.config.ts`** — add the `@tailwindcss/vite` plugin (required
+   because the library now ships source CSS with `@import "tailwindcss"`
+   that must be processed at build time, not a precompiled stylesheet).
+   Replace the `primevue: ["@primevue/core"]` manual chunk with nothing
+   (package no longer exists).
+3. **`package.json`** — add `tailwindcss` and `@tailwindcss/vite` as direct
+   devDependencies (currently only reachable transitively through
+   `@nychthemeron/library`, which is fragile) at the versions already
+   resolved in `bun.lock`. Bump `vue` from `^3.4.0` to `^3.5.0` to match the
+   library's peer requirement.
+4. **`src/assets/main.css`** — leave the design-token-based custom classes
+   (`.table-card`, `.data-table`, `.dialog-form`, `.gold-rule`,
+   `.loading-overlay`, etc.) as-is; they key off CSS custom properties
+   (`--surface-1`, `--primary`, ...) which kept the same names and values in
+   the new theme. Remove the dead overrides tied to the old unstyled-PrimeVue
+   class names: `.nych-dialog { min-width: 500px }`,
+   `[class^="nych-button"] { ... }`, and re-check `.nych-loading-icon .wreath`
+   still applies (the new `NychLoadingIcon` keeps the same class name/markup,
+   so this one likely stays).
+5. Verify with `bun run dev` that the app boots without console errors
+   before touching any view.
+
+## Phase 2 — View-by-view native migration
+
+Migrate one file at a time, in this order (simplest/lowest-risk first, so
+mistakes in the component mapping surface early on a small file rather than
+a large one):
+
+1. `Login.vue` (3 call sites, no Dialog/Select — good smoke test)
+2. `admin/Cache.vue` (2 call sites, Button only)
+3. `admin/Cors.vue`
+4. `admin/Queries.vue`
+5. `admin/Blacklist.vue`
+6. `admin/Permissions.vue`
+7. `admin/Users.vue`
+8. `admin/Cdn.vue`
+9. `admin/Tables.vue`
+10. `admin/ApiKeys.vue` (has the one `NychMessage` → `NychAlert` conversion
+    and the non-dismissible dialog pattern — do it last once that pattern is
+    proven elsewhere isn't needed, i.e. it's the only file needing it)
+
+For each file: apply the mapping above, then run the app (`bun run dev`),
+navigate to that view in the browser, and check the golden path (list
+renders, create/edit dialog opens and submits, select options populate,
+delete/revoke works) before moving to the next file. This is a visual/UI
+change, so it needs to be checked in a real browser, not just type-checked.
+
+## Verification
+
+- `vue-tsc --noEmit` (part of `bun run build`) after each file, to catch
+  prop-shape mistakes the compiler can see.
+- Manual browser check of each migrated view per the sequencing above.
+- Final full pass: `bun run build` succeeds, and a click-through of every
+  admin view's create/edit/delete flow.
+
+## Open questions / risks
+
+- The non-dismissible-dialog pattern for `ApiKeys.vue`'s key-reveal dialog
+  (ignoring `update:open` on close attempts) isn't a built-in library
+  feature — it's an app-level workaround. If it feels fragile once
+  implemented, worth flagging back to the library rather than solving twice.
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100644
index 0000000..939bdd7
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+set -e
+
+PGDATA="${PGDATA:-/var/lib/postgresql/data}"
+PGLOG="/var/log/postgresql/postgresql.log"
+MINIO_DATA="${MINIO_VOLUMES:-/var/lib/minio/data}"
+CDN_BUCKET="${CDN_BUCKET:-mercury}"
+
+mkdir -p "$PGDATA" /var/log/postgresql "$MINIO_DATA"
+chown postgres:postgres "$PGDATA" /var/log/postgresql
+
+# Start MinIO in background
+minio server "$MINIO_DATA" --console-address ":9001" > /var/log/minio.log 2>&1 &
+
+# Wait for MinIO to accept connections
+echo "Waiting for MinIO..."
+until mc alias set local http://localhost:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" > /dev/null 2>&1; do
+    sleep 1
+done
+
+# Create default bucket with anonymous read+write (MinIO is internal; no ports exposed)
+mc mb --ignore-existing "local/${CDN_BUCKET}" > /dev/null 2>&1
+mc anonymous set public "local/${CDN_BUCKET}" > /dev/null 2>&1
+echo "MinIO ready — bucket: ${CDN_BUCKET} (http://localhost:9000/${CDN_BUCKET})"
+
+# Initialise PostgreSQL on first start
+if [ ! -f "$PGDATA/PG_VERSION" ]; then
+    su -s /bin/sh postgres -c "initdb -D $PGDATA"
+    su -s /bin/sh postgres -c "pg_ctl start -D $PGDATA -w -l $PGLOG"
+    su -s /bin/sh postgres -c "psql postgres -c \"CREATE USER mercury WITH PASSWORD 'mercury';\""
+    su -s /bin/sh postgres -c "psql postgres -c \"CREATE DATABASE mercury OWNER mercury;\""
+    su -s /bin/sh postgres -c "pg_ctl stop -D $PGDATA -w"
+fi
+
+su -s /bin/sh postgres -c "pg_ctl start -D $PGDATA -w -l $PGLOG"
+
+exec /app/mercury
diff --git a/pics/Mercury-Login.png b/pics/Mercury-Login.png
new file mode 100644
index 0000000..7cbda99
Binary files /dev/null and b/pics/Mercury-Login.png differ
diff --git a/pics/Mercury.png b/pics/Mercury.png
new file mode 100644
index 0000000..4d04cf8
Binary files /dev/null and b/pics/Mercury.png differ
diff --git a/src/auth/middleware.rs b/src/auth/middleware.rs
new file mode 100644
index 0000000..36154cf
--- /dev/null
+++ b/src/auth/middleware.rs
@@ -0,0 +1,181 @@
+use axum::{
+    extract::{Request, State},
+    http::{header, HeaderMap, HeaderValue, Method, StatusCode},
+    middleware::Next,
+    response::{IntoResponse, Response},
+};
+
+use crate::{
+    auth::{decode_jwt, resolve_api_key, Claims},
+    state::AppState,
+};
+
+/// Resolves a Bearer token to Claims, trying JWT then API key.
+/// Inserts Claims into request extensions on success so downstream
+/// middleware can reuse them without an additional DB round-trip.
+async fn authenticate(token: &str, state: &AppState, req: &mut Request) -> Option<Claims> {
+    if let Some(existing) = req.extensions().get::<Claims>().cloned() {
+        return Some(existing);
+    }
+    let claims = if let Ok(c) = decode_jwt(token, &state.config.jwt_secret) {
+        c
+    } else {
+        resolve_api_key(token, &state.pool).await?
+    };
+    req.extensions_mut().insert(claims.clone());
+    Some(claims)
+}
+
+pub async fn blacklist_layer(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let method = req.method().as_str().to_uppercase();
+    let path = req.uri().path().to_string();
+    let caller_mask = if let Some(token) = extract_bearer(&req) {
+        authenticate(&token, &state, &mut req)
+            .await
+            .map(|c| c.permissions_mask())
+            .unwrap_or(0)
+    } else {
+        0
+    };
+    if state
+        .blacklist_cache
+        .is_blocked(&method, &path, caller_mask)
+        .await
+    {
+        return Err(StatusCode::FORBIDDEN);
+    }
+    Ok(next.run(req).await)
+}
+
+pub fn extract_bearer(req: &Request) -> Option<String> {
+    req.headers()
+        .get("authorization")
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.strip_prefix("Bearer "))
+        .map(|s| s.to_string())
+}
+
+pub async fn require_auth(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let token = extract_bearer(&req).ok_or(StatusCode::UNAUTHORIZED)?;
+    authenticate(&token, &state, &mut req)
+        .await
+        .ok_or(StatusCode::UNAUTHORIZED)?;
+    Ok(next.run(req).await)
+}
+
+pub async fn require_super_admin(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let token = extract_bearer(&req).ok_or(StatusCode::UNAUTHORIZED)?;
+    let claims = authenticate(&token, &state, &mut req)
+        .await
+        .ok_or(StatusCode::UNAUTHORIZED)?;
+    if !claims.has_permission(crate::auth::permissions::SUPER_ADMIN) {
+        return Err(StatusCode::FORBIDDEN);
+    }
+    Ok(next.run(req).await)
+}
+
+pub async fn require_admin_query(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let token = extract_bearer(&req).ok_or(StatusCode::UNAUTHORIZED)?;
+    let claims = authenticate(&token, &state, &mut req)
+        .await
+        .ok_or(StatusCode::UNAUTHORIZED)?;
+    if !claims.has_permission(crate::auth::permissions::ADMIN_QUERY) {
+        return Err(StatusCode::FORBIDDEN);
+    }
+    Ok(next.run(req).await)
+}
+
+pub async fn require_admin_cache(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let token = extract_bearer(&req).ok_or(StatusCode::UNAUTHORIZED)?;
+    let claims = authenticate(&token, &state, &mut req)
+        .await
+        .ok_or(StatusCode::UNAUTHORIZED)?;
+    if !claims.has_permission(crate::auth::permissions::ADMIN_CACHE) {
+        return Err(StatusCode::FORBIDDEN);
+    }
+    Ok(next.run(req).await)
+}
+
+pub async fn cors_layer(State(state): State<AppState>, req: Request, next: Next) -> Response {
+    let is_preflight = req.method() == Method::OPTIONS;
+    let origin_header = req.headers().get(header::ORIGIN).cloned();
+
+    enum CorsDecision {
+        None,
+        Wildcard,
+        Specific(HeaderValue),
+    }
+
+    let decision = {
+        let guard = state.cors_cache.inner.read().await;
+        if guard.wildcard {
+            CorsDecision::Wildcard
+        } else if let Some(origin) = origin_header.as_ref() {
+            if guard.origins.contains(origin) {
+                CorsDecision::Specific(origin.clone())
+            } else {
+                CorsDecision::None
+            }
+        } else {
+            CorsDecision::None
+        }
+    };
+
+    let (cors_origin, vary) = match &decision {
+        CorsDecision::None => (None, false),
+        CorsDecision::Wildcard => (Some(HeaderValue::from_static("*")), false),
+        CorsDecision::Specific(v) => (Some(v.clone()), true),
+    };
+
+    if is_preflight {
+        let mut headers = HeaderMap::new();
+        if let Some(origin) = cors_origin {
+            headers.insert(header::ACCESS_CONTROL_ALLOW_ORIGIN, origin);
+            headers.insert(
+                header::ACCESS_CONTROL_ALLOW_METHODS,
+                HeaderValue::from_static("GET, POST, PUT, DELETE, OPTIONS"),
+            );
+            headers.insert(
+                header::ACCESS_CONTROL_ALLOW_HEADERS,
+                HeaderValue::from_static("content-type, authorization"),
+            );
+            if vary {
+                headers.insert(header::VARY, HeaderValue::from_static("Origin"));
+            }
+        }
+        return (StatusCode::NO_CONTENT, headers).into_response();
+    }
+
+    let mut response = next.run(req).await;
+    if let Some(origin) = cors_origin {
+        response
+            .headers_mut()
+            .insert(header::ACCESS_CONTROL_ALLOW_ORIGIN, origin);
+        if vary {
+            response
+                .headers_mut()
+                .append(header::VARY, HeaderValue::from_static("Origin"));
+        }
+    }
+    response
+}
diff --git a/src/auth/mod.rs b/src/auth/mod.rs
new file mode 100644
index 0000000..fb6a7df
--- /dev/null
+++ b/src/auth/mod.rs
@@ -0,0 +1,123 @@
+pub mod middleware;
+
+use anyhow::Result;
+use chrono::Utc;
+use jsonwebtoken::{decode, encode, DecodingKey, EncodingKey, Header, Validation};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use uuid::Uuid;
+
+#[allow(dead_code)]
+pub mod permissions {
+    pub const READ: u128 = 1;
+    pub const WRITE: u128 = 2;
+    pub const DELETE: u128 = 4;
+    pub const ADMIN_QUERY: u128 = 8;
+    pub const ADMIN_CACHE: u128 = 16;
+    pub const SUPER_ADMIN: u128 = 32;
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Claims {
+    pub sub: String,
+    pub permissions: String, // u128 stored as decimal string
+    pub exp: usize,
+}
+
+impl Claims {
+    pub fn permissions_mask(&self) -> u128 {
+        self.permissions.parse().unwrap_or(0)
+    }
+
+    pub fn has_permission(&self, bit: u128) -> bool {
+        self.permissions_mask() & bit != 0
+    }
+}
+
+pub fn encode_jwt(username: &str, mask: u128, secret: &str, expiry_secs: u64) -> Result<String> {
+    let exp = (Utc::now().timestamp() as u64 + expiry_secs) as usize;
+    let claims = Claims {
+        sub: username.to_string(),
+        permissions: mask.to_string(),
+        exp,
+    };
+    let token = encode(
+        &Header::default(),
+        &claims,
+        &EncodingKey::from_secret(secret.as_bytes()),
+    )?;
+    Ok(token)
+}
+
+/// Generates a new API key: `mrc_<32 random hex chars>`.
+/// Returns `(plain_key, key_prefix, key_hash)`.
+pub fn generate_api_key() -> (String, String, String) {
+    let raw = format!("{}{}", Uuid::new_v4().simple(), Uuid::new_v4().simple());
+    let key = format!("mrc_{}", raw);
+    let prefix = raw[..8].to_string();
+    let hash = hash_api_key(&key);
+    (key, prefix, hash)
+}
+
+pub fn hash_api_key(key: &str) -> String {
+    format!("{:x}", Sha256::digest(key.as_bytes()))
+}
+
+/// Resolves an API key token against the database.
+/// Updates `last_used_at` on success.
+pub async fn resolve_api_key(token: &str, pool: &sqlx::PgPool) -> Option<Claims> {
+    if !token.starts_with("mrc_") {
+        return None;
+    }
+    let hash = hash_api_key(token);
+    let row: (String, String) = sqlx::query_as(
+        "UPDATE api_keys SET last_used_at = now()
+         WHERE key_hash = $1 AND (expires_at IS NULL OR expires_at > now())
+         RETURNING name, permissions_mask",
+    )
+    .bind(&hash)
+    .fetch_optional(pool)
+    .await
+    .ok()??;
+
+    Some(Claims {
+        sub: row.0,
+        permissions: row.1,
+        exp: usize::MAX,
+    })
+}
+
+pub fn decode_jwt(token: &str, secret: &str) -> Result<Claims> {
+    let data = decode::<Claims>(
+        token,
+        &DecodingKey::from_secret(secret.as_bytes()),
+        &Validation::default(),
+    )?;
+    Ok(data.claims)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_encode_decode_roundtrip() {
+        let secret = "test_secret";
+        let token = encode_jwt("alice", 63u128, secret, 3600).unwrap();
+        let claims = decode_jwt(&token, secret).unwrap();
+        assert_eq!(claims.sub, "alice");
+        assert_eq!(claims.permissions_mask(), 63u128);
+    }
+
+    #[test]
+    fn test_has_permission() {
+        let claims = Claims {
+            sub: "bob".into(),
+            permissions: "9".into(), // READ (1) + ADMIN_QUERY (8)
+            exp: 9999999999,
+        };
+        assert!(claims.has_permission(permissions::READ));
+        assert!(claims.has_permission(permissions::ADMIN_QUERY));
+        assert!(!claims.has_permission(permissions::SUPER_ADMIN));
+    }
+}
diff --git a/src/cache/mod.rs b/src/cache/mod.rs
new file mode 100644
index 0000000..a1ca063
--- /dev/null
+++ b/src/cache/mod.rs
@@ -0,0 +1,2 @@
+pub mod sweep;
+pub use sweep::spawn_sweep_task;
diff --git a/src/cache/sweep.rs b/src/cache/sweep.rs
new file mode 100644
index 0000000..bee1933
--- /dev/null
+++ b/src/cache/sweep.rs
@@ -0,0 +1,15 @@
+use crate::state::QueryCache;
+use std::time::Duration;
+
+pub fn spawn_sweep_task(cache: QueryCache, idle_timeout_secs: u64, sweep_interval_secs: u64) {
+    tokio::spawn(async move {
+        let interval = Duration::from_secs(sweep_interval_secs);
+        loop {
+            tokio::time::sleep(interval).await;
+            let now = crate::state::unix_now();
+            cache
+                .map
+                .retain(|_, entry| now.saturating_sub(entry.last_accessed()) < idle_timeout_secs);
+        }
+    });
+}
diff --git a/src/config.rs b/src/config.rs
new file mode 100644
index 0000000..aee1b76
--- /dev/null
+++ b/src/config.rs
@@ -0,0 +1,64 @@
+use anyhow::Result;
+
+#[derive(Clone, Debug)]
+pub struct Config {
+    pub database_url: String,
+    pub jwt_secret: String,
+    pub jwt_expiry_secs: u64,
+    pub cache_max_capacity: usize,
+    pub cache_idle_timeout_secs: u64,
+    pub cache_sweep_interval_secs: u64,
+    /// Comma-separated allowed CORS origins, or "*" for permissive. Empty = no CORS headers.
+    pub cors_origins: Vec<String>,
+    /// Base URL of the MinIO/S3 endpoint (no trailing slash).
+    pub cdn_endpoint: String,
+    /// Bucket name used for CDN object storage.
+    pub cdn_bucket: String,
+}
+
+impl Config {
+    pub fn from_env() -> Result<Self> {
+        Ok(Self {
+            database_url: std::env::var("DATABASE_URL")?,
+            jwt_secret: std::env::var("JWT_SECRET")?,
+            jwt_expiry_secs: std::env::var("JWT_EXPIRY_SECS")
+                .unwrap_or_else(|_| "3600".into())
+                .parse()?,
+            cache_max_capacity: std::env::var("CACHE_MAX_CAPACITY")
+                .unwrap_or_else(|_| "10000".into())
+                .parse()?,
+            cache_idle_timeout_secs: std::env::var("CACHE_IDLE_TIMEOUT_SECS")
+                .unwrap_or_else(|_| "300".into())
+                .parse()?,
+            cache_sweep_interval_secs: std::env::var("CACHE_SWEEP_INTERVAL_SECS")
+                .unwrap_or_else(|_| "60".into())
+                .parse()?,
+            cors_origins: std::env::var("CORS_ORIGINS")
+                .unwrap_or_default()
+                .split(',')
+                .map(|s| s.trim().to_string())
+                .filter(|s| !s.is_empty())
+                .collect(),
+            cdn_endpoint: std::env::var("CDN_ENDPOINT")
+                .unwrap_or_else(|_| "http://localhost:9000".into()),
+            cdn_bucket: std::env::var("CDN_BUCKET").unwrap_or_else(|_| "mercury".into()),
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_config_defaults() {
+        std::env::set_var("DATABASE_URL", "postgres://test");
+        std::env::set_var("JWT_SECRET", "secret");
+        let cfg = Config::from_env().unwrap();
+        assert_eq!(cfg.jwt_expiry_secs, 3600);
+        assert_eq!(cfg.cache_max_capacity, 10_000);
+        assert_eq!(cfg.cache_idle_timeout_secs, 300);
+        assert_eq!(cfg.cache_sweep_interval_secs, 60);
+        assert!(cfg.cors_origins.is_empty());
+    }
+}
diff --git a/src/db/migrations/001_initial.sql b/src/db/migrations/001_initial.sql
new file mode 100644
index 0000000..e2b3711
--- /dev/null
+++ b/src/db/migrations/001_initial.sql
@@ -0,0 +1,48 @@
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+CREATE TABLE users (
+    id SERIAL PRIMARY KEY,
+    username VARCHAR(255) UNIQUE NOT NULL,
+    password_hash TEXT NOT NULL,
+    permissions_mask TEXT NOT NULL DEFAULT '0',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE permissions (
+    id SERIAL PRIMARY KEY,
+    name VARCHAR(255) UNIQUE NOT NULL,
+    bit_value TEXT UNIQUE NOT NULL,
+    description TEXT
+);
+
+CREATE TABLE queries (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    identifier VARCHAR(255) UNIQUE NOT NULL,
+    sql_template TEXT NOT NULL,
+    description TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE blacklist (
+    id SERIAL PRIMARY KEY,
+    pattern VARCHAR(500) NOT NULL,
+    method VARCHAR(10),
+    reason TEXT,
+    active BOOLEAN NOT NULL DEFAULT true,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Seed permissions
+INSERT INTO permissions (name, bit_value, description) VALUES
+    ('READ',        '1',  'Can read via CRUD endpoints'),
+    ('WRITE',       '2',  'Can insert/update via CRUD'),
+    ('DELETE',      '4',  'Can delete via CRUD'),
+    ('ADMIN_QUERY', '8',  'Can manage query registry'),
+    ('ADMIN_CACHE', '16', 'Can manage cache'),
+    ('SUPER_ADMIN', '32', 'Full access');
+
+-- Seed blacklist (users and permissions tables are admin-only)
+INSERT INTO blacklist (pattern, method, reason, active) VALUES
+    ('/api/users/**',       NULL, 'admin-only table', true),
+    ('/api/permissions/**', NULL, 'admin-only table', true);
diff --git a/src/db/migrations/002_blacklist_system_tables.sql b/src/db/migrations/002_blacklist_system_tables.sql
new file mode 100644
index 0000000..8823f83
--- /dev/null
+++ b/src/db/migrations/002_blacklist_system_tables.sql
@@ -0,0 +1,9 @@
+-- Block PostgreSQL system catalog tables from the public CRUD API.
+-- The pg_ prefix covers pg_tables, pg_class, pg_user, pg_shadow, pg_authid, etc.
+-- information_schema columns contain dots so they're already rejected by the
+-- identifier validator, but we block them here for defense in depth.
+INSERT INTO blacklist (pattern, method, reason, active) VALUES
+    ('/api/pg_*',                NULL, 'postgresql system catalog', true),
+    ('/api/pg_*/**',             NULL, 'postgresql system catalog', true),
+    ('/api/information_schema',  NULL, 'postgresql information schema', true),
+    ('/api/information_schema/**', NULL, 'postgresql information schema', true);
diff --git a/src/db/migrations/003_blacklist_bypass_permission.sql b/src/db/migrations/003_blacklist_bypass_permission.sql
new file mode 100644
index 0000000..2efe878
--- /dev/null
+++ b/src/db/migrations/003_blacklist_bypass_permission.sql
@@ -0,0 +1,32 @@
+-- Allow blacklist entries to be bypassed by callers who hold a specific permission bit.
+-- bypass_mask NULL means the rule blocks everyone unconditionally.
+ALTER TABLE blacklist ADD COLUMN bypass_mask TEXT;
+
+-- Existing user/permission rules: SUPER_ADMIN (bit 32) can bypass them so the
+-- admin UI can reach these tables via the generic /api/:table CRUD endpoint.
+UPDATE blacklist
+SET bypass_mask = '32'
+WHERE pattern IN ('/api/users/**', '/api/permissions/**');
+
+-- Add rules for queries and blacklist tables, which also need admin-only CRUD access.
+INSERT INTO blacklist (pattern, method, reason, active, bypass_mask) VALUES
+    ('/api/users',       NULL, 'admin-only table', true, '32'),
+    ('/api/permissions', NULL, 'admin-only table', true, '32'),
+    ('/api/queries',     NULL, 'admin-only table', true, '32'),
+    ('/api/queries/**',  NULL, 'admin-only table', true, '32'),
+    ('/api/blacklist',   NULL, 'admin-only table', true, '32'),
+    ('/api/blacklist/**', NULL, 'admin-only table', true, '32');
+
+-- Automatically update updated_at on queries mutations so the generic CRUD
+-- endpoint doesn't need to know about that column.
+CREATE OR REPLACE FUNCTION update_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+    NEW.updated_at = NOW();
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER queries_updated_at
+    BEFORE UPDATE ON queries
+    FOR EACH ROW EXECUTE FUNCTION update_updated_at();
diff --git a/src/db/migrations/004_blacklist_method_text.sql b/src/db/migrations/004_blacklist_method_text.sql
new file mode 100644
index 0000000..b9582b5
--- /dev/null
+++ b/src/db/migrations/004_blacklist_method_text.sql
@@ -0,0 +1,2 @@
+-- Widen method column to support comma-separated multi-method values e.g. "GET,POST"
+ALTER TABLE blacklist ALTER COLUMN method TYPE TEXT;
diff --git a/src/db/migrations/005_api_keys.sql b/src/db/migrations/005_api_keys.sql
new file mode 100644
index 0000000..75ef167
--- /dev/null
+++ b/src/db/migrations/005_api_keys.sql
@@ -0,0 +1,12 @@
+CREATE TABLE api_keys (
+    id SERIAL PRIMARY KEY,
+    name VARCHAR(255) NOT NULL,
+    key_prefix VARCHAR(16) NOT NULL,
+    key_hash TEXT NOT NULL UNIQUE,
+    permissions_mask TEXT NOT NULL DEFAULT '0',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    expires_at TIMESTAMPTZ,
+    last_used_at TIMESTAMPTZ
+);
+
+CREATE INDEX idx_api_keys_hash ON api_keys(key_hash);
diff --git a/src/db/migrations/006_seed_api_keys_blacklist.sql b/src/db/migrations/006_seed_api_keys_blacklist.sql
new file mode 100644
index 0000000..1ddf16c
--- /dev/null
+++ b/src/db/migrations/006_seed_api_keys_blacklist.sql
@@ -0,0 +1,5 @@
+-- Prevent raw CRUD access to the api_keys table (would expose key_hash).
+-- The proper endpoints live at /api/admin/api-keys and are guarded by require_super_admin.
+INSERT INTO blacklist (pattern, method, reason, active) VALUES
+    ('/api/api_keys',    NULL, 'api key hashes must not be exposed via generic CRUD', true),
+    ('/api/api_keys/**', NULL, 'api key hashes must not be exposed via generic CRUD', true);
diff --git a/src/db/migrations/007_cors_origins.sql b/src/db/migrations/007_cors_origins.sql
new file mode 100644
index 0000000..cc4150e
--- /dev/null
+++ b/src/db/migrations/007_cors_origins.sql
@@ -0,0 +1,10 @@
+CREATE TABLE cors_origins (
+    id         SERIAL PRIMARY KEY,
+    origin     TEXT NOT NULL UNIQUE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Restrict mutations to super-admins (bit 32); GET remains open for all admins.
+INSERT INTO blacklist (pattern, method, reason, active, bypass_mask) VALUES
+    ('/api/cors_origins',    'POST,PUT,PATCH,DELETE', 'admin-only table', true, '32'),
+    ('/api/cors_origins/**', 'POST,PUT,PATCH,DELETE', 'admin-only table', true, '32');
diff --git a/src/db/migrations/008_cdn_objects.sql b/src/db/migrations/008_cdn_objects.sql
new file mode 100644
index 0000000..208dcef
--- /dev/null
+++ b/src/db/migrations/008_cdn_objects.sql
@@ -0,0 +1,13 @@
+CREATE TABLE cdn_objects (
+    id           SERIAL PRIMARY KEY,
+    key          TEXT NOT NULL UNIQUE,
+    url          TEXT NOT NULL,
+    content_type TEXT,
+    description  TEXT,
+    created_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Block mutations to /api/cdn for non-super-admins. GET is unblocked (no entry).
+INSERT INTO blacklist (pattern, method, reason, active, bypass_mask) VALUES
+    ('/api/cdn',    'POST,PUT,PATCH,DELETE', 'CDN write operations are super-admin only', true, '32'),
+    ('/api/cdn/**', 'POST,PUT,PATCH,DELETE', 'CDN write operations are super-admin only', true, '32');
diff --git a/src/db/migrations/009_cdn_drop_url.sql b/src/db/migrations/009_cdn_drop_url.sql
new file mode 100644
index 0000000..b7bb87d
--- /dev/null
+++ b/src/db/migrations/009_cdn_drop_url.sql
@@ -0,0 +1,2 @@
+-- Remove url column: the proxy constructs the URL from cdn_endpoint + cdn_bucket + key.
+ALTER TABLE cdn_objects DROP COLUMN IF EXISTS url;
diff --git a/src/db/mod.rs b/src/db/mod.rs
new file mode 100644
index 0000000..620c68e
--- /dev/null
+++ b/src/db/mod.rs
@@ -0,0 +1,2 @@
+pub mod pool;
+pub use pool::create_pool;
diff --git a/src/db/pool.rs b/src/db/pool.rs
new file mode 100644
index 0000000..d2c4790
--- /dev/null
+++ b/src/db/pool.rs
@@ -0,0 +1,11 @@
+use anyhow::Result;
+use sqlx::{postgres::PgPoolOptions, PgPool};
+
+pub async fn create_pool(database_url: &str) -> Result<PgPool> {
+    let pool = PgPoolOptions::new()
+        .max_connections(10)
+        .connect(database_url)
+        .await?;
+    sqlx::migrate!("src/db/migrations").run(&pool).await?;
+    Ok(pool)
+}
diff --git a/src/main.rs b/src/main.rs
new file mode 100644
index 0000000..6caf0e6
--- /dev/null
+++ b/src/main.rs
@@ -0,0 +1,208 @@
+mod auth;
+mod cache;
+mod config;
+mod db;
+mod models;
+mod routes;
+mod state;
+
+use std::io::{self, Write};
+use std::sync::Arc;
+
+use axum::{
+    extract::DefaultBodyLimit,
+    middleware,
+    routing::{get, post},
+    Router,
+};
+use tower_http::services::{ServeDir, ServeFile};
+use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
+
+use crate::{
+    auth::middleware::{blacklist_layer, cors_layer, require_auth},
+    cache::spawn_sweep_task,
+    config::Config,
+    db::create_pool,
+    models::blacklist::BlacklistEntry,
+    routes::{
+        admin::admin_router,
+        auth::login,
+        cdn::{cdn_create, cdn_delete, cdn_list, cdn_proxy, cdn_update, cdn_upload},
+        crud::handle_crud,
+    },
+    state::{AppState, BlacklistCache, CorsCache, QueryCache},
+};
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    dotenvy::dotenv().ok();
+
+    tracing_subscriber::registry()
+        .with(
+            tracing_subscriber::EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| "mercury=info".into()),
+        )
+        .with(tracing_subscriber::fmt::layer())
+        .init();
+
+    let config = Arc::new(Config::from_env()?);
+    let pool = create_pool(&config.database_url).await?;
+
+    // If no users exist, prompt to create the first admin interactively.
+    let user_count: i64 = sqlx::query_scalar::<_, Option<i64>>("SELECT COUNT(*) FROM users")
+        .fetch_one(&pool)
+        .await?
+        .unwrap_or(0);
+    if user_count == 0 {
+        let (username, password) = match (
+            std::env::var("MERCURY_ADMIN_USER")
+                .ok()
+                .filter(|s| !s.is_empty()),
+            std::env::var("MERCURY_ADMIN_PASSWORD")
+                .ok()
+                .filter(|s| !s.is_empty()),
+        ) {
+            (Some(u), Some(p)) => {
+                tracing::info!("creating first admin user from environment variables");
+                (u, p)
+            }
+            _ => {
+                println!("\nNo users found. Create the first admin account.");
+                print!("Username: ");
+                io::stdout().flush()?;
+                let mut username = String::new();
+                io::stdin().read_line(&mut username)?;
+                let username = username.trim().to_string();
+                if username.is_empty() {
+                    anyhow::bail!("username cannot be empty");
+                }
+
+                print!("Password: ");
+                io::stdout().flush()?;
+                let mut password = String::new();
+                io::stdin().read_line(&mut password)?;
+                let password = password.trim().to_string();
+                if password.is_empty() {
+                    anyhow::bail!("password cannot be empty");
+                }
+                (username, password)
+            }
+        };
+
+        let hash = bcrypt::hash(&password, bcrypt::DEFAULT_COST)?;
+        sqlx::query(
+            "INSERT INTO users (username, password_hash, permissions_mask) VALUES ($1, $2, '63')",
+        )
+        .bind(&username)
+        .bind(hash)
+        .execute(&pool)
+        .await?;
+        tracing::info!("created first admin user: {}", username);
+        println!("Admin user '{}' created. Starting server...\n", username);
+    }
+
+    let query_cache = QueryCache::new();
+    let blacklist_cache = BlacklistCache::new();
+
+    // Load blacklist from DB into memory
+    let entries = sqlx::query_as::<_, BlacklistEntry>(
+        "SELECT id, pattern, method, reason, active, bypass_mask, created_at FROM blacklist ORDER BY id"
+    )
+    .fetch_all(&pool)
+    .await?;
+    blacklist_cache.load(entries).await;
+
+    // Load CORS origins; seed from CORS_ORIGINS env var if table is empty.
+    let cors_count: i64 = sqlx::query_scalar::<_, Option<i64>>("SELECT COUNT(*) FROM cors_origins")
+        .fetch_one(&pool)
+        .await?
+        .unwrap_or(0);
+    if cors_count == 0 && !config.cors_origins.is_empty() {
+        for origin in &config.cors_origins {
+            sqlx::query("INSERT INTO cors_origins (origin) VALUES ($1) ON CONFLICT DO NOTHING")
+                .bind(origin)
+                .execute(&pool)
+                .await?;
+        }
+        tracing::info!(
+            "seeded {} CORS origin(s) from CORS_ORIGINS env var",
+            config.cors_origins.len()
+        );
+    }
+    let cors_origins: Vec<String> =
+        sqlx::query_scalar::<_, String>("SELECT origin FROM cors_origins ORDER BY id")
+            .fetch_all(&pool)
+            .await?;
+    let cors_cache = CorsCache::new();
+    cors_cache.load(cors_origins).await;
+
+    let http_client = reqwest::Client::new();
+    let cdn_base_url = format!("{}/{}", config.cdn_endpoint, config.cdn_bucket);
+
+    // Start cache sweep
+    spawn_sweep_task(
+        query_cache.clone(),
+        config.cache_idle_timeout_secs,
+        config.cache_sweep_interval_secs,
+    );
+
+    let state = AppState {
+        pool,
+        query_cache,
+        blacklist_cache,
+        cors_cache,
+        http_client,
+        cdn_base_url,
+        config: config.clone(),
+    };
+
+    let crud_routes = Router::new()
+        .route("/api/:table", get(handle_crud).post(handle_crud))
+        .route("/api/:table/", get(handle_crud).post(handle_crud))
+        .route(
+            "/api/:table/:id",
+            get(handle_crud).put(handle_crud).delete(handle_crud),
+        )
+        .route(
+            "/api/:table/:id/",
+            get(handle_crud).put(handle_crud).delete(handle_crud),
+        )
+        .layer(DefaultBodyLimit::max(1024 * 1024))
+        .route_layer(middleware::from_fn_with_state(state.clone(), require_auth))
+        .route_layer(middleware::from_fn_with_state(
+            state.clone(),
+            blacklist_layer,
+        ));
+
+    // CDN routes: GET is public; POST/PUT/DELETE are blacklisted for non-super-admins.
+    let cdn_routes = Router::new()
+        .route("/api/cdn", get(cdn_list).post(cdn_create))
+        .route("/api/cdn/upload", post(cdn_upload))
+        .route(
+            "/api/cdn/:key",
+            get(cdn_proxy).put(cdn_update).delete(cdn_delete),
+        )
+        .route_layer(middleware::from_fn_with_state(
+            state.clone(),
+            blacklist_layer,
+        ))
+        .layer(DefaultBodyLimit::disable());
+
+    let app = Router::new()
+        .route("/auth/login", post(login))
+        .merge(cdn_routes)
+        .merge(crud_routes)
+        .nest("/api/admin", admin_router(state.clone()))
+        .nest_service(
+            "/",
+            ServeDir::new("ui/dist").fallback(ServeFile::new("ui/dist/index.html")),
+        )
+        .layer(middleware::from_fn_with_state(state.clone(), cors_layer))
+        .with_state(state);
+
+    let addr = std::net::SocketAddr::from(([0, 0, 0, 0], 3000));
+    tracing::info!("listening on {}", addr);
+    let listener = tokio::net::TcpListener::bind(addr).await?;
+    axum::serve(listener, app).await?;
+    Ok(())
+}
diff --git a/src/models/api_key.rs b/src/models/api_key.rs
new file mode 100644
index 0000000..7437c6b
--- /dev/null
+++ b/src/models/api_key.rs
@@ -0,0 +1,27 @@
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct ApiKey {
+    pub id: i32,
+    pub name: String,
+    pub key_prefix: String,
+    pub permissions_mask: String,
+    pub created_at: DateTime<Utc>,
+    pub expires_at: Option<DateTime<Utc>>,
+    pub last_used_at: Option<DateTime<Utc>>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateApiKey {
+    pub name: String,
+    pub permissions_mask: Option<String>,
+    pub expires_at: Option<DateTime<Utc>>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UpdateApiKey {
+    pub name: Option<String>,
+    pub permissions_mask: Option<String>,
+    pub expires_at: Option<DateTime<Utc>>,
+}
diff --git a/src/models/blacklist.rs b/src/models/blacklist.rs
new file mode 100644
index 0000000..7ed6b2b
--- /dev/null
+++ b/src/models/blacklist.rs
@@ -0,0 +1,30 @@
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct BlacklistEntry {
+    pub id: i32,
+    pub pattern: String,
+    pub method: Option<String>,
+    pub reason: Option<String>,
+    pub active: bool,
+    pub bypass_mask: Option<String>,
+    pub created_at: DateTime<Utc>,
+}
+
+#[allow(dead_code)]
+#[derive(Debug, Deserialize)]
+pub struct CreateBlacklistEntry {
+    pub pattern: String,
+    pub method: Option<String>,
+    pub reason: Option<String>,
+}
+
+#[allow(dead_code)]
+#[derive(Debug, Deserialize)]
+pub struct UpdateBlacklistEntry {
+    pub pattern: Option<String>,
+    pub method: Option<String>,
+    pub reason: Option<String>,
+    pub active: Option<bool>,
+}
diff --git a/src/models/cdn.rs b/src/models/cdn.rs
new file mode 100644
index 0000000..38413a7
--- /dev/null
+++ b/src/models/cdn.rs
@@ -0,0 +1,25 @@
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct CdnObject {
+    pub id: i32,
+    pub key: String,
+    pub content_type: Option<String>,
+    pub description: Option<String>,
+    pub created_at: DateTime<Utc>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateCdnObject {
+    pub key: String,
+    pub content_type: Option<String>,
+    pub description: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UpdateCdnObject {
+    pub key: Option<String>,
+    pub content_type: Option<String>,
+    pub description: Option<String>,
+}
diff --git a/src/models/mod.rs b/src/models/mod.rs
new file mode 100644
index 0000000..6bd2f74
--- /dev/null
+++ b/src/models/mod.rs
@@ -0,0 +1,6 @@
+pub mod api_key;
+pub mod blacklist;
+pub mod cdn;
+pub mod permission;
+pub mod query;
+pub mod user;
diff --git a/src/models/permission.rs b/src/models/permission.rs
new file mode 100644
index 0000000..cf702fc
--- /dev/null
+++ b/src/models/permission.rs
@@ -0,0 +1,24 @@
+use serde::{Deserialize, Serialize};
+
+#[allow(dead_code)]
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct Permission {
+    pub id: i32,
+    pub name: String,
+    pub bit_value: String,
+    pub description: Option<String>,
+}
+
+#[allow(dead_code)]
+#[derive(Debug, Deserialize)]
+pub struct CreatePermission {
+    pub name: String,
+    pub description: Option<String>,
+}
+
+#[allow(dead_code)]
+#[derive(Debug, Deserialize)]
+pub struct UpdatePermission {
+    pub name: Option<String>,
+    pub description: Option<String>,
+}
diff --git a/src/models/query.rs b/src/models/query.rs
new file mode 100644
index 0000000..b0b8082
--- /dev/null
+++ b/src/models/query.rs
@@ -0,0 +1,28 @@
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct StoredQuery {
+    pub id: Uuid,
+    pub identifier: String,
+    pub sql_template: String,
+    pub description: Option<String>,
+    pub created_at: DateTime<Utc>,
+    pub updated_at: DateTime<Utc>,
+}
+
+#[allow(dead_code)]
+#[derive(Debug, Deserialize)]
+pub struct CreateQuery {
+    pub identifier: String,
+    pub sql_template: String,
+    pub description: Option<String>,
+}
+
+#[allow(dead_code)]
+#[derive(Debug, Deserialize)]
+pub struct UpdateQuery {
+    pub sql_template: Option<String>,
+    pub description: Option<String>,
+}
diff --git a/src/models/user.rs b/src/models/user.rs
new file mode 100644
index 0000000..ec9ff38
--- /dev/null
+++ b/src/models/user.rs
@@ -0,0 +1,34 @@
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct User {
+    pub id: i32,
+    pub username: String,
+    #[serde(skip_serializing)]
+    pub password_hash: String,
+    pub permissions_mask: String,
+    pub created_at: DateTime<Utc>,
+}
+
+#[allow(dead_code)]
+#[derive(Debug, Deserialize)]
+pub struct CreateUser {
+    pub username: String,
+    pub password: String,
+    pub permissions_mask: Option<String>,
+}
+
+#[allow(dead_code)]
+#[derive(Debug, Deserialize)]
+pub struct UpdateUser {
+    pub username: Option<String>,
+    pub password: Option<String>,
+    pub permissions_mask: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct LoginRequest {
+    pub username: String,
+    pub password: String,
+}
diff --git a/src/routes/admin/api_keys.rs b/src/routes/admin/api_keys.rs
new file mode 100644
index 0000000..58ab6da
--- /dev/null
+++ b/src/routes/admin/api_keys.rs
@@ -0,0 +1,103 @@
+use axum::{
+    extract::{Path, State},
+    http::StatusCode,
+    Json,
+};
+use serde_json::{json, Value};
+
+use crate::{
+    auth::generate_api_key,
+    models::api_key::{ApiKey, CreateApiKey, UpdateApiKey},
+    state::AppState,
+};
+
+pub async fn list_api_keys(State(state): State<AppState>) -> Result<Json<Vec<ApiKey>>, StatusCode> {
+    let keys = sqlx::query_as::<_, ApiKey>(
+        "SELECT id, name, key_prefix, permissions_mask, created_at, expires_at, last_used_at
+         FROM api_keys ORDER BY created_at DESC",
+    )
+    .fetch_all(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(keys))
+}
+
+pub async fn create_api_key(
+    State(state): State<AppState>,
+    Json(body): Json<CreateApiKey>,
+) -> Result<Json<Value>, StatusCode> {
+    let (plain_key, key_prefix, key_hash) = generate_api_key();
+    let mask = body.permissions_mask.unwrap_or_else(|| "0".into());
+
+    sqlx::query(
+        "INSERT INTO api_keys (name, key_prefix, key_hash, permissions_mask, expires_at)
+         VALUES ($1, $2, $3, $4, $5)",
+    )
+    .bind(&body.name)
+    .bind(&key_prefix)
+    .bind(&key_hash)
+    .bind(&mask)
+    .bind(body.expires_at)
+    .execute(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    Ok(Json(json!({
+        "key": plain_key,
+        "prefix": key_prefix,
+        "name": body.name,
+        "permissions_mask": mask,
+        "note": "Store this key securely — it will not be shown again."
+    })))
+}
+
+pub async fn update_api_key(
+    State(state): State<AppState>,
+    Path(id): Path<i32>,
+    Json(body): Json<UpdateApiKey>,
+) -> Result<Json<ApiKey>, StatusCode> {
+    if body.name.is_none() && body.permissions_mask.is_none() && body.expires_at.is_none() {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+
+    let key = sqlx::query_as::<_, ApiKey>(
+        "UPDATE api_keys
+         SET name             = COALESCE($1, name),
+             permissions_mask = COALESCE($2, permissions_mask),
+             expires_at       = CASE WHEN $3::boolean THEN $4 ELSE expires_at END
+         WHERE id = $5
+         RETURNING id, name, key_prefix, permissions_mask, created_at, expires_at, last_used_at",
+    )
+    .bind(body.name.as_deref())
+    .bind(body.permissions_mask.as_deref())
+    .bind(body.expires_at.is_some())
+    .bind(body.expires_at)
+    .bind(id)
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|e| {
+        tracing::error!("update api_key {}: {}", id, e);
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?
+    .ok_or(StatusCode::NOT_FOUND)?;
+
+    Ok(Json(key))
+}
+
+pub async fn revoke_api_key(
+    State(state): State<AppState>,
+    Path(id): Path<i32>,
+) -> Result<StatusCode, StatusCode> {
+    let rows = sqlx::query("DELETE FROM api_keys WHERE id = $1")
+        .bind(id)
+        .execute(&state.pool)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .rows_affected();
+
+    if rows == 0 {
+        Err(StatusCode::NOT_FOUND)
+    } else {
+        Ok(StatusCode::NO_CONTENT)
+    }
+}
diff --git a/src/routes/admin/cache.rs b/src/routes/admin/cache.rs
new file mode 100644
index 0000000..b159eae
--- /dev/null
+++ b/src/routes/admin/cache.rs
@@ -0,0 +1,24 @@
+use axum::extract::Extension;
+use axum::{extract::State, http::StatusCode, Json};
+use serde_json::{json, Value};
+
+use crate::{auth::Claims, state::AppState};
+
+pub async fn cache_stats(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+) -> Json<Value> {
+    Json(json!({
+        "size": state.query_cache.len(),
+        "hits": state.query_cache.hits(),
+        "misses": state.query_cache.misses(),
+    }))
+}
+
+pub async fn flush_cache(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+) -> Result<Json<Value>, StatusCode> {
+    state.query_cache.flush();
+    Ok(Json(json!({ "flushed": true })))
+}
diff --git a/src/routes/admin/mod.rs b/src/routes/admin/mod.rs
new file mode 100644
index 0000000..ad78995
--- /dev/null
+++ b/src/routes/admin/mod.rs
@@ -0,0 +1,62 @@
+pub mod api_keys;
+pub mod cache;
+pub mod queries;
+pub mod tables;
+
+use axum::{
+    middleware,
+    routing::{delete, get, put},
+    Router,
+};
+
+use crate::{
+    auth::middleware::{require_admin_cache, require_admin_query, require_super_admin},
+    state::AppState,
+};
+
+pub fn admin_router(state: AppState) -> Router<AppState> {
+    let query_routes = Router::new()
+        .route("/:identifier/execute", get(queries::execute_query))
+        .route_layer(middleware::from_fn_with_state(
+            state.clone(),
+            require_admin_query,
+        ));
+
+    // Registered with explicit paths (not nested) to avoid Axum double-nest
+    // ambiguity with route("/", handler) which can silently 404.
+    let cache_routes = Router::new()
+        .route("/cache/stats", get(cache::cache_stats))
+        .route("/cache", delete(cache::flush_cache))
+        .route("/cache/", delete(cache::flush_cache))
+        .route_layer(middleware::from_fn_with_state(
+            state.clone(),
+            require_admin_cache,
+        ));
+
+    let super_routes = Router::new()
+        .route(
+            "/tables",
+            get(tables::list_tables).post(tables::create_table),
+        )
+        .route(
+            "/tables/:name",
+            get(tables::get_table_preview).delete(tables::drop_table),
+        )
+        .route(
+            "/api-keys",
+            get(api_keys::list_api_keys).post(api_keys::create_api_key),
+        )
+        .route(
+            "/api-keys/:id",
+            put(api_keys::update_api_key).delete(api_keys::revoke_api_key),
+        )
+        .route_layer(middleware::from_fn_with_state(
+            state.clone(),
+            require_super_admin,
+        ));
+
+    Router::new()
+        .nest("/queries", query_routes)
+        .merge(cache_routes)
+        .merge(super_routes)
+}
diff --git a/src/routes/admin/queries.rs b/src/routes/admin/queries.rs
new file mode 100644
index 0000000..ce4dd15
--- /dev/null
+++ b/src/routes/admin/queries.rs
@@ -0,0 +1,85 @@
+use axum::{
+    extract::{Extension, Path, Query, State},
+    http::StatusCode,
+    Json,
+};
+use serde_json::Value;
+use std::collections::HashMap;
+
+use crate::{auth::Claims, models::query::StoredQuery, state::AppState};
+
+pub async fn execute_query(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path(identifier): Path<String>,
+    Query(params): Query<HashMap<String, String>>,
+) -> Result<Json<Value>, StatusCode> {
+    let stored = sqlx::query_as::<_, StoredQuery>(
+        "SELECT id, identifier, sql_template, description, created_at, updated_at FROM queries WHERE identifier = $1"
+    )
+    .bind(&identifier)
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    .ok_or(StatusCode::NOT_FOUND)?;
+
+    let mut sql = stored.sql_template.clone();
+    let mut bound_vals: Vec<String> = Vec::new();
+    let mut idx = 1usize;
+    let mut sorted_params: Vec<(String, String)> = params.into_iter().collect();
+    sorted_params.sort_by(|a, b| b.0.len().cmp(&a.0.len()).then(a.0.cmp(&b.0)));
+    for (name, val) in &sorted_params {
+        let placeholder = format!(":{}", name);
+        if sql.contains(&placeholder) {
+            sql = sql.replace(&placeholder, &format!("${}", idx));
+            bound_vals.push(val.clone());
+            idx += 1;
+        }
+    }
+
+    let mut q = sqlx::query(&sql);
+    for val in &bound_vals {
+        q = q.bind(val.as_str());
+    }
+
+    let rows = q.fetch_all(&state.pool).await.map_err(|e| {
+        tracing::error!("query execution error: {}", e);
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+
+    let json_rows: Vec<Value> = rows
+        .into_iter()
+        .map(crate::routes::crud::pg_row_to_json)
+        .collect();
+
+    Ok(Json(Value::Array(json_rows)))
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn test_prefix_param_substitution_order() {
+        let template = "SELECT * FROM t WHERE user_id = :user_id AND username = :username";
+        let mut params: Vec<(String, String)> = vec![
+            ("user_id".into(), "42".into()),
+            ("username".into(), "alice".into()),
+        ];
+        params.sort_by(|a, b| b.0.len().cmp(&a.0.len()).then(a.0.cmp(&b.0)));
+        let mut sql = template.to_string();
+        for (i, (name, _)) in params.iter().enumerate() {
+            sql = sql.replace(&format!(":{}", name), &format!("${}", i + 1));
+        }
+        assert!(
+            !sql.contains(":username"),
+            "placeholder not replaced: {}",
+            sql
+        );
+        assert!(
+            !sql.contains(":user_id"),
+            "placeholder not replaced: {}",
+            sql
+        );
+        // username (len 8) comes first → $1; user_id (len 7) → $2
+        assert_eq!(sql, "SELECT * FROM t WHERE user_id = $2 AND username = $1");
+    }
+}
diff --git a/src/routes/admin/tables.rs b/src/routes/admin/tables.rs
new file mode 100644
index 0000000..695d2a8
--- /dev/null
+++ b/src/routes/admin/tables.rs
@@ -0,0 +1,250 @@
+use axum::{
+    extract::{Extension, Path, State},
+    http::StatusCode,
+    Json,
+};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use sqlx::Row;
+
+use crate::{auth::Claims, routes::crud::pg_row_to_json, state::AppState};
+
+const ALLOWED_TYPES: &[&str] = &[
+    "TEXT",
+    "INTEGER",
+    "BIGINT",
+    "SMALLINT",
+    "BOOLEAN",
+    "NUMERIC",
+    "FLOAT4",
+    "FLOAT8",
+    "UUID",
+    "TIMESTAMPTZ",
+    "DATE",
+    "JSONB",
+];
+
+const PROTECTED_TABLES: &[&str] = &[
+    "users",
+    "blacklist",
+    "api_keys",
+    "queries",
+    "permissions",
+    "cors_origins",
+    "cdn_objects",
+];
+
+fn is_protected(name: &str) -> bool {
+    let lower = name.to_lowercase();
+    PROTECTED_TABLES.iter().any(|&t| t == lower)
+}
+
+#[derive(Debug, Deserialize)]
+pub struct ColumnDef {
+    pub name: String,
+    pub col_type: String,
+    pub nullable: Option<bool>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateTableRequest {
+    pub name: String,
+    pub columns: Vec<ColumnDef>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct TableInfo {
+    pub table_name: String,
+    pub column_count: i64,
+}
+
+#[derive(Debug, Serialize)]
+pub struct ColumnInfo {
+    pub column_name: String,
+    pub data_type: String,
+    pub is_nullable: String,
+}
+
+#[derive(Debug, Serialize)]
+pub struct TablePreview {
+    pub table_name: String,
+    pub row_count: i64,
+    pub columns: Vec<ColumnInfo>,
+    pub sample_rows: Vec<Value>,
+}
+
+pub async fn list_tables(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+) -> Result<Json<Vec<TableInfo>>, StatusCode> {
+    let rows = sqlx::query(
+        r#"
+        SELECT t.table_name,
+               COUNT(c.column_name)::bigint AS column_count
+        FROM information_schema.tables t
+        LEFT JOIN information_schema.columns c
+               ON c.table_schema = t.table_schema AND c.table_name = t.table_name
+        WHERE t.table_schema = 'public' AND t.table_type = 'BASE TABLE'
+        GROUP BY t.table_name
+        ORDER BY t.table_name
+        "#,
+    )
+    .fetch_all(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    let tables = rows
+        .into_iter()
+        .map(|r| TableInfo {
+            table_name: r.try_get::<String, _>("table_name").unwrap_or_default(),
+            column_count: r.try_get::<i64, _>("column_count").unwrap_or(0),
+        })
+        .collect();
+
+    Ok(Json(tables))
+}
+
+pub async fn get_table_preview(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path(name): Path<String>,
+) -> Result<Json<TablePreview>, StatusCode> {
+    if !crate::routes::is_valid_identifier(&name) {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+
+    let col_rows = sqlx::query(
+        "SELECT column_name, data_type, is_nullable \
+         FROM information_schema.columns \
+         WHERE table_schema = 'public' AND table_name = $1 \
+         ORDER BY ordinal_position",
+    )
+    .bind(&name)
+    .fetch_all(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    if col_rows.is_empty() {
+        return Err(StatusCode::NOT_FOUND);
+    }
+
+    let columns: Vec<ColumnInfo> = col_rows
+        .into_iter()
+        .map(|r| ColumnInfo {
+            column_name: r.try_get::<String, _>("column_name").unwrap_or_default(),
+            data_type: r.try_get::<String, _>("data_type").unwrap_or_default(),
+            is_nullable: r.try_get::<String, _>("is_nullable").unwrap_or_default(),
+        })
+        .collect();
+
+    let count_sql = format!("SELECT COUNT(*)::bigint FROM {}", name);
+    let row_count: i64 = sqlx::query(&count_sql)
+        .fetch_one(&state.pool)
+        .await
+        .map(|r| r.try_get::<i64, _>(0).unwrap_or(0))
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    let sample_sql = format!("SELECT * FROM {} LIMIT 10", name);
+    let sample_rows: Vec<Value> = sqlx::query(&sample_sql)
+        .fetch_all(&state.pool)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .into_iter()
+        .map(pg_row_to_json)
+        .collect();
+
+    Ok(Json(TablePreview {
+        table_name: name,
+        row_count,
+        columns,
+        sample_rows,
+    }))
+}
+
+pub async fn create_table(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Json(body): Json<CreateTableRequest>,
+) -> Result<Json<TableInfo>, StatusCode> {
+    if !crate::routes::is_valid_identifier(&body.name) {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+    if is_protected(&body.name) {
+        return Err(StatusCode::FORBIDDEN);
+    }
+
+    if body.columns.is_empty() {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+
+    let mut col_defs = vec!["id SERIAL PRIMARY KEY".to_string()];
+
+    for col in &body.columns {
+        if !crate::routes::is_valid_identifier(&col.name) {
+            return Err(StatusCode::BAD_REQUEST);
+        }
+
+        let upper_type = col.col_type.to_uppercase();
+        if !ALLOWED_TYPES.contains(&upper_type.as_str()) {
+            return Err(StatusCode::UNPROCESSABLE_ENTITY);
+        }
+
+        let nullable = col.nullable.unwrap_or(true);
+        let null_clause = if nullable { "" } else { " NOT NULL" };
+        col_defs.push(format!("{} {}{}", col.name, upper_type, null_clause));
+    }
+
+    let sql = format!("CREATE TABLE {} ({})", body.name, col_defs.join(", "));
+
+    sqlx::query(&sql).execute(&state.pool).await.map_err(|e| {
+        tracing::error!("create table error: {}", e);
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+
+    Ok(Json(TableInfo {
+        table_name: body.name,
+        column_count: body.columns.len() as i64 + 1,
+    }))
+}
+
+pub async fn drop_table(
+    State(state): State<AppState>,
+    Extension(_claims): Extension<Claims>,
+    Path(name): Path<String>,
+) -> Result<Json<Value>, StatusCode> {
+    if !crate::routes::is_valid_identifier(&name) {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+    if is_protected(&name) {
+        return Err(StatusCode::FORBIDDEN);
+    }
+
+    let sql = format!("DROP TABLE IF EXISTS {}", name);
+    sqlx::query(&sql).execute(&state.pool).await.map_err(|e| {
+        tracing::error!("drop table error: {}", e);
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+
+    Ok(Json(serde_json::json!({ "dropped": true })))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{is_protected, PROTECTED_TABLES};
+
+    #[test]
+    fn test_protected_tables_list() {
+        assert!(PROTECTED_TABLES.contains(&"users"));
+        assert!(PROTECTED_TABLES.contains(&"blacklist"));
+        assert!(PROTECTED_TABLES.contains(&"api_keys"));
+        assert!(PROTECTED_TABLES.contains(&"queries"));
+        assert!(PROTECTED_TABLES.contains(&"permissions"));
+    }
+
+    #[test]
+    fn test_is_protected() {
+        assert!(is_protected("users"));
+        assert!(is_protected("USERS"));
+        assert!(!is_protected("orders"));
+    }
+}
diff --git a/src/routes/auth.rs b/src/routes/auth.rs
new file mode 100644
index 0000000..e4cdf40
--- /dev/null
+++ b/src/routes/auth.rs
@@ -0,0 +1,36 @@
+use axum::{extract::State, http::StatusCode, Json};
+use serde_json::{json, Value};
+
+use crate::{auth::encode_jwt, models::user::LoginRequest, state::AppState};
+
+pub async fn login(
+    State(state): State<AppState>,
+    Json(body): Json<LoginRequest>,
+) -> Result<Json<Value>, StatusCode> {
+    let user = sqlx::query_as::<_, crate::models::user::User>(
+        "SELECT id, username, password_hash, permissions_mask, created_at FROM users WHERE username = $1",
+    )
+    .bind(&body.username)
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    .ok_or(StatusCode::UNAUTHORIZED)?;
+
+    let valid = bcrypt::verify(&body.password, &user.password_hash)
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    if !valid {
+        return Err(StatusCode::UNAUTHORIZED);
+    }
+
+    let mask: u128 = user.permissions_mask.parse().unwrap_or(0);
+    let token = encode_jwt(
+        &user.username,
+        mask,
+        &state.config.jwt_secret,
+        state.config.jwt_expiry_secs,
+    )
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    Ok(Json(json!({ "token": token })))
+}
diff --git a/src/routes/cdn.rs b/src/routes/cdn.rs
new file mode 100644
index 0000000..13acba5
--- /dev/null
+++ b/src/routes/cdn.rs
@@ -0,0 +1,244 @@
+use axum::{
+    extract::{Multipart, Path, State},
+    http::{header, StatusCode},
+    response::IntoResponse,
+    Json,
+};
+use serde_json::Value;
+use sqlx::Row;
+
+use crate::{
+    models::cdn::{CdnObject, CreateCdnObject, UpdateCdnObject},
+    state::AppState,
+};
+
+pub async fn cdn_list(State(state): State<AppState>) -> Result<Json<Vec<CdnObject>>, StatusCode> {
+    let objects = sqlx::query_as::<_, CdnObject>(
+        "SELECT id, key, content_type, description, created_at \
+         FROM cdn_objects ORDER BY id",
+    )
+    .fetch_all(&state.pool)
+    .await
+    .map_err(|e| {
+        tracing::error!("cdn_list: {}", e);
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+    Ok(Json(objects))
+}
+
+pub async fn cdn_proxy(
+    State(state): State<AppState>,
+    Path(key): Path<String>,
+) -> Result<impl IntoResponse, StatusCode> {
+    let row = sqlx::query("SELECT content_type FROM cdn_objects WHERE key = $1")
+        .bind(&key)
+        .fetch_optional(&state.pool)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+
+    let content_type: Option<String> = row
+        .try_get::<Option<String>, _>("content_type")
+        .ok()
+        .flatten();
+    let url = format!("{}/{}", state.cdn_base_url, key);
+
+    let upstream = state.http_client.get(&url).send().await.map_err(|e| {
+        tracing::error!("cdn_proxy upstream error for key={}: {}", key, e);
+        StatusCode::BAD_GATEWAY
+    })?;
+
+    let status =
+        StatusCode::from_u16(upstream.status().as_u16()).unwrap_or(StatusCode::BAD_GATEWAY);
+
+    let bytes = upstream
+        .bytes()
+        .await
+        .map_err(|_| StatusCode::BAD_GATEWAY)?;
+
+    let ct = content_type.unwrap_or_else(|| "application/octet-stream".to_string());
+
+    Ok((status, [(header::CONTENT_TYPE, ct)], bytes))
+}
+
+pub async fn cdn_create(
+    State(state): State<AppState>,
+    Json(body): Json<CreateCdnObject>,
+) -> Result<Json<CdnObject>, StatusCode> {
+    let obj = sqlx::query_as::<_, CdnObject>(
+        "INSERT INTO cdn_objects (key, content_type, description) \
+         VALUES ($1, $2, $3) \
+         RETURNING id, key, content_type, description, created_at",
+    )
+    .bind(&body.key)
+    .bind(&body.content_type)
+    .bind(&body.description)
+    .fetch_one(&state.pool)
+    .await
+    .map_err(|e| {
+        tracing::error!("cdn_create: {}", e);
+        if let sqlx::Error::Database(db_err) = &e {
+            if db_err.code().as_deref() == Some("23505") {
+                return StatusCode::CONFLICT;
+            }
+        }
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+    Ok(Json(obj))
+}
+
+pub async fn cdn_update(
+    State(state): State<AppState>,
+    Path(key): Path<String>,
+    Json(body): Json<UpdateCdnObject>,
+) -> Result<Json<CdnObject>, StatusCode> {
+    let obj = sqlx::query_as::<_, CdnObject>(
+        "UPDATE cdn_objects \
+         SET key          = COALESCE($2, key), \
+             content_type = COALESCE($3, content_type), \
+             description  = COALESCE($4, description) \
+         WHERE key = $1 \
+         RETURNING id, key, content_type, description, created_at",
+    )
+    .bind(&key)
+    .bind(&body.key)
+    .bind(&body.content_type)
+    .bind(&body.description)
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|e| {
+        tracing::error!("cdn_update: {}", e);
+        if let sqlx::Error::Database(db_err) = &e {
+            if db_err.code().as_deref() == Some("23505") {
+                return StatusCode::CONFLICT;
+            }
+        }
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?
+    .ok_or(StatusCode::NOT_FOUND)?;
+    Ok(Json(obj))
+}
+
+pub async fn cdn_delete(
+    State(state): State<AppState>,
+    Path(key): Path<String>,
+) -> Result<Json<Value>, StatusCode> {
+    let rows = sqlx::query("DELETE FROM cdn_objects WHERE key = $1")
+        .bind(&key)
+        .execute(&state.pool)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .rows_affected();
+    if rows == 0 {
+        return Err(StatusCode::NOT_FOUND);
+    }
+
+    let url = format!("{}/{}", state.cdn_base_url, key);
+    let res = state.http_client.delete(&url).send().await.map_err(|e| {
+        tracing::error!("cdn_delete: MinIO DELETE failed for key={}: {}", key, e);
+        StatusCode::BAD_GATEWAY
+    })?;
+    if !res.status().is_success() {
+        tracing::error!(
+            "cdn_delete: MinIO returned {} for key={}",
+            res.status(),
+            key
+        );
+        return Err(StatusCode::BAD_GATEWAY);
+    }
+
+    Ok(Json(serde_json::json!({ "deleted": true })))
+}
+
+/// Receive a multipart upload, PUT the file to MinIO, then register it in cdn_objects.
+/// Fields: `file` (required), `key` (optional — defaults to filename), `content_type`
+/// (optional — defaults to detected), `description` (optional).
+pub async fn cdn_upload(
+    State(state): State<AppState>,
+    mut multipart: Multipart,
+) -> Result<Json<CdnObject>, StatusCode> {
+    let mut file_bytes: Option<axum::body::Bytes> = None;
+    let mut filename: Option<String> = None;
+    let mut key_override: Option<String> = None;
+    let mut content_type_override: Option<String> = None;
+    let mut description: Option<String> = None;
+
+    while let Some(field) = multipart
+        .next_field()
+        .await
+        .map_err(|_| StatusCode::BAD_REQUEST)?
+    {
+        let field_name = field.name().unwrap_or("").to_string();
+        match field_name.as_str() {
+            "file" => {
+                filename = field.file_name().map(|s| s.to_string());
+                if content_type_override.is_none() {
+                    content_type_override = field.content_type().map(|s| s.to_string());
+                }
+                file_bytes = Some(field.bytes().await.map_err(|_| StatusCode::BAD_REQUEST)?);
+            }
+            "key" => {
+                let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
+                if !v.is_empty() {
+                    key_override = Some(v);
+                }
+            }
+            "content_type" => {
+                let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
+                if !v.is_empty() {
+                    content_type_override = Some(v);
+                }
+            }
+            "description" => {
+                let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
+                if !v.is_empty() {
+                    description = Some(v);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    let bytes = file_bytes.ok_or(StatusCode::BAD_REQUEST)?;
+    let key = key_override.or(filename).ok_or(StatusCode::BAD_REQUEST)?;
+    let ct = content_type_override.unwrap_or_else(|| "application/octet-stream".to_string());
+
+    // Upload to MinIO (bucket is anonymous-public, so no auth needed)
+    let upload_url = format!("{}/{}", state.cdn_base_url, key);
+    let res = state
+        .http_client
+        .put(&upload_url)
+        .header("Content-Type", &ct)
+        .body(bytes)
+        .send()
+        .await
+        .map_err(|e| {
+            tracing::error!("cdn_upload: MinIO PUT failed: {}", e);
+            StatusCode::BAD_GATEWAY
+        })?;
+
+    if !res.status().is_success() {
+        tracing::error!("cdn_upload: MinIO returned {}", res.status());
+        return Err(StatusCode::BAD_GATEWAY);
+    }
+
+    let obj = sqlx::query_as::<_, CdnObject>(
+        "INSERT INTO cdn_objects (key, content_type, description) \
+         VALUES ($1, $2, $3) \
+         ON CONFLICT (key) DO UPDATE \
+           SET content_type = EXCLUDED.content_type, \
+               description  = EXCLUDED.description \
+         RETURNING id, key, content_type, description, created_at",
+    )
+    .bind(&key)
+    .bind(&ct)
+    .bind(&description)
+    .fetch_one(&state.pool)
+    .await
+    .map_err(|e| {
+        tracing::error!("cdn_upload: DB insert failed: {}", e);
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+
+    Ok(Json(obj))
+}
diff --git a/src/routes/crud.rs b/src/routes/crud.rs
new file mode 100644
index 0000000..c44777f
--- /dev/null
+++ b/src/routes/crud.rs
@@ -0,0 +1,449 @@
+use anyhow::{anyhow, Result};
+use axum::{
+    extract::{Extension, Path, Query, State},
+    http::{Method, StatusCode},
+    Json,
+};
+use serde_json::Value;
+use sqlx::postgres::PgRow;
+use sqlx::Column;
+use sqlx::Row;
+use sqlx::TypeInfo;
+use std::collections::HashMap;
+
+use crate::{
+    auth::Claims,
+    models::blacklist::BlacklistEntry,
+    state::{AppState, CacheEntry},
+};
+
+/// Returns (sql, ordered_param_values, cache_key).
+/// body_cols: (col_name, typed_value) pairs from request body.
+/// filter_cols: (col_name, string_value) pairs from query params.
+fn coerce_id(id_val: &str) -> Value {
+    if let Ok(n) = id_val.parse::<i64>() {
+        Value::Number(n.into())
+    } else {
+        Value::String(id_val.to_string())
+    }
+}
+
+pub fn build_query(
+    method: &str,
+    table: &str,
+    id: Option<&str>,
+    body_cols: &[(String, Value)],
+    filter_cols: &[(String, String)],
+) -> Result<(String, Vec<Value>, String)> {
+    if !crate::routes::is_valid_identifier(table) {
+        return Err(anyhow!("invalid identifier: {}", table));
+    }
+    for (col, _) in body_cols.iter() {
+        if !crate::routes::is_valid_identifier(col) {
+            return Err(anyhow!("invalid identifier: {}", col));
+        }
+    }
+    for (col, _) in filter_cols.iter() {
+        if !crate::routes::is_valid_identifier(col) {
+            return Err(anyhow!("invalid identifier: {}", col));
+        }
+    }
+
+    let mut sorted_body = body_cols.to_vec();
+    sorted_body.sort_by(|a, b| a.0.cmp(&b.0));
+    let mut sorted_filters = filter_cols.to_vec();
+    sorted_filters.sort_by(|a, b| a.0.cmp(&b.0));
+
+    match method.to_uppercase().as_str() {
+        "GET" => {
+            if let Some(id_val) = id {
+                let sql = format!("SELECT * FROM {} WHERE id = $1", table);
+                let key = format!("GET:{}:~id", table);
+                Ok((sql, vec![coerce_id(id_val)], key))
+            } else if sorted_filters.is_empty() {
+                let sql = format!("SELECT * FROM {}", table);
+                let key = format!("GET:{}:", table);
+                Ok((sql, vec![], key))
+            } else {
+                let col_names: Vec<String> =
+                    sorted_filters.iter().map(|(c, _)| c.clone()).collect();
+                let where_clause: Vec<String> = col_names
+                    .iter()
+                    .enumerate()
+                    .map(|(i, c)| format!("{} = ${}", c, i + 1))
+                    .collect();
+                let sql = format!(
+                    "SELECT * FROM {} WHERE {}",
+                    table,
+                    where_clause.join(" AND ")
+                );
+                let params: Vec<Value> = sorted_filters
+                    .iter()
+                    .map(|(_, v)| Value::String(v.clone()))
+                    .collect();
+                let key = format!("GET:{}:{}", table, col_names.join(","));
+                Ok((sql, params, key))
+            }
+        }
+        "POST" => {
+            if sorted_body.is_empty() {
+                return Err(anyhow!("POST requires a body with at least one field"));
+            }
+            let cols: Vec<String> = sorted_body.iter().map(|(c, _)| c.clone()).collect();
+            let placeholders: Vec<String> = (1..=cols.len()).map(|i| format!("${}", i)).collect();
+            let sql = format!(
+                "INSERT INTO {} ({}) VALUES ({}) RETURNING *",
+                table,
+                cols.join(", "),
+                placeholders.join(", ")
+            );
+            let params: Vec<Value> = sorted_body.iter().map(|(_, v)| v.clone()).collect();
+            let key = format!("POST:{}:{}", table, cols.join(","));
+            Ok((sql, params, key))
+        }
+        "PUT" => {
+            let id_val = id.ok_or_else(|| anyhow!("PUT requires an id"))?;
+            if sorted_body.is_empty() {
+                return Err(anyhow!("PUT requires a body with at least one field"));
+            }
+            let cols: Vec<String> = sorted_body.iter().map(|(c, _)| c.clone()).collect();
+            let set_clause: Vec<String> = cols
+                .iter()
+                .enumerate()
+                .map(|(i, c)| format!("{} = ${}", c, i + 1))
+                .collect();
+            let id_placeholder = cols.len() + 1;
+            let sql = format!(
+                "UPDATE {} SET {} WHERE id = ${} RETURNING *",
+                table,
+                set_clause.join(", "),
+                id_placeholder
+            );
+            let mut params: Vec<Value> = sorted_body.iter().map(|(_, v)| v.clone()).collect();
+            params.push(coerce_id(id_val));
+            let key = format!("PUT:{}:{}:by_id", table, cols.join(","));
+            Ok((sql, params, key))
+        }
+        "DELETE" => {
+            let id_val = id.ok_or_else(|| anyhow!("DELETE requires an id"))?;
+            let sql = format!("DELETE FROM {} WHERE id = $1", table);
+            let key = format!("DELETE:{}:by_id", table);
+            Ok((sql, vec![coerce_id(id_val)], key))
+        }
+        m => Err(anyhow!("unsupported method: {}", m)),
+    }
+}
+
+pub fn pg_row_to_json(row: PgRow) -> Value {
+    let columns = row.columns();
+    let mut map = serde_json::Map::new();
+    for col in columns {
+        let name = col.name().to_string();
+        let type_name = col.type_info().name();
+        let val = match type_name {
+            "INT2" => row
+                .try_get::<i16, _>(col.ordinal())
+                .map(|v| Value::Number(i64::from(v).into()))
+                .unwrap_or(Value::Null),
+            "INT4" | "SERIAL" => row
+                .try_get::<i32, _>(col.ordinal())
+                .map(|v| Value::Number(i64::from(v).into()))
+                .unwrap_or(Value::Null),
+            "INT8" => row
+                .try_get::<i64, _>(col.ordinal())
+                .map(|v| Value::Number(v.into()))
+                .unwrap_or(Value::Null),
+            "FLOAT4" | "FLOAT8" => row
+                .try_get::<f64, _>(col.ordinal())
+                .ok()
+                .and_then(serde_json::Number::from_f64)
+                .map(Value::Number)
+                .unwrap_or(Value::Null),
+            "BOOL" => row
+                .try_get::<bool, _>(col.ordinal())
+                .map(Value::Bool)
+                .unwrap_or(Value::Null),
+            "UUID" => row
+                .try_get::<uuid::Uuid, _>(col.ordinal())
+                .map(|v| Value::String(v.to_string()))
+                .unwrap_or(Value::Null),
+            "TIMESTAMPTZ" | "TIMESTAMP" => row
+                .try_get::<chrono::DateTime<chrono::Utc>, _>(col.ordinal())
+                .map(|v| Value::String(v.to_rfc3339()))
+                .unwrap_or(Value::Null),
+            _ => row
+                .try_get::<String, _>(col.ordinal())
+                .map(Value::String)
+                .unwrap_or(Value::Null),
+        };
+        map.insert(name, val);
+    }
+    Value::Object(map)
+}
+
+async fn reload_blacklist(state: &AppState) -> Result<(), StatusCode> {
+    let entries = sqlx::query_as::<_, BlacklistEntry>(
+        "SELECT id, pattern, method, reason, active, bypass_mask, created_at FROM blacklist ORDER BY id",
+    )
+    .fetch_all(&state.pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    state.blacklist_cache.load(entries).await;
+    Ok(())
+}
+
+async fn reload_cors(state: &AppState) -> Result<(), StatusCode> {
+    let origins: Vec<String> =
+        sqlx::query_scalar::<_, String>("SELECT origin FROM cors_origins ORDER BY id")
+            .fetch_all(&state.pool)
+            .await
+            .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    state.cors_cache.load(origins).await;
+    Ok(())
+}
+
+fn strip_password_hash(v: Value) -> Value {
+    match v {
+        Value::Object(mut m) => {
+            m.remove("password_hash");
+            Value::Object(m)
+        }
+        Value::Array(arr) => Value::Array(
+            arr.into_iter()
+                .map(|item| match item {
+                    Value::Object(mut m) => {
+                        m.remove("password_hash");
+                        Value::Object(m)
+                    }
+                    other => other,
+                })
+                .collect(),
+        ),
+        other => other,
+    }
+}
+
+pub async fn handle_crud(
+    State(state): State<AppState>,
+    method: Method,
+    Extension(claims): Extension<Claims>,
+    Path(params): Path<HashMap<String, String>>,
+    Query(query_params): Query<HashMap<String, String>>,
+    body: Option<Json<HashMap<String, Value>>>,
+) -> Result<Json<Value>, StatusCode> {
+    let table = params.get("table").ok_or(StatusCode::BAD_REQUEST)?.clone();
+    let id = params.get("id").map(|s| s.as_str());
+    let method_str = method.as_str();
+
+    // Enforce permission bits before doing any work.
+    let required_bit = match method_str.to_uppercase().as_str() {
+        "GET" => crate::auth::permissions::READ,
+        "POST" | "PUT" => crate::auth::permissions::WRITE,
+        "DELETE" => crate::auth::permissions::DELETE,
+        _ => return Err(StatusCode::METHOD_NOT_ALLOWED),
+    };
+    if !claims.has_permission(required_bit) {
+        return Err(StatusCode::FORBIDDEN);
+    }
+
+    // Collect body as typed Values directly — no sentinel needed.
+    let mut body_cols: Vec<(String, Value)> = body
+        .map(|Json(b)| b.into_iter().collect())
+        .unwrap_or_default();
+
+    // Hash the password field for the users table before building the query.
+    if table == "users" && matches!(method_str.to_uppercase().as_str(), "POST" | "PUT") {
+        if let Some(pos) = body_cols.iter().position(|(k, _)| k == "password") {
+            let (_, val) = body_cols.remove(pos);
+            if let Value::String(plaintext) = val {
+                let hash = bcrypt::hash(&plaintext, bcrypt::DEFAULT_COST)
+                    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+                body_cols.push(("password_hash".to_string(), Value::String(hash)));
+            }
+        }
+    }
+
+    let filter_cols: Vec<(String, String)> = query_params.into_iter().collect();
+
+    let (sql, params_vals, cache_key) =
+        build_query(method_str, &table, id, &body_cols, &filter_cols)
+            .map_err(|_| StatusCode::BAD_REQUEST)?;
+
+    let sql = if let Some(entry) = state.query_cache.get(&cache_key) {
+        entry.sql.clone()
+    } else {
+        let entry = CacheEntry::new(sql.clone());
+        state
+            .query_cache
+            .insert(cache_key, entry.clone(), state.config.cache_max_capacity);
+        entry.sql
+    };
+
+    let mut q = sqlx::query(&sql);
+    for val in &params_vals {
+        match val {
+            Value::Null => q = q.bind(Option::<String>::None),
+            Value::Bool(b) => q = q.bind(*b),
+            Value::Number(n) => {
+                if let Some(i) = n.as_i64() {
+                    q = q.bind(i);
+                } else if let Some(f) = n.as_f64() {
+                    q = q.bind(f);
+                } else {
+                    q = q.bind(n.to_string());
+                }
+            }
+            Value::String(s) => q = q.bind(s.as_str()),
+            other => q = q.bind(other.to_string()),
+        }
+    }
+
+    let response = match method_str.to_uppercase().as_str() {
+        "GET" => {
+            let rows = q.fetch_all(&state.pool).await.map_err(|e| {
+                tracing::error!("GET {}: {}", table, e);
+                StatusCode::INTERNAL_SERVER_ERROR
+            })?;
+            let mut v = Value::Array(rows.into_iter().map(pg_row_to_json).collect());
+            if table == "users" {
+                v = strip_password_hash(v);
+            }
+            v
+        }
+        "POST" | "PUT" => {
+            let row = q.fetch_one(&state.pool).await.map_err(|e| {
+                if matches!(e, sqlx::Error::RowNotFound) {
+                    StatusCode::NOT_FOUND
+                } else {
+                    tracing::error!("{} {}: {}", method_str, table, e);
+                    StatusCode::INTERNAL_SERVER_ERROR
+                }
+            })?;
+            let mut v = pg_row_to_json(row);
+            if table == "users" {
+                v = strip_password_hash(v);
+            }
+            v
+        }
+        "DELETE" => {
+            let rows_affected = q
+                .execute(&state.pool)
+                .await
+                .map_err(|e| {
+                    tracing::error!("DELETE {}: {}", table, e);
+                    StatusCode::INTERNAL_SERVER_ERROR
+                })?
+                .rows_affected();
+            if rows_affected == 0 {
+                return Err(StatusCode::NOT_FOUND);
+            }
+            serde_json::json!({ "deleted": true })
+        }
+        _ => return Err(StatusCode::METHOD_NOT_ALLOWED),
+    };
+
+    // Reload in-memory caches after mutations to their backing tables.
+    if table == "blacklist" && method_str != "GET" {
+        reload_blacklist(&state).await?;
+    }
+    if table == "cors_origins" && method_str != "GET" {
+        reload_cors(&state).await?;
+    }
+
+    Ok(Json(response))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_build_select_all() {
+        let (sql, params, key) = build_query("GET", "orders", None, &[], &[]).unwrap();
+        assert_eq!(sql, "SELECT * FROM orders");
+        assert!(params.is_empty());
+        assert_eq!(key, "GET:orders:");
+    }
+
+    #[test]
+    fn test_build_select_by_id() {
+        let (sql, params, key) = build_query("GET", "orders", Some("42"), &[], &[]).unwrap();
+        assert_eq!(sql, "SELECT * FROM orders WHERE id = $1");
+        assert_eq!(params, vec![Value::Number(42.into())]);
+        assert_eq!(key, "GET:orders:~id");
+    }
+
+    #[test]
+    fn test_build_insert() {
+        let cols = vec![
+            ("email".into(), Value::String("a@b.com".into())),
+            ("name".into(), Value::String("Alice".into())),
+        ];
+        let (sql, params, key) = build_query("POST", "users", None, &cols, &[]).unwrap();
+        assert_eq!(
+            sql,
+            "INSERT INTO users (email, name) VALUES ($1, $2) RETURNING *"
+        );
+        assert_eq!(
+            params,
+            vec![
+                Value::String("a@b.com".into()),
+                Value::String("Alice".into())
+            ]
+        );
+        assert_eq!(key, "POST:users:email,name");
+    }
+
+    #[test]
+    fn test_build_update() {
+        let cols = vec![("name".into(), Value::String("Bob".into()))];
+        let (sql, params, key) = build_query("PUT", "users", Some("7"), &cols, &[]).unwrap();
+        assert_eq!(sql, "UPDATE users SET name = $1 WHERE id = $2 RETURNING *");
+        assert_eq!(
+            params,
+            vec![Value::String("Bob".into()), Value::Number(7.into())]
+        );
+        assert_eq!(key, "PUT:users:name:by_id");
+    }
+
+    #[test]
+    fn test_build_delete() {
+        let (sql, params, key) = build_query("DELETE", "users", Some("3"), &[], &[]).unwrap();
+        assert_eq!(sql, "DELETE FROM users WHERE id = $1");
+        assert_eq!(params, vec![Value::Number(3.into())]);
+        assert_eq!(key, "DELETE:users:by_id");
+    }
+
+    #[test]
+    fn test_build_select_with_filters() {
+        let filters = vec![
+            ("status".into(), "active".into()),
+            ("role".into(), "admin".into()),
+        ];
+        let (sql, params, key) = build_query("GET", "users", None, &[], &filters).unwrap();
+        assert_eq!(sql, "SELECT * FROM users WHERE role = $1 AND status = $2");
+        assert_eq!(
+            params,
+            vec![
+                Value::String("admin".into()),
+                Value::String("active".into())
+            ]
+        );
+        assert_eq!(key, "GET:users:role,status");
+    }
+
+    #[test]
+    fn test_build_null_body_value() {
+        let cols = vec![("note".into(), Value::Null)];
+        let (sql, params, key) = build_query("POST", "items", None, &cols, &[]).unwrap();
+        assert_eq!(sql, "INSERT INTO items (note) VALUES ($1) RETURNING *");
+        assert_eq!(params, vec![Value::Null]);
+        assert_eq!(key, "POST:items:note");
+    }
+
+    #[test]
+    fn test_rejects_invalid_table_name() {
+        let result = build_query("GET", "users; DROP TABLE users--", None, &[], &[]);
+        assert!(result.is_err());
+    }
+}
diff --git a/src/routes/mod.rs b/src/routes/mod.rs
new file mode 100644
index 0000000..f9ec927
--- /dev/null
+++ b/src/routes/mod.rs
@@ -0,0 +1,8 @@
+pub mod admin;
+pub mod auth;
+pub mod cdn;
+pub mod crud;
+
+pub fn is_valid_identifier(name: &str) -> bool {
+    !name.is_empty() && name.chars().all(|c| c.is_alphanumeric() || c == '_')
+}
diff --git a/src/state.rs b/src/state.rs
new file mode 100644
index 0000000..484da65
--- /dev/null
+++ b/src/state.rs
@@ -0,0 +1,330 @@
+use std::sync::{
+    atomic::{AtomicU64, Ordering},
+    Arc,
+};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use axum::http::HeaderValue;
+use dashmap::DashMap;
+use glob::Pattern;
+use sqlx::PgPool;
+use tokio::sync::RwLock;
+
+use crate::config::Config;
+use crate::models::blacklist::BlacklistEntry;
+
+pub fn unix_now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+
+#[derive(Clone)]
+pub struct AppState {
+    pub pool: PgPool,
+    pub query_cache: QueryCache,
+    pub blacklist_cache: BlacklistCache,
+    pub cors_cache: CorsCache,
+    pub http_client: reqwest::Client,
+    pub cdn_base_url: String,
+    pub config: Arc<Config>,
+}
+
+#[derive(Clone)]
+pub struct QueryCache {
+    pub map: Arc<DashMap<String, CacheEntry>>,
+    pub hits: Arc<AtomicU64>,
+    pub misses: Arc<AtomicU64>,
+}
+
+#[derive(Clone, Debug)]
+pub struct CacheEntry {
+    pub sql: String,
+    pub last_accessed_secs: Arc<AtomicU64>,
+}
+
+impl CacheEntry {
+    pub fn new(sql: String) -> Self {
+        Self {
+            sql,
+            last_accessed_secs: Arc::new(AtomicU64::new(unix_now())),
+        }
+    }
+
+    pub fn touch(&self) {
+        self.last_accessed_secs.store(unix_now(), Ordering::Relaxed);
+    }
+
+    pub fn last_accessed(&self) -> u64 {
+        self.last_accessed_secs.load(Ordering::Relaxed)
+    }
+}
+
+impl QueryCache {
+    pub fn new() -> Self {
+        Self {
+            map: Arc::new(DashMap::new()),
+            hits: Arc::new(AtomicU64::new(0)),
+            misses: Arc::new(AtomicU64::new(0)),
+        }
+    }
+
+    pub fn get(&self, key: &str) -> Option<CacheEntry> {
+        if let Some(entry) = self.map.get(key) {
+            entry.touch();
+            self.hits.fetch_add(1, Ordering::Relaxed);
+            Some(entry.clone())
+        } else {
+            self.misses.fetch_add(1, Ordering::Relaxed);
+            None
+        }
+    }
+
+    pub fn insert(&self, key: String, entry: CacheEntry, max_capacity: usize) {
+        if self.map.len() >= max_capacity {
+            let oldest_key = self
+                .map
+                .iter()
+                .min_by_key(|e| e.last_accessed())
+                .map(|e| e.key().clone());
+            if let Some(k) = oldest_key {
+                self.map.remove(&k);
+            }
+        }
+        self.map.insert(key, entry);
+    }
+
+    #[allow(dead_code)]
+    pub fn remove(&self, key: &str) {
+        self.map.remove(key);
+    }
+
+    pub fn hits(&self) -> u64 {
+        self.hits.load(Ordering::Relaxed)
+    }
+
+    pub fn misses(&self) -> u64 {
+        self.misses.load(Ordering::Relaxed)
+    }
+
+    pub fn len(&self) -> usize {
+        self.map.len()
+    }
+
+    pub fn flush(&self) {
+        self.map.clear();
+    }
+}
+
+#[derive(Clone)]
+pub struct BlacklistCache {
+    pub inner: Arc<RwLock<Vec<CompiledEntry>>>,
+}
+
+#[derive(Clone)]
+pub struct CompiledEntry {
+    pub entry: BlacklistEntry,
+    pub pattern: Pattern,
+    pub bypass_mask: Option<u128>,
+}
+
+impl BlacklistCache {
+    pub fn new() -> Self {
+        Self {
+            inner: Arc::new(RwLock::new(Vec::new())),
+        }
+    }
+
+    pub async fn load(&self, entries: Vec<BlacklistEntry>) {
+        let compiled: Vec<CompiledEntry> = entries
+            .into_iter()
+            .filter_map(|e| {
+                let bypass_mask = e
+                    .bypass_mask
+                    .as_deref()
+                    .and_then(|s| s.parse::<u128>().ok());
+                Pattern::new(&e.pattern).ok().map(|pattern| CompiledEntry {
+                    entry: e,
+                    pattern,
+                    bypass_mask,
+                })
+            })
+            .collect();
+        let mut guard = self.inner.write().await;
+        *guard = compiled;
+    }
+
+    /// Returns true if the request should be blocked.
+    /// `caller_mask` is 0 for unauthenticated requests; bypass only applies
+    /// when the caller holds the permission bit stored in bypass_mask.
+    pub async fn is_blocked(&self, method: &str, path: &str, caller_mask: u128) -> bool {
+        let path = path.trim_end_matches('/');
+        let path = if path.is_empty() { "/" } else { path };
+        let guard = self.inner.read().await;
+        guard.iter().any(|compiled| {
+            if !compiled.entry.active {
+                return false;
+            }
+            let method_matches = compiled
+                .entry
+                .method
+                .as_deref()
+                .map(|m| {
+                    m.split(',')
+                        .any(|part| part.trim().eq_ignore_ascii_case(method))
+                })
+                .unwrap_or(true);
+            if !method_matches || !compiled.pattern.matches(path) {
+                return false;
+            }
+            // If caller holds the bypass permission, they are not blocked.
+            !matches!(compiled.bypass_mask, Some(mask) if caller_mask & mask != 0)
+        })
+    }
+}
+
+#[derive(Clone)]
+pub struct CorsCache {
+    pub inner: Arc<RwLock<CorsState>>,
+}
+
+#[derive(Clone, Default)]
+pub struct CorsState {
+    pub wildcard: bool,
+    pub origins: Vec<HeaderValue>,
+}
+
+impl CorsCache {
+    pub fn new() -> Self {
+        Self {
+            inner: Arc::new(RwLock::new(CorsState::default())),
+        }
+    }
+
+    pub async fn load(&self, origins: Vec<String>) {
+        let wildcard = origins.iter().any(|o| o == "*");
+        let parsed: Vec<HeaderValue> = origins
+            .iter()
+            .filter(|o| *o != "*")
+            .filter_map(|o| o.parse().ok())
+            .collect();
+        let mut guard = self.inner.write().await;
+        *guard = CorsState {
+            wildcard,
+            origins: parsed,
+        };
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_cache_insert_and_get() {
+        let cache = QueryCache::new();
+        let entry = CacheEntry::new("SELECT 1".into());
+        cache.insert("key1".into(), entry, 100);
+        let got = cache.get("key1");
+        assert!(got.is_some());
+        assert_eq!(got.unwrap().sql, "SELECT 1");
+        assert_eq!(cache.hits(), 1);
+        assert_eq!(cache.misses(), 0);
+    }
+
+    #[test]
+    fn test_cache_miss() {
+        let cache = QueryCache::new();
+        let got = cache.get("missing");
+        assert!(got.is_none());
+        assert_eq!(cache.misses(), 1);
+    }
+
+    #[test]
+    fn test_cache_capacity_evicts_oldest() {
+        let cache = QueryCache::new();
+        let e1 = CacheEntry::new("SELECT 1".into());
+        // force e1 to be older
+        e1.last_accessed_secs.store(1, Ordering::Relaxed);
+        cache.map.insert("old".into(), e1);
+        let e2 = CacheEntry::new("SELECT 2".into());
+        cache.insert("new".into(), e2, 1); // capacity=1, should evict "old"
+        assert!(cache.map.get("old").is_none());
+        assert!(cache.map.get("new").is_some());
+    }
+
+    #[tokio::test]
+    async fn test_blacklist_blocks_pattern() {
+        use chrono::Utc;
+        let cache = BlacklistCache::new();
+        let entry = BlacklistEntry {
+            id: 1,
+            pattern: "/api/users/**".into(),
+            method: None,
+            reason: None,
+            active: true,
+            bypass_mask: None,
+            created_at: Utc::now(),
+        };
+        cache.load(vec![entry]).await;
+        assert!(cache.is_blocked("GET", "/api/users/42", 0).await);
+        assert!(!cache.is_blocked("GET", "/api/orders/1", 0).await);
+    }
+
+    #[tokio::test]
+    async fn test_blacklist_method_specific() {
+        use chrono::Utc;
+        let cache = BlacklistCache::new();
+        let entry = BlacklistEntry {
+            id: 2,
+            pattern: "/api/secrets".into(),
+            method: Some("GET".into()),
+            reason: None,
+            active: true,
+            bypass_mask: None,
+            created_at: Utc::now(),
+        };
+        cache.load(vec![entry]).await;
+        assert!(cache.is_blocked("GET", "/api/secrets", 0).await);
+        assert!(!cache.is_blocked("POST", "/api/secrets", 0).await);
+    }
+
+    #[tokio::test]
+    async fn test_cors_cache_wildcard() {
+        let cache = CorsCache::new();
+        cache.load(vec!["*".to_string()]).await;
+        let guard = cache.inner.read().await;
+        assert!(guard.wildcard);
+        assert!(guard.origins.is_empty());
+    }
+
+    #[tokio::test]
+    async fn test_cors_cache_specific_origin() {
+        let cache = CorsCache::new();
+        cache.load(vec!["https://example.com".to_string()]).await;
+        let guard = cache.inner.read().await;
+        assert!(!guard.wildcard);
+        assert_eq!(guard.origins.len(), 1);
+        assert_eq!(guard.origins[0], "https://example.com");
+    }
+
+    #[tokio::test]
+    async fn test_cors_cache_empty() {
+        let cache = CorsCache::new();
+        cache.load(vec![]).await;
+        let guard = cache.inner.read().await;
+        assert!(!guard.wildcard);
+        assert!(guard.origins.is_empty());
+    }
+
+    #[tokio::test]
+    async fn test_cors_cache_load_replaces() {
+        let cache = CorsCache::new();
+        cache.load(vec!["https://a.com".to_string()]).await;
+        cache.load(vec!["https://b.com".to_string()]).await;
+        let guard = cache.inner.read().await;
+        assert_eq!(guard.origins.len(), 1);
+        assert_eq!(guard.origins[0], "https://b.com");
+    }
+}
diff --git a/ui/.gitignore b/ui/.gitignore
new file mode 100644
index 0000000..27420d2
--- /dev/null
+++ b/ui/.gitignore
@@ -0,0 +1,11 @@
+node_modules/
+dist/
+.npmrc
+
+# vue-tsc emit artifacts (should never appear in src/ — noEmit is set)
+src/**/*.vue.js
+src/**/*.vue.js.map
+src/**/*.vue.d.ts
+src/**/*.vue.d.ts.map
+src/**/*.ts.js
+src/**/*.ts.js.map
diff --git a/ui/bun.lock b/ui/bun.lock
new file mode 100644
index 0000000..8b30307
--- /dev/null
+++ b/ui/bun.lock
@@ -0,0 +1,1162 @@
+{
+  "lockfileVersion": 1,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "mercury-ui",
+      "dependencies": {
+        "@nychthemeron/library": "^0.0.3",
+        "pinia": "^2.3.1",
+        "vue": "^3.5.40",
+        "vue-router": "^4.6.4",
+      },
+      "devDependencies": {
+        "@tailwindcss/vite": "^4.3.3",
+        "@vitejs/plugin-vue": "^5.2.4",
+        "tailwindcss": "^4.3.3",
+        "typescript": "^5.9.3",
+        "vite": "^5.4.21",
+        "vue-tsc": "^2.2.12",
+      },
+    },
+  },
+  "packages": {
+    "@babel/code-frame": ["@babel/code-frame@7.29.7", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.29.7", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw=="],
+
+    "@babel/compat-data": ["@babel/compat-data@7.29.7", "", {}, "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg=="],
+
+    "@babel/core": ["@babel/core@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.7", "@babel/helper-compilation-targets": "^7.29.7", "@babel/helper-module-transforms": "^7.29.7", "@babel/helpers": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/template": "^7.29.7", "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA=="],
+
+    "@babel/generator": ["@babel/generator@7.29.7", "", { "dependencies": { "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ=="],
+
+    "@babel/helper-annotate-as-pure": ["@babel/helper-annotate-as-pure@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" } }, "sha512-OoK6239jHPuSQOoS0kfTVKn0b/rVTk0seKq4Gd2UMLtmOVLjDC0ki3e+c90Trqv2gMfvJFqkiljrr568+qddiw=="],
+
+    "@babel/helper-compilation-targets": ["@babel/helper-compilation-targets@7.29.7", "", { "dependencies": { "@babel/compat-data": "^7.29.7", "@babel/helper-validator-option": "^7.29.7", "browserslist": "^4.24.0", "lru-cache": "^5.1.1", "semver": "^6.3.1" } }, "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g=="],
+
+    "@babel/helper-create-class-features-plugin": ["@babel/helper-create-class-features-plugin@7.29.7", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.29.7", "@babel/helper-member-expression-to-functions": "^7.29.7", "@babel/helper-optimise-call-expression": "^7.29.7", "@babel/helper-replace-supers": "^7.29.7", "@babel/helper-skip-transparent-expression-wrappers": "^7.29.7", "@babel/traverse": "^7.29.7", "semver": "^6.3.1" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-IY3ZD9Tmooqr3TUhc3DUWxiuo8xx1DWLhd5M7hQ+ZWJamqM2BbalrBJb2MisSLoYorOj75U03qULCxQTY9r3hg=="],
+
+    "@babel/helper-globals": ["@babel/helper-globals@7.29.7", "", {}, "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA=="],
+
+    "@babel/helper-member-expression-to-functions": ["@babel/helper-member-expression-to-functions@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-j+7JYmk1JYDtACIGj0QJqqWZjoUpMoEikQGADMaHgCMCSDqd2+P32rfcibUNrGOMWrlzK1WJBdxrB3JJQZwWtg=="],
+
+    "@babel/helper-module-imports": ["@babel/helper-module-imports@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g=="],
+
+    "@babel/helper-module-transforms": ["@babel/helper-module-transforms@7.29.7", "", { "dependencies": { "@babel/helper-module-imports": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg=="],
+
+    "@babel/helper-optimise-call-expression": ["@babel/helper-optimise-call-expression@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" } }, "sha512-+kmGVjcT9RGYzoDwdwEqEvGgKe3BYq+O1iGzjFubaNgZHwYHP6lsF2Yghf4kEuv9BV7tYDZ913aBW9am6YKong=="],
+
+    "@babel/helper-plugin-utils": ["@babel/helper-plugin-utils@7.29.7", "", {}, "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw=="],
+
+    "@babel/helper-replace-supers": ["@babel/helper-replace-supers@7.29.7", "", { "dependencies": { "@babel/helper-member-expression-to-functions": "^7.29.7", "@babel/helper-optimise-call-expression": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-atfGXWSeCiF4DnKZIfmJfQRkSw9b9gNNXR1kqKjbhG4pGYCOnkp8OcTB8E3NXjBu8NpheSnOeNKz8KT7UNFTmQ=="],
+
+    "@babel/helper-skip-transparent-expression-wrappers": ["@babel/helper-skip-transparent-expression-wrappers@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-brcMGQaVzIeUb+6/bs1Av0f8YuNNjKY2JyvfRCsFuFsdKccEQ5Ges2y74D74NZ1Rz8lKJ9ksJkfqwQFJ/iNEyQ=="],
+
+    "@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/helper-validator-option": ["@babel/helper-validator-option@7.29.7", "", {}, "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw=="],
+
+    "@babel/helpers": ["@babel/helpers@7.29.7", "", { "dependencies": { "@babel/template": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg=="],
+
+    "@babel/parser": ["@babel/parser@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" }, "bin": "./bin/babel-parser.js" }, "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg=="],
+
+    "@babel/plugin-syntax-jsx": ["@babel/plugin-syntax-jsx@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-TSu8+mHCoEaaCDEZ0I3+6mvTBYR4PCxQwf2z9/r5Tbztv6NaLR3B9thGTTxX2WGuGHJqRiAbKPeGTJ5XWXVg6A=="],
+
+    "@babel/plugin-syntax-typescript": ["@babel/plugin-syntax-typescript@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-ngr+82Sh0xMz25TPCZi+nC2iTzjfCdWS2ONXTp/PtSCHCgaCNBpdMqgvJ2ccdLlClVZ7sisIgB914j/JFe+RZA=="],
+
+    "@babel/plugin-transform-modules-commonjs": ["@babel/plugin-transform-modules-commonjs@7.29.7", "", { "dependencies": { "@babel/helper-module-transforms": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-j0vCldybPC5b5dwCQOJ21uKtHzt7hxLygJTg9eF1ScfaikEDNfzn94XoW5Fi+seBR0nCyL23xaBFFkq7dTM8XQ=="],
+
+    "@babel/plugin-transform-typescript": ["@babel/plugin-transform-typescript@7.29.7", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.29.7", "@babel/helper-create-class-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-skip-transparent-expression-wrappers": "^7.29.7", "@babel/plugin-syntax-typescript": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-jK52h8LaLc7JarhQV2ofeFMts4H7vnOXnqZNA6fYglBTZewRBE51KWt3BUltW1P+KoPsYkHoJeXePuz4zo2LMw=="],
+
+    "@babel/preset-typescript": ["@babel/preset-typescript@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-validator-option": "^7.29.7", "@babel/plugin-syntax-jsx": "^7.29.7", "@babel/plugin-transform-modules-commonjs": "^7.29.7", "@babel/plugin-transform-typescript": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-/Foi8vKY2EVbed/1eZx0gJEEwHAIxogrySI7rULcRIvhZzbvoE/b5qG5Ghc0WKAFKOHA9SD1x7RsFlOYdutIiQ=="],
+
+    "@babel/template": ["@babel/template@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg=="],
+
+    "@babel/traverse": ["@babel/traverse@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.7", "@babel/helper-globals": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/template": "^7.29.7", "@babel/types": "^7.29.7", "debug": "^4.3.1" } }, "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw=="],
+
+    "@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+
+    "@dotenvx/dotenvx": ["@dotenvx/dotenvx@2.11.1", "", { "dependencies": { "@dotenvx/primitives": "^1.8.1", "@dotenvx/tooling": "^1.0.2", "yocto-spinner": "^1.2.1" }, "bin": { "dotenvx": "src/cli/dotenvx.js" } }, "sha512-9GjzU+kiJnQitTghYkq5tQVBm+R2Oi8GglSZ9Te4OTJMAP7aTLe9zVtPEYCzSsGMM3/VjMoJbp7WhMo3WD5GqA=="],
+
+    "@dotenvx/primitives": ["@dotenvx/primitives@1.8.1", "", {}, "sha512-xcEkhZDDA9E/ElU27Ft6ZaBBZN4EkXDmD0H4kZB7CcEMfQr43P6RMb7AMU6xYvqLyg2zT8rb0lEuaE8gUlUEiw=="],
+
+    "@dotenvx/tooling": ["@dotenvx/tooling@1.0.2", "", {}, "sha512-yf4VwIZUzSqlLy2pe0kH2xk6dME73oYW5XqcHE7M1zA1H0RX/dSUThsSRmpCjp622iW9f6VGQl5Aa6szt5Xc0w=="],
+
+    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.21.5", "", { "os": "aix", "cpu": "ppc64" }, "sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ=="],
+
+    "@esbuild/android-arm": ["@esbuild/android-arm@0.21.5", "", { "os": "android", "cpu": "arm" }, "sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg=="],
+
+    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.21.5", "", { "os": "android", "cpu": "arm64" }, "sha512-c0uX9VAUBQ7dTDCjq+wdyGLowMdtR/GoC2U5IYk/7D1H1JYC0qseD7+11iMP2mRLN9RcCMRcjC4YMclCzGwS/A=="],
+
+    "@esbuild/android-x64": ["@esbuild/android-x64@0.21.5", "", { "os": "android", "cpu": "x64" }, "sha512-D7aPRUUNHRBwHxzxRvp856rjUHRFW1SdQATKXH2hqA0kAZb1hKmi02OpYRacl0TxIGz/ZmXWlbZgjwWYaCakTA=="],
+
+    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.21.5", "", { "os": "darwin", "cpu": "arm64" }, "sha512-DwqXqZyuk5AiWWf3UfLiRDJ5EDd49zg6O9wclZ7kUMv2WRFr4HKjXp/5t8JZ11QbQfUS6/cRCKGwYhtNAY88kQ=="],
+
+    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.21.5", "", { "os": "darwin", "cpu": "x64" }, "sha512-se/JjF8NlmKVG4kNIuyWMV/22ZaerB+qaSi5MdrXtd6R08kvs2qCN4C09miupktDitvh8jRFflwGFBQcxZRjbw=="],
+
+    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.21.5", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-5JcRxxRDUJLX8JXp/wcBCy3pENnCgBR9bN6JsY4OmhfUtIHe3ZW0mawA7+RDAcMLrMIZaf03NlQiX9DGyB8h4g=="],
+
+    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.21.5", "", { "os": "freebsd", "cpu": "x64" }, "sha512-J95kNBj1zkbMXtHVH29bBriQygMXqoVQOQYA+ISs0/2l3T9/kj42ow2mpqerRBxDJnmkUDCaQT/dfNXWX/ZZCQ=="],
+
+    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.21.5", "", { "os": "linux", "cpu": "arm" }, "sha512-bPb5AHZtbeNGjCKVZ9UGqGwo8EUu4cLq68E95A53KlxAPRmUyYv2D6F0uUI65XisGOL1hBP5mTronbgo+0bFcA=="],
+
+    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.21.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-ibKvmyYzKsBeX8d8I7MH/TMfWDXBF3db4qM6sy+7re0YXya+K1cem3on9XgdT2EQGMu4hQyZhan7TeQ8XkGp4Q=="],
+
+    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.21.5", "", { "os": "linux", "cpu": "ia32" }, "sha512-YvjXDqLRqPDl2dvRODYmmhz4rPeVKYvppfGYKSNGdyZkA01046pLWyRKKI3ax8fbJoK5QbxblURkwK/MWY18Tg=="],
+
+    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.21.5", "", { "os": "linux", "cpu": "none" }, "sha512-uHf1BmMG8qEvzdrzAqg2SIG/02+4/DHB6a9Kbya0XDvwDEKCoC8ZRWI5JJvNdUjtciBGFQ5PuBlpEOXQj+JQSg=="],
+
+    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.21.5", "", { "os": "linux", "cpu": "none" }, "sha512-IajOmO+KJK23bj52dFSNCMsz1QP1DqM6cwLUv3W1QwyxkyIWecfafnI555fvSGqEKwjMXVLokcV5ygHW5b3Jbg=="],
+
+    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.21.5", "", { "os": "linux", "cpu": "ppc64" }, "sha512-1hHV/Z4OEfMwpLO8rp7CvlhBDnjsC3CttJXIhBi+5Aj5r+MBvy4egg7wCbe//hSsT+RvDAG7s81tAvpL2XAE4w=="],
+
+    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.21.5", "", { "os": "linux", "cpu": "none" }, "sha512-2HdXDMd9GMgTGrPWnJzP2ALSokE/0O5HhTUvWIbD3YdjME8JwvSCnNGBnTThKGEB91OZhzrJ4qIIxk/SBmyDDA=="],
+
+    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.21.5", "", { "os": "linux", "cpu": "s390x" }, "sha512-zus5sxzqBJD3eXxwvjN1yQkRepANgxE9lgOW2qLnmr8ikMTphkjgXu1HR01K4FJg8h1kEEDAqDcZQtbrRnB41A=="],
+
+    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.21.5", "", { "os": "linux", "cpu": "x64" }, "sha512-1rYdTpyv03iycF1+BhzrzQJCdOuAOtaqHTWJZCWvijKD2N5Xu0TtVC8/+1faWqcP9iBCWOmjmhoH94dH82BxPQ=="],
+
+    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.21.5", "", { "os": "none", "cpu": "x64" }, "sha512-Woi2MXzXjMULccIwMnLciyZH4nCIMpWQAs049KEeMvOcNADVxo0UBIQPfSmxB3CWKedngg7sWZdLvLczpe0tLg=="],
+
+    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.21.5", "", { "os": "openbsd", "cpu": "x64" }, "sha512-HLNNw99xsvx12lFBUwoT8EVCsSvRNDVxNpjZ7bPn947b8gJPzeHWyNVhFsaerc0n3TsbOINvRP2byTZ5LKezow=="],
+
+    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.21.5", "", { "os": "sunos", "cpu": "x64" }, "sha512-6+gjmFpfy0BHU5Tpptkuh8+uw3mnrvgs+dSPQXQOv3ekbordwnzTVEb4qnIvQcYXq6gzkyTnoZ9dZG+D4garKg=="],
+
+    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.21.5", "", { "os": "win32", "cpu": "arm64" }, "sha512-Z0gOTd75VvXqyq7nsl93zwahcTROgqvuAcYDUr+vOv8uHhNSKROyU961kgtCD1e95IqPKSQKH7tBTslnS3tA8A=="],
+
+    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.21.5", "", { "os": "win32", "cpu": "ia32" }, "sha512-SWXFF1CL2RVNMaVs+BBClwtfZSvDgtL//G/smwAc5oVK/UPu2Gu9tIaRgFmYFFKrmg3SyAjSrElf0TiJ1v8fYA=="],
+
+    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.21.5", "", { "os": "win32", "cpu": "x64" }, "sha512-tQd/1efJuzPC6rCFwEvLtci/xNFcTZknmXs98FYDfGE4wP9ClFV98nyKrzJKVPMhdDnjzLhdUyMX4PsQAPjwIw=="],
+
+    "@eslint-community/eslint-utils": ["@eslint-community/eslint-utils@4.9.1", "", { "dependencies": { "eslint-visitor-keys": "^3.4.3" }, "peerDependencies": { "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0" } }, "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ=="],
+
+    "@eslint-community/regexpp": ["@eslint-community/regexpp@4.12.2", "", {}, "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew=="],
+
+    "@eslint/config-array": ["@eslint/config-array@0.23.5", "", { "dependencies": { "@eslint/object-schema": "^3.0.5", "debug": "^4.3.1", "minimatch": "^10.2.4" } }, "sha512-Y3kKLvC1dvTOT+oGlqNQ1XLqK6D1HU2YXPc52NmAlJZbMMWDzGYXMiPRJ8TYD39muD/OTjlZmNJ4ib7dvSrMBA=="],
+
+    "@eslint/config-helpers": ["@eslint/config-helpers@0.6.0", "", { "dependencies": { "@eslint/core": "^1.2.1" } }, "sha512-ii6Bw9jJ2zi2cWA2Z+9/QZ/+3DX6kwaV5Q986D/CdP3Lap3w/pgQZ373FV7byY/i7L4IRH/G43I5dz1ClsCbpA=="],
+
+    "@eslint/core": ["@eslint/core@1.2.1", "", { "dependencies": { "@types/json-schema": "^7.0.15" } }, "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ=="],
+
+    "@eslint/object-schema": ["@eslint/object-schema@3.0.5", "", {}, "sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw=="],
+
+    "@eslint/plugin-kit": ["@eslint/plugin-kit@0.7.2", "", { "dependencies": { "@eslint/core": "^1.2.1", "levn": "^0.4.1" } }, "sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A=="],
+
+    "@floating-ui/core": ["@floating-ui/core@1.8.0", "", { "dependencies": { "@floating-ui/utils": "^0.2.12" } }, "sha512-0CIZ5itps/8x7BG8dEIhs53BvCUH2PCoogtakwRTut+Arm58sJooJ0AuZhLw2HJYIR5cMLNPBSS728sPho2khQ=="],
+
+    "@floating-ui/dom": ["@floating-ui/dom@1.8.0", "", { "dependencies": { "@floating-ui/core": "^1.8.0", "@floating-ui/utils": "^0.2.12" } }, "sha512-yXSrzeHZBTZadLOlfyhCkJHNeLJnHRnRInwdZ40L7ZiaAtrBwoYlsDrX3v5zB1Utk7CLfzcOVnVVWoXEky7Ceg=="],
+
+    "@floating-ui/utils": ["@floating-ui/utils@0.2.12", "", {}, "sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww=="],
+
+    "@floating-ui/vue": ["@floating-ui/vue@1.1.11", "", { "dependencies": { "@floating-ui/dom": "^1.7.6", "@floating-ui/utils": "^0.2.11", "vue-demi": ">=0.13.0" } }, "sha512-HzHKCNVxnGS35r9fCHBc3+uCnjw9IWIlCPL683cGgM9Kgj2BiAl8x1mS7vtvP6F9S/e/q4O6MApwSHj8hNLGfw=="],
+
+    "@fontsource/cinzel": ["@fontsource/cinzel@5.2.8", "", {}, "sha512-B9WeF/jPlOJOrcXfX96cy4KfM+s1QcU2C9W2hE3azBOBzPvzFkNpBovT5JmhAeicE/s4HZWKF9LF5hmEcqlbsw=="],
+
+    "@fontsource/ibm-plex-mono": ["@fontsource/ibm-plex-mono@5.2.7", "", {}, "sha512-MKAb8qV+CaiMQn2B0dIi1OV3565NYzp3WN5b4oT6LTkk+F0jR6j0ZN+5BKJiIhffDC3rtBULsYZE65+0018z9w=="],
+
+    "@fontsource/ibm-plex-sans": ["@fontsource/ibm-plex-sans@5.2.8", "", {}, "sha512-eztSXjDhPhcpxNIiGTgMebdLP9qS4rWkysuE1V7c+DjOR0qiezaiDaTwQE7bTnG5HxAY/8M43XKDvs3cYq6ZYQ=="],
+
+    "@hono/node-server": ["@hono/node-server@1.19.14", "", { "peerDependencies": { "hono": "^4" } }, "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw=="],
+
+    "@humanfs/core": ["@humanfs/core@0.19.2", "", { "dependencies": { "@humanfs/types": "^0.15.0" } }, "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA=="],
+
+    "@humanfs/node": ["@humanfs/node@0.16.8", "", { "dependencies": { "@humanfs/core": "^0.19.2", "@humanfs/types": "^0.15.0", "@humanwhocodes/retry": "^0.4.0" } }, "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ=="],
+
+    "@humanfs/types": ["@humanfs/types@0.15.0", "", {}, "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q=="],
+
+    "@humanwhocodes/module-importer": ["@humanwhocodes/module-importer@1.0.1", "", {}, "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA=="],
+
+    "@humanwhocodes/retry": ["@humanwhocodes/retry@0.4.3", "", {}, "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ=="],
+
+    "@internationalized/date": ["@internationalized/date@3.12.2", "", { "dependencies": { "@swc/helpers": "^0.5.0" } }, "sha512-FY1Y+H64NDs+HAF6omlnWxm3mEpfgaCSWtL5l551ZZfImA+kGjPFgrnJrGjH6lfmLL0g8Z/mBu1R3kufeCp6Jw=="],
+
+    "@internationalized/number": ["@internationalized/number@3.6.7", "", { "dependencies": { "@swc/helpers": "^0.5.0" } }, "sha512-3ji1fcrT+FPAK86UqEhB/psHixYo6niWPJtt7+qRaYFynt/BaJG8GhAPimtWUpEiVSTq8ZM8L5psMxGquiB/Vg=="],
+
+    "@isaacs/cliui": ["@isaacs/cliui@9.0.0", "", {}, "sha512-AokJm4tuBHillT+FpMtxQ60n8ObyXBatq7jD2/JA9dxbDDokKQm8KMht5ibGzLVU9IJDIKK4TPKgMHEYMn3lMg=="],
+
+    "@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.13", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.0", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA=="],
+
+    "@jridgewell/remapping": ["@jridgewell/remapping@2.3.5", "", { "dependencies": { "@jridgewell/gen-mapping": "^0.3.5", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ=="],
+
+    "@jridgewell/resolve-uri": ["@jridgewell/resolve-uri@3.1.2", "", {}, "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw=="],
+
+    "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.5", "", {}, "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og=="],
+
+    "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
+
+    "@lucide/vue": ["@lucide/vue@1.24.0", "", { "peerDependencies": { "vue": ">=3.0.1" } }, "sha512-5bNPX0G2YEWdUlBYk7pE8SgDg/f1mkIFpJ9vtE44pW/cwRz7Ioc0tOTESoVJAPvxIELSmYekX+XXIJMjsswNIg=="],
+
+    "@modelcontextprotocol/sdk": ["@modelcontextprotocol/sdk@1.29.0", "", { "dependencies": { "@hono/node-server": "^1.19.9", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", "cors": "^2.8.5", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "express": "^5.2.1", "express-rate-limit": "^8.2.1", "hono": "^4.11.4", "jose": "^6.1.3", "json-schema-typed": "^8.0.2", "pkce-challenge": "^5.0.0", "raw-body": "^3.0.0", "zod": "^3.25 || ^4.0", "zod-to-json-schema": "^3.25.1" }, "peerDependencies": { "@cfworker/json-schema": "^4.1.1" }, "optionalPeers": ["@cfworker/json-schema"] }, "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ=="],
+
+    "@nodelib/fs.scandir": ["@nodelib/fs.scandir@2.1.5", "", { "dependencies": { "@nodelib/fs.stat": "2.0.5", "run-parallel": "^1.1.9" } }, "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g=="],
+
+    "@nodelib/fs.stat": ["@nodelib/fs.stat@2.0.5", "", {}, "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A=="],
+
+    "@nodelib/fs.walk": ["@nodelib/fs.walk@1.2.8", "", { "dependencies": { "@nodelib/fs.scandir": "2.1.5", "fastq": "^1.6.0" } }, "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg=="],
+
+    "@nychthemeron/library": ["@nychthemeron/library@0.0.3", "https://git.mcpeakdev.com/api/packages/McPeakDev/npm/%40nychthemeron%2Flibrary/-/0.0.3/library-0.0.3.tgz", { "dependencies": { "@fontsource/cinzel": "^5.2.8", "@fontsource/ibm-plex-mono": "^5.2.7", "@fontsource/ibm-plex-sans": "^5.2.8", "@lucide/vue": "^1.24.0", "@tailwindcss/vite": "^4.3.2", "@vueuse/core": "^14.3.0", "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", "shadcn-vue": "^2.7.4", "tailwind-merge": "^3.6.0", "tailwindcss": "^4.3.2", "tw-animate-css": "^1.4.0" }, "peerDependencies": { "vue": "^3.5.0" } }, "sha512-UV5ehTgefJ2qY78XIEy/vPL2jLuT2SyMewi9hUcrGhsVJLYJxNE80I4PklN2Mc14kpLfpTM3JvpDwvfnpk0DzA=="],
+
+    "@rollup/rollup-android-arm-eabi": ["@rollup/rollup-android-arm-eabi@4.62.2", "", { "os": "android", "cpu": "arm" }, "sha512-6o7ZLZK+BeenkZCFNDXqpbjw9bD6nuWonvS/lwQJp7NoVVxm6p3qE7qQ5jGuBjiFsgvqjD8mZAU5oWxTmbOeOg=="],
+
+    "@rollup/rollup-android-arm64": ["@rollup/rollup-android-arm64@4.62.2", "", { "os": "android", "cpu": "arm64" }, "sha512-BaH7BllCACHoH1LguOU56UItGfUWjujlO65kS9LAodViaN4bwIKd7oeW/ZHJ/4ljr/7MIiENnNy3HJ0zXv8Zkw=="],
+
+    "@rollup/rollup-darwin-arm64": ["@rollup/rollup-darwin-arm64@4.62.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-v39RCCvj4He82I9sFmk+M1VZ0PLM9sfsLVikjfx2hYBNALhrrOR2D3JjQA6AhlaSOgcR+RzrKY7e1+bT6SUO/A=="],
+
+    "@rollup/rollup-darwin-x64": ["@rollup/rollup-darwin-x64@4.62.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-yl0y2vq3S3lHeuXhEdss6TWfKW8vkujImO12tn4ZkG/4oghr09LvdYm2RElVjokTQiUvDUGXLGsYeLqUMCKpGA=="],
+
+    "@rollup/rollup-freebsd-arm64": ["@rollup/rollup-freebsd-arm64@4.62.2", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-tT4pvt4qXD+vEoezupCWi+a1F0vvDiksiHc+PxRlYTOH1I6/X4id9jPxTP+Fg+545euaFT1jJVs4CEdHZAU1vw=="],
+
+    "@rollup/rollup-freebsd-x64": ["@rollup/rollup-freebsd-x64@4.62.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-6nU5F2wCW+qvCBhTn1pdIU3bzsIoF7EUwsCDRxilWGprQR6yd508YnH9+OKFCwpfS8pjZqDUmnCAr7exax0XCg=="],
+
+    "@rollup/rollup-linux-arm-gnueabihf": ["@rollup/rollup-linux-arm-gnueabihf@4.62.2", "", { "os": "linux", "cpu": "arm" }, "sha512-n1GJHPOvpIfhi3TmrCeh6S6URt9BFCt0KQE3qvexyGCTAKpR4Lg+eWvNZEqu7epxwus/8ElT3hacYEucm49SZg=="],
+
+    "@rollup/rollup-linux-arm-musleabihf": ["@rollup/rollup-linux-arm-musleabihf@4.62.2", "", { "os": "linux", "cpu": "arm" }, "sha512-JqgflS8wEB+UXV/vS1RpRbifGBeN4D5lz8D8oOFbFZw4vedvdOgCFAjfBmIMdW3yL10XpQQ0Ambepw6MXrhOnA=="],
+
+    "@rollup/rollup-linux-arm64-gnu": ["@rollup/rollup-linux-arm64-gnu@4.62.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-wnFJkogWvN4jm/hQRF2UBaeUmk20j5+DmHvoyWii2b8HJDyvz1MF2OU/6ynXt2KR63rbZLWkFpoytpdc/yBuSA=="],
+
+    "@rollup/rollup-linux-arm64-musl": ["@rollup/rollup-linux-arm64-musl@4.62.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-HVu2bp0zhvJ8xHEV9+UUs7S90VadmBSY3LcIMvozbPo4AuMGDWlz3ymHLHZPX4hR67TKTt8Qp5PJ5RBg/i+RMQ=="],
+
+    "@rollup/rollup-linux-loong64-gnu": ["@rollup/rollup-linux-loong64-gnu@4.62.2", "", { "os": "linux", "cpu": "none" }, "sha512-mQqqAV8QaoSgr9I2fKDLY2BAVvmKjWoGiu/cSYQonsLvtqwEn1E4QYfnCOcp5zoEqNhsDYin1s6jx/VJmrxlZg=="],
+
+    "@rollup/rollup-linux-loong64-musl": ["@rollup/rollup-linux-loong64-musl@4.62.2", "", { "os": "linux", "cpu": "none" }, "sha512-IxKLoxCQ2IWi6bT2akyDUBGsOImDKB+sPp4EsTmwFQ/fMwpCKm8uLSSgP/Kx/QYUgKis6SEZ5/Nlhup0DIA0PQ=="],
+
+    "@rollup/rollup-linux-ppc64-gnu": ["@rollup/rollup-linux-ppc64-gnu@4.62.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-Mk5ha2RQSgyFfmYYLkBpPnUk8D8FriBxesO1u9O75X0mHgXL1UQcH5Itl2lurWL2tj0RxV9b9tJgipac0hRY9A=="],
+
+    "@rollup/rollup-linux-ppc64-musl": ["@rollup/rollup-linux-ppc64-musl@4.62.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-CjvEnqJL/0/TQ3TXX3OPIJ/kmBellrWd4heXUmHeJlTnmwjKpSJzoehLaL6Xk0ZnMHBu9dZuFADNOrtjF4v+2w=="],
+
+    "@rollup/rollup-linux-riscv64-gnu": ["@rollup/rollup-linux-riscv64-gnu@4.62.2", "", { "os": "linux", "cpu": "none" }, "sha512-1SiZbzwdkaDURsew/tSOrooKiYy7EQGT6m8ufavAi9NEyQb/6VuIxFXAL1fqa4iZe3g4NbNk4P7J32z2tw5Mgg=="],
+
+    "@rollup/rollup-linux-riscv64-musl": ["@rollup/rollup-linux-riscv64-musl@4.62.2", "", { "os": "linux", "cpu": "none" }, "sha512-nQts12zJ3NQRoE6uYljOH89v7szzLDvG2JD/vsX+vGXU8w/At1GowTZ5/7qeFQ8m7L55rpR8Okugnuo5bgjy2Q=="],
+
+    "@rollup/rollup-linux-s390x-gnu": ["@rollup/rollup-linux-s390x-gnu@4.62.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-E9/ll019jhPIJgpzfZoIkBGhcz+kKNgVWYRY0zr9srBdPPFVpvOKW8VaJKUbeK+eZXyQF9ltME+Kk6affeaPgg=="],
+
+    "@rollup/rollup-linux-x64-gnu": ["@rollup/rollup-linux-x64-gnu@4.62.2", "", { "os": "linux", "cpu": "x64" }, "sha512-5BqxR/pshjey51iliyzTD5Xi3EN0aLmQ2lZ3lvefVV9c82BvrLo2/6OT55iifpWBufs6kdwWbuOKS841DrmK9A=="],
+
+    "@rollup/rollup-linux-x64-musl": ["@rollup/rollup-linux-x64-musl@4.62.2", "", { "os": "linux", "cpu": "x64" }, "sha512-uNN83XxQrRAh/w0/pmAfibcwyb6YWt4gP+dpnQKPVJshAloQ785ii8CT8ZCIxkGg9opVsvAlGhFitSm6D1Jjpg=="],
+
+    "@rollup/rollup-openbsd-x64": ["@rollup/rollup-openbsd-x64@4.62.2", "", { "os": "openbsd", "cpu": "x64" }, "sha512-srjEIxSH3LRnJN6THczDHWQplqEMFiAJrTab0msUryh9kwNpkICf3Ea6q6MN/2cZwRFUNx5w+h6Hpi4QuHS6Zg=="],
+
+    "@rollup/rollup-openharmony-arm64": ["@rollup/rollup-openharmony-arm64@4.62.2", "", { "os": "none", "cpu": "arm64" }, "sha512-8hOJnxgbyObnCm5AlRA3A931xX19xq80RjVTKgJOvEKWqJruP/Uf12IbAOaDjjEXYRewwHLfmF0YRIdK3OwKWA=="],
+
+    "@rollup/rollup-win32-arm64-msvc": ["@rollup/rollup-win32-arm64-msvc@4.62.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-mmF4AY1i0hG/bLWUctUq59gtmgaSIRa3cu/A3JFRp/sCNEme2bgDEiDS22P9FbnJB8NJNF4jPJiSP5RHQpUTDg=="],
+
+    "@rollup/rollup-win32-ia32-msvc": ["@rollup/rollup-win32-ia32-msvc@4.62.2", "", { "os": "win32", "cpu": "ia32" }, "sha512-DZgkknc6jhHrk46V25vbAM0zZkyP0nSDkJB8/dRkLTxv470dOmWDqGoEJl/9A0dFfS7yE3REOwNDxpHwSLSt0Q=="],
+
+    "@rollup/rollup-win32-x64-gnu": ["@rollup/rollup-win32-x64-gnu@4.62.2", "", { "os": "win32", "cpu": "x64" }, "sha512-T6xr6ucWSFto+VGajA8YH26LdpHRuP4YLHEKAtCWvJDOlnmWcDZVCI2Jmjr+IFHDlt2zRaTAKE4tfjTaWLgJBg=="],
+
+    "@rollup/rollup-win32-x64-msvc": ["@rollup/rollup-win32-x64-msvc@4.62.2", "", { "os": "win32", "cpu": "x64" }, "sha512-BfzEnDJOt9T8M989/lA37EcJgat01wLRnoi5dQf3QzOH7jzpqTAzdDbVfRljVr5r+jzKqpbHeyOfAaXxAd0PAA=="],
+
+    "@swc/helpers": ["@swc/helpers@0.5.23", "", { "dependencies": { "tslib": "^2.8.0" } }, "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw=="],
+
+    "@tailwindcss/node": ["@tailwindcss/node@4.3.3", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "enhanced-resolve": "^5.24.1", "jiti": "^2.7.0", "lightningcss": "1.32.0", "magic-string": "^0.30.21", "source-map-js": "^1.2.1", "tailwindcss": "4.3.3" } }, "sha512-/T8IKEsf9VTU6tLjgC7+sv2mOPtQxzE2jMw7u4Tt40Tx+QSZxpzh95/H6cMKoja9XuW7iMdLJYBB0o9G1CaAgg=="],
+
+    "@tailwindcss/oxide": ["@tailwindcss/oxide@4.3.3", "", { "optionalDependencies": { "@tailwindcss/oxide-android-arm64": "4.3.3", "@tailwindcss/oxide-darwin-arm64": "4.3.3", "@tailwindcss/oxide-darwin-x64": "4.3.3", "@tailwindcss/oxide-freebsd-x64": "4.3.3", "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.3", "@tailwindcss/oxide-linux-arm64-gnu": "4.3.3", "@tailwindcss/oxide-linux-arm64-musl": "4.3.3", "@tailwindcss/oxide-linux-x64-gnu": "4.3.3", "@tailwindcss/oxide-linux-x64-musl": "4.3.3", "@tailwindcss/oxide-wasm32-wasi": "4.3.3", "@tailwindcss/oxide-win32-arm64-msvc": "4.3.3", "@tailwindcss/oxide-win32-x64-msvc": "4.3.3" } }, "sha512-krXjAikiaFSPaK/FkAQT5UTx3VormQaiZ5hBFlJZ9UFQGB/rwg1MZIhHAG9smMQRTdyJxP6Qt5MwMtdyU5FWrA=="],
+
+    "@tailwindcss/oxide-android-arm64": ["@tailwindcss/oxide-android-arm64@4.3.3", "", { "os": "android", "cpu": "arm64" }, "sha512-Y85A2gmPSkl5Ve5qR86GL4HT509cFqQh1aes9p3sSkyTPwt0Pppf3GkwGe4JPACcRYjgJIEhQgM6dBClnr0NYw=="],
+
+    "@tailwindcss/oxide-darwin-arm64": ["@tailwindcss/oxide-darwin-arm64@4.3.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-BiaWatpBcERQFDlOjRDpIVXuFK5PJez5SA4JMg6VYZdBYU+qKfV/vqjcIs+IYmtitf1xYQZTwXvU/8y4lfZUGw=="],
+
+    "@tailwindcss/oxide-darwin-x64": ["@tailwindcss/oxide-darwin-x64@4.3.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-fAeUqfV5ndhxRwai8cXGzdLvul9utWOmeTkv69unv4ZXixjn61Z+p9lCWdwOwA3TYboG3BwdVuN/RDjhBRl0mw=="],
+
+    "@tailwindcss/oxide-freebsd-x64": ["@tailwindcss/oxide-freebsd-x64@4.3.3", "", { "os": "freebsd", "cpu": "x64" }, "sha512-iyf5bV6+wnAlflVeEy7R25dupxTNECZN5QMI0qNT6eT+EgaGdZcKhGkr5SdoaWiLJ3spLqIY9VCeSGrwmtg4kw=="],
+
+    "@tailwindcss/oxide-linux-arm-gnueabihf": ["@tailwindcss/oxide-linux-arm-gnueabihf@4.3.3", "", { "os": "linux", "cpu": "arm" }, "sha512-aAYUprJAJQWWbRrPvtjdroZ56Md+JM8pMiopS6xGEwDfLhqj+2ver2p4nU4Mb3CRqcMmNBjo8KkUgcxhkzVQGQ=="],
+
+    "@tailwindcss/oxide-linux-arm64-gnu": ["@tailwindcss/oxide-linux-arm64-gnu@4.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-nDxldcEENOxZRzC2uu9jrutZdAAQtb+8WWDCSnWL1zvBk1+FN+x6MtDViPB5AJMfttVCUhehGWus3XBPgatM/w=="],
+
+    "@tailwindcss/oxide-linux-arm64-musl": ["@tailwindcss/oxide-linux-arm64-musl@4.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-Md44bD6veX/PC5iyF8cDVnw4HBIANZepRZZ7a8DQOvkfo5WUBwcp6iAuCUz23u+4SUkhJlD3eL7hNdW8ezd/kA=="],
+
+    "@tailwindcss/oxide-linux-x64-gnu": ["@tailwindcss/oxide-linux-x64-gnu@4.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-tx7us1muwOKAKWao2v/GaafFeQboE6aj88vC6ziN2NCGcRm8gWUhwjzg+YdVB1e4boAtdtma4L43onunI6NS4w=="],
+
+    "@tailwindcss/oxide-linux-x64-musl": ["@tailwindcss/oxide-linux-x64-musl@4.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-SJxX60smvHgasZoBy11dX6YRjXJFovwWBoedhbQPOBzgFWBHGB+TVPWB9BxzR7TTxU8FQZAI2AyiNCMzFm8Img=="],
+
+    "@tailwindcss/oxide-wasm32-wasi": ["@tailwindcss/oxide-wasm32-wasi@4.3.3", "", { "dependencies": { "@emnapi/core": "^1.11.1", "@emnapi/runtime": "^1.11.1", "@emnapi/wasi-threads": "^1.2.2", "@napi-rs/wasm-runtime": "^1.1.4", "@tybys/wasm-util": "^0.10.2", "tslib": "^2.8.1" }, "cpu": "none" }, "sha512-jx1+rPhY/5Ympkktd656HBWEBLxP7dH06losBLjjf5vgCODXvi9KhtftWcMIwTFIDqBr7cRnQkdLnAG+IOlGvQ=="],
+
+    "@tailwindcss/oxide-win32-arm64-msvc": ["@tailwindcss/oxide-win32-arm64-msvc@4.3.3", "", { "os": "win32", "cpu": "arm64" }, "sha512-3rc292Ca2ceK6Ulcc/bAVnTs/3nDtoPhyEKlgPv+yQJQi/JS/AMJlqzxvlDacL1nekbrcf6bTqp/jV4qgnPxNQ=="],
+
+    "@tailwindcss/oxide-win32-x64-msvc": ["@tailwindcss/oxide-win32-x64-msvc@4.3.3", "", { "os": "win32", "cpu": "x64" }, "sha512-yJ0pwIVc/nYeGoV02WtsN8KYyLQv7kyI2wDnkezyJlGGjkd4QLwDGAwl47YpPJeuI0M0ObaXGSPjvWDPeTPggw=="],
+
+    "@tailwindcss/vite": ["@tailwindcss/vite@4.3.3", "", { "dependencies": { "@tailwindcss/node": "4.3.3", "@tailwindcss/oxide": "4.3.3", "tailwindcss": "4.3.3" }, "peerDependencies": { "vite": "^5.2.0 || ^6 || ^7 || ^8" } }, "sha512-yYU8cogLeSh/ms2jh8Fj7jaba/EWa7Ja6GoUqYZaraEuCI5YS6ms6ObZgjjedm+jm6XZjdNRWBpPP6Z86oOxcw=="],
+
+    "@tanstack/virtual-core": ["@tanstack/virtual-core@3.17.4", "", {}, "sha512-nGm5KteqxasUdThLc2izl6dHUqLv0LQj7Nuyo5gYalTPf/U8a9ermvsl7reT+6ioBW1l8WfpP/mcU338nLXpqw=="],
+
+    "@tanstack/vue-virtual": ["@tanstack/vue-virtual@3.13.32", "", { "dependencies": { "@tanstack/virtual-core": "3.17.4" }, "peerDependencies": { "vue": "^2.7.0 || ^3.0.0" } }, "sha512-E8OCutx7QnwZdvpJijz0Q2PHsYDWBWjnGr3TvgWiqxTU35jB1kVhtkd93scRV7tTFuId2tg3x2iFiw+IE4evjQ=="],
+
+    "@ts-morph/common": ["@ts-morph/common@0.29.0", "", { "dependencies": { "minimatch": "^10.0.1", "path-browserify": "^1.0.1", "tinyglobby": "^0.2.14" } }, "sha512-35oUmphHbJvQ/+UTwFNme/t2p3FoKiGJ5auTjjpNTop2dyREspirjMy82PLSC1pnDJ8ah1GU98hwpVt64YXQsg=="],
+
+    "@types/esrecurse": ["@types/esrecurse@4.3.1", "", {}, "sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw=="],
+
+    "@types/estree": ["@types/estree@1.0.9", "", {}, "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg=="],
+
+    "@types/json-schema": ["@types/json-schema@7.0.15", "", {}, "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="],
+
+    "@types/web-bluetooth": ["@types/web-bluetooth@0.0.21", "", {}, "sha512-oIQLCGWtcFZy2JW77j9k8nHzAOpqMHLQejDA48XXMWH6tjCQHz5RCFz1bzsmROyL6PUm+LLnUiI4BCn221inxA=="],
+
+    "@unovue/detypes": ["@unovue/detypes@0.8.5", "", { "dependencies": { "@babel/core": "^7.24.5", "@babel/preset-typescript": "^7.24.1", "@vue/compiler-dom": "^3.4.27", "@vue/compiler-sfc": "^3.4.27", "@vuedx/template-ast-types": "0.7.1", "fast-glob": "^3.3.2", "prettier": "^3.2.5", "typescript": "^5.4.5" }, "bin": { "detypes": "detype.js" } }, "sha512-Yz4JeWOHGa+w/3YudVdng8hgN/VGW9cvp8xmFkmPPFzalGblLPPSpIRiwVo853yLstMZO2LLwe0vOoLAQsUQXw=="],
+
+    "@vitejs/plugin-vue": ["@vitejs/plugin-vue@5.2.4", "", { "peerDependencies": { "vite": "^5.0.0 || ^6.0.0", "vue": "^3.2.25" } }, "sha512-7Yx/SXSOcQq5HiiV3orevHUFn+pmMB4cgbEkDYgnkUWb0WfeQ/wa2yFv6D5ICiCQOVpjA7vYDXrC7AGO8yjDHA=="],
+
+    "@volar/language-core": ["@volar/language-core@2.4.15", "", { "dependencies": { "@volar/source-map": "2.4.15" } }, "sha512-3VHw+QZU0ZG9IuQmzT68IyN4hZNd9GchGPhbD9+pa8CVv7rnoOZwo7T8weIbrRmihqy3ATpdfXFnqRrfPVK6CA=="],
+
+    "@volar/source-map": ["@volar/source-map@2.4.15", "", {}, "sha512-CPbMWlUN6hVZJYGcU/GSoHu4EnCHiLaXI9n8c9la6RaI9W5JHX+NqG+GSQcB0JdC2FIBLdZJwGsfKyBB71VlTg=="],
+
+    "@volar/typescript": ["@volar/typescript@2.4.15", "", { "dependencies": { "@volar/language-core": "2.4.15", "path-browserify": "^1.0.1", "vscode-uri": "^3.0.8" } }, "sha512-2aZ8i0cqPGjXb4BhkMsPYDkkuc2ZQ6yOpqwAuNwUoncELqoy5fRgOQtLR9gB0g902iS0NAkvpIzs27geVyVdPg=="],
+
+    "@vue/compiler-core": ["@vue/compiler-core@3.5.40", "", { "dependencies": { "@babel/parser": "^7.29.7", "@vue/shared": "3.5.40", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-39E8IgOhTbVDnoJFMKc2DvYnypcZwUqgUhQkccva/0m6FUwtIKSGV7n1hpVmYcFaoRAwf9pBcwnKlCEsN63ZEQ=="],
+
+    "@vue/compiler-dom": ["@vue/compiler-dom@3.5.40", "", { "dependencies": { "@vue/compiler-core": "3.5.40", "@vue/shared": "3.5.40" } }, "sha512-pwkx4vqlqOspFstrcmzwkKLePVMD3PT65imRzLhanU2V1Fj4K13g6OXjanOyzw3aTAuRk84BOmY8f3rEHqPaVA=="],
+
+    "@vue/compiler-sfc": ["@vue/compiler-sfc@3.5.40", "", { "dependencies": { "@babel/parser": "^7.29.7", "@vue/compiler-core": "3.5.40", "@vue/compiler-dom": "3.5.40", "@vue/compiler-ssr": "3.5.40", "@vue/shared": "3.5.40", "estree-walker": "^2.0.2", "magic-string": "^0.30.21", "postcss": "^8.5.19", "source-map-js": "^1.2.1" } }, "sha512-gIf497P4kpuALcvs5n3AEg1Vdn0pSY4XbjASIfHNYF1/MP3T2Mf2STERTubysBxCRxzJGJYtF/O7vwJrxFB3Vw=="],
+
+    "@vue/compiler-ssr": ["@vue/compiler-ssr@3.5.40", "", { "dependencies": { "@vue/compiler-dom": "3.5.40", "@vue/shared": "3.5.40" } }, "sha512-rrE5xiXG663+vHCHa3J9p2z5OcBRjXmoqenprJxAFQxg5pSshzeBiCE6pu46axapRJ2Adk0YDA2BRZVjiHXnhg=="],
+
+    "@vue/compiler-vue2": ["@vue/compiler-vue2@2.7.16", "", { "dependencies": { "de-indent": "^1.0.2", "he": "^1.2.0" } }, "sha512-qYC3Psj9S/mfu9uVi5WvNZIzq+xnXMhOwbTFKKDD7b1lhpnn71jXSFdTQ+WsIEk0ONCd7VV2IMm7ONl6tbQ86A=="],
+
+    "@vue/devtools-api": ["@vue/devtools-api@6.6.4", "", {}, "sha512-sGhTPMuXqZ1rVOk32RylztWkfXTRhuS7vgAKv0zjqk8gbsHkJ7xfFf+jbySxt7tWObEJwyKaHMikV/WGDiQm8g=="],
+
+    "@vue/language-core": ["@vue/language-core@2.2.12", "", { "dependencies": { "@volar/language-core": "2.4.15", "@vue/compiler-dom": "^3.5.0", "@vue/compiler-vue2": "^2.7.16", "@vue/shared": "^3.5.0", "alien-signals": "^1.0.3", "minimatch": "^9.0.3", "muggle-string": "^0.4.1", "path-browserify": "^1.0.1" }, "peerDependencies": { "typescript": "*" }, "optionalPeers": ["typescript"] }, "sha512-IsGljWbKGU1MZpBPN+BvPAdr55YPkj2nB/TBNGNC32Vy2qLG25DYu/NBN2vNtZqdRbTRjaoYrahLrToim2NanA=="],
+
+    "@vue/reactivity": ["@vue/reactivity@3.5.40", "", { "dependencies": { "@vue/shared": "3.5.40" } }, "sha512-B7ot9UlUZOi1zbq61/LvE88ZLTV8IlajTdiZTAEiDQgrnIMIZoPr9kGw0Zw46ObW62O9+H/Be3kMbfb7kYPQZA=="],
+
+    "@vue/runtime-core": ["@vue/runtime-core@3.5.40", "", { "dependencies": { "@vue/reactivity": "3.5.40", "@vue/shared": "3.5.40" } }, "sha512-KAZLweuZ6uUJPK1PMSQPgBU5gCjgrrfjUhSglmU9NhH+Zjepa8cnwSydPWDWHDwOgY4g3VcZ+PljbiHlURNCbw=="],
+
+    "@vue/runtime-dom": ["@vue/runtime-dom@3.5.40", "", { "dependencies": { "@vue/reactivity": "3.5.40", "@vue/runtime-core": "3.5.40", "@vue/shared": "3.5.40", "csstype": "^3.2.3" } }, "sha512-ZfrX8ssZQds900L9pr8AuK05ddnMsR4MPMZr8cPN9GoqoPWcXLhjvvbIA2SMv+7a97sJ1vv9pj/zxK0Cq/eEFQ=="],
+
+    "@vue/server-renderer": ["@vue/server-renderer@3.5.40", "", { "dependencies": { "@vue/compiler-ssr": "3.5.40", "@vue/runtime-dom": "3.5.40", "@vue/shared": "3.5.40" } }, "sha512-XNJym9WpevhTVt1HuwOrCRJ5Q+9z4BjTMrDtjTrvx74SmUll8spNTw6whWJa9mEkO4PKn5TihI/bm/8ds2QVJw=="],
+
+    "@vue/shared": ["@vue/shared@3.5.40", "", {}, "sha512-WxnBtruIqOoV3rA4jeKDWzrYI5h7Cp4+pjwDi8kWGHz+IslhiN+wguLVVhtv2l8VoU02rzDCVfDjgCl1lNpZVg=="],
+
+    "@vuedx/template-ast-types": ["@vuedx/template-ast-types@0.7.1", "", { "dependencies": { "@vue/compiler-core": "^3.0.0" } }, "sha512-Mqugk/F0lFN2u9bhimH6G1kSu2hhLi2WoqgCVxrMvgxm2kDc30DtdvVGRq+UgEmKVP61OudcMtZqkUoGQeFBUQ=="],
+
+    "@vueuse/core": ["@vueuse/core@14.3.0", "", { "dependencies": { "@types/web-bluetooth": "^0.0.21", "@vueuse/metadata": "14.3.0", "@vueuse/shared": "14.3.0" }, "peerDependencies": { "vue": "^3.5.0" } }, "sha512-aHfz47g0ZhMtTVHmIzMVpJy8ePhhOy68GY5bv110+5DVtZ+W7BsOx+m61UNQqfrWyPztIHIanWa3E2tib3NFIw=="],
+
+    "@vueuse/metadata": ["@vueuse/metadata@14.3.0", "", {}, "sha512-BwxmbAzwAVF50+MW57GXOUEV61nFBGnlBvrTqj49PqWJu3uw7hdu72ztXeZ33RdZtDY6kO+bfCAE1PCn88Tktw=="],
+
+    "@vueuse/shared": ["@vueuse/shared@14.3.0", "", { "peerDependencies": { "vue": "^3.5.0" } }, "sha512-bZpge9eSXwa4ToSiqJ7j6KRwhAsneMFoSz3LMWKQDkqimm3D/tbFlrklrs/IOqC8tEcYmXQZJ6N0UrjhBirVCg=="],
+
+    "accepts": ["accepts@2.0.0", "", { "dependencies": { "mime-types": "^3.0.0", "negotiator": "^1.0.0" } }, "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng=="],
+
+    "acorn": ["acorn@8.17.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg=="],
+
+    "acorn-jsx": ["acorn-jsx@5.3.2", "", { "peerDependencies": { "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ=="],
+
+    "ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
+
+    "ajv-formats": ["ajv-formats@3.0.1", "", { "dependencies": { "ajv": "^8.0.0" } }, "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ=="],
+
+    "alien-signals": ["alien-signals@1.0.13", "", {}, "sha512-OGj9yyTnJEttvzhTUWuscOvtqxq5vrhF7vL9oS0xJ2mK0ItPYP1/y+vCFebfxoEyAz0++1AIwJ5CMr+Fk3nDmg=="],
+
+    "ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
+
+    "ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
+
+    "aria-hidden": ["aria-hidden@1.2.6", "", { "dependencies": { "tslib": "^2.0.0" } }, "sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA=="],
+
+    "ast-types": ["ast-types-x@1.18.0", "", { "dependencies": { "tslib": "^2.0.1" } }, "sha512-ZtfIlyTCmnAXPCQo4mSDtFsHL7L3q0sJfpVYPmy5uYPjs+fynzOuc1Cg6yQ9fF6h61RjEWtOlRFwV1Kc80Qs6A=="],
+
+    "ast-types-x": ["ast-types-x@1.18.0", "", { "dependencies": { "tslib": "^2.0.1" } }, "sha512-ZtfIlyTCmnAXPCQo4mSDtFsHL7L3q0sJfpVYPmy5uYPjs+fynzOuc1Cg6yQ9fF6h61RjEWtOlRFwV1Kc80Qs6A=="],
+
+    "astral-regex": ["astral-regex@2.0.0", "", {}, "sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ=="],
+
+    "atob": ["atob@2.1.2", "", { "bin": { "atob": "bin/atob.js" } }, "sha512-Wm6ukoaOGJi/73p/cl2GvLjTI5JM1k/O14isD73YML8StrH/7/lRFgmg8nICZgD3bZZvjwCGxtMOD3wWNAu8cg=="],
+
+    "balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
+
+    "baseline-browser-mapping": ["baseline-browser-mapping@2.10.43", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-AjYpR78kDWAY3Efj+cDTFH9t9SCoL7OoTp1BOb0mQV7S+6CiLwnWM3FyxhJtdPufDFKzmCSFoUncKjWgJEZTCQ=="],
+
+    "body-parser": ["body-parser@2.3.0", "", { "dependencies": { "bytes": "^3.1.2", "content-type": "^2.0.0", "debug": "^4.4.3", "http-errors": "^2.0.1", "iconv-lite": "^0.7.2", "on-finished": "^2.4.1", "qs": "^6.15.2", "raw-body": "^3.0.2", "type-is": "^2.1.0" } }, "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw=="],
+
+    "boolbase": ["boolbase@1.0.0", "", {}, "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww=="],
+
+    "brace-expansion": ["brace-expansion@2.1.2", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA=="],
+
+    "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
+
+    "browserslist": ["browserslist@4.28.6", "", { "dependencies": { "baseline-browser-mapping": "^2.10.42", "caniuse-lite": "^1.0.30001803", "electron-to-chromium": "^1.5.389", "node-releases": "^2.0.51", "update-browserslist-db": "^1.2.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-FQBYNK15VMslhLHpA7+n+n1GOlF1kId2xcCg7/j95f24AOF6VDYMNH4mFxF7KuaTdv627faazpOAjFzMrfJOUw=="],
+
+    "bundle-name": ["bundle-name@4.1.0", "", { "dependencies": { "run-applescript": "^7.0.0" } }, "sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q=="],
+
+    "bytes": ["bytes@3.1.2", "", {}, "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="],
+
+    "c12": ["c12@3.3.4", "", { "dependencies": { "chokidar": "^5.0.0", "confbox": "^0.2.4", "defu": "^6.1.6", "dotenv": "^17.3.1", "exsolve": "^1.0.8", "giget": "^3.2.0", "jiti": "^2.6.1", "ohash": "^2.0.11", "pathe": "^2.0.3", "perfect-debounce": "^2.1.0", "pkg-types": "^2.3.0", "rc9": "^3.0.1" }, "peerDependencies": { "magicast": "*" }, "optionalPeers": ["magicast"] }, "sha512-cM0ApFQSBXuourJejzwv/AuPRvAxordTyParRVcHjjtXirtkzM0uK2L9TTn9s0cXZbG7E55jCivRQzoxYmRAlA=="],
+
+    "call-bind-apply-helpers": ["call-bind-apply-helpers@1.0.2", "", { "dependencies": { "es-errors": "^1.3.0", "function-bind": "^1.1.2" } }, "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ=="],
+
+    "call-bound": ["call-bound@1.0.4", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "get-intrinsic": "^1.3.0" } }, "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg=="],
+
+    "caniuse-lite": ["caniuse-lite@1.0.30001805", "", {}, "sha512-52noaS3DubycKSXaU30TwPGIp+POyQSUVa5jBEq3vkRkY0kjyb3LQgvhU6WGyCcyXqVLWO0Cw0Q6BSdD0kUfVA=="],
+
+    "chalk": ["chalk@5.6.2", "", {}, "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA=="],
+
+    "chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
+
+    "citty": ["citty@0.2.2", "", {}, "sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w=="],
+
+    "class-variance-authority": ["class-variance-authority@0.7.1", "", { "dependencies": { "clsx": "^2.1.1" } }, "sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg=="],
+
+    "cli-cursor": ["cli-cursor@5.0.0", "", { "dependencies": { "restore-cursor": "^5.0.0" } }, "sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw=="],
+
+    "cli-progress": ["cli-progress@3.12.0", "", { "dependencies": { "string-width": "^4.2.3" } }, "sha512-tRkV3HJ1ASwm19THiiLIXLO7Im7wlTuKnvkYaTkyoAPefqjNg7W7DHKUlGRxy9vxDvbyCYQkQozvptuMkGCg8A=="],
+
+    "cli-spinners": ["cli-spinners@3.4.0", "", {}, "sha512-bXfOC4QcT1tKXGorxL3wbJm6XJPDqEnij2gQ2m7ESQuE+/z9YFIWnl/5RpTiKWbMq3EVKR4fRLJGn6DVfu0mpw=="],
+
+    "clsx": ["clsx@2.1.1", "", {}, "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA=="],
+
+    "code-block-writer": ["code-block-writer@13.0.3", "", {}, "sha512-Oofo0pq3IKnsFtuHqSF7TqBfr71aeyZDVJ0HpmqB7FBM2qEigL0iPONSCZSO9pE9dZTAxANe5XHG9Uy0YMv8cg=="],
+
+    "color-convert": ["color-convert@2.0.1", "", { "dependencies": { "color-name": "~1.1.4" } }, "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ=="],
+
+    "color-name": ["color-name@1.1.4", "", {}, "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="],
+
+    "commander": ["commander@15.0.0", "", {}, "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg=="],
+
+    "concat-map": ["concat-map@0.0.1", "", {}, "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="],
+
+    "confbox": ["confbox@0.2.4", "", {}, "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ=="],
+
+    "consola": ["consola@3.4.2", "", {}, "sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA=="],
+
+    "content-disposition": ["content-disposition@1.1.0", "", {}, "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g=="],
+
+    "content-type": ["content-type@1.0.5", "", {}, "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA=="],
+
+    "convert-hrtime": ["convert-hrtime@5.0.0", "", {}, "sha512-lOETlkIeYSJWcbbcvjRKGxVMXJR+8+OQb/mTPbA4ObPMytYIsUbuOE0Jzy60hjARYszq1id0j8KgVhC+WGZVTg=="],
+
+    "convert-source-map": ["convert-source-map@2.0.0", "", {}, "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg=="],
+
+    "cookie": ["cookie@0.7.2", "", {}, "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w=="],
+
+    "cookie-signature": ["cookie-signature@1.2.2", "", {}, "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg=="],
+
+    "cors": ["cors@2.8.6", "", { "dependencies": { "object-assign": "^4", "vary": "^1" } }, "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw=="],
+
+    "cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="],
+
+    "css": ["css@3.0.0", "", { "dependencies": { "inherits": "^2.0.4", "source-map": "^0.6.1", "source-map-resolve": "^0.6.0" } }, "sha512-DG9pFfwOrzc+hawpmqX/dHYHJG+Bsdb0klhyi1sDneOgGOXy9wQIC8hzyVp1e4NRYDBdxcylvywPkkXCHAzTyQ=="],
+
+    "css-select": ["css-select@5.2.2", "", { "dependencies": { "boolbase": "^1.0.0", "css-what": "^6.1.0", "domhandler": "^5.0.2", "domutils": "^3.0.1", "nth-check": "^2.0.1" } }, "sha512-TizTzUddG/xYLA3NXodFM0fSbNizXjOKhqiQQwvhlspadZokn1KDy0NZFS0wuEubIYAV5/c1/lAr0TaaFXEXzw=="],
+
+    "css-what": ["css-what@6.2.2", "", {}, "sha512-u/O3vwbptzhMs3L1fQE82ZSLHQQfto5gyZzwteVIEyeaY5Fc7R4dapF/BvRoSYFeqfBk4m0V1Vafq5Pjv25wvA=="],
+
+    "cssesc": ["cssesc@3.0.0", "", { "bin": { "cssesc": "bin/cssesc" } }, "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg=="],
+
+    "csstype": ["csstype@3.2.3", "", {}, "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ=="],
+
+    "de-indent": ["de-indent@1.0.2", "", {}, "sha512-e/1zu3xH5MQryN2zdVaF0OrdNLUbvWxzMbi+iNA6Bky7l1RoP8a2fIbRocyHclXt/arDrrR6lL3TqFD9pMQTsg=="],
+
+    "debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" }, "peerDependencies": { "supports-color": "*" }, "optionalPeers": ["supports-color"] }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="],
+
+    "decode-uri-component": ["decode-uri-component@0.2.2", "", {}, "sha512-FqUYQ+8o158GyGTrMFJms9qh3CqTKvAqgqsTnkLI8sKu0028orqBhxNMFkFen0zGyg6epACD32pjVk58ngIErQ=="],
+
+    "dedent": ["dedent@1.7.2", "", { "peerDependencies": { "babel-plugin-macros": "^3.1.0" }, "optionalPeers": ["babel-plugin-macros"] }, "sha512-WzMx3mW98SN+zn3hgemf4OzdmyNhhhKz5Ay0pUfQiMQ3e1g+xmTJWp/pKdwKVXhdSkAEGIIzqeuWrL3mV/AXbA=="],
+
+    "deep-diff": ["deep-diff@1.0.2", "", {}, "sha512-aWS3UIVH+NPGCD1kki+DCU9Dua032iSsO43LqQpcs4R3+dVv7tX0qBGjiVHJHjplsoUM2XRO/KB92glqc68awg=="],
+
+    "deep-is": ["deep-is@0.1.4", "", {}, "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ=="],
+
+    "deepmerge": ["deepmerge@4.3.1", "", {}, "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A=="],
+
+    "default-browser": ["default-browser@5.5.0", "", { "dependencies": { "bundle-name": "^4.1.0", "default-browser-id": "^5.0.0" } }, "sha512-H9LMLr5zwIbSxrmvikGuI/5KGhZ8E2zH3stkMgM5LpOWDutGM2JZaj460Udnf1a+946zc7YBgrqEWwbk7zHvGw=="],
+
+    "default-browser-id": ["default-browser-id@5.0.1", "", {}, "sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q=="],
+
+    "define-lazy-prop": ["define-lazy-prop@3.0.0", "", {}, "sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg=="],
+
+    "defu": ["defu@6.1.7", "", {}, "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ=="],
+
+    "depd": ["depd@2.0.0", "", {}, "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw=="],
+
+    "destr": ["destr@2.0.5", "", {}, "sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA=="],
+
+    "detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="],
+
+    "diff": ["diff@9.0.0", "", {}, "sha512-svtcdpS8CgJyqAjEQIXdb3OjhFVVYjzGAPO8WGCmRbrml64SPw/jJD4GoE98aR7r25A0XcgrK3F02yw9R/vhQw=="],
+
+    "dom-serializer": ["dom-serializer@2.0.0", "", { "dependencies": { "domelementtype": "^2.3.0", "domhandler": "^5.0.2", "entities": "^4.2.0" } }, "sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg=="],
+
+    "domelementtype": ["domelementtype@2.3.0", "", {}, "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw=="],
+
+    "domhandler": ["domhandler@5.0.3", "", { "dependencies": { "domelementtype": "^2.3.0" } }, "sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w=="],
+
+    "domutils": ["domutils@3.2.2", "", { "dependencies": { "dom-serializer": "^2.0.0", "domelementtype": "^2.3.0", "domhandler": "^5.0.3" } }, "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw=="],
+
+    "dotenv": ["dotenv@17.4.2", "", {}, "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw=="],
+
+    "dunder-proto": ["dunder-proto@1.0.1", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.1", "es-errors": "^1.3.0", "gopd": "^1.2.0" } }, "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A=="],
+
+    "ee-first": ["ee-first@1.1.1", "", {}, "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow=="],
+
+    "electron-to-chromium": ["electron-to-chromium@1.5.392", "", {}, "sha512-1yQq3VQCZRwsnYc67Oc+1fge6Lwtn0hzi6zmEVkB61Zx21kTbwJAW4dFLadl5Rc1tKhG/kSpYXnfiAhu0f0a1g=="],
+
+    "emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
+
+    "encodeurl": ["encodeurl@2.0.0", "", {}, "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg=="],
+
+    "enhanced-resolve": ["enhanced-resolve@5.24.2", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.3" } }, "sha512-rpsZEGT1jFuve6QlpyRp9ckQ+kN61hvF9BzCPyMdaKTm8UJce96KBn3sorXOFXlzjPrs3Vc4T1NsSroZ3PxlFw=="],
+
+    "entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
+
+    "es-define-property": ["es-define-property@1.0.1", "", {}, "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g=="],
+
+    "es-errors": ["es-errors@1.3.0", "", {}, "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw=="],
+
+    "es-object-atoms": ["es-object-atoms@1.1.2", "", { "dependencies": { "es-errors": "^1.3.0" } }, "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw=="],
+
+    "esbuild": ["esbuild@0.21.5", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.21.5", "@esbuild/android-arm": "0.21.5", "@esbuild/android-arm64": "0.21.5", "@esbuild/android-x64": "0.21.5", "@esbuild/darwin-arm64": "0.21.5", "@esbuild/darwin-x64": "0.21.5", "@esbuild/freebsd-arm64": "0.21.5", "@esbuild/freebsd-x64": "0.21.5", "@esbuild/linux-arm": "0.21.5", "@esbuild/linux-arm64": "0.21.5", "@esbuild/linux-ia32": "0.21.5", "@esbuild/linux-loong64": "0.21.5", "@esbuild/linux-mips64el": "0.21.5", "@esbuild/linux-ppc64": "0.21.5", "@esbuild/linux-riscv64": "0.21.5", "@esbuild/linux-s390x": "0.21.5", "@esbuild/linux-x64": "0.21.5", "@esbuild/netbsd-x64": "0.21.5", "@esbuild/openbsd-x64": "0.21.5", "@esbuild/sunos-x64": "0.21.5", "@esbuild/win32-arm64": "0.21.5", "@esbuild/win32-ia32": "0.21.5", "@esbuild/win32-x64": "0.21.5" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw=="],
+
+    "escalade": ["escalade@3.2.0", "", {}, "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA=="],
+
+    "escape-html": ["escape-html@1.0.3", "", {}, "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow=="],
+
+    "escape-string-regexp": ["escape-string-regexp@4.0.0", "", {}, "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA=="],
+
+    "eslint": ["eslint@10.7.0", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.8.0", "@eslint-community/regexpp": "^4.12.2", "@eslint/config-array": "^0.23.5", "@eslint/config-helpers": "^0.6.0", "@eslint/core": "^1.2.1", "@eslint/plugin-kit": "^0.7.2", "@humanfs/node": "^0.16.6", "@humanwhocodes/module-importer": "^1.0.1", "@humanwhocodes/retry": "^0.4.2", "@types/estree": "^1.0.6", "ajv": "^6.14.0", "cross-spawn": "^7.0.6", "debug": "^4.3.2", "escape-string-regexp": "^4.0.0", "eslint-scope": "^9.1.2", "eslint-visitor-keys": "^5.0.1", "espree": "^11.2.0", "esquery": "^1.7.0", "esutils": "^2.0.2", "fast-deep-equal": "^3.1.3", "file-entry-cache": "^8.0.0", "find-up": "^5.0.0", "glob-parent": "^6.0.2", "ignore": "^5.2.0", "imurmurhash": "^0.1.4", "is-glob": "^4.0.0", "json-stable-stringify-without-jsonify": "^1.0.1", "minimatch": "^10.2.4", "natural-compare": "^1.4.0", "optionator": "^0.9.3" }, "peerDependencies": { "jiti": "*" }, "optionalPeers": ["jiti"], "bin": { "eslint": "bin/eslint.js" } }, "sha512-GVTD7s1vdIl6UYvAfriOPeY1Df8LIZjfofLvHwde+erDHGGuHyuM6xoxRxmHiebhYuD2p1vN4wWh0XzPARSGDQ=="],
+
+    "eslint-scope": ["eslint-scope@9.1.2", "", { "dependencies": { "@types/esrecurse": "^4.3.1", "@types/estree": "^1.0.8", "esrecurse": "^4.3.0", "estraverse": "^5.2.0" } }, "sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ=="],
+
+    "eslint-visitor-keys": ["eslint-visitor-keys@5.0.1", "", {}, "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA=="],
+
+    "espree": ["espree@11.2.0", "", { "dependencies": { "acorn": "^8.16.0", "acorn-jsx": "^5.3.2", "eslint-visitor-keys": "^5.0.1" } }, "sha512-7p3DrVEIopW1B1avAGLuCSh1jubc01H2JHc8B4qqGblmg5gI9yumBgACjWo4JlIc04ufug4xJ3SQI8HkS/Rgzw=="],
+
+    "esquery": ["esquery@1.7.0", "", { "dependencies": { "estraverse": "^5.1.0" } }, "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g=="],
+
+    "esrecurse": ["esrecurse@4.3.0", "", { "dependencies": { "estraverse": "^5.2.0" } }, "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag=="],
+
+    "estraverse": ["estraverse@5.3.0", "", {}, "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA=="],
+
+    "estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+
+    "esutils": ["esutils@2.0.3", "", {}, "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g=="],
+
+    "etag": ["etag@1.8.1", "", {}, "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg=="],
+
+    "eventsource": ["eventsource@3.0.7", "", { "dependencies": { "eventsource-parser": "^3.0.1" } }, "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA=="],
+
+    "eventsource-parser": ["eventsource-parser@3.1.0", "", {}, "sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg=="],
+
+    "express": ["express@5.2.1", "", { "dependencies": { "accepts": "^2.0.0", "body-parser": "^2.2.1", "content-disposition": "^1.0.0", "content-type": "^1.0.5", "cookie": "^0.7.1", "cookie-signature": "^1.2.1", "debug": "^4.4.0", "depd": "^2.0.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "finalhandler": "^2.1.0", "fresh": "^2.0.0", "http-errors": "^2.0.0", "merge-descriptors": "^2.0.0", "mime-types": "^3.0.0", "on-finished": "^2.4.1", "once": "^1.4.0", "parseurl": "^1.3.3", "proxy-addr": "^2.0.7", "qs": "^6.14.0", "range-parser": "^1.2.1", "router": "^2.2.0", "send": "^1.1.0", "serve-static": "^2.2.0", "statuses": "^2.0.1", "type-is": "^2.0.1", "vary": "^1.1.2" } }, "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw=="],
+
+    "express-rate-limit": ["express-rate-limit@8.5.2", "", { "dependencies": { "ip-address": "^10.2.0" }, "peerDependencies": { "express": ">= 4.11" } }, "sha512-5Kb34ipNX694DH48vN9irak1Qx30nb0PLYHXfJgw4YEjiC3ZEmZJhwOp+VfiCYwFzvFTdB9QkArYS5kXa2cx2A=="],
+
+    "exsolve": ["exsolve@1.1.0", "", {}, "sha512-D+42+T12DdIlJM3uepa55qGiL3sYdLBOxIl2ifQCzCHz4c7eiolaHsi3BIqEr7JxBzxv2pYZQX9kw16ziMcEmw=="],
+
+    "fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="],
+
+    "fast-diff": ["fast-diff@1.3.0", "", {}, "sha512-VxPP4NqbUjj6MaAOafWeUn2cXWLcCtljklUtZf0Ind4XQ+QPtmA0b18zZy0jIQx+ExRVCR/ZQpBmik5lXshNsw=="],
+
+    "fast-glob": ["fast-glob@3.3.3", "", { "dependencies": { "@nodelib/fs.stat": "^2.0.2", "@nodelib/fs.walk": "^1.2.3", "glob-parent": "^5.1.2", "merge2": "^1.3.0", "micromatch": "^4.0.8" } }, "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg=="],
+
+    "fast-json-stable-stringify": ["fast-json-stable-stringify@2.1.0", "", {}, "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw=="],
+
+    "fast-levenshtein": ["fast-levenshtein@2.0.6", "", {}, "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw=="],
+
+    "fast-uri": ["fast-uri@3.1.3", "", {}, "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg=="],
+
+    "fastq": ["fastq@1.20.1", "", { "dependencies": { "reusify": "^1.0.4" } }, "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw=="],
+
+    "fdir": ["fdir@6.5.0", "", { "peerDependencies": { "picomatch": "^3 || ^4" }, "optionalPeers": ["picomatch"] }, "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="],
+
+    "file-entry-cache": ["file-entry-cache@8.0.0", "", { "dependencies": { "flat-cache": "^4.0.0" } }, "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ=="],
+
+    "fill-range": ["fill-range@7.1.1", "", { "dependencies": { "to-regex-range": "^5.0.1" } }, "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg=="],
+
+    "finalhandler": ["finalhandler@2.1.1", "", { "dependencies": { "debug": "^4.4.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "on-finished": "^2.4.1", "parseurl": "^1.3.3", "statuses": "^2.0.1" } }, "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA=="],
+
+    "find-up": ["find-up@5.0.0", "", { "dependencies": { "locate-path": "^6.0.0", "path-exists": "^4.0.0" } }, "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng=="],
+
+    "flat-cache": ["flat-cache@4.0.1", "", { "dependencies": { "flatted": "^3.2.9", "keyv": "^4.5.4" } }, "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw=="],
+
+    "flatted": ["flatted@3.4.2", "", {}, "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA=="],
+
+    "foreground-child": ["foreground-child@3.3.1", "", { "dependencies": { "cross-spawn": "^7.0.6", "signal-exit": "^4.0.1" } }, "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw=="],
+
+    "forwarded": ["forwarded@0.2.0", "", {}, "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow=="],
+
+    "fresh": ["fresh@2.0.0", "", {}, "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A=="],
+
+    "fs-extra": ["fs-extra@11.3.6", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-w8ZNZr2mKIc7qeNaQ9AVPT1+iFaI+Avd4xudVOvdDJ8VytREi1Ft5Ih7hd9jjehod8vAM5GMsfQ/TpPf4EyoEA=="],
+
+    "fs.realpath": ["fs.realpath@1.0.0", "", {}, "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="],
+
+    "fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="],
+
+    "function-bind": ["function-bind@1.1.2", "", {}, "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA=="],
+
+    "function-timeout": ["function-timeout@1.0.2", "", {}, "sha512-939eZS4gJ3htTHAldmyyuzlrD58P03fHG49v2JfFXbV6OhvZKRC9j2yAtdHw/zrp2zXHuv05zMIy40F0ge7spA=="],
+
+    "fuzzysort": ["fuzzysort@3.1.0", "", {}, "sha512-sR9BNCjBg6LNgwvxlBd0sBABvQitkLzoVY9MYYROQVX/FvfJ4Mai9LsGhDgd8qYdds0bY77VzYd5iuB+v5rwQQ=="],
+
+    "gensync": ["gensync@1.0.0-beta.2", "", {}, "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg=="],
+
+    "get-east-asian-width": ["get-east-asian-width@1.6.0", "", {}, "sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA=="],
+
+    "get-intrinsic": ["get-intrinsic@1.3.0", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "es-object-atoms": "^1.1.1", "function-bind": "^1.1.2", "get-proto": "^1.0.1", "gopd": "^1.2.0", "has-symbols": "^1.1.0", "hasown": "^2.0.2", "math-intrinsics": "^1.1.0" } }, "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ=="],
+
+    "get-own-enumerable-keys": ["get-own-enumerable-keys@1.0.0", "", {}, "sha512-PKsK2FSrQCyxcGHsGrLDcK0lx+0Ke+6e8KFFozA9/fIQLhQzPaRvJFdcz7+Axg3jUH/Mq+NI4xa5u/UT2tQskA=="],
+
+    "get-proto": ["get-proto@1.0.1", "", { "dependencies": { "dunder-proto": "^1.0.1", "es-object-atoms": "^1.0.0" } }, "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g=="],
+
+    "get-tsconfig": ["get-tsconfig@4.14.0", "", { "dependencies": { "resolve-pkg-maps": "^1.0.0" } }, "sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA=="],
+
+    "giget": ["giget@3.3.0", "", { "bin": { "giget": "dist/cli.mjs" } }, "sha512-gzi2D96p+AMfDcmJHGDj3KJ9NRiwvlFAU5yfa3ROwWZmFUjX4P43x3BcyRaOMMLto1vUo7C+86+MFhYTl6Ryiw=="],
+
+    "glob": ["glob@7.2.3", "", { "dependencies": { "fs.realpath": "^1.0.0", "inflight": "^1.0.4", "inherits": "2", "minimatch": "^3.1.1", "once": "^1.3.0", "path-is-absolute": "^1.0.0" } }, "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q=="],
+
+    "glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="],
+
+    "gonzales-pe": ["gonzales-pe@4.3.0", "", { "dependencies": { "minimist": "^1.2.5" }, "bin": { "gonzales": "bin/gonzales.js" } }, "sha512-otgSPpUmdWJ43VXyiNgEYE4luzHCL2pz4wQ0OnDluC6Eg4Ko3Vexy/SrSynglw/eR+OhkzmqFCZa/OFa/RgAOQ=="],
+
+    "gopd": ["gopd@1.2.0", "", {}, "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg=="],
+
+    "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],
+
+    "has-symbols": ["has-symbols@1.1.0", "", {}, "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ=="],
+
+    "hasown": ["hasown@2.0.4", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A=="],
+
+    "he": ["he@1.2.0", "", { "bin": { "he": "bin/he" } }, "sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw=="],
+
+    "hono": ["hono@4.12.30", "", {}, "sha512-emn+JoJjrN9YTpRDS5it/UI2SO9BAE37T6I3d963RxcZ81G9A4pr2SZTEiiaiKbzx+NKRg5BZ89fCL7gCJCUog=="],
+
+    "http-errors": ["http-errors@2.0.1", "", { "dependencies": { "depd": "~2.0.0", "inherits": "~2.0.4", "setprototypeof": "~1.2.0", "statuses": "~2.0.2", "toidentifier": "~1.0.1" } }, "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ=="],
+
+    "iconv-lite": ["iconv-lite@0.7.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ=="],
+
+    "identifier-regex": ["identifier-regex@1.1.0", "", { "dependencies": { "reserved-identifiers": "^1.0.0" } }, "sha512-SLX4H/vtcYlYnL7XqnuJKHU7Z8517TgsW9nmQiGOgMCjQ8V/deLYu6bEmbGoXe7WMMhc9+EUGyFFneHja8KabA=="],
+
+    "ignore": ["ignore@5.3.2", "", {}, "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g=="],
+
+    "imurmurhash": ["imurmurhash@0.1.4", "", {}, "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA=="],
+
+    "inflight": ["inflight@1.0.6", "", { "dependencies": { "once": "^1.3.0", "wrappy": "1" } }, "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA=="],
+
+    "inherits": ["inherits@2.0.4", "", {}, "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="],
+
+    "ip-address": ["ip-address@10.2.0", "", {}, "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA=="],
+
+    "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="],
+
+    "is-docker": ["is-docker@3.0.0", "", { "bin": { "is-docker": "cli.js" } }, "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ=="],
+
+    "is-extglob": ["is-extglob@2.1.1", "", {}, "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ=="],
+
+    "is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
+
+    "is-glob": ["is-glob@4.0.3", "", { "dependencies": { "is-extglob": "^2.1.1" } }, "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg=="],
+
+    "is-identifier": ["is-identifier@1.1.0", "", { "dependencies": { "identifier-regex": "^1.1.0", "super-regex": "^1.1.0" } }, "sha512-NhOds0mDx9lJu+1lBRO0xbwFo5nobA7GCk/0e5xjr6+6XugX985+0OyGX35BNrTkPAsdLcIKg02HUQJOK8D8kw=="],
+
+    "is-in-ssh": ["is-in-ssh@1.0.0", "", {}, "sha512-jYa6Q9rH90kR1vKB6NM7qqd1mge3Fx4Dhw5TVlK1MUBqhEOuCagrEHMevNuCcbECmXZ0ThXkRm+Ymr51HwEPAw=="],
+
+    "is-inside-container": ["is-inside-container@1.0.0", "", { "dependencies": { "is-docker": "^3.0.0" }, "bin": { "is-inside-container": "cli.js" } }, "sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA=="],
+
+    "is-interactive": ["is-interactive@2.0.0", "", {}, "sha512-qP1vozQRI+BMOPcjFzrjXuQvdak2pHNUMZoeG2eRbiSqyvbEf/wQtEOTOX1guk6E3t36RkaqiSt8A/6YElNxLQ=="],
+
+    "is-number": ["is-number@7.0.0", "", {}, "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng=="],
+
+    "is-obj": ["is-obj@3.0.0", "", {}, "sha512-IlsXEHOjtKhpN8r/tRFj2nDyTmHvcfNeu/nrRIcXE17ROeatXchkojffa1SpdqW4cr/Fj6QkEf/Gn4zf6KKvEQ=="],
+
+    "is-promise": ["is-promise@4.0.0", "", {}, "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ=="],
+
+    "is-regexp": ["is-regexp@3.1.0", "", {}, "sha512-rbku49cWloU5bSMI+zaRaXdQHXnthP6DZ/vLnfdSKyL4zUzuWnomtOEiZZOd+ioQ+avFo/qau3KPTc7Fjy1uPA=="],
+
+    "is-unicode-supported": ["is-unicode-supported@2.1.0", "", {}, "sha512-mE00Gnza5EEB3Ds0HfMyllZzbBrmLOX3vfWoj9A9PEnTfratQ/BcaJOuMhnkhjXvb2+FkY3VuHqtAGpTPmglFQ=="],
+
+    "is-wsl": ["is-wsl@3.1.1", "", { "dependencies": { "is-inside-container": "^1.0.0" } }, "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw=="],
+
+    "isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="],
+
+    "jackspeak": ["jackspeak@4.2.3", "", { "dependencies": { "@isaacs/cliui": "^9.0.0" } }, "sha512-ykkVRwrYvFm1nb2AJfKKYPr0emF6IiXDYUaFx4Zn9ZuIH7MrzEZ3sD5RlqGXNRpHtvUHJyOnCEFxOlNDtGo7wg=="],
+
+    "jiti": ["jiti@2.7.0", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ=="],
+
+    "jose": ["jose@6.2.3", "", {}, "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw=="],
+
+    "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
+
+    "jsesc": ["jsesc@3.1.0", "", { "bin": { "jsesc": "bin/jsesc" } }, "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA=="],
+
+    "json-buffer": ["json-buffer@3.0.1", "", {}, "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ=="],
+
+    "json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
+
+    "json-schema-typed": ["json-schema-typed@8.0.2", "", {}, "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA=="],
+
+    "json-stable-stringify-without-jsonify": ["json-stable-stringify-without-jsonify@1.0.1", "", {}, "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw=="],
+
+    "json5": ["json5@2.2.3", "", { "bin": { "json5": "lib/cli.js" } }, "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg=="],
+
+    "jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
+
+    "keyv": ["keyv@4.5.4", "", { "dependencies": { "json-buffer": "3.0.1" } }, "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw=="],
+
+    "kleur": ["kleur@3.0.3", "", {}, "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w=="],
+
+    "levn": ["levn@0.4.1", "", { "dependencies": { "prelude-ls": "^1.2.1", "type-check": "~0.4.0" } }, "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ=="],
+
+    "lightningcss": ["lightningcss@1.32.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.32.0", "lightningcss-darwin-arm64": "1.32.0", "lightningcss-darwin-x64": "1.32.0", "lightningcss-freebsd-x64": "1.32.0", "lightningcss-linux-arm-gnueabihf": "1.32.0", "lightningcss-linux-arm64-gnu": "1.32.0", "lightningcss-linux-arm64-musl": "1.32.0", "lightningcss-linux-x64-gnu": "1.32.0", "lightningcss-linux-x64-musl": "1.32.0", "lightningcss-win32-arm64-msvc": "1.32.0", "lightningcss-win32-x64-msvc": "1.32.0" } }, "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ=="],
+
+    "lightningcss-android-arm64": ["lightningcss-android-arm64@1.32.0", "", { "os": "android", "cpu": "arm64" }, "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg=="],
+
+    "lightningcss-darwin-arm64": ["lightningcss-darwin-arm64@1.32.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ=="],
+
+    "lightningcss-darwin-x64": ["lightningcss-darwin-x64@1.32.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w=="],
+
+    "lightningcss-freebsd-x64": ["lightningcss-freebsd-x64@1.32.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig=="],
+
+    "lightningcss-linux-arm-gnueabihf": ["lightningcss-linux-arm-gnueabihf@1.32.0", "", { "os": "linux", "cpu": "arm" }, "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw=="],
+
+    "lightningcss-linux-arm64-gnu": ["lightningcss-linux-arm64-gnu@1.32.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ=="],
+
+    "lightningcss-linux-arm64-musl": ["lightningcss-linux-arm64-musl@1.32.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg=="],
+
+    "lightningcss-linux-x64-gnu": ["lightningcss-linux-x64-gnu@1.32.0", "", { "os": "linux", "cpu": "x64" }, "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA=="],
+
+    "lightningcss-linux-x64-musl": ["lightningcss-linux-x64-musl@1.32.0", "", { "os": "linux", "cpu": "x64" }, "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg=="],
+
+    "lightningcss-win32-arm64-msvc": ["lightningcss-win32-arm64-msvc@1.32.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw=="],
+
+    "lightningcss-win32-x64-msvc": ["lightningcss-win32-x64-msvc@1.32.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q=="],
+
+    "locate-path": ["locate-path@6.0.0", "", { "dependencies": { "p-locate": "^5.0.0" } }, "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw=="],
+
+    "lodash-es": ["lodash-es@4.18.1", "", {}, "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A=="],
+
+    "lodash.sortedlastindex": ["lodash.sortedlastindex@4.1.0", "", {}, "sha512-s8xEQdsp2Tu5zUqVdFSe9C0kR8YlnAJYLqMdkh+pIRBRxF6/apWseLdHl3/+jv2I61dhPwtI/Ff+EqvCpc+N8w=="],
+
+    "lodash.truncate": ["lodash.truncate@4.4.2", "", {}, "sha512-jttmRe7bRse52OsWIMDLaXxWqRAmtIUccAQ3garviCqJjafXOfNMO0yMfNpdD6zbGaTU0P5Nz7e7gAT6cKmJRw=="],
+
+    "log-symbols": ["log-symbols@7.0.1", "", { "dependencies": { "is-unicode-supported": "^2.0.0", "yoctocolors": "^2.1.1" } }, "sha512-ja1E3yCr9i/0hmBVaM0bfwDjnGy8I/s6PP4DFp+yP+a+mrHO4Rm7DtmnqROTUkHIkqffC84YY7AeqX6oFk0WFg=="],
+
+    "lru-cache": ["lru-cache@5.1.1", "", { "dependencies": { "yallist": "^3.0.2" } }, "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w=="],
+
+    "magic-string": ["magic-string@0.30.21", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="],
+
+    "make-asynchronous": ["make-asynchronous@1.1.0", "", { "dependencies": { "p-event": "^6.0.0", "type-fest": "^4.6.0", "web-worker": "^1.5.0" } }, "sha512-ayF7iT+44LXdxJLTrTd3TLQpFDDvPCBxXxbv+pMUSuHA5Q8zyAfwkRP6aHHwNVFBUFWtxAHqwNJxF8vMZLAbVg=="],
+
+    "math-intrinsics": ["math-intrinsics@1.1.0", "", {}, "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g=="],
+
+    "media-typer": ["media-typer@1.1.0", "", {}, "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw=="],
+
+    "merge-descriptors": ["merge-descriptors@2.0.0", "", {}, "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g=="],
+
+    "merge2": ["merge2@1.4.1", "", {}, "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg=="],
+
+    "micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
+
+    "mime-db": ["mime-db@1.54.0", "", {}, "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ=="],
+
+    "mime-types": ["mime-types@3.0.2", "", { "dependencies": { "mime-db": "^1.54.0" } }, "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A=="],
+
+    "mimic-function": ["mimic-function@5.0.1", "", {}, "sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA=="],
+
+    "minimatch": ["minimatch@9.0.9", "", { "dependencies": { "brace-expansion": "^2.0.2" } }, "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg=="],
+
+    "minimist": ["minimist@1.2.8", "", {}, "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA=="],
+
+    "minipass": ["minipass@7.1.3", "", {}, "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A=="],
+
+    "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
+
+    "muggle-string": ["muggle-string@0.4.1", "", {}, "sha512-VNTrAak/KhO2i8dqqnqnAHOa3cYBwXEZe9h+D5h/1ZqFSTEFHdM65lR7RoIqq3tBBYavsOXV84NoHXZ0AkPyqQ=="],
+
+    "nanoid": ["nanoid@3.3.16", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q=="],
+
+    "natural-compare": ["natural-compare@1.4.0", "", {}, "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw=="],
+
+    "negotiator": ["negotiator@1.0.0", "", {}, "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg=="],
+
+    "node-fetch-native": ["node-fetch-native@1.6.7", "", {}, "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q=="],
+
+    "node-html-parser": ["node-html-parser@7.1.0", "", { "dependencies": { "css-select": "^5.1.0", "he": "1.2.0" } }, "sha512-iJo8b2uYGT40Y8BTyy5ufL6IVbN8rbm/1QK2xffXU/1a/v3AAa0d1YAoqBNYqaS4R/HajkWIpIfdE6KcyFh1AQ=="],
+
+    "node-releases": ["node-releases@2.0.51", "", {}, "sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ=="],
+
+    "nth-check": ["nth-check@2.1.1", "", { "dependencies": { "boolbase": "^1.0.0" } }, "sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w=="],
+
+    "nypm": ["nypm@0.6.8", "", { "dependencies": { "citty": "^0.2.2", "pathe": "^2.0.3", "tinyexec": "^1.2.4" }, "bin": { "nypm": "./dist/cli.mjs" } }, "sha512-Q9K4Diu6l5u6xJQogeFSs/zKtyMSgFKFtRQV+tHP4kL7KPm2grpBU0dFIwFaXwNxN0MtfKWc43VpCugAa+LPsw=="],
+
+    "object-assign": ["object-assign@4.1.1", "", {}, "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg=="],
+
+    "object-inspect": ["object-inspect@1.13.4", "", {}, "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew=="],
+
+    "ofetch": ["ofetch@1.5.1", "", { "dependencies": { "destr": "^2.0.5", "node-fetch-native": "^1.6.7", "ufo": "^1.6.1" } }, "sha512-2W4oUZlVaqAPAil6FUg/difl6YhqhUR7x2eZY4bQCko22UXg3hptq9KLQdqFClV+Wu85UX7hNtdGTngi/1BxcA=="],
+
+    "ohash": ["ohash@2.0.11", "", {}, "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ=="],
+
+    "on-finished": ["on-finished@2.4.1", "", { "dependencies": { "ee-first": "1.1.1" } }, "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg=="],
+
+    "once": ["once@1.4.0", "", { "dependencies": { "wrappy": "1" } }, "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w=="],
+
+    "onetime": ["onetime@7.0.0", "", { "dependencies": { "mimic-function": "^5.0.0" } }, "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ=="],
+
+    "open": ["open@11.0.0", "", { "dependencies": { "default-browser": "^5.4.0", "define-lazy-prop": "^3.0.0", "is-in-ssh": "^1.0.0", "is-inside-container": "^1.0.0", "powershell-utils": "^0.1.0", "wsl-utils": "^0.3.0" } }, "sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw=="],
+
+    "optionator": ["optionator@0.9.4", "", { "dependencies": { "deep-is": "^0.1.3", "fast-levenshtein": "^2.0.6", "levn": "^0.4.1", "prelude-ls": "^1.2.1", "type-check": "^0.4.0", "word-wrap": "^1.2.5" } }, "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g=="],
+
+    "ora": ["ora@9.4.1", "", { "dependencies": { "chalk": "^5.6.2", "cli-cursor": "^5.0.0", "cli-spinners": "^3.2.0", "is-interactive": "^2.0.0", "is-unicode-supported": "^2.1.0", "log-symbols": "^7.0.1", "stdin-discarder": "^0.3.2", "string-width": "^8.1.0" } }, "sha512-6VlU9MLXbjVQD04AZCMX28hVtA5bUoadvUqO76MUCVA0ilwJbMiHsITRPfyVm6p/BC0Av/BXMujx39WCe1LEqw=="],
+
+    "p-event": ["p-event@6.0.1", "", { "dependencies": { "p-timeout": "^6.1.2" } }, "sha512-Q6Bekk5wpzW5qIyUP4gdMEujObYstZl6DMMOSenwBvV0BlE5LkDwkjs5yHbZmdCEq2o4RJx4tE1vwxFVf2FG1w=="],
+
+    "p-limit": ["p-limit@3.1.0", "", { "dependencies": { "yocto-queue": "^0.1.0" } }, "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ=="],
+
+    "p-locate": ["p-locate@5.0.0", "", { "dependencies": { "p-limit": "^3.0.2" } }, "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw=="],
+
+    "p-timeout": ["p-timeout@6.1.4", "", {}, "sha512-MyIV3ZA/PmyBN/ud8vV9XzwTrNtR4jFrObymZYnZqMmW0zA8Z17vnT0rBgFE/TlohB+YCHqXMgZzb3Csp49vqg=="],
+
+    "package-json-from-dist": ["package-json-from-dist@1.0.1", "", {}, "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw=="],
+
+    "parseurl": ["parseurl@1.3.3", "", {}, "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ=="],
+
+    "path-browserify": ["path-browserify@1.0.1", "", {}, "sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g=="],
+
+    "path-exists": ["path-exists@4.0.0", "", {}, "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w=="],
+
+    "path-is-absolute": ["path-is-absolute@1.0.1", "", {}, "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg=="],
+
+    "path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="],
+
+    "path-scurry": ["path-scurry@2.0.2", "", { "dependencies": { "lru-cache": "^11.0.0", "minipass": "^7.1.2" } }, "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg=="],
+
+    "path-to-regexp": ["path-to-regexp@8.4.2", "", {}, "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA=="],
+
+    "pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],
+
+    "perfect-debounce": ["perfect-debounce@2.1.0", "", {}, "sha512-LjgdTytVFXeUgtHZr9WYViYSM/g8MkcTPYDlPa3cDqMirHjKiSZPYd6DoL7pK8AJQr+uWkQvCjHNdiMqsrJs+g=="],
+
+    "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
+
+    "picomatch": ["picomatch@4.0.5", "", {}, "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A=="],
+
+    "pinia": ["pinia@2.3.1", "", { "dependencies": { "@vue/devtools-api": "^6.6.3", "vue-demi": "^0.14.10" }, "peerDependencies": { "typescript": ">=4.4.4", "vue": "^2.7.0 || ^3.5.11" }, "optionalPeers": ["typescript"] }, "sha512-khUlZSwt9xXCaTbbxFYBKDc/bWAGWJjOgvxETwkTN7KRm66EeT1ZdZj6i2ceh9sP2Pzqsbc704r2yngBrxBVug=="],
+
+    "pkce-challenge": ["pkce-challenge@5.0.1", "", {}, "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ=="],
+
+    "pkg-types": ["pkg-types@2.3.1", "", { "dependencies": { "confbox": "^0.2.4", "exsolve": "^1.0.8", "pathe": "^2.0.3" } }, "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg=="],
+
+    "postcss": ["postcss@8.5.19", "", { "dependencies": { "nanoid": "^3.3.12", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-Mz8SaolMd8nB+G13WkORcxQKHZ/NE4xXevtkJHVuG+guo9/wYKlIMTKAqGdEmYOXR2ijPjTYNHssizdaVSUNdQ=="],
+
+    "postcss-less": ["postcss-less@6.0.0", "", { "peerDependencies": { "postcss": "^8.3.5" } }, "sha512-FPX16mQLyEjLzEuuJtxA8X3ejDLNGGEG503d2YGZR5Ask1SpDN8KmZUMpzCvyalWRywAn1n1VOA5dcqfCLo5rg=="],
+
+    "postcss-sass": ["postcss-sass@0.5.0", "", { "dependencies": { "gonzales-pe": "^4.3.0", "postcss": "^8.2.14" } }, "sha512-qtu8awh1NMF3o9j/x9j3EZnd+BlF66X6NZYl12BdKoG2Z4hmydOt/dZj2Nq+g0kfk2pQy3jeYFBmvG9DBwynGQ=="],
+
+    "postcss-scss": ["postcss-scss@4.0.9", "", { "peerDependencies": { "postcss": "^8.4.29" } }, "sha512-AjKOeiwAitL/MXxQW2DliT28EKukvvbEWx3LBmJIRN8KfBGZbRTxNYW0kSqi1COiTZ57nZ9NW06S6ux//N1c9A=="],
+
+    "postcss-selector-parser": ["postcss-selector-parser@7.1.4", "", { "dependencies": { "cssesc": "^3.0.0", "util-deprecate": "^1.0.2" } }, "sha512-HeP7D2wyhkR+XaK6v4W8oRF62Dsz4flyuczALJp61GckGm42u1saSSJ/0auvcBqxs3jMRFEcPK34At/0JBKdOg=="],
+
+    "postcss-styl": ["postcss-styl@0.12.3", "", { "dependencies": { "debug": "^4.1.1", "fast-diff": "^1.2.0", "lodash.sortedlastindex": "^4.1.0", "postcss": "^7.0.27 || ^8.0.0", "stylus": "^0.57.0" } }, "sha512-8I7Cd8sxiEITIp32xBK4K/Aj1ukX6vuWnx8oY/oAH35NfQI4OZaY5nd68Yx8HeN5S49uhQ6DL0rNk0ZBu/TaLg=="],
+
+    "powershell-utils": ["powershell-utils@0.1.0", "", {}, "sha512-dM0jVuXJPsDN6DvRpea484tCUaMiXWjuCn++HGTqUWzGDjv5tZkEZldAJ/UMlqRYGFrD/etByo4/xOuC/snX2A=="],
+
+    "prelude-ls": ["prelude-ls@1.2.1", "", {}, "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g=="],
+
+    "prettier": ["prettier@3.9.5", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-/FVl766LpUfB5vXgCYOYa0MeV/441Ia99AeICQIQFTY/Nw0roZwULcXpku5i1/m5kt/baz+s4Zogspd839HSMg=="],
+
+    "prompts": ["prompts@2.4.2", "", { "dependencies": { "kleur": "^3.0.3", "sisteransi": "^1.0.5" } }, "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q=="],
+
+    "proxy-addr": ["proxy-addr@2.0.7", "", { "dependencies": { "forwarded": "0.2.0", "ipaddr.js": "1.9.1" } }, "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg=="],
+
+    "punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],
+
+    "qs": ["qs@6.15.3", "", { "dependencies": { "es-define-property": "^1.0.1", "side-channel": "^1.1.1" } }, "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A=="],
+
+    "queue-microtask": ["queue-microtask@1.2.3", "", {}, "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A=="],
+
+    "quote-js-string": ["quote-js-string@0.1.0", "", {}, "sha512-Y3NoRtprEEZQD8RfxMCfS0ZTqc4e+i18OrXEXAvpM6TfC/3y+0L5rNbZiSnbBBEkDfFzbpd8o+cE8q3/anjMGA=="],
+
+    "range-parser": ["range-parser@1.3.0", "", {}, "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw=="],
+
+    "raw-body": ["raw-body@3.0.2", "", { "dependencies": { "bytes": "~3.1.2", "http-errors": "~2.0.1", "iconv-lite": "~0.7.0", "unpipe": "~1.0.0" } }, "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA=="],
+
+    "rc9": ["rc9@3.0.1", "", { "dependencies": { "defu": "^6.1.6", "destr": "^2.0.5" } }, "sha512-gMDyleLWVE+i6Sgtc0QbbY6pEKqYs97NGi6isHQPqYlLemPoO8dxQ3uGi0f4NiP98c+jMW6cG1Kx9dDwfvqARQ=="],
+
+    "readdirp": ["readdirp@5.0.0", "", {}, "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ=="],
+
+    "recast-x": ["recast-x@1.0.5", "", { "dependencies": { "ast-types": "npm:ast-types-x@1.18.0", "source-map": "~0.6.1", "tiny-invariant": "^1.3.3", "tslib": "^2.0.1" } }, "sha512-CkfWKhQiYsMQYaWUkHdERXUxT2jJLBoa5y7zFv3dUAE7Ly5oU/0hsqrENyEfrCL03pDsQYbnoz17Cbagx/c2OA=="],
+
+    "reka-ui": ["reka-ui@2.10.1", "", { "dependencies": { "@floating-ui/dom": "^1.6.13", "@floating-ui/vue": "^1.1.6", "@internationalized/date": "^3.5.0", "@internationalized/number": "^3.5.0", "@tanstack/vue-virtual": "^3.12.0", "@vueuse/core": "^14.1.0", "@vueuse/shared": "^14.1.0", "aria-hidden": "^1.2.4", "defu": "^6.1.5", "ohash": "^2.0.11" }, "peerDependencies": { "vue": ">= 3.4.0" } }, "sha512-drcOQ4rQtDYAcGCsyQBqQg8QQ+H3B+zDaMJU0h8KPEPMa7g9BHu3zcOi4OB39XJSWizceFoNO0Z9tctSGLOXqg=="],
+
+    "require-from-string": ["require-from-string@2.0.2", "", {}, "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw=="],
+
+    "reserved-identifiers": ["reserved-identifiers@1.2.0", "", {}, "sha512-yE7KUfFvaBFzGPs5H3Ops1RevfUEsDc5Iz65rOwWg4lE8HJSYtle77uul3+573457oHvBKuHYDl/xqUkKpEEdw=="],
+
+    "resolve-pkg-maps": ["resolve-pkg-maps@1.0.0", "", {}, "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw=="],
+
+    "restore-cursor": ["restore-cursor@5.1.0", "", { "dependencies": { "onetime": "^7.0.0", "signal-exit": "^4.1.0" } }, "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA=="],
+
+    "reusify": ["reusify@1.1.0", "", {}, "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw=="],
+
+    "rollup": ["rollup@4.62.2", "", { "dependencies": { "@types/estree": "1.0.9" }, "optionalDependencies": { "@rollup/rollup-android-arm-eabi": "4.62.2", "@rollup/rollup-android-arm64": "4.62.2", "@rollup/rollup-darwin-arm64": "4.62.2", "@rollup/rollup-darwin-x64": "4.62.2", "@rollup/rollup-freebsd-arm64": "4.62.2", "@rollup/rollup-freebsd-x64": "4.62.2", "@rollup/rollup-linux-arm-gnueabihf": "4.62.2", "@rollup/rollup-linux-arm-musleabihf": "4.62.2", "@rollup/rollup-linux-arm64-gnu": "4.62.2", "@rollup/rollup-linux-arm64-musl": "4.62.2", "@rollup/rollup-linux-loong64-gnu": "4.62.2", "@rollup/rollup-linux-loong64-musl": "4.62.2", "@rollup/rollup-linux-ppc64-gnu": "4.62.2", "@rollup/rollup-linux-ppc64-musl": "4.62.2", "@rollup/rollup-linux-riscv64-gnu": "4.62.2", "@rollup/rollup-linux-riscv64-musl": "4.62.2", "@rollup/rollup-linux-s390x-gnu": "4.62.2", "@rollup/rollup-linux-x64-gnu": "4.62.2", "@rollup/rollup-linux-x64-musl": "4.62.2", "@rollup/rollup-openbsd-x64": "4.62.2", "@rollup/rollup-openharmony-arm64": "4.62.2", "@rollup/rollup-win32-arm64-msvc": "4.62.2", "@rollup/rollup-win32-ia32-msvc": "4.62.2", "@rollup/rollup-win32-x64-gnu": "4.62.2", "@rollup/rollup-win32-x64-msvc": "4.62.2", "fsevents": "~2.3.2" }, "bin": { "rollup": "dist/bin/rollup" } }, "sha512-RFnrW4lhXA3s3eqHDZvN654g8OTjzRfqpIRJYczCGB6HzphckVAi/Qh4tbPUbRuDi7s1Llv8g/NspLkttY3gTA=="],
+
+    "router": ["router@2.2.0", "", { "dependencies": { "debug": "^4.4.0", "depd": "^2.0.0", "is-promise": "^4.0.0", "parseurl": "^1.3.3", "path-to-regexp": "^8.0.0" } }, "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ=="],
+
+    "run-applescript": ["run-applescript@7.1.0", "", {}, "sha512-DPe5pVFaAsinSaV6QjQ6gdiedWDcRCbUuiQfQa2wmWV7+xC9bGulGI8+TdRmoFkAPaBXk8CrAbnlY2ISniJ47Q=="],
+
+    "run-parallel": ["run-parallel@1.2.0", "", { "dependencies": { "queue-microtask": "^1.2.2" } }, "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA=="],
+
+    "safer-buffer": ["safer-buffer@2.1.2", "", {}, "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="],
+
+    "sax": ["sax@1.2.4", "", {}, "sha512-NqVDv9TpANUjFm0N8uM5GxL36UgKi9/atZw+x7YFnQ8ckwFGKrl4xX4yWtrey3UJm5nP1kUbnYgLopqWNSRhWw=="],
+
+    "semver": ["semver@7.8.5", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA=="],
+
+    "send": ["send@1.2.1", "", { "dependencies": { "debug": "^4.4.3", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "fresh": "^2.0.0", "http-errors": "^2.0.1", "mime-types": "^3.0.2", "ms": "^2.1.3", "on-finished": "^2.4.1", "range-parser": "^1.2.1", "statuses": "^2.0.2" } }, "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ=="],
+
+    "serve-static": ["serve-static@2.2.1", "", { "dependencies": { "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "parseurl": "^1.3.3", "send": "^1.2.0" } }, "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw=="],
+
+    "setprototypeof": ["setprototypeof@1.2.0", "", {}, "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="],
+
+    "shadcn-vue": ["shadcn-vue@2.8.0", "", { "dependencies": { "@dotenvx/dotenvx": "^2.6.0", "@modelcontextprotocol/sdk": "^1.29.0", "@unovue/detypes": "^0.8.5", "@vue/compiler-sfc": "^3.5", "c12": "^3.3.4", "commander": "^15.0.0", "consola": "^3.4.2", "dedent": "^1.7.2", "deepmerge": "^4.3.1", "diff": "^9.0.0", "fs-extra": "^11.3.6", "fuzzysort": "^3.1.0", "get-tsconfig": "^4.14.0", "giget": "^3.3.0", "magic-string": "^0.30.21", "nypm": "^0.6.8", "ofetch": "^1.5.1", "open": "^11.0.0", "ora": "^9.4.1", "pathe": "^2.0.3", "postcss": "^8.5.19", "postcss-selector-parser": "^7.1.4", "prompts": "^2.4.2", "reka-ui": "^2.10.1", "semver": "^7.8.5", "stringify-object": "^7.0.0", "tailwindcss": "^4.3.2", "tinyexec": "^1.2.4", "tinyglobby": "^0.2.17", "ts-morph": "^28.0.0", "undici": "^8.7.0", "validate-npm-package-name": "^8.0.0", "vue-metamorph": "3.3.4", "zod": "^3.25.76", "zod-to-json-schema": "^3.25.2" }, "bin": { "shadcn-vue": "dist/index.js" } }, "sha512-iCRrUYGJ52rJkivBpk+O2ZW+2u30UOvA4sMTu8kw24r2UPkpO57NwLBMegPeC/ifPESSiOOrtMjvYTV5lpCf9w=="],
+
+    "shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="],
+
+    "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
+
+    "side-channel": ["side-channel@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.4", "side-channel-list": "^1.0.1", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ=="],
+
+    "side-channel-list": ["side-channel-list@1.0.1", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.4" } }, "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w=="],
+
+    "side-channel-map": ["side-channel-map@1.0.1", "", { "dependencies": { "call-bound": "^1.0.2", "es-errors": "^1.3.0", "get-intrinsic": "^1.2.5", "object-inspect": "^1.13.3" } }, "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA=="],
+
+    "side-channel-weakmap": ["side-channel-weakmap@1.0.2", "", { "dependencies": { "call-bound": "^1.0.2", "es-errors": "^1.3.0", "get-intrinsic": "^1.2.5", "object-inspect": "^1.13.3", "side-channel-map": "^1.0.1" } }, "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A=="],
+
+    "signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
+
+    "sisteransi": ["sisteransi@1.0.5", "", {}, "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg=="],
+
+    "slice-ansi": ["slice-ansi@4.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "astral-regex": "^2.0.0", "is-fullwidth-code-point": "^3.0.0" } }, "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ=="],
+
+    "source-map": ["source-map@0.7.6", "", {}, "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ=="],
+
+    "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
+
+    "source-map-resolve": ["source-map-resolve@0.6.0", "", { "dependencies": { "atob": "^2.1.2", "decode-uri-component": "^0.2.0" } }, "sha512-KXBr9d/fO/bWo97NXsPIAW1bFSBOuCnjbNTBMO7N59hsv5i9yzRDfcYwwt0l04+VqnKC+EwzvJZIP/qkuMgR/w=="],
+
+    "statuses": ["statuses@2.0.2", "", {}, "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw=="],
+
+    "stdin-discarder": ["stdin-discarder@0.3.2", "", {}, "sha512-eCPu1qRxPVkl5605OTWF8Wz40b4Mf45NY5LQmVPQ599knfs5QhASUm9GbJ5BDMDOXgrnh0wyEdvzmL//YMlw0A=="],
+
+    "string-width": ["string-width@8.2.2", "", { "dependencies": { "get-east-asian-width": "^1.5.0", "strip-ansi": "^7.1.2" } }, "sha512-GaPUh5gfdrYzqeVNZvUfT23vYYxXzKYidUcnMtJg/3rxRV63EFZy3k6xfKlmfeJD0176lnUV/Usr3XcwSvFzpg=="],
+
+    "stringify-object": ["stringify-object@7.0.0", "", { "dependencies": { "get-own-enumerable-keys": "^1.0.0", "is-identifier": "^1.0.1", "is-obj": "^3.0.0", "is-regexp": "^3.1.0", "quote-js-string": "^0.1.0" } }, "sha512-RQU1n5OVVXD9fhww7e/rqiKdMa+LPMFLz0zDTbZ+KUjMfiMmh9soT8aw5iwvCGVquUJOodoinyv3VECyY7aFBQ=="],
+
+    "strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="],
+
+    "stylus": ["stylus@0.57.0", "", { "dependencies": { "css": "^3.0.0", "debug": "^4.3.2", "glob": "^7.1.6", "safer-buffer": "^2.1.2", "sax": "~1.2.4", "source-map": "^0.7.3" }, "bin": { "stylus": "bin/stylus" } }, "sha512-yOI6G8WYfr0q8v8rRvE91wbxFU+rJPo760Va4MF6K0I6BZjO4r+xSynkvyPBP9tV1CIEUeRsiidjIs2rzb1CnQ=="],
+
+    "super-regex": ["super-regex@1.1.0", "", { "dependencies": { "function-timeout": "^1.0.1", "make-asynchronous": "^1.0.1", "time-span": "^5.1.0" } }, "sha512-WHkws2ZflZe41zj6AolvvmaTrWds/VuyeYr9iPVv/oQeaIoVxMKaushfFWpOGDT+GuBrM/sVqF8KUCYQlSSTdQ=="],
+
+    "table": ["table@6.9.0", "", { "dependencies": { "ajv": "^8.0.1", "lodash.truncate": "^4.4.2", "slice-ansi": "^4.0.0", "string-width": "^4.2.3", "strip-ansi": "^6.0.1" } }, "sha512-9kY+CygyYM6j02t5YFHbNz2FN5QmYGv9zAjVp4lCDjlCw7amdckXlEt/bjMhUIfj4ThGRE4gCUH5+yGnNuPo5A=="],
+
+    "tailwind-merge": ["tailwind-merge@3.6.0", "", {}, "sha512-uxL7qAVQriqRQPAyK3pj66VqskWqoZ37PW94jwOTwNfq/z9oyu1V+eqrZqtR2+fCiXdYOZe/Modt8GtvqNzu+w=="],
+
+    "tailwindcss": ["tailwindcss@4.3.3", "", {}, "sha512-gOhV3P7ufE62QDGg1zVaTgCR+EtPv92k2nIhVcVKcLmxT1sUBsQGhnZj175j+MqRt4zLF7ic+sCYjfhxMxj7YQ=="],
+
+    "tapable": ["tapable@2.3.3", "", {}, "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A=="],
+
+    "time-span": ["time-span@5.1.0", "", { "dependencies": { "convert-hrtime": "^5.0.0" } }, "sha512-75voc/9G4rDIJleOo4jPvN4/YC4GRZrY8yy1uU4lwrB3XEQbWve8zXoO5No4eFrGcTAMYyoY67p8jRQdtA1HbA=="],
+
+    "tiny-invariant": ["tiny-invariant@1.3.3", "", {}, "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg=="],
+
+    "tinyexec": ["tinyexec@1.2.4", "", {}, "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg=="],
+
+    "tinyglobby": ["tinyglobby@0.2.17", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g=="],
+
+    "to-regex-range": ["to-regex-range@5.0.1", "", { "dependencies": { "is-number": "^7.0.0" } }, "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ=="],
+
+    "toidentifier": ["toidentifier@1.0.1", "", {}, "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="],
+
+    "ts-morph": ["ts-morph@28.0.0", "", { "dependencies": { "@ts-morph/common": "~0.29.0", "code-block-writer": "^13.0.3" } }, "sha512-Wp3tnZ2bzwxyTZMtgWVzXDfm7lB1Drz+y9DmmYH/L702PQhPyVrp3pkou3yIz4qjS14GY9kcpmLiOOMvl8oG1g=="],
+
+    "tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
+
+    "tw-animate-css": ["tw-animate-css@1.4.0", "", {}, "sha512-7bziOlRqH0hJx80h/3mbicLW7o8qLsH5+RaLR2t+OHM3D0JlWGODQKQ4cxbK7WlvmUxpcj6Kgu6EKqjrGFe3QQ=="],
+
+    "type-check": ["type-check@0.4.0", "", { "dependencies": { "prelude-ls": "^1.2.1" } }, "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew=="],
+
+    "type-fest": ["type-fest@4.41.0", "", {}, "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA=="],
+
+    "type-is": ["type-is@2.1.0", "", { "dependencies": { "content-type": "^2.0.0", "media-typer": "^1.1.0", "mime-types": "^3.0.0" } }, "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA=="],
+
+    "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
+
+    "ufo": ["ufo@1.6.4", "", {}, "sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA=="],
+
+    "undici": ["undici@8.7.0", "", {}, "sha512-N7iQtfyLhIMOFgQubvmLV26svHpO0bqKnAiWotTQCVKCmWrcGbBotPuW1x+xwYZ2VHdSTVUfPQQnlEt1/LouTQ=="],
+
+    "universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
+
+    "unpipe": ["unpipe@1.0.0", "", {}, "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ=="],
+
+    "update-browserslist-db": ["update-browserslist-db@1.2.3", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w=="],
+
+    "uri-js": ["uri-js@4.4.1", "", { "dependencies": { "punycode": "^2.1.0" } }, "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg=="],
+
+    "util-deprecate": ["util-deprecate@1.0.2", "", {}, "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw=="],
+
+    "validate-npm-package-name": ["validate-npm-package-name@8.0.0", "", {}, "sha512-SCv6OOV6Xj2/3cXy3dGmADluJTNcL3o7hZAglNPTe+WYuEuvxgJzxPrSDLZhF+CwyQOubqgecjMmTJGMVLWjYQ=="],
+
+    "vary": ["vary@1.1.2", "", {}, "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg=="],
+
+    "vite": ["vite@5.4.21", "", { "dependencies": { "esbuild": "^0.21.3", "postcss": "^8.4.43", "rollup": "^4.20.0" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^18.0.0 || >=20.0.0", "less": "*", "lightningcss": "^1.21.0", "sass": "*", "sass-embedded": "*", "stylus": "*", "sugarss": "*", "terser": "^5.4.0" }, "optionalPeers": ["@types/node", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser"], "bin": { "vite": "bin/vite.js" } }, "sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw=="],
+
+    "vscode-uri": ["vscode-uri@3.1.0", "", {}, "sha512-/BpdSx+yCQGnCvecbyXdxHDkuk55/G3xwnC0GqY4gmQ3j+A+g8kzzgB4Nk/SINjqn6+waqw3EgbVF2QKExkRxQ=="],
+
+    "vue": ["vue@3.5.40", "", { "dependencies": { "@vue/compiler-dom": "3.5.40", "@vue/compiler-sfc": "3.5.40", "@vue/runtime-dom": "3.5.40", "@vue/server-renderer": "3.5.40", "@vue/shared": "3.5.40" }, "peerDependencies": { "typescript": "*" }, "optionalPeers": ["typescript"] }, "sha512-+8PJ4SJXdn/cHGImF4CKdxlWHIN5Dkt7DoufRREM6h6uVCx2m7QxgcEQmmzyOK8A9mcafg7sFbJFYsdFVubTig=="],
+
+    "vue-demi": ["vue-demi@0.14.10", "", { "peerDependencies": { "@vue/composition-api": "^1.0.0-rc.1", "vue": "^3.0.0-0 || ^2.6.0" }, "optionalPeers": ["@vue/composition-api"], "bin": { "vue-demi-fix": "bin/vue-demi-fix.js", "vue-demi-switch": "bin/vue-demi-switch.js" } }, "sha512-nMZBOwuzabUO0nLgIcc6rycZEebF6eeUfaiQx9+WSk8e29IbLvPU9feI6tqW4kTo3hvoYAJkMh8n8D0fuISphg=="],
+
+    "vue-eslint-parser": ["vue-eslint-parser@10.4.1", "", { "dependencies": { "debug": "^4.4.0", "eslint-scope": "^8.2.0 || ^9.0.0", "eslint-visitor-keys": "^4.2.0 || ^5.0.0", "espree": "^10.3.0 || ^11.0.0", "esquery": "^1.6.0", "semver": "^7.6.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0" } }, "sha512-Gk6gRDj0n/fkRa3C3l0bBheoBckUq/Rs0F/TvMWIS6nzzx67amAViMe9CkNgsP2tXyQONvGiHQESHwFtZ3aYDA=="],
+
+    "vue-metamorph": ["vue-metamorph@3.3.4", "", { "dependencies": { "@babel/parser": "8.0.0-alpha.12", "ast-types-x": "1.18.0", "chalk": "^5.3.0", "cli-progress": "^3.12.0", "commander": "^14.0.0", "deep-diff": "^1.0.2", "fs-extra": "^11.2.0", "glob": "^11.0.0", "lodash-es": "^4.17.21", "magic-string": "^0.30.10", "micromatch": "^4.0.8", "node-html-parser": "^7.0.1", "postcss": "^8.4.38", "postcss-less": "^6.0.0", "postcss-sass": "^0.5.0", "postcss-scss": "^4.0.9", "postcss-styl": "^0.12.3", "recast-x": "1.0.5", "table": "^6.8.2", "vue-eslint-parser": "^10.1.0" }, "bin": { "vue-metamorph": "scripts/scaffold.js" } }, "sha512-WZ1xzHrmYh9UiZ7OC9eG1ASzgSybEB10jhop+k5KzMY9I1JmRKdreqUYzbV3hOnOMvLhyDn7y6f62mLE2jHFSg=="],
+
+    "vue-router": ["vue-router@4.6.4", "", { "dependencies": { "@vue/devtools-api": "^6.6.4" }, "peerDependencies": { "vue": "^3.5.0" } }, "sha512-Hz9q5sa33Yhduglwz6g9skT8OBPii+4bFn88w6J+J4MfEo4KRRpmiNG/hHHkdbRFlLBOqxN8y8gf2Fb0MTUgVg=="],
+
+    "vue-tsc": ["vue-tsc@2.2.12", "", { "dependencies": { "@volar/typescript": "2.4.15", "@vue/language-core": "2.2.12" }, "peerDependencies": { "typescript": ">=5.0.0" }, "bin": { "vue-tsc": "./bin/vue-tsc.js" } }, "sha512-P7OP77b2h/Pmk+lZdJ0YWs+5tJ6J2+uOQPo7tlBnY44QqQSPYvS0qVT4wqDJgwrZaLe47etJLLQRFia71GYITw=="],
+
+    "web-worker": ["web-worker@1.5.0", "", {}, "sha512-RiMReJrTAiA+mBjGONMnjVDP2u3p9R1vkcGz6gDIrOMT3oGuYwX2WRMYI9ipkphSuE5XKEhydbhNEJh4NY9mlw=="],
+
+    "which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="],
+
+    "word-wrap": ["word-wrap@1.2.5", "", {}, "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA=="],
+
+    "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
+
+    "wsl-utils": ["wsl-utils@0.3.1", "", { "dependencies": { "is-wsl": "^3.1.0", "powershell-utils": "^0.1.0" } }, "sha512-g/eziiSUNBSsdDJtCLB8bdYEUMj4jR7AGeUo96p/3dTafgjHhpF4RiCFPiRILwjQoDXx5MqkBr4fwWtR3Ky4Wg=="],
+
+    "yallist": ["yallist@3.1.1", "", {}, "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="],
+
+    "yocto-queue": ["yocto-queue@0.1.0", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
+
+    "yocto-spinner": ["yocto-spinner@1.2.1", "", { "dependencies": { "yoctocolors": "^2.1.1" } }, "sha512-9cbFWLhbiZp+820O4pkHGNncI7+MrUGzBOjw8NMG+ewsY+aG0DdEXnr19Smxao32YOjLZRMdn1UtaxcrXOYOIg=="],
+
+    "yoctocolors": ["yoctocolors@2.1.2", "", {}, "sha512-CzhO+pFNo8ajLM2d2IW/R93ipy99LWjtwblvC1RsoSUMZgyLbYFr221TnSNT7GjGdYui6P459mw9JH/g/zW2ug=="],
+
+    "zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
+
+    "zod-to-json-schema": ["zod-to-json-schema@3.25.2", "", { "peerDependencies": { "zod": "^3.25.28 || ^4" } }, "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA=="],
+
+    "@babel/core/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
+
+    "@babel/helper-compilation-targets/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
+
+    "@babel/helper-create-class-features-plugin/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
+
+    "@eslint-community/eslint-utils/eslint-visitor-keys": ["eslint-visitor-keys@3.4.3", "", {}, "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag=="],
+
+    "@eslint/config-array/minimatch": ["minimatch@10.2.5", "", { "dependencies": { "brace-expansion": "^5.0.5" } }, "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg=="],
+
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.11.2", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.2", "tslib": "^2.4.0" }, "bundled": true }, "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA=="],
+
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.11.2", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA=="],
+
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.2", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA=="],
+
+    "@tailwindcss/oxide-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.6", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" }, "bundled": true }, "sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg=="],
+
+    "@tailwindcss/oxide-wasm32-wasi/@tybys/wasm-util": ["@tybys/wasm-util@0.10.3", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg=="],
+
+    "@tailwindcss/oxide-wasm32-wasi/tslib": ["tslib@2.8.1", "", { "bundled": true }, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
+
+    "@ts-morph/common/minimatch": ["minimatch@10.2.5", "", { "dependencies": { "brace-expansion": "^5.0.5" } }, "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg=="],
+
+    "@unovue/detypes/@vue/compiler-dom": ["@vue/compiler-dom@3.5.39", "", { "dependencies": { "@vue/compiler-core": "3.5.39", "@vue/shared": "3.5.39" } }, "sha512-oQPigALqYbNxTNPvNgSOe+czwVExfbVF02lz8jP0S3AXJiu3jxYDygNUiqSep4ezzW8XgnubqH63My2A7JR/vg=="],
+
+    "@unovue/detypes/@vue/compiler-sfc": ["@vue/compiler-sfc@3.5.39", "", { "dependencies": { "@babel/parser": "^7.29.7", "@vue/compiler-core": "3.5.39", "@vue/compiler-dom": "3.5.39", "@vue/compiler-ssr": "3.5.39", "@vue/shared": "3.5.39", "estree-walker": "^2.0.2", "magic-string": "^0.30.21", "postcss": "^8.5.15", "source-map-js": "^1.2.1" } }, "sha512-d0ki86iOyN8LoZPBmk5SJWNwHP19CnDDCfuo//+2WJa2g5Ke0Jay983PIBIcSSzldC68I8DrD5GrHV3OSDfodg=="],
+
+    "@vue/language-core/@vue/compiler-dom": ["@vue/compiler-dom@3.5.39", "", { "dependencies": { "@vue/compiler-core": "3.5.39", "@vue/shared": "3.5.39" } }, "sha512-oQPigALqYbNxTNPvNgSOe+czwVExfbVF02lz8jP0S3AXJiu3jxYDygNUiqSep4ezzW8XgnubqH63My2A7JR/vg=="],
+
+    "@vue/language-core/@vue/shared": ["@vue/shared@3.5.39", "", {}, "sha512-l1rrBtBfTnmxvtsvdQDXltUUy8S1Y+ZaqdfUzmAnJkTd8Z8rv5v/ytW+TKiqEOWyHPoqtPlNFSs0lhRmYVSHVA=="],
+
+    "@vuedx/template-ast-types/@vue/compiler-core": ["@vue/compiler-core@3.5.39", "", { "dependencies": { "@babel/parser": "^7.29.7", "@vue/shared": "3.5.39", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-16KBTEXAJCpDr0mwlw+AZyhu8iyC7R3S2vBwsI7QnWJU6X3WKc9VKeNEZpiMdZ569qWhz9574L3vV55qRL0Vtw=="],
+
+    "body-parser/content-type": ["content-type@2.0.0", "", {}, "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ=="],
+
+    "cli-progress/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
+
+    "css/source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
+
+    "dom-serializer/entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="],
+
+    "eslint/ajv": ["ajv@6.15.0", "", { "dependencies": { "fast-deep-equal": "^3.1.1", "fast-json-stable-stringify": "^2.0.0", "json-schema-traverse": "^0.4.1", "uri-js": "^4.2.2" } }, "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw=="],
+
+    "eslint/glob-parent": ["glob-parent@6.0.2", "", { "dependencies": { "is-glob": "^4.0.3" } }, "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A=="],
+
+    "eslint/minimatch": ["minimatch@10.2.5", "", { "dependencies": { "brace-expansion": "^5.0.5" } }, "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg=="],
+
+    "glob/minimatch": ["minimatch@3.1.5", "", { "dependencies": { "brace-expansion": "^1.1.7" } }, "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w=="],
+
+    "micromatch/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
+
+    "path-scurry/lru-cache": ["lru-cache@11.5.2", "", {}, "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g=="],
+
+    "recast-x/source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
+
+    "shadcn-vue/@vue/compiler-sfc": ["@vue/compiler-sfc@3.5.39", "", { "dependencies": { "@babel/parser": "^7.29.7", "@vue/compiler-core": "3.5.39", "@vue/compiler-dom": "3.5.39", "@vue/compiler-ssr": "3.5.39", "@vue/shared": "3.5.39", "estree-walker": "^2.0.2", "magic-string": "^0.30.21", "postcss": "^8.5.15", "source-map-js": "^1.2.1" } }, "sha512-d0ki86iOyN8LoZPBmk5SJWNwHP19CnDDCfuo//+2WJa2g5Ke0Jay983PIBIcSSzldC68I8DrD5GrHV3OSDfodg=="],
+
+    "shadcn-vue/tailwindcss": ["tailwindcss@4.3.2", "", {}, "sha512-WtctNNSH8A9jlMIqxzuYumOHU5uGZyRv0Q5svQl+oEPy5w84YpBxdb7MdqyiSPQge5jTJ6zFQLq0PFygdccSBA=="],
+
+    "table/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
+
+    "table/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "type-is/content-type": ["content-type@2.0.0", "", {}, "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ=="],
+
+    "vue-metamorph/@babel/parser": ["@babel/parser@8.0.0-alpha.12", "", { "bin": "./bin/babel-parser.js" }, "sha512-AzWmrp4uJ+DcXVH0uoUpJVhRqxNirC0BbXsZ82AQuVod41CoaV5G+cwcvtYusrIIxv7BIJb6ce0dQ9L0wAl1iA=="],
+
+    "vue-metamorph/commander": ["commander@14.0.3", "", {}, "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw=="],
+
+    "vue-metamorph/glob": ["glob@11.1.0", "", { "dependencies": { "foreground-child": "^3.3.1", "jackspeak": "^4.1.1", "minimatch": "^10.1.1", "minipass": "^7.1.2", "package-json-from-dist": "^1.0.0", "path-scurry": "^2.0.0" }, "bin": { "glob": "dist/esm/bin.mjs" } }, "sha512-vuNwKSaKiqm7g0THUBu2x7ckSs3XJLXE+2ssL7/MfTGPLLcrJQ/4Uq1CjPTtO5cCIiRxqvN6Twy1qOwhL0Xjcw=="],
+
+    "@eslint/config-array/minimatch/brace-expansion": ["brace-expansion@5.0.7", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA=="],
+
+    "@ts-morph/common/minimatch/brace-expansion": ["brace-expansion@5.0.7", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA=="],
+
+    "@unovue/detypes/@vue/compiler-dom/@vue/compiler-core": ["@vue/compiler-core@3.5.39", "", { "dependencies": { "@babel/parser": "^7.29.7", "@vue/shared": "3.5.39", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-16KBTEXAJCpDr0mwlw+AZyhu8iyC7R3S2vBwsI7QnWJU6X3WKc9VKeNEZpiMdZ569qWhz9574L3vV55qRL0Vtw=="],
+
+    "@unovue/detypes/@vue/compiler-dom/@vue/shared": ["@vue/shared@3.5.39", "", {}, "sha512-l1rrBtBfTnmxvtsvdQDXltUUy8S1Y+ZaqdfUzmAnJkTd8Z8rv5v/ytW+TKiqEOWyHPoqtPlNFSs0lhRmYVSHVA=="],
+
+    "@unovue/detypes/@vue/compiler-sfc/@vue/compiler-core": ["@vue/compiler-core@3.5.39", "", { "dependencies": { "@babel/parser": "^7.29.7", "@vue/shared": "3.5.39", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-16KBTEXAJCpDr0mwlw+AZyhu8iyC7R3S2vBwsI7QnWJU6X3WKc9VKeNEZpiMdZ569qWhz9574L3vV55qRL0Vtw=="],
+
+    "@unovue/detypes/@vue/compiler-sfc/@vue/compiler-ssr": ["@vue/compiler-ssr@3.5.39", "", { "dependencies": { "@vue/compiler-dom": "3.5.39", "@vue/shared": "3.5.39" } }, "sha512-Ce7/wvwMHai74bdszfXExdazFigYnlF9zgCmEQUcM1j0fOymlouZ7XilTYNo8oUjhlnjYOZbGrcYKuqjz89Ucw=="],
+
+    "@unovue/detypes/@vue/compiler-sfc/@vue/shared": ["@vue/shared@3.5.39", "", {}, "sha512-l1rrBtBfTnmxvtsvdQDXltUUy8S1Y+ZaqdfUzmAnJkTd8Z8rv5v/ytW+TKiqEOWyHPoqtPlNFSs0lhRmYVSHVA=="],
+
+    "@vue/language-core/@vue/compiler-dom/@vue/compiler-core": ["@vue/compiler-core@3.5.39", "", { "dependencies": { "@babel/parser": "^7.29.7", "@vue/shared": "3.5.39", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-16KBTEXAJCpDr0mwlw+AZyhu8iyC7R3S2vBwsI7QnWJU6X3WKc9VKeNEZpiMdZ569qWhz9574L3vV55qRL0Vtw=="],
+
+    "@vuedx/template-ast-types/@vue/compiler-core/@vue/shared": ["@vue/shared@3.5.39", "", {}, "sha512-l1rrBtBfTnmxvtsvdQDXltUUy8S1Y+ZaqdfUzmAnJkTd8Z8rv5v/ytW+TKiqEOWyHPoqtPlNFSs0lhRmYVSHVA=="],
+
+    "cli-progress/string-width/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "eslint/ajv/json-schema-traverse": ["json-schema-traverse@0.4.1", "", {}, "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg=="],
+
+    "eslint/minimatch/brace-expansion": ["brace-expansion@5.0.7", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA=="],
+
+    "glob/minimatch/brace-expansion": ["brace-expansion@1.1.16", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw=="],
+
+    "shadcn-vue/@vue/compiler-sfc/@vue/compiler-core": ["@vue/compiler-core@3.5.39", "", { "dependencies": { "@babel/parser": "^7.29.7", "@vue/shared": "3.5.39", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-16KBTEXAJCpDr0mwlw+AZyhu8iyC7R3S2vBwsI7QnWJU6X3WKc9VKeNEZpiMdZ569qWhz9574L3vV55qRL0Vtw=="],
+
+    "shadcn-vue/@vue/compiler-sfc/@vue/compiler-dom": ["@vue/compiler-dom@3.5.39", "", { "dependencies": { "@vue/compiler-core": "3.5.39", "@vue/shared": "3.5.39" } }, "sha512-oQPigALqYbNxTNPvNgSOe+czwVExfbVF02lz8jP0S3AXJiu3jxYDygNUiqSep4ezzW8XgnubqH63My2A7JR/vg=="],
+
+    "shadcn-vue/@vue/compiler-sfc/@vue/compiler-ssr": ["@vue/compiler-ssr@3.5.39", "", { "dependencies": { "@vue/compiler-dom": "3.5.39", "@vue/shared": "3.5.39" } }, "sha512-Ce7/wvwMHai74bdszfXExdazFigYnlF9zgCmEQUcM1j0fOymlouZ7XilTYNo8oUjhlnjYOZbGrcYKuqjz89Ucw=="],
+
+    "shadcn-vue/@vue/compiler-sfc/@vue/shared": ["@vue/shared@3.5.39", "", {}, "sha512-l1rrBtBfTnmxvtsvdQDXltUUy8S1Y+ZaqdfUzmAnJkTd8Z8rv5v/ytW+TKiqEOWyHPoqtPlNFSs0lhRmYVSHVA=="],
+
+    "table/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
+    "vue-metamorph/glob/minimatch": ["minimatch@10.2.5", "", { "dependencies": { "brace-expansion": "^5.0.5" } }, "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg=="],
+
+    "@eslint/config-array/minimatch/brace-expansion/balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
+
+    "@ts-morph/common/minimatch/brace-expansion/balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
+
+    "cli-progress/string-width/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
+    "eslint/minimatch/brace-expansion/balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
+
+    "vue-metamorph/glob/minimatch/brace-expansion": ["brace-expansion@5.0.7", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA=="],
+
+    "vue-metamorph/glob/minimatch/brace-expansion/balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
+  }
+}
diff --git a/ui/index.html b/ui/index.html
new file mode 100644
index 0000000..e66c144
--- /dev/null
+++ b/ui/index.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Mercury</title>
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+  </head>
+  <body>
+    <div id="app"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>
diff --git a/ui/package.json b/ui/package.json
new file mode 100644
index 0000000..ea54610
--- /dev/null
+++ b/ui/package.json
@@ -0,0 +1,25 @@
+{
+  "name": "mercury-ui",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vue-tsc --noEmit && vite build",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@nychthemeron/library": "^0.0.3",
+    "pinia": "^2.3.1",
+    "vue": "^3.5.40",
+    "vue-router": "^4.6.4"
+  },
+  "devDependencies": {
+    "@tailwindcss/vite": "^4.3.3",
+    "@vitejs/plugin-vue": "^5.2.4",
+    "tailwindcss": "^4.3.3",
+    "typescript": "^5.9.3",
+    "vite": "^5.4.21",
+    "vue-tsc": "^2.2.12"
+  }
+}
diff --git a/ui/public/favicon.svg b/ui/public/favicon.svg
new file mode 100644
index 0000000..12fae39
--- /dev/null
+++ b/ui/public/favicon.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <!-- Background circle -->
+  <circle cx="32" cy="32" r="32" fill="#1a1410"/>
+  <!-- Mercury symbol ☿ -->
+  <!-- Top crescent (horns) -->
+  <path d="M22 18 Q32 10 42 18" fill="none" stroke="#c9a84c" stroke-width="3.5" stroke-linecap="round"/>
+  <!-- Circle for the head -->
+  <circle cx="32" cy="25" r="7" fill="none" stroke="#c9a84c" stroke-width="3.5"/>
+  <!-- Vertical staff -->
+  <line x1="32" y1="32" x2="32" y2="50" stroke="#c9a84c" stroke-width="3.5" stroke-linecap="round"/>
+  <!-- Cross bar -->
+  <line x1="24" y1="40" x2="40" y2="40" stroke="#c9a84c" stroke-width="3.5" stroke-linecap="round"/>
+</svg>
diff --git a/ui/src/App.vue b/ui/src/App.vue
new file mode 100644
index 0000000..7c2aa3f
--- /dev/null
+++ b/ui/src/App.vue
@@ -0,0 +1,3 @@
+<template>
+  <RouterView />
+</template>
diff --git a/ui/src/assets/main.css b/ui/src/assets/main.css
new file mode 100644
index 0000000..abb8761
--- /dev/null
+++ b/ui/src/assets/main.css
@@ -0,0 +1,265 @@
+*,
+*::before,
+*::after {
+    box-sizing: border-box;
+    -webkit-font-smoothing: antialiased;
+    -moz-osx-font-smoothing: grayscale;
+    text-rendering: optimizeLegibility;
+}
+
+body {
+    margin: 0;
+    font-family: var(--font-serif);
+    background-color: var(--surface-0);
+    color: var(--text-body);
+    min-height: 100vh;
+}
+
+h1,
+h2,
+h3 {
+    font-family: var(--font-serif);
+    font-weight: 600; /* Cinzel's actual heaviest weight — avoids synthetic bold */
+    font-optical-sizing: auto;
+    color: var(--text-high);
+    margin: 0;
+    letter-spacing: 0.06em;
+}
+
+a {
+    color: var(--primary);
+    text-decoration: none;
+}
+a:hover {
+    text-decoration: underline;
+}
+
+code {
+    font-family: var(--font-mono);
+    font-size: 0.85em;
+    color: var(--text-label);
+    background: var(--surface-2);
+    padding: 0.1em 0.4em;
+    border-radius: 3px;
+    border: 1px solid var(--border-lo);
+}
+
+/* ── Page header ────────────────────────────────────────── */
+.page-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: flex-end;
+    margin-bottom: 1.75rem;
+}
+
+.page-title {
+    display: flex;
+    flex-direction: column;
+    gap: 0.25rem;
+}
+
+.page-title h2 {
+    font-size: 1.6rem;
+    line-height: 1;
+}
+
+.page-title .subtitle {
+    font-family: var(--font-sans);
+    font-size: 0.8rem;
+    color: var(--text-muted);
+    letter-spacing: 0.02em;
+}
+
+/* ── Table card ─────────────────────────────────────────── */
+.table-card {
+    background-color: var(--surface-1);
+    border: 1px solid var(--border);
+    border-radius: 12px;
+    box-shadow:
+        0 4px 24px rgba(0, 0, 0, 0.07),
+        0 1px 4px rgba(0, 0, 0, 0.05);
+    overflow: hidden;
+}
+
+/* Scroll wrapper sits inside the card so the header stays pinned */
+.table-scroll {
+    overflow-x: auto;
+}
+
+.table-card-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 0.875rem 1.25rem;
+    border-bottom: 1px solid var(--border);
+    background: var(--surface-2);
+}
+
+.table-card-header .count {
+    font-size: 0.78rem;
+    color: var(--text-muted);
+    font-family: var(--font-mono);
+}
+
+.data-table {
+    width: 100%;
+    min-width: max-content;
+    border-collapse: collapse;
+    font-family: var(--font-serif);
+    font-size: 0.875rem;
+}
+
+.data-table th {
+    padding: 0.65rem 1.25rem;
+    text-align: left;
+    background-color: var(--surface-2);
+    border-bottom: 1px solid var(--border);
+    font-weight: 700;
+    font-size: 0.7rem;
+    color: var(--text-muted);
+    letter-spacing: 0.1em;
+    text-transform: uppercase;
+}
+
+.data-table td {
+    padding: 0.8rem 1.25rem;
+    text-align: left;
+    border-bottom: 1px solid var(--border-lo);
+    color: var(--text-body);
+    vertical-align: middle;
+}
+
+.data-table tbody tr:last-child td {
+    border-bottom: none;
+}
+
+.data-table tbody tr {
+    transition: background-color 0.12s ease;
+}
+
+.data-table tbody tr:hover td {
+    background: color-mix(in srgb, var(--primary) 4%, var(--surface-1));
+}
+
+.actions-cell {
+    display: flex;
+    gap: 0.4rem;
+}
+
+/* ── Empty state ────────────────────────────────────────── */
+.empty-state {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    gap: 0.5rem;
+    padding: 4rem 2rem;
+    color: var(--text-dim);
+}
+
+.empty-state .empty-icon {
+    font-size: 2.5rem;
+    opacity: 0.35;
+    line-height: 1;
+}
+
+.empty-state .empty-label {
+    font-family: var(--font-serif);
+    font-size: 1rem;
+    letter-spacing: 0.04em;
+    color: var(--text-muted);
+}
+
+.empty-state .empty-hint {
+    font-size: 0.8rem;
+    color: var(--text-dim);
+}
+
+/* ── Dialog form ────────────────────────────────────────── */
+.dialog-form {
+    display: flex;
+    flex-direction: column;
+    gap: 1.1rem;
+    padding-top: 0.25rem;
+}
+
+.field {
+    display: flex;
+    flex-direction: column;
+    gap: 0.4rem;
+}
+
+.field label {
+    font-size: 0.72rem;
+    font-weight: 700;
+    letter-spacing: 0.09em;
+    text-transform: uppercase;
+    color: var(--text-muted);
+}
+
+.field .hint {
+    margin: 0;
+    font-size: 0.78rem;
+    color: var(--text-dim);
+}
+
+.optional {
+    font-weight: 400;
+    font-size: 0.72rem;
+    color: var(--text-dim);
+    letter-spacing: 0;
+    text-transform: none;
+}
+
+/* ── Gold divider ───────────────────────────────────────── */
+.gold-rule {
+    display: flex;
+    align-items: center;
+    gap: 0.6rem;
+    color: var(--primary);
+    font-size: 0.6rem;
+    letter-spacing: 0.2em;
+    opacity: 0.6;
+}
+.gold-rule::before,
+.gold-rule::after {
+    content: "";
+    flex: 1;
+    height: 1px;
+    background: linear-gradient(
+        90deg,
+        transparent,
+        var(--primary),
+        transparent
+    );
+}
+.nych-loading-icon .wreath {
+    transform-box: fill-box;
+    transform-origin: center;
+}
+
+/* ── Loading spinner ─────────────────────────────────────── */
+@keyframes mercury-spin {
+  to { transform: rotate(360deg); }
+}
+
+.loading-spinner {
+  width: 1.25rem;
+  height: 1.25rem;
+  border: 2px solid var(--border);
+  border-top-color: var(--primary);
+  border-radius: 50%;
+  animation: mercury-spin 0.7s linear infinite;
+  flex-shrink: 0;
+}
+
+.loading-overlay {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.6rem;
+  padding: 3rem 2rem;
+  color: var(--text-muted);
+  font-size: 0.85rem;
+  font-family: var(--font-sans);
+}
diff --git a/ui/src/env.d.ts b/ui/src/env.d.ts
new file mode 100644
index 0000000..6ac34fb
--- /dev/null
+++ b/ui/src/env.d.ts
@@ -0,0 +1,7 @@
+/// <reference types="vite/client" />
+
+declare module '*.vue' {
+  import type { DefineComponent } from 'vue'
+  const component: DefineComponent
+  export default component
+}
diff --git a/ui/src/main.ts b/ui/src/main.ts
new file mode 100644
index 0000000..c42482d
--- /dev/null
+++ b/ui/src/main.ts
@@ -0,0 +1,14 @@
+import { createApp } from "vue";
+import '@nychthemeron/library/style'
+import './assets/main.css'
+import './stores/theme'
+import { createPinia } from "pinia";
+import { createNychthemeron } from "@nychthemeron/library";
+import App from "./App.vue";
+import router from "./router";
+
+const app = createApp(App);
+app.use(createPinia());
+app.use(router);
+app.use(createNychthemeron());
+app.mount("#app");
diff --git a/ui/src/router/index.ts b/ui/src/router/index.ts
new file mode 100644
index 0000000..f942970
--- /dev/null
+++ b/ui/src/router/index.ts
@@ -0,0 +1,38 @@
+import { createRouter, createWebHistory } from 'vue-router'
+import { useAuthStore } from '../stores/auth'
+
+const router = createRouter({
+  history: createWebHistory(),
+  routes: [
+    { path: '/login', component: () => import('../views/Login.vue') },
+    {
+      path: '/admin',
+      component: () => import('../views/admin/Layout.vue'),
+      children: [
+        { path: 'queries', component: () => import('../views/admin/Queries.vue') },
+        { path: 'tables', component: () => import('../views/admin/Tables.vue') },
+        { path: 'users', component: () => import('../views/admin/Users.vue') },
+        { path: 'permissions', component: () => import('../views/admin/Permissions.vue') },
+        { path: 'blacklist', component: () => import('../views/admin/Blacklist.vue') },
+        { path: 'api-keys', component: () => import('../views/admin/ApiKeys.vue') },
+        { path: 'cache', component: () => import('../views/admin/Cache.vue') },
+        { path: 'cors', component: () => import('../views/admin/Cors.vue') },
+        { path: 'cdn', component: () => import('../views/admin/Cdn.vue') },
+      ],
+      meta: { requiresAuth: true },
+    },
+    { path: '/', redirect: '/admin/queries' },
+  ],
+})
+
+router.beforeEach((to) => {
+  const auth = useAuthStore()
+  if (to.meta.requiresAuth && !auth.isAuthenticated) {
+    return '/login'
+  }
+  if (to.path === '/login' && auth.isAuthenticated) {
+    return '/admin/queries'
+  }
+})
+
+export default router
diff --git a/ui/src/stores/auth.ts b/ui/src/stores/auth.ts
new file mode 100644
index 0000000..4fe8b5f
--- /dev/null
+++ b/ui/src/stores/auth.ts
@@ -0,0 +1,70 @@
+import { defineStore } from "pinia";
+import { ref, computed } from "vue";
+
+interface Claims {
+    sub: string;
+    permissions: string;
+    exp: number;
+}
+
+function parseJwt(token: string): Claims | null {
+    try {
+        const payload = token.split(".")[1];
+        return payload ? (JSON.parse(atob(payload)) as Claims) : null;
+    } catch {
+        return null;
+    }
+}
+
+export const useAuthStore = defineStore("auth", () => {
+    const token = ref<string | null>(localStorage.getItem("mercury_token"));
+    const claims = computed<Claims | null>(() =>
+        token.value ? parseJwt(token.value) : null,
+    );
+    const isAuthenticated = computed(() => {
+        if (!claims.value) return false;
+        return claims.value.exp * 1000 > Date.now();
+    });
+    const username = computed(() => claims.value?.sub ?? "");
+
+    function hasPermission(bit: bigint): boolean {
+        if (!claims.value) return false;
+        const mask = BigInt(claims.value.permissions);
+        return (mask & bit) !== 0n;
+    }
+
+    const isSuperAdmin = computed(() => hasPermission(32n));
+
+    async function login(username: string, password: string): Promise<void> {
+        const res = await fetch("/auth/login", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ username, password }),
+        });
+        if (!res.ok) throw new Error("Invalid credentials");
+        const data = await res.json();
+        token.value = data.token;
+        localStorage.setItem("mercury_token", data.token);
+    }
+
+    function logout() {
+        token.value = null;
+        localStorage.removeItem("mercury_token");
+    }
+
+    function authHeaders(): Record<string, string> {
+        return token.value ? { Authorization: `Bearer ${token.value}` } : {};
+    }
+
+    return {
+        token,
+        claims,
+        isAuthenticated,
+        username,
+        isSuperAdmin,
+        hasPermission,
+        login,
+        logout,
+        authHeaders,
+    };
+});
diff --git a/ui/src/stores/theme.ts b/ui/src/stores/theme.ts
new file mode 100644
index 0000000..9cebd64
--- /dev/null
+++ b/ui/src/stores/theme.ts
@@ -0,0 +1,24 @@
+import { ref } from 'vue'
+
+export type Theme = 'apollo' | 'hades'
+
+const stored = localStorage.getItem('mercury-theme') as Theme | null
+const theme = ref<Theme>(stored ?? 'apollo')
+
+function applyTheme(t: Theme) {
+  theme.value = t
+  document.documentElement.setAttribute('data-theme', t)
+  localStorage.setItem('mercury-theme', t)
+}
+
+applyTheme(theme.value)
+
+export function useTheme() {
+  return {
+    theme,
+    isDark: () => theme.value === 'hades',
+    toggle() {
+      applyTheme(theme.value === 'apollo' ? 'hades' : 'apollo')
+    },
+  }
+}
diff --git a/ui/src/views/Login.vue b/ui/src/views/Login.vue
new file mode 100644
index 0000000..23b0c80
--- /dev/null
+++ b/ui/src/views/Login.vue
@@ -0,0 +1,173 @@
+<template>
+    <div class="login-page">
+        <div class="login-card">
+            <div class="login-brand">
+                <img src="/favicon.svg" class="brand-ornament" alt="" />
+                <h1>Mercury</h1>
+                <p class="brand-sub">Administration Console</p>
+                <div class="brand-rule"></div>
+            </div>
+
+            <form @submit.prevent="handleLogin" class="login-form">
+                <div class="login-field">
+                    <label>Username</label>
+                    <NychInput
+                        v-model="username"
+                        placeholder="username"
+                        class="w-full"
+                        autocomplete="username"
+                    />
+                </div>
+                <div class="login-field">
+                    <label>Password</label>
+                    <NychInput
+                        v-model="password"
+                        type="password"
+                        placeholder="••••••••"
+                        class="w-full"
+                        autocomplete="current-password"
+                    />
+                </div>
+                <p v-if="error" class="login-error">{{ error }}</p>
+                <NychButton type="submit" :loading="loading" class="w-full">Sign In</NychButton>
+            </form>
+        </div>
+    </div>
+</template>
+
+<script setup lang="ts">
+import { ref } from "vue";
+import { useRouter } from "vue-router";
+import { useAuthStore } from "../stores/auth";
+
+const auth = useAuthStore();
+const router = useRouter();
+const username = ref("");
+const password = ref("");
+const loading = ref(false);
+const error = ref("");
+
+async function handleLogin() {
+    loading.value = true;
+    error.value = "";
+    try {
+        await auth.login(username.value, password.value);
+        router.push("/admin/queries");
+    } catch {
+        error.value = "Invalid username or password";
+    } finally {
+        loading.value = false;
+    }
+}
+</script>
+
+<style scoped>
+.login-page {
+    display: flex;
+    min-height: 100vh;
+    align-items: center;
+    justify-content: center;
+    background-color: var(--surface-0);
+    background-image: radial-gradient(
+        ellipse 80% 60% at 50% 0%,
+        color-mix(in srgb, var(--primary) 8%, transparent),
+        transparent
+    );
+}
+
+.login-card {
+    width: 380px;
+    background: var(--surface-1);
+    border: 1px solid var(--border);
+    border-radius: 16px;
+    box-shadow:
+        0 4px 6px rgba(0, 0, 0, 0.04),
+        0 12px 40px rgba(0, 0, 0, 0.1),
+        0 0 0 1px color-mix(in srgb, var(--primary) 10%, transparent);
+    padding: 2.5rem 2.25rem 2.25rem;
+}
+
+.login-brand {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 0.3rem;
+    margin-bottom: 2rem;
+}
+
+.brand-ornament {
+    color: var(--primary);
+    font-size: 0.9rem;
+    opacity: 0.7;
+    letter-spacing: 0.3em;
+    margin-bottom: 0.4rem;
+    max-width: 100px;
+}
+
+.login-brand h1 {
+    font-family: var(--font-serif);
+    font-size: 2.2rem;
+    font-weight: 400;
+    letter-spacing: 0.2em;
+    color: var(--primary);
+    text-transform: uppercase;
+    line-height: 1;
+    margin: 0;
+}
+
+.brand-sub {
+    margin: 0;
+    font-size: 0.7rem;
+    letter-spacing: 0.18em;
+    text-transform: uppercase;
+    color: var(--text-dim);
+    font-family: var(--font-sans);
+}
+
+.brand-rule {
+    width: 100%;
+    height: 1px;
+    margin-top: 1.25rem;
+    background: linear-gradient(
+        90deg,
+        transparent,
+        var(--border-hi),
+        transparent
+    );
+}
+
+.login-form {
+    display: flex;
+    flex-direction: column;
+    gap: 1rem;
+}
+
+.login-field {
+    display: flex;
+    flex-direction: column;
+    gap: 0.4rem;
+}
+
+.login-field label {
+    font-size: 0.7rem;
+    font-weight: 700;
+    letter-spacing: 0.1em;
+    text-transform: uppercase;
+    color: var(--text-muted);
+}
+
+.login-error {
+    margin: 0;
+    font-size: 0.8rem;
+    color: var(--danger);
+    text-align: center;
+    padding: 0.5rem;
+    background: var(--danger-subtle);
+    border: 1px solid var(--danger-border);
+    border-radius: 6px;
+}
+
+[data-slot="button"] {
+    margin-top: 2px;
+}
+</style>
diff --git a/ui/src/views/admin/ApiKeys.vue b/ui/src/views/admin/ApiKeys.vue
new file mode 100644
index 0000000..6957c94
--- /dev/null
+++ b/ui/src/views/admin/ApiKeys.vue
@@ -0,0 +1,292 @@
+<template>
+  <div>
+    <div class="page-header">
+      <div class="page-title">
+        <h2>API Keys</h2>
+        <span class="subtitle">Long-lived tokens for non-interactive service access — scoped by permission mask</span>
+      </div>
+      <NychButton @click="showCreate = true">+ New Key</NychButton>
+    </div>
+
+    <div class="table-card">
+      <div class="table-card-header">
+        <span class="count">{{ keys.length }} {{ keys.length === 1 ? 'key' : 'keys' }}</span>
+      </div>
+      <div v-if="loading" class="loading-overlay">
+        <div class="loading-spinner"></div>
+        <span>Loading…</span>
+      </div>
+      <template v-else-if="keys.length"><div class="table-scroll"><table class="data-table">
+        <thead>
+          <tr>
+            <th>Name</th>
+            <th>Prefix</th>
+            <th>Role</th>
+            <th>Mask</th>
+            <th>Created</th>
+            <th>Expires</th>
+            <th>Last used</th>
+            <th>Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr v-for="k in keys" :key="k.id">
+            <td class="name-cell">{{ k.name }}</td>
+            <td><code class="prefix-cell">mrc_{{ k.key_prefix }}…</code></td>
+            <td><span class="role-badge" :class="roleBadgeClass(k.permissions_mask)">{{ roleName(k.permissions_mask) }}</span></td>
+            <td><code>{{ k.permissions_mask }}</code></td>
+            <td class="date-cell">{{ fmtDate(k.created_at) }}</td>
+            <td class="date-cell">{{ k.expires_at ? fmtDate(k.expires_at) : '—' }}</td>
+            <td class="date-cell">{{ k.last_used_at ? fmtDate(k.last_used_at) : 'Never' }}</td>
+            <td class="actions-cell">
+              <NychButton size="sm" variant="danger" @click="revoke(k.id, k.name)">Revoke</NychButton>
+            </td>
+          </tr>
+        </tbody>
+      </table></div></template>
+      <div class="empty-state" v-else>
+        <span class="empty-icon">⚿</span>
+        <span class="empty-label">No API keys</span>
+        <span class="empty-hint">Create a key to allow service-to-service access without user credentials.</span>
+      </div>
+    </div>
+
+    <!-- Create dialog -->
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(560px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>New API Key</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>Name</label>
+            <NychInput v-model="form.name" placeholder="e.g. CI pipeline, data importer" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Role</label>
+            <NychSelect v-model="form.permissions_mask" class="w-full">
+              <NychSelectTrigger class="w-full"><NychSelectValue placeholder="Select a role" /></NychSelectTrigger>
+              <NychSelectContent>
+                <NychSelectItem v-for="r in ROLES" :key="r.value" :value="r.value">{{ r.label }}</NychSelectItem>
+              </NychSelectContent>
+            </NychSelect>
+            <p class="hint">{{ ROLES.find(r => r.value === form.permissions_mask)?.description ?? '' }}</p>
+          </div>
+          <div class="field">
+            <label>Expires <span class="optional">(optional — leave blank for no expiry)</span></label>
+            <NychInput v-model="form.expires_at" type="datetime-local" class="w-full" />
+          </div>
+          <NychButton type="submit" :disabled="!form.name || !form.permissions_mask" class="w-full">Generate Key</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+
+    <!-- Key reveal dialog — shown once after creation -->
+    <NychDialog v-model:open="showReveal">
+      <NychDialogContent class="w-[min(600px,95vw)]" :show-close-button="false">
+        <NychDialogHeader><NychDialogTitle>API Key Created</NychDialogTitle></NychDialogHeader>
+        <div class="reveal-body">
+          <NychAlert variant="warning" class="reveal-warning">
+            Copy this key now — it will <strong>not</strong> be shown again.
+          </NychAlert>
+          <div class="key-display">
+            <code class="key-text">{{ newKey }}</code>
+            <button type="button" class="copy-btn" :class="{ copied }" @click="copyKey" title="Copy to clipboard">
+              {{ copied ? '✓' : '⎘' }}
+            </button>
+          </div>
+          <NychButton class="w-full" @click="closeReveal">I've saved the key</NychButton>
+        </div>
+      </NychDialogContent>
+    </NychDialog>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted, onUnmounted, watch } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const keys = ref<any[]>([])
+const showCreate = ref(false)
+const showReveal = ref(false)
+const newKey = ref('')
+const copied = ref(false)
+const form = ref({ name: '', permissions_mask: '', expires_at: '' })
+const loading = ref(false)
+
+const ROLES = [
+  { label: 'Viewer',      value: '1',  description: 'Read-only access to API data' },
+  { label: 'Editor',      value: '7',  description: 'Read, write, and delete via API' },
+  { label: 'Query Admin', value: '15', description: 'Editor + manage SQL query registry' },
+  { label: 'Ops Admin',   value: '23', description: 'Editor + manage query cache' },
+  { label: 'Admin',       value: '31', description: 'All above combined' },
+  { label: 'Super Admin', value: '63', description: 'Full access including users, permissions, and blacklist' },
+]
+
+function roleName(mask: string) {
+  return ROLES.find(r => r.value === mask)?.label ?? 'Custom'
+}
+
+function roleBadgeClass(mask: string) {
+  const map: Record<string, string> = {
+    '1': 'role-viewer', '7': 'role-editor',
+    '15': 'role-query', '23': 'role-ops',
+    '31': 'role-admin', '63': 'role-super',
+  }
+  return map[mask] ?? 'role-custom'
+}
+
+function fmtDate(iso: string) {
+  return new Date(iso).toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' })
+}
+
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/admin/api-keys', { headers: auth.authHeaders() })
+    keys.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+
+async function submitCreate() {
+  const body: any = {
+    name: form.value.name,
+    permissions_mask: form.value.permissions_mask,
+  }
+  if (form.value.expires_at) {
+    body.expires_at = new Date(form.value.expires_at).toISOString()
+  }
+  const res = await fetch('/api/admin/api-keys', {
+    method: 'POST',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  })
+  const data = await res.json()
+  showCreate.value = false
+  form.value = { name: '', permissions_mask: '', expires_at: '' }
+  newKey.value = data.key
+  copied.value = false
+  showReveal.value = true
+  load()
+}
+
+async function revoke(id: number, name: string) {
+  if (!confirm(`Revoke key "${name}"? Any services using it will lose access immediately.`)) return
+  await fetch(`/api/admin/api-keys/${id}`, { method: 'DELETE', headers: auth.authHeaders() })
+  load()
+}
+
+async function copyKey() {
+  await navigator.clipboard.writeText(newKey.value)
+  copied.value = true
+  setTimeout(() => { copied.value = false }, 2000)
+}
+
+function closeReveal() {
+  showReveal.value = false
+  newKey.value = ''
+}
+
+// The reveal dialog must not be dismissible by clicking outside it (only
+// via the "I've saved the key" button, which calls closeReveal above) —
+// the library's own DialogContent only calls its dismiss handler for an
+// outside pointerdown when the event isn't already defaultPrevented, so a
+// capture-phase listener that preempts it is enough to block just the
+// outside-click path. Escape still closes it (no equivalent hook exists
+// for that path) — accepted as a known, minor gap.
+function blockOutsideDismiss(event: PointerEvent) {
+  const target = event.target as HTMLElement | null
+  if (!target?.closest('[data-slot="dialog-content"]')) {
+    event.preventDefault()
+  }
+}
+
+watch(showReveal, (open) => {
+  if (open) {
+    document.addEventListener('pointerdown', blockOutsideDismiss, { capture: true })
+  } else {
+    document.removeEventListener('pointerdown', blockOutsideDismiss, { capture: true })
+  }
+})
+
+onUnmounted(() => {
+  document.removeEventListener('pointerdown', blockOutsideDismiss, { capture: true })
+})
+
+onMounted(load)
+</script>
+
+<style scoped>
+.name-cell   { font-weight: 600; color: var(--text-high); }
+.prefix-cell { font-size: 0.8rem; color: var(--text-muted); }
+.date-cell   { color: var(--text-muted); font-size: 0.82rem; font-family: var(--font-mono); }
+
+.role-badge {
+  display: inline-block;
+  padding: 0.2rem 0.65rem;
+  border-radius: 20px;
+  font-size: 0.72rem;
+  font-weight: 700;
+  letter-spacing: 0.05em;
+  text-transform: uppercase;
+}
+.role-viewer { background: var(--info-subtle);    color: var(--info);    border: 1px solid var(--info-border); }
+.role-editor { background: var(--success-subtle); color: var(--success); border: 1px solid var(--success-border); }
+.role-query  { background: var(--warn-subtle);    color: var(--warn);    border: 1px solid var(--warn-border); }
+.role-ops    { background: var(--warn-subtle);    color: var(--warn);    border: 1px solid var(--warn-border); }
+.role-admin  { background: color-mix(in srgb, var(--primary) 12%, var(--surface-1)); color: var(--primary); border: 1px solid color-mix(in srgb, var(--primary) 35%, var(--border)); }
+.role-super  { background: var(--primary); color: var(--primary-fg); border: 1px solid var(--primary); }
+.role-custom { background: var(--surface-2); color: var(--text-muted); border: 1px solid var(--border); }
+
+/* Key reveal */
+.reveal-body {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+  padding-top: 0.25rem;
+}
+
+.reveal-warning {
+  width: 100%;
+}
+
+.key-display {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  background: var(--surface-2);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  padding: 0.75rem 1rem;
+}
+
+.key-text {
+  flex: 1;
+  font-family: var(--font-mono);
+  font-size: 0.78rem;
+  color: var(--text-high);
+  word-break: break-all;
+  background: none;
+  border: none;
+  padding: 0;
+}
+
+.copy-btn {
+  flex-shrink: 0;
+  width: 2rem;
+  height: 2rem;
+  border-radius: 5px;
+  border: 1px solid var(--border);
+  background: var(--surface-1);
+  color: var(--text-muted);
+  font-size: 1rem;
+  cursor: pointer;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  transition: all 0.15s ease;
+}
+.copy-btn:hover { border-color: var(--primary); color: var(--primary); }
+.copy-btn.copied { border-color: var(--success); color: var(--success); background: var(--success-subtle); }
+</style>
diff --git a/ui/src/views/admin/Blacklist.vue b/ui/src/views/admin/Blacklist.vue
new file mode 100644
index 0000000..9944c92
--- /dev/null
+++ b/ui/src/views/admin/Blacklist.vue
@@ -0,0 +1,254 @@
+<template>
+  <div>
+    <div class="page-header">
+      <div class="page-title">
+        <h2>Route Blacklist</h2>
+        <span class="subtitle">Glob patterns blocking API routes — matched against path and HTTP method</span>
+      </div>
+      <NychButton @click="showCreate = true">+ Add Pattern</NychButton>
+    </div>
+
+    <div class="table-card">
+      <div class="table-card-header">
+        <span class="count">{{ entries.length }} {{ entries.length === 1 ? 'entry' : 'entries' }}</span>
+      </div>
+      <div v-if="loading" class="loading-overlay">
+        <div class="loading-spinner"></div>
+        <span>Loading…</span>
+      </div>
+      <template v-else-if="entries.length"><div class="table-scroll"><table class="data-table">
+        <thead>
+          <tr>
+            <th>Pattern</th>
+            <th>Method</th>
+            <th>Status</th>
+            <th>Reason</th>
+            <th>Bypass mask</th>
+            <th>Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr v-for="e in entries" :key="e.id">
+            <td><code>{{ e.pattern }}</code></td>
+            <td>
+              <div class="method-cell">
+                <template v-if="e.method">
+                  <span v-for="m in e.method.split(',')" :key="m" class="method-badge">{{ m.trim() }}</span>
+                </template>
+                <span v-else class="dim">ALL</span>
+              </div>
+            </td>
+            <td>
+              <span class="status-badge" :class="e.active ? 'status-active' : 'status-inactive'">
+                {{ e.active ? 'Active' : 'Disabled' }}
+              </span>
+            </td>
+            <td class="reason-cell">{{ e.reason ?? '—' }}</td>
+            <td><span v-if="e.bypass_mask" class="bit-badge">{{ e.bypass_mask }}</span><span v-else class="dim">—</span></td>
+            <td class="actions-cell">
+              <NychButton size="sm" @click="openEdit(e)">Edit</NychButton>
+              <NychButton size="sm" variant="danger" @click="deleteEntry(e.id)">Delete</NychButton>
+            </td>
+          </tr>
+        </tbody>
+      </table></div></template>
+      <div class="empty-state" v-else>
+        <span class="empty-icon">⊘</span>
+        <span class="empty-label">Blacklist is empty</span>
+        <span class="empty-hint">All routes are currently open. Add a pattern to block access.</span>
+      </div>
+    </div>
+
+    <NychDialog v-model:open="showEdit">
+      <NychDialogContent class="w-[min(640px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Edit Blacklist Entry</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitEdit" class="dialog-form">
+          <div class="field">
+            <label>Pattern</label>
+            <NychInput v-model="editForm.pattern" class="w-full" />
+          </div>
+          <div class="field">
+            <label>HTTP Methods <span class="optional">(none = all methods)</span></label>
+            <MethodSelect v-model="editForm.methods" :options="HTTP_METHODS" placeholder="All methods" />
+          </div>
+          <div class="field">
+            <label>Reason <span class="optional">(optional)</span></label>
+            <NychInput v-model="editForm.reason" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Bypass permission mask <span class="optional">(optional)</span></label>
+            <NychInput v-model="editForm.bypass_mask" placeholder="32" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Status</label>
+            <NychSelect v-model="editForm.active" class="w-full">
+              <NychSelectTrigger class="w-full"><NychSelectValue /></NychSelectTrigger>
+              <NychSelectContent>
+                <NychSelectItem value="true">Active</NychSelectItem>
+                <NychSelectItem value="false">Disabled</NychSelectItem>
+              </NychSelectContent>
+            </NychSelect>
+          </div>
+          <NychButton type="submit" class="w-full">Save Changes</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(640px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>New Blacklist Entry</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>Pattern</label>
+            <NychInput v-model="form.pattern" placeholder="/api/sensitive/**" class="w-full" />
+            <p class="hint">Use <code>*</code> for one segment, <code>**</code> for any depth.</p>
+          </div>
+          <div class="field">
+            <label>HTTP Methods <span class="optional">(none = all methods)</span></label>
+            <MethodSelect v-model="form.methods" :options="HTTP_METHODS" placeholder="All methods" />
+          </div>
+          <div class="field">
+            <label>Reason <span class="optional">(optional)</span></label>
+            <NychInput v-model="form.reason" placeholder="Why is this route blocked?" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Bypass permission mask <span class="optional">(optional)</span></label>
+            <NychInput v-model="form.bypass_mask" placeholder="32" class="w-full" />
+            <p class="hint">Permission bit that allows callers to bypass this rule. Leave blank to block everyone.</p>
+          </div>
+          <NychButton type="submit" class="w-full">Add to Blacklist</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import MethodSelect from './MethodSelect.vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const entries = ref<any[]>([])
+const showCreate = ref(false)
+const showEdit = ref(false)
+const editId = ref<number | null>(null)
+const editForm = ref({ pattern: '', methods: [] as string[], reason: '', bypass_mask: '', active: 'true' })
+const form = ref({ pattern: '', methods: [] as string[], reason: '', bypass_mask: '' })
+const loading = ref(false)
+
+const HTTP_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE']
+
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/blacklist', { headers: auth.authHeaders() })
+    entries.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+
+function methodsToString(methods: string[]): string | null {
+  return methods.length ? methods.join(',') : null
+}
+
+function stringToMethods(s: string | null | undefined): string[] {
+  return s ? s.split(',').map(m => m.trim()).filter(Boolean) : []
+}
+
+async function submitCreate() {
+  await fetch('/api/blacklist', {
+    method: 'POST',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      pattern: form.value.pattern,
+      method: methodsToString(form.value.methods),
+      reason: form.value.reason || null,
+      bypass_mask: form.value.bypass_mask || null,
+      active: true,
+    }),
+  })
+  showCreate.value = false
+  form.value = { pattern: '', methods: [], reason: '', bypass_mask: '' }
+  load()
+}
+
+function openEdit(e: any) {
+  editId.value = e.id
+  editForm.value = {
+    pattern: e.pattern,
+    methods: stringToMethods(e.method),
+    reason: e.reason ?? '',
+    bypass_mask: e.bypass_mask ?? '',
+    active: String(e.active),
+  }
+  showEdit.value = true
+}
+
+async function submitEdit() {
+  await fetch(`/api/blacklist/${editId.value}`, {
+    method: 'PUT',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      pattern: editForm.value.pattern,
+      method: methodsToString(editForm.value.methods),
+      reason: editForm.value.reason || null,
+      bypass_mask: editForm.value.bypass_mask || null,
+      active: editForm.value.active === 'true',
+    }),
+  })
+  showEdit.value = false
+  load()
+}
+
+async function deleteEntry(id: number) {
+  if (!confirm('Delete this blacklist entry?')) return
+  await fetch(`/api/blacklist/${id}`, { method: 'DELETE', headers: auth.authHeaders() })
+  load()
+}
+
+onMounted(load)
+</script>
+
+<style scoped>
+.reason-cell { color: var(--text-muted); font-size: 0.85rem; }
+.dim { color: var(--text-dim); font-size: 0.8rem; font-family: var(--font-mono); }
+
+.method-cell { display: flex; gap: 0.25rem; flex-wrap: wrap; align-items: center; }
+
+.bit-badge {
+  display: inline-block;
+  padding: 0.15rem 0.5rem;
+  border-radius: 4px;
+  font-family: var(--font-mono);
+  font-size: 0.78rem;
+  background: var(--surface-2);
+  border: 1px solid var(--border-lo);
+  color: var(--text-label);
+}
+
+.method-badge {
+  display: inline-block;
+  padding: 0.15rem 0.5rem;
+  border-radius: 4px;
+  font-family: var(--font-mono);
+  font-size: 0.75rem;
+  font-weight: 600;
+  background: var(--surface-2);
+  border: 1px solid var(--border-lo);
+  color: var(--text-label);
+}
+
+.status-badge {
+  display: inline-block;
+  padding: 0.2rem 0.6rem;
+  border-radius: 20px;
+  font-size: 0.72rem;
+  font-weight: 700;
+  letter-spacing: 0.05em;
+  text-transform: uppercase;
+}
+.status-active   { background: var(--danger-subtle); color: var(--danger);  border: 1px solid var(--danger-border); }
+.status-inactive { background: var(--surface-2);     color: var(--text-dim); border: 1px solid var(--border-lo); }
+</style>
diff --git a/ui/src/views/admin/Cache.vue b/ui/src/views/admin/Cache.vue
new file mode 100644
index 0000000..80b8399
--- /dev/null
+++ b/ui/src/views/admin/Cache.vue
@@ -0,0 +1,160 @@
+<template>
+  <div>
+    <div class="page-header">
+      <div class="page-title">
+        <h2>Query Cache</h2>
+        <span class="subtitle">In-memory LRU cache for compiled SQL queries — inspect and flush as needed</span>
+      </div>
+      <div class="header-actions">
+        <NychButton @click="load">Refresh</NychButton>
+        <NychButton variant="danger" @click="flushCache">Flush Cache</NychButton>
+      </div>
+    </div>
+
+    <div v-if="loading" class="loading-overlay">
+      <div class="loading-spinner"></div>
+      <span>Loading…</span>
+    </div>
+
+    <div class="stats-grid" v-else-if="stats">
+      <div class="stat-card">
+        <span class="stat-label">Entries</span>
+        <span class="stat-value">{{ stats.size }}</span>
+      </div>
+      <div class="stat-card">
+        <span class="stat-label">Cache Hits</span>
+        <span class="stat-value success">{{ stats.hits }}</span>
+      </div>
+      <div class="stat-card">
+        <span class="stat-label">Cache Misses</span>
+        <span class="stat-value muted">{{ stats.misses }}</span>
+      </div>
+      <div class="stat-card hit-rate-card">
+        <span class="stat-label">Hit Rate</span>
+        <span class="stat-value" :class="hitRateClass">{{ hitRate }}%</span>
+        <div class="hit-rate-bar">
+          <div class="hit-rate-fill" :style="{ width: hitRate + '%' }"></div>
+        </div>
+      </div>
+    </div>
+
+    <div class="no-stats" v-else>
+      <span class="empty-icon">◈</span>
+      <span class="empty-label">Cache stats unavailable</span>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, computed, onMounted } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const stats = ref<{ size: number; hits: number; misses: number } | null>(null)
+const loading = ref(false)
+
+const hitRate = computed(() => {
+  if (!stats.value) return 0
+  const total = stats.value.hits + stats.value.misses
+  return total === 0 ? 0 : Math.round((stats.value.hits / total) * 100)
+})
+
+const hitRateClass = computed(() => {
+  const r = hitRate.value
+  if (r >= 80) return 'good'
+  if (r >= 50) return 'ok'
+  return 'poor'
+})
+
+async function load() {
+  const res = await fetch('/api/admin/cache/stats', { headers: auth.authHeaders() })
+  stats.value = await res.json()
+}
+
+async function flushCache() {
+  if (!confirm('Flush the entire query cache?')) return
+  await fetch('/api/admin/cache/', { method: 'DELETE', headers: auth.authHeaders() })
+  load()
+}
+
+onMounted(load)
+</script>
+
+<style scoped>
+.header-actions { display: flex; gap: 0.5rem; }
+
+.stats-grid {
+  display: grid;
+  grid-template-columns: repeat(4, 1fr);
+  gap: 1rem;
+}
+
+.stat-card {
+  background: var(--surface-1);
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  padding: 1.5rem 1.75rem;
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  box-shadow: 0 2px 8px rgba(0,0,0,0.05);
+}
+
+.stat-label {
+  font-size: 0.7rem;
+  font-weight: 700;
+  letter-spacing: 0.1em;
+  text-transform: uppercase;
+  color: var(--text-muted);
+}
+
+.stat-value {
+  font-family: var(--font-mono);
+  font-size: 2.4rem;
+  font-weight: 500;
+  line-height: 1;
+  color: var(--primary);
+}
+.stat-value.success { color: var(--success); }
+.stat-value.muted   { color: var(--text-muted); }
+.stat-value.good    { color: var(--success); }
+.stat-value.ok      { color: var(--warn); }
+.stat-value.poor    { color: var(--danger); }
+
+.hit-rate-card { gap: 0.75rem; }
+
+.hit-rate-bar {
+  height: 4px;
+  background: var(--surface-2);
+  border-radius: 2px;
+  overflow: hidden;
+  margin-top: auto;
+}
+
+.hit-rate-fill {
+  height: 100%;
+  background: var(--primary);
+  border-radius: 2px;
+  transition: width 0.4s ease;
+}
+
+.no-stats {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 4rem;
+  color: var(--text-dim);
+}
+
+.no-stats .empty-icon {
+  font-size: 2.5rem;
+  opacity: 0.3;
+}
+
+.no-stats .empty-label {
+  font-family: var(--font-serif);
+  font-size: 1rem;
+  color: var(--text-muted);
+}
+</style>
diff --git a/ui/src/views/admin/Cdn.vue b/ui/src/views/admin/Cdn.vue
new file mode 100644
index 0000000..8c1a262
--- /dev/null
+++ b/ui/src/views/admin/Cdn.vue
@@ -0,0 +1,209 @@
+<template>
+  <div>
+    <div class="page-header">
+      <div class="page-title">
+        <h2>CDN Objects</h2>
+        <span class="subtitle">Object storage registry — keys proxied through the API to the local CDN</span>
+      </div>
+      <NychButton @click="showCreate = true">+ Add Object</NychButton>
+    </div>
+
+    <div class="table-card">
+      <div class="table-card-header">
+        <span class="count">{{ objects.length }} {{ objects.length === 1 ? 'object' : 'objects' }}</span>
+      </div>
+      <div v-if="loading" class="loading-overlay">
+        <div class="loading-spinner"></div>
+        <span>Loading…</span>
+      </div>
+      <template v-else-if="objects.length">
+        <div class="table-scroll">
+          <table class="data-table">
+            <thead>
+              <tr>
+                <th>Key</th>
+                <th>Content Type</th>
+                <th>Description</th>
+                <th>Actions</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr v-for="o in objects" :key="o.id">
+                <td><code>{{ o.key }}</code></td>
+                <td class="ct-cell">{{ o.content_type ?? '—' }}</td>
+                <td class="desc-cell">{{ o.description ?? '—' }}</td>
+                <td class="actions-cell">
+                  <NychButton size="sm" @click="openEdit(o)">Edit</NychButton>
+                  <NychButton size="sm" variant="danger" @click="deleteObject(o.key)">Delete</NychButton>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </div>
+      </template>
+      <div class="empty-state" v-else>
+        <span class="empty-icon">▣</span>
+        <span class="empty-label">No CDN objects</span>
+        <span class="empty-hint">Add objects to expose local CDN assets through the API.</span>
+      </div>
+    </div>
+
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(560px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Upload CDN Object</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>File</label>
+            <input type="file" ref="fileInput" @change="onFileChange" class="file-input" />
+            <p class="hint">The filename becomes the key unless overridden below.</p>
+          </div>
+          <div class="field">
+            <label>Key <span class="optional">(optional — defaults to filename)</span></label>
+            <NychInput v-model="form.key" placeholder="logo.png" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Content Type <span class="optional">(optional — auto-detected)</span></label>
+            <NychInput v-model="form.content_type" placeholder="image/png" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Description <span class="optional">(optional)</span></label>
+            <NychInput v-model="form.description" placeholder="App logo" class="w-full" />
+          </div>
+          <NychButton type="submit" class="w-full" :disabled="!selectedFile || loading">Upload</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+
+    <NychDialog v-model:open="showEdit">
+      <NychDialogContent class="w-[min(560px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Edit — {{ editKey }}</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitEdit" class="dialog-form">
+          <div class="field">
+            <label>Key</label>
+            <NychInput v-model="editForm.key" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Content Type <span class="optional">(optional)</span></label>
+            <NychInput v-model="editForm.content_type" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Description <span class="optional">(optional)</span></label>
+            <NychInput v-model="editForm.description" class="w-full" />
+          </div>
+          <NychButton type="submit" class="w-full" :disabled="loading">Save Changes</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const objects = ref<any[]>([])
+const showCreate = ref(false)
+const showEdit = ref(false)
+const editKey = ref('')
+const loading = ref(false)
+const form = ref({ key: '', content_type: '', description: '' })
+const editForm = ref({ key: '', content_type: '', description: '' })
+const fileInput = ref<HTMLInputElement | null>(null)
+const selectedFile = ref<File | null>(null)
+
+function onFileChange() {
+  selectedFile.value = fileInput.value?.files?.[0] ?? null
+}
+
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/cdn', { headers: auth.authHeaders() })
+    objects.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+
+async function submitCreate() {
+  if (!selectedFile.value) return
+  loading.value = true
+  try {
+    const fd = new FormData()
+    fd.append('file', selectedFile.value)
+    if (form.value.key) fd.append('key', form.value.key)
+    if (form.value.content_type) fd.append('content_type', form.value.content_type)
+    if (form.value.description) fd.append('description', form.value.description)
+    const res = await fetch('/api/cdn/upload', {
+      method: 'POST',
+      headers: auth.authHeaders(),
+      body: fd,
+    })
+    if (!res.ok) return
+    showCreate.value = false
+    selectedFile.value = null
+    form.value = { key: '', content_type: '', description: '' }
+    await load()
+  } finally {
+    loading.value = false
+  }
+}
+
+function openEdit(o: any) {
+  editKey.value = o.key
+  editForm.value = {
+    key: o.key,
+    content_type: o.content_type ?? '',
+    description: o.description ?? '',
+  }
+  showEdit.value = true
+}
+
+async function submitEdit() {
+  loading.value = true
+  try {
+    const res = await fetch(`/api/cdn/${editKey.value}`, {
+      method: 'PUT',
+      headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        key: editForm.value.key || null,
+        content_type: editForm.value.content_type || null,
+        description: editForm.value.description || null,
+      }),
+    })
+    if (!res.ok) return
+    showEdit.value = false
+    await load()
+  } finally {
+    loading.value = false
+  }
+}
+
+async function deleteObject(key: string) {
+  if (!confirm(`Delete CDN object "${key}"?`)) return
+  loading.value = true
+  try {
+    const res = await fetch(`/api/cdn/${key}`, { method: 'DELETE', headers: auth.authHeaders() })
+    if (!res.ok) return
+    await load()
+  } finally {
+    loading.value = false
+  }
+}
+
+onMounted(load)
+</script>
+
+<style scoped>
+.file-input {
+  width: 100%;
+  font-size: 0.85rem;
+  font-family: var(--font-sans);
+  color: var(--text-label);
+  cursor: pointer;
+}
+.ct-cell   { color: var(--text-muted); font-size: 0.85rem; font-family: var(--font-mono); }
+.desc-cell { color: var(--text-muted); font-size: 0.85rem; }
+.hint { font-size: 0.78rem; color: var(--text-dim); margin: 0.25rem 0 0; font-family: var(--font-sans); }
+</style>
diff --git a/ui/src/views/admin/Cors.vue b/ui/src/views/admin/Cors.vue
new file mode 100644
index 0000000..7c4e870
--- /dev/null
+++ b/ui/src/views/admin/Cors.vue
@@ -0,0 +1,121 @@
+<template>
+  <div>
+    <div class="page-header">
+      <div class="page-title">
+        <h2>CORS Origins</h2>
+        <span class="subtitle">Allowed cross-origin request sources — matched against the request Origin header</span>
+      </div>
+      <NychButton @click="showCreate = true">+ Add Origin</NychButton>
+    </div>
+
+    <div class="table-card">
+      <div class="table-card-header">
+        <span class="count">{{ origins.length }} {{ origins.length === 1 ? 'origin' : 'origins' }}</span>
+      </div>
+      <div v-if="loading" class="loading-overlay">
+        <div class="loading-spinner"></div>
+        <span>Loading…</span>
+      </div>
+      <template v-else-if="origins.length">
+        <div class="table-scroll">
+          <table class="data-table">
+            <thead>
+              <tr>
+                <th>Origin</th>
+                <th>Added</th>
+                <th>Actions</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr v-for="o in origins" :key="o.id">
+                <td><code>{{ o.origin }}</code></td>
+                <td class="date-cell">{{ fmtDate(o.created_at) }}</td>
+                <td class="actions-cell">
+                  <NychButton size="sm" variant="danger" @click="deleteOrigin(o.id)">Delete</NychButton>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </div>
+      </template>
+      <div class="empty-state" v-else>
+        <span class="empty-icon">✦</span>
+        <span class="empty-label">No origins configured</span>
+        <span class="empty-hint">Cross-origin requests will be rejected until an origin is added.</span>
+      </div>
+    </div>
+
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(480px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Add CORS Origin</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>Origin</label>
+            <NychInput v-model="form.origin" placeholder="https://app.example.com" class="w-full" />
+            <p class="hint">Use <code>*</code> to allow all origins (permissive mode).</p>
+          </div>
+          <NychButton type="submit" class="w-full" :disabled="!form.origin || loading">Add Origin</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const origins = ref<any[]>([])
+const showCreate = ref(false)
+const loading = ref(false)
+const form = ref({ origin: '' })
+
+function fmtDate(s: string) {
+  return new Date(s).toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' })
+}
+
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/cors_origins', { headers: auth.authHeaders() })
+    origins.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+
+async function submitCreate() {
+  loading.value = true
+  try {
+    await fetch('/api/cors_origins', {
+      method: 'POST',
+      headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+      body: JSON.stringify({ origin: form.value.origin }),
+    })
+    showCreate.value = false
+    form.value = { origin: '' }
+    await load()
+  } finally {
+    loading.value = false
+  }
+}
+
+async function deleteOrigin(id: number) {
+  if (!confirm('Remove this CORS origin?')) return
+  loading.value = true
+  try {
+    await fetch(`/api/cors_origins/${id}`, { method: 'DELETE', headers: auth.authHeaders() })
+    await load()
+  } finally {
+    loading.value = false
+  }
+}
+
+onMounted(load)
+</script>
+
+<style scoped>
+.date-cell { color: var(--text-muted); font-size: 0.85rem; }
+.hint { font-size: 0.78rem; color: var(--text-dim); margin: 0.25rem 0 0; font-family: var(--font-sans); }
+</style>
diff --git a/ui/src/views/admin/Layout.vue b/ui/src/views/admin/Layout.vue
new file mode 100644
index 0000000..37837fb
--- /dev/null
+++ b/ui/src/views/admin/Layout.vue
@@ -0,0 +1,267 @@
+<template>
+    <div class="admin-layout">
+        <nav class="sidebar">
+            <div class="sidebar-brand">
+                <img src="/favicon.svg" class="brand-mark" alt="" />
+                <span class="brand-name">Mercury</span>
+            </div>
+
+            <div class="sidebar-rule"></div>
+
+            <ul class="nav-list">
+                <li v-for="item in navItems" :key="item.to">
+                    <RouterLink :to="item.to">
+                        <span class="nav-icon">{{ item.icon }}</span>
+                        {{ item.label }}
+                    </RouterLink>
+                </li>
+            </ul>
+
+            <div class="sidebar-footer">
+                <div class="user-info">
+                    <span class="user-avatar">{{ usernameInitial }}</span>
+                    <span class="user-name">{{ auth.username }}</span>
+                </div>
+                <div class="footer-actions">
+                    <button
+                        class="icon-btn"
+                        :title="isDark ? 'Light mode' : 'Dark mode'"
+                        @click="toggleTheme"
+                    >
+                        {{ isDark ? "☀" : "☾" }}
+                    </button>
+                    <button
+                        class="icon-btn danger-btn"
+                        title="Sign out"
+                        @click="handleLogout"
+                    >
+                        ⏻
+                    </button>
+                </div>
+            </div>
+        </nav>
+
+        <main class="content">
+            <div class="page-wrapper">
+                <RouterView />
+            </div>
+        </main>
+    </div>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import { useRouter } from "vue-router";
+import { useAuthStore } from "../../stores/auth";
+import { useTheme } from "../../stores/theme";
+
+const auth = useAuthStore();
+const router = useRouter();
+const { theme, toggle: toggleTheme } = useTheme();
+const isDark = computed(() => theme.value === "hades");
+
+const usernameInitial = computed(() =>
+    (auth.username?.[0] ?? "?").toUpperCase(),
+);
+
+const navItems = [
+    { to: "/admin/queries", label: "Queries", icon: "⌗" },
+    { to: "/admin/tables", label: "Tables", icon: "▦" },
+    { to: "/admin/users", label: "Users", icon: "◉" },
+    { to: "/admin/permissions", label: "Permissions", icon: "⬡" },
+    { to: "/admin/blacklist", label: "Blacklist", icon: "⊘" },
+    { to: "/admin/api-keys", label: "API Keys", icon: "⚿" },
+    { to: "/admin/cache", label: "Cache", icon: "◈" },
+    { to: "/admin/cors", label: "CORS", icon: "✦" },
+    { to: "/admin/cdn", label: "CDN Objects", icon: "▣" },
+];
+
+function handleLogout() {
+    auth.logout();
+    router.push("/login");
+}
+</script>
+
+<style scoped>
+.admin-layout {
+    display: flex;
+    height: 100vh;
+    background-color: var(--surface-0);
+}
+
+/* ── Sidebar ──────────────────────────────────────── */
+.sidebar {
+    width: 224px;
+    display: flex;
+    flex-direction: column;
+    background-color: var(--surface-1);
+    border-right: 1px solid var(--border);
+    flex-shrink: 0;
+}
+
+.sidebar-brand {
+    display: flex;
+    align-items: center;
+    gap: 0.6rem;
+    padding: 1.5rem 1.25rem 1.25rem;
+}
+
+.brand-mark {
+    width: 1.4rem;
+    height: 1.4rem;
+    flex-shrink: 0;
+}
+
+.brand-name {
+    font-family: var(--font-serif);
+    font-size: 1.3rem;
+    font-weight: 400;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--primary);
+    line-height: 1;
+}
+
+.sidebar-rule {
+    height: 1px;
+    margin: 0 1.25rem 0.75rem;
+    background: linear-gradient(90deg, var(--border-lo), transparent);
+}
+
+/* ── Nav ──────────────────────────────────────────── */
+.nav-list {
+    list-style: none;
+    padding: 0 0.75rem;
+    margin: 0;
+    display: flex;
+    flex-direction: column;
+    gap: 0.125rem;
+    flex: 1;
+}
+
+.nav-list li a {
+    display: flex;
+    align-items: center;
+    gap: 0.6rem;
+    padding: 0.5rem 0.75rem;
+    border-radius: 7px;
+    color: var(--text-label);
+    font-family: var(--font-sans);
+    font-size: 0.85rem;
+    font-weight: 500;
+    text-decoration: none;
+    transition:
+        background-color 0.12s ease,
+        color 0.12s ease;
+    letter-spacing: 0.01em;
+}
+
+.nav-list li a:hover {
+    background: var(--surface-2);
+    color: var(--text-high);
+    text-decoration: none;
+}
+
+.nav-list li a.router-link-active {
+    background: color-mix(in srgb, var(--primary) 10%, var(--surface-1));
+    color: var(--primary);
+    font-weight: 600;
+}
+
+.nav-icon {
+    font-size: 0.9rem;
+    width: 1.1rem;
+    text-align: center;
+    opacity: 0.65;
+    flex-shrink: 0;
+}
+
+.nav-list li a.router-link-active .nav-icon {
+    opacity: 1;
+}
+
+/* ── Footer ───────────────────────────────────────── */
+.sidebar-footer {
+    padding: 0.875rem 1rem;
+    border-top: 1px solid var(--border-lo);
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 0.5rem;
+}
+
+.user-info {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    min-width: 0;
+}
+
+.user-avatar {
+    width: 1.75rem;
+    height: 1.75rem;
+    border-radius: 50%;
+    background: color-mix(in srgb, var(--primary) 15%, var(--surface-2));
+    color: var(--primary);
+    font-size: 0.7rem;
+    font-weight: 700;
+    font-family: var(--font-serif);
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    flex-shrink: 0;
+    border: 1px solid color-mix(in srgb, var(--primary) 25%, var(--border));
+}
+
+.user-name {
+    font-size: 0.8rem;
+    color: var(--text-muted);
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    font-family: var(--font-sans);
+}
+
+.footer-actions {
+    display: flex;
+    gap: 0.25rem;
+    flex-shrink: 0;
+}
+
+.icon-btn {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 1.75rem;
+    height: 1.75rem;
+    border-radius: 6px;
+    background: transparent;
+    border: 1px solid transparent;
+    color: var(--text-dim);
+    font-size: 0.85rem;
+    cursor: pointer;
+    transition:
+        background-color 0.12s ease,
+        color 0.12s ease,
+        border-color 0.12s ease;
+}
+
+.icon-btn:hover {
+    background: var(--surface-2);
+    color: var(--text-high);
+    border-color: var(--border-lo);
+}
+
+.danger-btn:hover {
+    background: var(--danger-subtle);
+    color: var(--danger);
+    border-color: var(--danger-border);
+}
+
+/* ── Content ──────────────────────────────────────── */
+.content {
+    flex: 1;
+    padding: 2.25rem 2.5rem;
+    overflow-y: auto;
+}
+</style>
diff --git a/ui/src/views/admin/MethodSelect.vue b/ui/src/views/admin/MethodSelect.vue
new file mode 100644
index 0000000..7c84f3a
--- /dev/null
+++ b/ui/src/views/admin/MethodSelect.vue
@@ -0,0 +1,205 @@
+<template>
+  <div ref="triggerRef">
+    <button
+      type="button"
+      class="nych-select ms-trigger"
+      @click="toggleOpen"
+    >
+      <span
+        class="nych-select-label"
+        :data-p="modelValue.length === 0 ? 'placeholder' : undefined"
+      >
+        {{ modelValue.length === 0 ? placeholder : modelValue.join(', ') }}
+      </span>
+      <span class="nych-select-dropdown">
+        <svg
+          class="nych-select-dropdownIcon ms-chevron"
+          :class="{ 'ms-chevron-open': isOpen }"
+          viewBox="0 0 24 24"
+          fill="none"
+          stroke="currentColor"
+          stroke-width="2"
+          stroke-linecap="round"
+          stroke-linejoin="round"
+        >
+          <polyline points="6 9 12 15 18 9" />
+        </svg>
+      </span>
+    </button>
+
+    <Teleport to="body">
+      <template v-if="isOpen">
+        <div class="ms-backdrop" @click="close" />
+        <div class="nych-select-overlay ms-panel" :style="overlayStyle">
+          <ul class="nych-select-list">
+            <li
+              v-for="opt in options"
+              :key="opt"
+              class="nych-select-option"
+              :data-p-selected="modelValue.includes(opt) ? 'true' : undefined"
+              @click="toggleOption(opt)"
+            >
+              {{ opt }}
+            </li>
+          </ul>
+        </div>
+      </template>
+    </Teleport>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onUnmounted } from 'vue'
+
+const props = withDefaults(defineProps<{
+  modelValue: string[]
+  options: string[]
+  placeholder?: string
+}>(), { placeholder: 'Select…' })
+
+const emit = defineEmits<{ 'update:modelValue': [string[]] }>()
+
+const triggerRef = ref<HTMLElement>()
+const isOpen = ref(false)
+const overlayStyle = ref<Record<string, string>>({})
+
+function open() {
+  const rect = triggerRef.value!.getBoundingClientRect()
+  overlayStyle.value = {
+    position: 'fixed',
+    top: `${rect.bottom + 4}px`,
+    left: `${rect.left}px`,
+    width: `${rect.width}px`,
+  }
+  isOpen.value = true
+  window.addEventListener('scroll', close, { capture: true, once: true })
+}
+
+function close() {
+  isOpen.value = false
+}
+
+function toggleOpen() {
+  isOpen.value ? close() : open()
+}
+
+function toggleOption(opt: string) {
+  const cur = props.modelValue
+  emit('update:modelValue', cur.includes(opt) ? cur.filter(x => x !== opt) : [...cur, opt])
+}
+
+onUnmounted(close)
+</script>
+
+<style>
+/* Must be global — teleported content renders outside this component's scoped tree.
+   These .nych-select-* rules used to come from the library's own CSS; the new
+   shadcn-vue build doesn't emit them (its Select uses Tailwind utility classes
+   instead), so this component now carries its own copy to keep the same look. */
+.nych-select {
+  display: inline-flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  min-width: 13rem;
+  font-family: var(--font-sans);
+  padding: 8px 11px;
+  color: var(--text-body);
+  background-color: var(--surface-1);
+  border: 1px solid var(--border);
+  border-radius: 5px;
+  cursor: pointer;
+  transition:
+    border-color 0.2s ease,
+    box-shadow 0.2s ease;
+}
+
+.nych-select:hover {
+  border-color: var(--border-hi);
+}
+
+.nych-select-label {
+  flex: 1;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.nych-select-label[data-p='placeholder'] {
+  color: var(--text-dim);
+}
+
+.nych-select-dropdown {
+  display: flex;
+  align-items: center;
+  color: var(--text-muted);
+}
+
+.nych-select-dropdownIcon {
+  width: 14px;
+  height: 14px;
+}
+
+.nych-select-overlay {
+  font-family: var(--font-sans);
+  margin-top: 4px;
+  background-color: var(--surface-2);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.35);
+  overflow: hidden;
+}
+
+.nych-select-list {
+  list-style: none;
+  margin: 0;
+  padding: 4px;
+  max-height: 14rem;
+  overflow-y: auto;
+}
+
+.nych-select-option {
+  padding: 8px 11px;
+  border-radius: 4px;
+  color: var(--text-body);
+  cursor: pointer;
+  transition: background-color 0.15s ease;
+}
+
+.nych-select-option:hover {
+  background-color: var(--surface-3);
+}
+
+.nych-select-option[data-p-selected='true'] {
+  background-color: var(--primary);
+  color: var(--primary-fg);
+}
+
+/* Must be global — teleported content renders outside this component's scoped tree */
+.ms-trigger {
+  display: flex;
+  width: 100%;
+  min-width: unset;
+  text-align: left;
+  font-family: var(--font-sans);
+  font-size: 14px;
+  cursor: pointer;
+}
+
+.ms-backdrop {
+  position: fixed;
+  inset: 0;
+  z-index: 9998;
+}
+
+.ms-panel {
+  z-index: 9999;
+}
+
+.ms-chevron {
+  transition: transform 0.15s ease;
+}
+.ms-chevron-open {
+  transform: rotate(180deg);
+}
+</style>
diff --git a/ui/src/views/admin/Permissions.vue b/ui/src/views/admin/Permissions.vue
new file mode 100644
index 0000000..76d99b2
--- /dev/null
+++ b/ui/src/views/admin/Permissions.vue
@@ -0,0 +1,163 @@
+<template>
+  <div>
+    <div class="page-header">
+      <div class="page-title">
+        <h2>Permissions</h2>
+        <span class="subtitle">Bitmask permission flags assigned to users via their permissions mask</span>
+      </div>
+      <NychButton @click="showCreate = true">+ New Permission</NychButton>
+    </div>
+
+    <div class="table-card">
+      <div class="table-card-header">
+        <span class="count">{{ permissions.length }} {{ permissions.length === 1 ? 'permission' : 'permissions' }}</span>
+      </div>
+      <div v-if="loading" class="loading-overlay">
+        <div class="loading-spinner"></div>
+        <span>Loading…</span>
+      </div>
+      <template v-else-if="permissions.length"><div class="table-scroll"><table class="data-table">
+        <thead>
+          <tr>
+            <th>ID</th>
+            <th>Name</th>
+            <th>Bit Value</th>
+            <th>Description</th>
+            <th>Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr v-for="p in permissions" :key="p.id">
+            <td class="id-cell">{{ p.id }}</td>
+            <td><code>{{ p.name }}</code></td>
+            <td><span class="bit-badge">{{ p.bit_value }}</span></td>
+            <td class="desc-cell">{{ p.description ?? '—' }}</td>
+            <td class="actions-cell">
+              <NychButton size="sm" @click="openEdit(p)">Edit</NychButton>
+              <NychButton size="sm" variant="danger" @click="deletePermission(p.id)">Delete</NychButton>
+            </td>
+          </tr>
+        </tbody>
+      </table></div></template>
+      <div class="empty-state" v-else>
+        <span class="empty-icon">⬡</span>
+        <span class="empty-label">No permissions defined</span>
+        <span class="empty-hint">Define bitmask flags to control fine-grained API access.</span>
+      </div>
+    </div>
+
+    <NychDialog v-model:open="showEdit">
+      <NychDialogContent class="w-[min(600px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Edit — {{ editForm.name }}</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitEdit" class="dialog-form">
+          <div class="field">
+            <label>Name</label>
+            <NychInput v-model="editForm.name" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Description</label>
+            <NychInput v-model="editForm.description" class="w-full" />
+          </div>
+          <NychButton type="submit" class="w-full">Save Changes</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(600px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>New Permission</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>Name</label>
+            <NychInput v-model="form.name" placeholder="PERMISSION_NAME" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Bit value</label>
+            <NychInput v-model="form.bit_value" placeholder="64" class="w-full" />
+            <p class="hint">Must be a power of 2 not already in use (1, 2, 4, 8, 16, 32, 64 …)</p>
+          </div>
+          <div class="field">
+            <label>Description</label>
+            <NychInput v-model="form.description" placeholder="What this permission grants" class="w-full" />
+          </div>
+          <NychButton type="submit" class="w-full">Create Permission</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const permissions = ref<any[]>([])
+const showCreate = ref(false)
+const showEdit = ref(false)
+const editId = ref<number | null>(null)
+const editForm = ref({ name: '', description: '' })
+const form = ref({ name: '', bit_value: '', description: '' })
+const loading = ref(false)
+
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/permissions', { headers: auth.authHeaders() })
+    permissions.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+
+async function submitCreate() {
+  await fetch('/api/permissions', {
+    method: 'POST',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify(form.value),
+  })
+  showCreate.value = false
+  form.value = { name: '', bit_value: '', description: '' }
+  load()
+}
+
+function openEdit(p: any) {
+  editId.value = p.id
+  editForm.value = { name: p.name, description: p.description ?? '' }
+  showEdit.value = true
+}
+
+async function submitEdit() {
+  await fetch(`/api/permissions/${editId.value}`, {
+    method: 'PUT',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify(editForm.value),
+  })
+  showEdit.value = false
+  load()
+}
+
+async function deletePermission(id: number) {
+  if (!confirm('Delete this permission?')) return
+  await fetch(`/api/permissions/${id}`, { method: 'DELETE', headers: auth.authHeaders() })
+  load()
+}
+
+onMounted(load)
+</script>
+
+<style scoped>
+.id-cell   { color: var(--text-dim); font-family: var(--font-mono); font-size: 0.8rem; }
+.desc-cell { color: var(--text-muted); font-size: 0.85rem; }
+
+.bit-badge {
+  display: inline-block;
+  padding: 0.15rem 0.5rem;
+  border-radius: 4px;
+  font-family: var(--font-mono);
+  font-size: 0.78rem;
+  background: var(--surface-2);
+  border: 1px solid var(--border-lo);
+  color: var(--text-label);
+}
+</style>
diff --git a/ui/src/views/admin/Queries.vue b/ui/src/views/admin/Queries.vue
new file mode 100644
index 0000000..1156693
--- /dev/null
+++ b/ui/src/views/admin/Queries.vue
@@ -0,0 +1,153 @@
+<template>
+  <div>
+    <div class="page-header">
+      <div class="page-title">
+        <h2>Query Registry</h2>
+        <span class="subtitle">Named SQL templates executed via the API using bind parameters</span>
+      </div>
+      <NychButton @click="showCreate = true">+ New Query</NychButton>
+    </div>
+
+    <div class="table-card">
+      <div class="table-card-header">
+        <span class="count">{{ queries.length }} {{ queries.length === 1 ? 'query' : 'queries' }}</span>
+      </div>
+      <div v-if="loading" class="loading-overlay">
+        <div class="loading-spinner"></div>
+        <span>Loading…</span>
+      </div>
+      <template v-else-if="queries.length"><div class="table-scroll"><table class="data-table">
+        <thead>
+          <tr>
+            <th>Identifier</th>
+            <th>Description</th>
+            <th>Updated</th>
+            <th>Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr v-for="q in queries" :key="q.identifier">
+            <td><code>{{ q.identifier }}</code></td>
+            <td class="desc-cell">{{ q.description ?? '—' }}</td>
+            <td class="date-cell">{{ new Date(q.updated_at).toLocaleString() }}</td>
+            <td class="actions-cell">
+              <NychButton size="sm" @click="openEdit(q)">Edit</NychButton>
+              <NychButton size="sm" variant="danger" @click="deleteQuery(q)">Delete</NychButton>
+            </td>
+          </tr>
+        </tbody>
+      </table></div></template>
+      <div class="empty-state" v-else>
+        <span class="empty-icon">⌗</span>
+        <span class="empty-label">No queries registered</span>
+        <span class="empty-hint">Add your first named SQL template to get started.</span>
+      </div>
+    </div>
+
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(800px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>New Query</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>Identifier</label>
+            <NychInput v-model="form.identifier" placeholder="e.g. get-user-orders" class="w-full" />
+          </div>
+          <div class="field">
+            <label>Description <span class="optional">(optional)</span></label>
+            <NychInput v-model="form.description" placeholder="Brief description of what this query does" class="w-full" />
+          </div>
+          <div class="field">
+            <label>SQL Template</label>
+            <NychTextarea v-model="form.sql_template" placeholder="SELECT * FROM orders WHERE user_id = :user_id" :rows="12" class="w-full" />
+            <p class="hint">Use <code>:param_name</code> for named bind parameters.</p>
+          </div>
+          <NychButton type="submit" class="w-full">Save Query</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+
+    <NychDialog v-model:open="showEdit">
+      <NychDialogContent class="w-[min(800px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Edit — {{ editIdentifier }}</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitEdit" class="dialog-form">
+          <div class="field">
+            <label>SQL Template</label>
+            <NychTextarea v-model="editForm.sql_template" :rows="12" class="w-full" />
+            <p class="hint">Use <code>:param_name</code> for named bind parameters.</p>
+          </div>
+          <div class="field">
+            <label>Description <span class="optional">(optional)</span></label>
+            <NychInput v-model="editForm.description" placeholder="Brief description" class="w-full" />
+          </div>
+          <NychButton type="submit" class="w-full">Update Query</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const queries = ref<any[]>([])
+const showCreate = ref(false)
+const showEdit = ref(false)
+const editId = ref('')         // UUID used for PUT/DELETE
+const editIdentifier = ref('') // identifier used for display and execute URL
+const form = ref({ identifier: '', sql_template: '', description: '' })
+const editForm = ref({ sql_template: '', description: '' })
+const loading = ref(false)
+
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/queries', { headers: auth.authHeaders() })
+    queries.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+
+async function submitCreate() {
+  await fetch('/api/queries', {
+    method: 'POST',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify(form.value),
+  })
+  showCreate.value = false
+  form.value = { identifier: '', sql_template: '', description: '' }
+  load()
+}
+
+function openEdit(row: any) {
+  editId.value = row.id
+  editIdentifier.value = row.identifier
+  editForm.value = { sql_template: row.sql_template, description: row.description ?? '' }
+  showEdit.value = true
+}
+
+async function submitEdit() {
+  await fetch(`/api/queries/${editId.value}`, {
+    method: 'PUT',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify(editForm.value),
+  })
+  showEdit.value = false
+  load()
+}
+
+async function deleteQuery(row: any) {
+  if (!confirm(`Delete query "${row.identifier}"?`)) return
+  await fetch(`/api/queries/${row.id}`, { method: 'DELETE', headers: auth.authHeaders() })
+  load()
+}
+
+onMounted(load)
+</script>
+
+<style scoped>
+.desc-cell { color: var(--text-muted); font-size: 0.85rem; }
+.date-cell { color: var(--text-dim); font-family: var(--font-mono); font-size: 0.8rem; white-space: nowrap; }
+</style>
diff --git a/ui/src/views/admin/Tables.vue b/ui/src/views/admin/Tables.vue
new file mode 100644
index 0000000..9942c01
--- /dev/null
+++ b/ui/src/views/admin/Tables.vue
@@ -0,0 +1,585 @@
+<template>
+  <div>
+    <div class="page-header">
+      <div class="page-title">
+        <h2>Tables</h2>
+        <span class="subtitle">Create and manage PostgreSQL tables in the public schema</span>
+      </div>
+      <NychButton @click="showCreate = true">+ New Table</NychButton>
+    </div>
+
+    <div class="table-card">
+      <div class="table-card-header">
+        <span class="count">{{ tables.length }} {{ tables.length === 1 ? 'table' : 'tables' }}</span>
+      </div>
+      <div v-if="loading" class="loading-overlay">
+        <div class="loading-spinner"></div>
+        <span>Loading…</span>
+      </div>
+      <template v-else-if="tables.length"><div class="table-scroll"><table class="data-table">
+        <thead>
+          <tr>
+            <th>Name</th>
+            <th>Columns</th>
+            <th>Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr v-for="t in tables" :key="t.table_name">
+            <td class="name-cell"><code>{{ t.table_name }}</code></td>
+            <td class="count-cell">{{ t.column_count }}</td>
+            <td class="actions-cell">
+              <NychButton size="sm" variant="secondary" @click="openInspect(t.table_name)">Inspect</NychButton>
+              <NychButton size="sm" variant="danger" @click="openDropPreview(t.table_name)">Drop</NychButton>
+            </td>
+          </tr>
+        </tbody>
+      </table></div></template>
+      <div class="empty-state" v-else>
+        <span class="empty-icon">▦</span>
+        <span class="empty-label">No tables yet</span>
+        <span class="empty-hint">Create a table to start storing data via the CRUD API.</span>
+      </div>
+    </div>
+
+    <!-- Create Table Dialog -->
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(700px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>New Table</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>Table Name</label>
+            <NychInput v-model="createForm.name" placeholder="my_table" class="w-full" autocomplete="off" />
+            <p class="hint">Lowercase letters, numbers, and underscores only.</p>
+          </div>
+
+          <div class="columns-section">
+            <div class="columns-header">
+              <label>Columns</label>
+              <NychButton type="button" size="sm" @click="addColumn">+ Add Column</NychButton>
+            </div>
+            <div class="hint fixed-col-hint">An <code>id SERIAL PRIMARY KEY</code> column is always added automatically.</div>
+
+            <div class="column-row header-row">
+              <span>Name</span>
+              <span>Type</span>
+              <span>Nullable</span>
+              <span></span>
+            </div>
+
+            <div v-for="(col, i) in createForm.columns" :key="i" class="column-row">
+              <NychInput v-model="col.name" placeholder="column_name" class="w-full" />
+              <NychSelect v-model="col.col_type" class="w-full">
+                <NychSelectTrigger class="w-full"><NychSelectValue /></NychSelectTrigger>
+                <NychSelectContent>
+                  <NychSelectItem v-for="ct in COLUMN_TYPES" :key="ct" :value="ct">{{ ct }}</NychSelectItem>
+                </NychSelectContent>
+              </NychSelect>
+              <div class="nullable-toggle">
+                <input type="checkbox" v-model="col.nullable" :id="`nullable-${i}`" />
+                <label :for="`nullable-${i}`">Yes</label>
+              </div>
+              <button type="button" class="remove-btn" @click="removeColumn(i)">✕</button>
+            </div>
+
+            <div class="empty-columns" v-if="createForm.columns.length === 0">
+              <span>Add at least one column.</span>
+            </div>
+          </div>
+
+          <NychButton type="submit" class="w-full" :disabled="!canSubmitCreate">Create Table</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+
+    <!-- Inspect Dialog (read-only) -->
+    <NychDialog v-model:open="showInspect">
+      <NychDialogContent class="w-[min(760px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Inspect — {{ inspectPreview?.table_name ?? '' }}</NychDialogTitle></NychDialogHeader>
+      <div v-if="inspectLoading" class="preview-loading">Loading table data…</div>
+      <div v-else-if="inspectPreview" class="preview-body">
+        <div class="preview-meta">
+          <div class="meta-row">
+            <span class="meta-label">Table</span>
+            <code class="meta-value">{{ inspectPreview.table_name }}</code>
+          </div>
+          <div class="meta-row">
+            <span class="meta-label">Rows</span>
+            <span class="meta-value">{{ inspectPreview.row_count.toLocaleString() }}</span>
+          </div>
+          <div class="meta-row">
+            <span class="meta-label">CRUD endpoint</span>
+            <code class="meta-value endpoint">/api/{{ inspectPreview.table_name }}</code>
+          </div>
+        </div>
+
+        <div class="schema-section">
+          <div class="section-label">Schema</div>
+          <table class="schema-table">
+            <thead>
+              <tr>
+                <th>Column</th>
+                <th>Type</th>
+                <th>Nullable</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr v-for="col in inspectPreview.columns" :key="col.column_name">
+                <td><code>{{ col.column_name }}</code></td>
+                <td><span class="type-badge">{{ col.data_type }}</span></td>
+                <td>{{ col.is_nullable === 'YES' ? 'yes' : 'no' }}</td>
+              </tr>
+            </tbody>
+          </table>
+        </div>
+
+        <div class="sample-section" v-if="inspectPreview.sample_rows.length > 0">
+          <div class="section-label">
+            Sample data
+            <span class="sample-count">(first {{ inspectPreview.sample_rows.length }} of {{ inspectPreview.row_count.toLocaleString() }})</span>
+          </div>
+          <div class="sample-scroll">
+            <table class="data-table sample-table">
+              <thead>
+                <tr>
+                  <th v-for="col in inspectPreview.columns" :key="col.column_name">{{ col.column_name }}</th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr v-for="(row, i) in inspectPreview.sample_rows" :key="i">
+                  <td v-for="col in inspectPreview.columns" :key="col.column_name">
+                    {{ row[col.column_name] ?? '—' }}
+                  </td>
+                </tr>
+              </tbody>
+            </table>
+          </div>
+        </div>
+        <div class="empty-state sample-empty" v-else>
+          <span class="empty-icon">▦</span>
+          <span class="empty-label">Empty table</span>
+          <span class="empty-hint">Use <code>POST /api/{{ inspectPreview.table_name }}</code> to insert rows.</span>
+        </div>
+      </div>
+      </NychDialogContent>
+    </NychDialog>
+
+    <!-- Drop Preview Dialog -->
+    <NychDialog v-model:open="showDropPreview">
+      <NychDialogContent class="w-[min(760px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Drop Table</NychDialogTitle></NychDialogHeader>
+      <div v-if="dropPreviewLoading" class="preview-loading">Loading table data…</div>
+      <div v-else-if="dropPreview" class="preview-body">
+        <div class="preview-meta">
+          <div class="meta-row">
+            <span class="meta-label">Table</span>
+            <code class="meta-value">{{ dropPreview.table_name }}</code>
+          </div>
+          <div class="meta-row">
+            <span class="meta-label">Rows</span>
+            <span class="meta-value row-count" :class="dropPreview.row_count > 0 ? 'has-data' : 'no-data'">
+              {{ dropPreview.row_count.toLocaleString() }}
+            </span>
+          </div>
+        </div>
+
+        <div class="warning-banner" v-if="dropPreview.row_count > 0">
+          ⚠ This table contains {{ dropPreview.row_count.toLocaleString() }} {{ dropPreview.row_count === 1 ? 'row' : 'rows' }} that will be permanently deleted.
+        </div>
+
+        <div class="schema-section">
+          <div class="section-label">Schema</div>
+          <table class="schema-table">
+            <thead>
+              <tr>
+                <th>Column</th>
+                <th>Type</th>
+                <th>Nullable</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr v-for="col in dropPreview.columns" :key="col.column_name">
+                <td><code>{{ col.column_name }}</code></td>
+                <td><span class="type-badge">{{ col.data_type }}</span></td>
+                <td>{{ col.is_nullable === 'YES' ? 'yes' : 'no' }}</td>
+              </tr>
+            </tbody>
+          </table>
+        </div>
+
+        <div class="sample-section" v-if="dropPreview.sample_rows.length > 0">
+          <div class="section-label">
+            Sample data
+            <span class="sample-count">(first {{ dropPreview.sample_rows.length }} of {{ dropPreview.row_count.toLocaleString() }})</span>
+          </div>
+          <div class="sample-scroll">
+            <table class="data-table sample-table">
+              <thead>
+                <tr>
+                  <th v-for="col in dropPreview.columns" :key="col.column_name">{{ col.column_name }}</th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr v-for="(row, i) in dropPreview.sample_rows" :key="i">
+                  <td v-for="col in dropPreview.columns" :key="col.column_name">
+                    {{ row[col.column_name] ?? '—' }}
+                  </td>
+                </tr>
+              </tbody>
+            </table>
+          </div>
+        </div>
+
+        <div class="confirm-section">
+          <label class="confirm-label">Type <strong>{{ dropPreview.table_name }}</strong> to confirm:</label>
+          <NychInput v-model="dropConfirmName" :placeholder="dropPreview.table_name" class="w-full" />
+        </div>
+
+        <div class="drop-actions">
+          <NychButton variant="secondary" @click="showDropPreview = false">Cancel</NychButton>
+          <NychButton variant="danger" :disabled="dropConfirmName !== dropPreview.table_name" @click="confirmDrop">Drop Table</NychButton>
+        </div>
+      </div>
+      </NychDialogContent>
+    </NychDialog>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, computed, onMounted } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+
+const COLUMN_TYPES = [
+  'TEXT', 'INTEGER', 'BIGINT', 'SMALLINT', 'BOOLEAN',
+  'NUMERIC', 'FLOAT4', 'FLOAT8', 'UUID', 'TIMESTAMPTZ', 'DATE', 'JSONB',
+]
+
+interface TableInfo {
+  table_name: string
+  column_count: number
+}
+
+interface ColumnInfo {
+  column_name: string
+  data_type: string
+  is_nullable: string
+}
+
+interface TablePreview {
+  table_name: string
+  row_count: number
+  columns: ColumnInfo[]
+  sample_rows: Record<string, unknown>[]
+}
+
+interface ColumnDef {
+  name: string
+  col_type: string
+  nullable: boolean
+}
+
+const tables = ref<TableInfo[]>([])
+const loading = ref(false)
+
+// create
+const showCreate = ref(false)
+const createForm = ref<{ name: string; columns: ColumnDef[] }>({ name: '', columns: [] })
+
+const canSubmitCreate = computed(
+  () => createForm.value.name.trim() !== '' && createForm.value.columns.length > 0,
+)
+
+function addColumn() {
+  createForm.value.columns.push({ name: '', col_type: 'TEXT', nullable: true })
+}
+
+function removeColumn(i: number) {
+  createForm.value.columns.splice(i, 1)
+}
+
+// inspect
+const showInspect = ref(false)
+const inspectLoading = ref(false)
+const inspectPreview = ref<TablePreview | null>(null)
+
+// drop
+const showDropPreview = ref(false)
+const dropPreviewLoading = ref(false)
+const dropPreview = ref<TablePreview | null>(null)
+const dropConfirmName = ref('')
+
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/admin/tables', { headers: auth.authHeaders() })
+    tables.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+
+async function fetchPreview(tableName: string): Promise<TablePreview> {
+  const res = await fetch(`/api/admin/tables/${tableName}`, { headers: auth.authHeaders() })
+  return res.json()
+}
+
+async function submitCreate() {
+  const res = await fetch('/api/admin/tables', {
+    method: 'POST',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify(createForm.value),
+  })
+  if (res.ok) {
+    const createdName = createForm.value.name
+    showCreate.value = false
+    createForm.value = { name: '', columns: [] }
+    await load()
+    // immediately open inspect so the user can verify the new table
+    openInspect(createdName)
+  }
+}
+
+async function openInspect(tableName: string) {
+  showInspect.value = true
+  inspectLoading.value = true
+  inspectPreview.value = null
+  inspectPreview.value = await fetchPreview(tableName)
+  inspectLoading.value = false
+}
+
+async function openDropPreview(tableName: string) {
+  showDropPreview.value = true
+  dropPreviewLoading.value = true
+  dropPreview.value = null
+  dropConfirmName.value = ''
+  dropPreview.value = await fetchPreview(tableName)
+  dropPreviewLoading.value = false
+}
+
+async function confirmDrop() {
+  if (!dropPreview.value) return
+  await fetch(`/api/admin/tables/${dropPreview.value.table_name}`, {
+    method: 'DELETE',
+    headers: auth.authHeaders(),
+  })
+  showDropPreview.value = false
+  dropPreview.value = null
+  load()
+}
+
+onMounted(load)
+</script>
+
+<style scoped>
+.name-cell  { font-family: var(--font-mono); }
+.count-cell { color: var(--text-muted); font-family: var(--font-mono); font-size: 0.82rem; }
+.actions-cell { display: flex; gap: 0.4rem; }
+
+/* ── Create form ────────────────────────────────── */
+.columns-section {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  margin-bottom: 1rem;
+}
+
+.columns-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+}
+
+.fixed-col-hint {
+  margin-top: -0.25rem;
+}
+
+.column-row {
+  display: grid;
+  grid-template-columns: 1fr 1fr 5rem 2rem;
+  gap: 0.5rem;
+  align-items: center;
+}
+
+.header-row {
+  font-size: 0.75rem;
+  color: var(--text-dim);
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  padding: 0 0.25rem;
+}
+
+.nullable-toggle {
+  display: flex;
+  align-items: center;
+  gap: 0.35rem;
+  font-size: 0.85rem;
+  color: var(--text-muted);
+  padding-left: 0.25rem;
+}
+
+.remove-btn {
+  background: none;
+  border: none;
+  color: var(--text-dim);
+  cursor: pointer;
+  font-size: 0.8rem;
+  padding: 0.25rem;
+  border-radius: 4px;
+  line-height: 1;
+  transition: color 0.1s, background 0.1s;
+}
+
+.remove-btn:hover {
+  color: var(--danger);
+  background: var(--danger-subtle);
+}
+
+.empty-columns {
+  font-size: 0.82rem;
+  color: var(--text-dim);
+  padding: 0.5rem 0.25rem;
+}
+
+/* ── Shared preview ─────────────────────────────── */
+.preview-loading {
+  color: var(--text-muted);
+  font-size: 0.9rem;
+  padding: 1rem 0;
+  text-align: center;
+}
+
+.preview-body {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+
+.preview-meta {
+  display: flex;
+  gap: 2rem;
+  flex-wrap: wrap;
+}
+
+.meta-row {
+  display: flex;
+  flex-direction: column;
+  gap: 0.2rem;
+}
+
+.meta-label {
+  font-size: 0.72rem;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: var(--text-dim);
+  font-weight: 600;
+}
+
+.meta-value {
+  font-size: 1rem;
+  color: var(--text-high);
+}
+
+.endpoint {
+  font-size: 0.85rem;
+  color: var(--primary);
+}
+
+.row-count.has-data { color: var(--danger); font-weight: 700; }
+.row-count.no-data  { color: var(--success); }
+
+.warning-banner {
+  background: var(--danger-subtle);
+  border: 1px solid var(--danger-border);
+  color: var(--danger);
+  border-radius: 6px;
+  padding: 0.65rem 0.9rem;
+  font-size: 0.85rem;
+  font-weight: 500;
+}
+
+.section-label {
+  font-size: 0.75rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: var(--text-dim);
+  margin-bottom: 0.4rem;
+}
+
+.sample-count {
+  font-weight: 400;
+  text-transform: none;
+  letter-spacing: 0;
+  color: var(--text-muted);
+}
+
+.schema-table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.83rem;
+}
+
+.schema-table th,
+.schema-table td {
+  padding: 0.35rem 0.6rem;
+  border-bottom: 1px solid var(--border-lo);
+  text-align: left;
+}
+
+.schema-table th {
+  color: var(--text-dim);
+  font-size: 0.72rem;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+}
+
+.type-badge {
+  font-family: var(--font-mono);
+  font-size: 0.75rem;
+  background: var(--surface-2);
+  border: 1px solid var(--border-lo);
+  border-radius: 4px;
+  padding: 0.1rem 0.4rem;
+  color: var(--text-label);
+}
+
+.sample-scroll {
+  overflow-x: auto;
+  max-height: 200px;
+  overflow-y: auto;
+  border: 1px solid var(--border-lo);
+  border-radius: 6px;
+}
+
+.sample-table {
+  min-width: 100%;
+}
+
+.sample-empty {
+  padding: 1.5rem;
+  border: 1px dashed var(--border-lo);
+  border-radius: 8px;
+}
+
+/* ── Drop confirm ───────────────────────────────── */
+.confirm-section {
+  display: flex;
+  flex-direction: column;
+  gap: 0.4rem;
+}
+
+.confirm-label {
+  font-size: 0.85rem;
+  color: var(--text-label);
+}
+
+.drop-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 0.5rem;
+  padding-top: 0.25rem;
+}
+</style>
diff --git a/ui/src/views/admin/Users.vue b/ui/src/views/admin/Users.vue
new file mode 100644
index 0000000..1ea5fd2
--- /dev/null
+++ b/ui/src/views/admin/Users.vue
@@ -0,0 +1,217 @@
+<template>
+  <div>
+    <div class="page-header">
+      <div class="page-title">
+        <h2>Users</h2>
+        <span class="subtitle">Manage API access accounts and their permission roles</span>
+      </div>
+      <NychButton @click="showCreate = true">+ New User</NychButton>
+    </div>
+
+    <div class="table-card">
+      <div class="table-card-header">
+        <span class="count">{{ users.length }} {{ users.length === 1 ? 'user' : 'users' }}</span>
+      </div>
+      <div v-if="loading" class="loading-overlay">
+        <div class="loading-spinner"></div>
+        <span>Loading…</span>
+      </div>
+      <template v-else-if="users.length"><div class="table-scroll"><table class="data-table">
+        <thead>
+          <tr>
+            <th>ID</th>
+            <th>Username</th>
+            <th>Role</th>
+            <th>Mask</th>
+            <th>Created</th>
+            <th>Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr v-for="u in users" :key="u.id">
+            <td class="id-cell">{{ u.id }}</td>
+            <td class="username-cell">{{ u.username }}</td>
+            <td><span class="role-badge" :class="roleBadgeClass(u.permissions_mask)">{{ roleName(u.permissions_mask) }}</span></td>
+            <td><code>{{ u.permissions_mask }}</code></td>
+            <td class="date-cell">{{ new Date(u.created_at).toLocaleDateString() }}</td>
+            <td class="actions-cell">
+              <NychButton size="sm" @click="openEdit(u)">Edit</NychButton>
+              <NychButton size="sm" variant="danger" @click="deleteUser(u.id)">Delete</NychButton>
+            </td>
+          </tr>
+        </tbody>
+      </table></div></template>
+      <div class="empty-state" v-else>
+        <span class="empty-icon">◉</span>
+        <span class="empty-label">No users yet</span>
+        <span class="empty-hint">Create the first user to grant API access.</span>
+      </div>
+    </div>
+
+    <NychDialog v-model:open="showEdit">
+      <NychDialogContent class="w-[min(680px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>Edit — {{ editForm.username }}</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitEdit" class="dialog-form">
+          <div class="field">
+            <label>Username</label>
+            <NychInput v-model="editForm.username" class="w-full" autocomplete="off" />
+          </div>
+          <div class="field">
+            <label>New password <span class="optional">(leave blank to keep current)</span></label>
+            <NychInput v-model="editForm.password" type="password" placeholder="••••••••" class="w-full" autocomplete="new-password" />
+          </div>
+          <div class="field">
+            <label>Role</label>
+            <NychSelect v-model="editForm.permissions_mask" class="w-full">
+              <NychSelectTrigger class="w-full"><NychSelectValue /></NychSelectTrigger>
+              <NychSelectContent>
+                <NychSelectItem v-for="r in ROLES" :key="r.value" :value="r.value">{{ r.label }}</NychSelectItem>
+              </NychSelectContent>
+            </NychSelect>
+            <p class="hint">{{ ROLES.find(r => r.value === editForm.permissions_mask)?.description ?? '' }}</p>
+          </div>
+          <NychButton type="submit" class="w-full">Save Changes</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+
+    <NychDialog v-model:open="showCreate">
+      <NychDialogContent class="w-[min(680px,95vw)]">
+        <NychDialogHeader><NychDialogTitle>New User</NychDialogTitle></NychDialogHeader>
+        <form @submit.prevent="submitCreate" class="dialog-form">
+          <div class="field">
+            <label>Username</label>
+            <NychInput v-model="form.username" placeholder="username" class="w-full" autocomplete="off" />
+          </div>
+          <div class="field">
+            <label>Password</label>
+            <NychInput v-model="form.password" type="password" placeholder="••••••••" class="w-full" autocomplete="new-password" />
+          </div>
+          <div class="field">
+            <label>Role</label>
+            <NychSelect v-model="selectedRole" class="w-full">
+              <NychSelectTrigger class="w-full"><NychSelectValue placeholder="Select a role" /></NychSelectTrigger>
+              <NychSelectContent>
+                <NychSelectItem v-for="r in ROLES" :key="r.value" :value="r.value">{{ r.label }}</NychSelectItem>
+              </NychSelectContent>
+            </NychSelect>
+            <p class="hint">{{ roleDescription }}</p>
+          </div>
+          <NychButton type="submit" class="w-full">Create User</NychButton>
+        </form>
+      </NychDialogContent>
+    </NychDialog>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, computed, onMounted } from 'vue'
+import { useAuthStore } from '../../stores/auth'
+
+const auth = useAuthStore()
+const users = ref<any[]>([])
+const showCreate = ref(false)
+const showEdit = ref(false)
+const editId = ref<number | null>(null)
+const editForm = ref({ username: '', password: '', permissions_mask: '1' })
+const form = ref({ username: '', password: '' })
+const loading = ref(false)
+const selectedRole = ref('1')
+
+const ROLES = [
+  { label: 'Viewer',      value: '1',  description: 'Read-only access to API data' },
+  { label: 'Editor',      value: '7',  description: 'Read, write, and delete via API' },
+  { label: 'Query Admin', value: '15', description: 'Editor + manage SQL query registry' },
+  { label: 'Ops Admin',   value: '23', description: 'Editor + manage query cache' },
+  { label: 'Admin',       value: '31', description: 'All above combined' },
+  { label: 'Super Admin', value: '63', description: 'Full access including users, permissions, and blacklist' },
+]
+
+const roleDescription = computed(() =>
+  ROLES.find(r => r.value === selectedRole.value)?.description ?? ''
+)
+
+function roleName(mask: string) {
+  return ROLES.find(r => r.value === mask)?.label ?? 'Custom'
+}
+
+function roleBadgeClass(mask: string) {
+  const map: Record<string, string> = {
+    '1': 'role-viewer', '7': 'role-editor',
+    '15': 'role-query', '23': 'role-ops',
+    '31': 'role-admin', '63': 'role-super',
+  }
+  return map[mask] ?? 'role-custom'
+}
+
+async function load() {
+  loading.value = true
+  try {
+    const res = await fetch('/api/users', { headers: auth.authHeaders() })
+    users.value = await res.json()
+  } finally {
+    loading.value = false
+  }
+}
+
+async function submitCreate() {
+  await fetch('/api/users', {
+    method: 'POST',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify({ ...form.value, permissions_mask: selectedRole.value }),
+  })
+  showCreate.value = false
+  form.value = { username: '', password: '' }
+  selectedRole.value = '1'
+  load()
+}
+
+function openEdit(u: any) {
+  editId.value = u.id
+  editForm.value = { username: u.username, password: '', permissions_mask: u.permissions_mask }
+  showEdit.value = true
+}
+
+async function submitEdit() {
+  const body: any = { username: editForm.value.username, permissions_mask: editForm.value.permissions_mask }
+  if (editForm.value.password) body.password = editForm.value.password
+  await fetch(`/api/users/${editId.value}`, {
+    method: 'PUT',
+    headers: { ...auth.authHeaders(), 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  })
+  showEdit.value = false
+  load()
+}
+
+async function deleteUser(id: number) {
+  if (!confirm('Delete this user?')) return
+  await fetch(`/api/users/${id}`, { method: 'DELETE', headers: auth.authHeaders() })
+  load()
+}
+
+onMounted(load)
+</script>
+
+<style scoped>
+.id-cell       { color: var(--text-dim); font-family: var(--font-mono); font-size: 0.8rem; }
+.username-cell { font-weight: 600; color: var(--text-high); }
+.date-cell     { color: var(--text-muted); font-size: 0.82rem; font-family: var(--font-mono); }
+
+.role-badge {
+  display: inline-block;
+  padding: 0.2rem 0.65rem;
+  border-radius: 20px;
+  font-size: 0.72rem;
+  font-weight: 700;
+  letter-spacing: 0.05em;
+  text-transform: uppercase;
+}
+.role-viewer { background: var(--info-subtle);    color: var(--info);    border: 1px solid var(--info-border); }
+.role-editor { background: var(--success-subtle); color: var(--success); border: 1px solid var(--success-border); }
+.role-query  { background: var(--warn-subtle);    color: var(--warn);    border: 1px solid var(--warn-border); }
+.role-ops    { background: var(--warn-subtle);    color: var(--warn);    border: 1px solid var(--warn-border); }
+.role-admin  { background: color-mix(in srgb, var(--primary) 12%, var(--surface-1)); color: var(--primary); border: 1px solid color-mix(in srgb, var(--primary) 35%, var(--border)); }
+.role-super  { background: var(--primary); color: var(--primary-fg); border: 1px solid var(--primary); }
+.role-custom { background: var(--surface-2); color: var(--text-muted); border: 1px solid var(--border); }
+</style>
diff --git a/ui/tsconfig.json b/ui/tsconfig.json
new file mode 100644
index 0000000..d5763ca
--- /dev/null
+++ b/ui/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": ["ES2020", "DOM", "DOM.Iterable"],
+    "jsx": "preserve",
+    "noEmit": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "isolatedModules": true,
+    "useDefineForClassFields": true
+  },
+  "include": ["src/**/*.ts", "src/**/*.d.ts", "src/**/*.tsx", "src/**/*.vue"],
+  "exclude": ["node_modules", "dist"]
+}
diff --git a/ui/vite.config.d.ts b/ui/vite.config.d.ts
new file mode 100644
index 0000000..fd582a2
--- /dev/null
+++ b/ui/vite.config.d.ts
@@ -0,0 +1,3 @@
+declare const _default: any;
+export default _default;
+//# sourceMappingURL=vite.config.d.ts.map
\ No newline at end of file
diff --git a/ui/vite.config.ts b/ui/vite.config.ts
new file mode 100644
index 0000000..b0d28c0
--- /dev/null
+++ b/ui/vite.config.ts
@@ -0,0 +1,50 @@
+import { fileURLToPath } from "node:url";
+import { defineConfig } from "vite";
+import vue from "@vitejs/plugin-vue";
+import tailwindcss from "@tailwindcss/vite";
+
+export default defineConfig({
+    plugins: [vue(), tailwindcss()],
+    resolve: {
+        alias: [
+            {
+                // @nychthemeron/library's package.json "." export declares a
+                // "development" condition pointing at ./src/index.ts, which
+                // its published tarball doesn't include (only dist/,
+                // src/assets/, src/components/ ship) — Vite picks that
+                // condition first in dev mode and fails to resolve it before
+                // ever trying "import". Alias straight past the exports map
+                // to the working dist bundle. Anchored to match only the
+                // bare specifier (not "@nychthemeron/library/style" etc,
+                // which aren't affected — they don't declare a "development"
+                // condition and must keep resolving through the real
+                // exports map).
+                find: /^@nychthemeron\/library$/,
+                replacement: fileURLToPath(
+                    new URL("./node_modules/@nychthemeron/library/dist/index.js", import.meta.url),
+                ),
+            },
+        ],
+    },
+    server: {
+        proxy: {
+            "/api": "http://localhost:3000",
+            "/auth": "http://localhost:3000",
+            "/admin": "http://localhost:3000",
+        },
+    },
+    build: {
+        outDir: "dist",
+        rollupOptions: {
+            output: {
+                manualChunks: {
+                    vue: ["vue", "vue-router", "pinia"],
+                    nychthemeron: ["@nychthemeron/library"],
+                },
+                entryFileNames: "js/[name]-[hash].js",
+                chunkFileNames: "js/[name]-[hash].js",
+                assetFileNames: "assets/[name]-[hash][extname]",
+            },
+        },
+    },
+});