diff --git a/package-lock.json b/package-lock.json
index 4291fbb..0b2afbc 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,7 +11,7 @@
         "@chenglou/pretext": "^0.0.8",
         "bcryptjs": "^2.4.3",
         "jose": "^5.6.3",
-        "next": "14.2.28",
+        "next": "^14.2.35",
         "pg": "^8.12.0",
         "react": "^18.3.1",
         "react-dom": "^18.3.1",
@@ -1354,15 +1354,15 @@
       }
     },
     "node_modules/@next/env": {
-      "version": "14.2.28",
-      "resolved": "https://registry.npmjs.org/@next/env/-/env-14.2.28.tgz",
-      "integrity": "sha512-PAmWhJfJQlP+kxZwCjrVd9QnR5x0R3u0mTXTiZDgSd4h5LdXmjxCCWbN9kq6hkZBOax8Rm3xDW5HagWyJuT37g==",
+      "version": "14.2.35",
+      "resolved": "https://registry.npmjs.org/@next/env/-/env-14.2.35.tgz",
+      "integrity": "sha512-DuhvCtj4t9Gwrx80dmz2F4t/zKQ4ktN8WrMwOuVzkJfBilwAwGr6v16M5eI8yCuZ63H9TTuEU09Iu2HqkzFPVQ==",
       "license": "MIT"
     },
     "node_modules/@next/swc-darwin-arm64": {
-      "version": "14.2.28",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-14.2.28.tgz",
-      "integrity": "sha512-kzGChl9setxYWpk3H6fTZXXPFFjg7urptLq5o5ZgYezCrqlemKttwMT5iFyx/p1e/JeglTwDFRtb923gTJ3R1w==",
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-14.2.33.tgz",
+      "integrity": "sha512-HqYnb6pxlsshoSTubdXKu15g3iivcbsMXg4bYpjL2iS/V6aQot+iyF4BUc2qA/J/n55YtvE4PHMKWBKGCF/+wA==",
       "cpu": [
         "arm64"
       ],
@@ -1376,9 +1376,9 @@
       }
     },
     "node_modules/@next/swc-darwin-x64": {
-      "version": "14.2.28",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-14.2.28.tgz",
-      "integrity": "sha512-z6FXYHDJlFOzVEOiiJ/4NG8aLCeayZdcRSMjPDysW297Up6r22xw6Ea9AOwQqbNsth8JNgIK8EkWz2IDwaLQcw==",
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-14.2.33.tgz",
+      "integrity": "sha512-8HGBeAE5rX3jzKvF593XTTFg3gxeU4f+UWnswa6JPhzaR6+zblO5+fjltJWIZc4aUalqTclvN2QtTC37LxvZAA==",
       "cpu": [
         "x64"
       ],
@@ -1392,9 +1392,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-gnu": {
-      "version": "14.2.28",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-14.2.28.tgz",
-      "integrity": "sha512-9ARHLEQXhAilNJ7rgQX8xs9aH3yJSj888ssSjJLeldiZKR4D7N08MfMqljk77fAwZsWwsrp8ohHsMvurvv9liQ==",
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-14.2.33.tgz",
+      "integrity": "sha512-JXMBka6lNNmqbkvcTtaX8Gu5by9547bukHQvPoLe9VRBx1gHwzf5tdt4AaezW85HAB3pikcvyqBToRTDA4DeLw==",
       "cpu": [
         "arm64"
       ],
@@ -1411,9 +1411,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-musl": {
-      "version": "14.2.28",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-14.2.28.tgz",
-      "integrity": "sha512-p6gvatI1nX41KCizEe6JkF0FS/cEEF0u23vKDpl+WhPe/fCTBeGkEBh7iW2cUM0rvquPVwPWdiUR6Ebr/kQWxQ==",
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-14.2.33.tgz",
+      "integrity": "sha512-Bm+QulsAItD/x6Ih8wGIMfRJy4G73tu1HJsrccPW6AfqdZd0Sfm5Imhgkgq2+kly065rYMnCOxTBvmvFY1BKfg==",
       "cpu": [
         "arm64"
       ],
@@ -1430,9 +1430,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-gnu": {
-      "version": "14.2.28",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-14.2.28.tgz",
-      "integrity": "sha512-nsiSnz2wO6GwMAX2o0iucONlVL7dNgKUqt/mDTATGO2NY59EO/ZKnKEr80BJFhuA5UC1KZOMblJHWZoqIJddpA==",
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-14.2.33.tgz",
+      "integrity": "sha512-FnFn+ZBgsVMbGDsTqo8zsnRzydvsGV8vfiWwUo1LD8FTmPTdV+otGSWKc4LJec0oSexFnCYVO4hX8P8qQKaSlg==",
       "cpu": [
         "x64"
       ],
@@ -1449,9 +1449,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-musl": {
-      "version": "14.2.28",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-14.2.28.tgz",
-      "integrity": "sha512-+IuGQKoI3abrXFqx7GtlvNOpeExUH1mTIqCrh1LGFf8DnlUcTmOOCApEnPJUSLrSbzOdsF2ho2KhnQoO0I1RDw==",
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-14.2.33.tgz",
+      "integrity": "sha512-345tsIWMzoXaQndUTDv1qypDRiebFxGYx9pYkhwY4hBRaOLt8UGfiWKr9FSSHs25dFIf8ZqIFaPdy5MljdoawA==",
       "cpu": [
         "x64"
       ],
@@ -1468,9 +1468,9 @@
       }
     },
     "node_modules/@next/swc-win32-arm64-msvc": {
-      "version": "14.2.28",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-14.2.28.tgz",
-      "integrity": "sha512-l61WZ3nevt4BAnGksUVFKy2uJP5DPz2E0Ma/Oklvo3sGj9sw3q7vBWONFRgz+ICiHpW5mV+mBrkB3XEubMrKaA==",
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-14.2.33.tgz",
+      "integrity": "sha512-nscpt0G6UCTkrT2ppnJnFsYbPDQwmum4GNXYTeoTIdsmMydSKFz9Iny2jpaRupTb+Wl298+Rh82WKzt9LCcqSQ==",
       "cpu": [
         "arm64"
       ],
@@ -1484,9 +1484,9 @@
       }
     },
     "node_modules/@next/swc-win32-ia32-msvc": {
-      "version": "14.2.28",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-ia32-msvc/-/swc-win32-ia32-msvc-14.2.28.tgz",
-      "integrity": "sha512-+Kcp1T3jHZnJ9v9VTJ/yf1t/xmtFAc/Sge4v7mVc1z+NYfYzisi8kJ9AsY8itbgq+WgEwMtOpiLLJsUy2qnXZw==",
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-ia32-msvc/-/swc-win32-ia32-msvc-14.2.33.tgz",
+      "integrity": "sha512-pc9LpGNKhJ0dXQhZ5QMmYxtARwwmWLpeocFmVG5Z0DzWq5Uf0izcI8tLc+qOpqxO1PWqZ5A7J1blrUIKrIFc7Q==",
       "cpu": [
         "ia32"
       ],
@@ -1500,9 +1500,9 @@
       }
     },
     "node_modules/@next/swc-win32-x64-msvc": {
-      "version": "14.2.28",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-14.2.28.tgz",
-      "integrity": "sha512-1gCmpvyhz7DkB1srRItJTnmR2UwQPAUXXIg9r0/56g3O8etGmwlX68skKXJOp9EejW3hhv7nSQUJ2raFiz4MoA==",
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-14.2.33.tgz",
+      "integrity": "sha512-nOjfZMy8B94MdisuzZo9/57xuFVLHJaDj5e/xrduJp9CV2/HrfxTRH2fbyLe+K9QT41WBLUd4iXX3R7jBp0EUg==",
       "cpu": [
         "x64"
       ],
@@ -2896,13 +2896,12 @@
       }
     },
     "node_modules/next": {
-      "version": "14.2.28",
-      "resolved": "https://registry.npmjs.org/next/-/next-14.2.28.tgz",
-      "integrity": "sha512-QLEIP/kYXynIxtcKB6vNjtWLVs3Y4Sb+EClTC/CSVzdLD1gIuItccpu/n1lhmduffI32iPGEK2cLLxxt28qgYA==",
-      "deprecated": "This version has a security vulnerability. Please upgrade to a patched version. See https://nextjs.org/blog/security-update-2025-12-11 for more details.",
+      "version": "14.2.35",
+      "resolved": "https://registry.npmjs.org/next/-/next-14.2.35.tgz",
+      "integrity": "sha512-KhYd2Hjt/O1/1aZVX3dCwGXM1QmOV4eNM2UTacK5gipDdPN/oHHK/4oVGy7X8GMfPMsUTUEmGlsy0EY1YGAkig==",
       "license": "MIT",
       "dependencies": {
-        "@next/env": "14.2.28",
+        "@next/env": "14.2.35",
         "@swc/helpers": "0.5.5",
         "busboy": "1.6.0",
         "caniuse-lite": "^1.0.30001579",
@@ -2917,15 +2916,15 @@
         "node": ">=18.17.0"
       },
       "optionalDependencies": {
-        "@next/swc-darwin-arm64": "14.2.28",
-        "@next/swc-darwin-x64": "14.2.28",
-        "@next/swc-linux-arm64-gnu": "14.2.28",
-        "@next/swc-linux-arm64-musl": "14.2.28",
-        "@next/swc-linux-x64-gnu": "14.2.28",
-        "@next/swc-linux-x64-musl": "14.2.28",
-        "@next/swc-win32-arm64-msvc": "14.2.28",
-        "@next/swc-win32-ia32-msvc": "14.2.28",
-        "@next/swc-win32-x64-msvc": "14.2.28"
+        "@next/swc-darwin-arm64": "14.2.33",
+        "@next/swc-darwin-x64": "14.2.33",
+        "@next/swc-linux-arm64-gnu": "14.2.33",
+        "@next/swc-linux-arm64-musl": "14.2.33",
+        "@next/swc-linux-x64-gnu": "14.2.33",
+        "@next/swc-linux-x64-musl": "14.2.33",
+        "@next/swc-win32-arm64-msvc": "14.2.33",
+        "@next/swc-win32-ia32-msvc": "14.2.33",
+        "@next/swc-win32-x64-msvc": "14.2.33"
       },
       "peerDependencies": {
         "@opentelemetry/api": "^1.1.0",
diff --git a/package.json b/package.json
index 216f1dc..cf3bf40 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "@chenglou/pretext": "^0.0.8",
     "bcryptjs": "^2.4.3",
     "jose": "^5.6.3",
-    "next": "14.2.28",
+    "next": "^14.2.35",
     "pg": "^8.12.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
diff --git a/src/app/admin/messages/page.tsx b/src/app/admin/messages/page.tsx
new file mode 100644
index 0000000..33c6e23
--- /dev/null
+++ b/src/app/admin/messages/page.tsx
@@ -0,0 +1,383 @@
+'use client';
+
+import { useState, useEffect, useRef } from 'react';
+import { formatDisplayDateTime } from '@/lib/date';
+
+type User = { id: number; username: string; first_name: string; last_name: string; role: string; email: string };
+type Message = { id: number; content: string; created_at: string; sender_id: number; username: string; first_name: string; last_name: string; role: string };
+type Participant = { id: number; username: string; first_name: string; last_name: string; role: string };
+type Conversation = {
+  id: number;
+  subject: string | null;
+  last_message: string | null;
+  last_message_at: string | null;
+  message_count: number;
+  unread_count: number;
+  participants: Participant[];
+};
+
+export default function AdminMessagesPage() {
+  const [conversations, setConversations] = useState<Conversation[]>([]);
+  const [users, setUsers] = useState<User[]>([]);
+  const [selectedConv, setSelectedConv] = useState<number | null>(null);
+  const [messages, setMessages] = useState<Message[]>([]);
+  const [participants, setParticipants] = useState<Participant[]>([]);
+  const [newMessage, setNewMessage] = useState('');
+  const [showBulk, setShowBulk] = useState(false);
+  const [bulkSubject, setBulkSubject] = useState('');
+  const [bulkContent, setBulkContent] = useState('');
+  const [bulkType, setBulkType] = useState<'all_customers' | 'specific_users' | 'admins'>('all_customers');
+  const [selectedUsers, setSelectedUsers] = useState<number[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [sending, setSending] = useState(false);
+  const messagesEndRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    fetchData();
+  }, []);
+
+  useEffect(() => {
+    if (selectedConv) {
+      fetchMessages(selectedConv);
+    }
+  }, [selectedConv]);
+
+  useEffect(() => {
+    messagesEndRef.current?.scrollIntoView({ behavior: 'smooth' });
+  }, [messages]);
+
+  const fetchData = async () => {
+    try {
+      const [convRes, usersRes] = await Promise.all([
+        fetch('/api/admin/conversations'),
+        fetch('/api/admin/users'),
+      ]);
+
+      if (convRes.ok) {
+        const data = await convRes.json();
+        setConversations(data.conversations || []);
+      }
+      if (usersRes.ok) {
+        const data = await usersRes.json();
+        setUsers(data.users || []);
+      }
+    } catch (err) {
+      console.error('Failed to fetch data:', err);
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const fetchMessages = async (convId: number) => {
+    try {
+      const res = await fetch(`/api/conversations/${convId}`);
+      if (res.ok) {
+        const data = await res.json();
+        setMessages(data.messages || []);
+        setParticipants(data.participants || []);
+      }
+    } catch (err) {
+      console.error('Failed to fetch messages:', err);
+    }
+  };
+
+  const sendMessage = async () => {
+    if (!newMessage.trim() || !selectedConv) return;
+
+    try {
+      const res = await fetch(`/api/conversations/${selectedConv}/messages`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ content: newMessage.trim() }),
+      });
+
+      if (res.ok) {
+        const data = await res.json();
+        setMessages(prev => [...prev, data.message]);
+        setNewMessage('');
+        fetchData();
+      }
+    } catch (err) {
+      console.error('Failed to send message:', err);
+    }
+  };
+
+  const sendBulkMessage = async () => {
+    if (!bulkContent.trim()) return;
+
+    if (bulkType === 'specific_users' && selectedUsers.length === 0) {
+      alert('Please select at least one user');
+      return;
+    }
+
+    setSending(true);
+    try {
+      const res = await fetch('/api/admin/bulk-messages', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          subject: bulkSubject || null,
+          content: bulkContent.trim(),
+          recipient_type: bulkType,
+          recipient_ids: bulkType === 'specific_users' ? selectedUsers : undefined,
+        }),
+      });
+
+      if (res.ok) {
+        const data = await res.json();
+        alert(`Message sent to ${data.sent_count} users`);
+        setShowBulk(false);
+        setBulkSubject('');
+        setBulkContent('');
+        setSelectedUsers([]);
+        fetchData();
+      } else {
+        const err = await res.json();
+        alert(err.error || 'Failed to send');
+      }
+    } catch (err) {
+      console.error('Failed to send bulk message:', err);
+      alert('Failed to send message');
+    } finally {
+      setSending(false);
+    }
+  };
+
+  const getDisplayName = (p: Participant | User) => {
+    return p.first_name || p.username;
+  };
+
+  const customerConvs = conversations.filter(c => c.participants.some(p => p.role === 'customer'));
+  const adminConvs = conversations.filter(c => c.participants.every(p => p.role === 'admin'));
+
+  if (loading) {
+    return (
+      <div className="p-8 flex items-center justify-center">
+        <div className="text-gray-500">Loading...</div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="p-6">
+      <div className="flex justify-between items-center mb-6">
+        <h1 className="text-2xl font-bold text-gray-800">Messages</h1>
+        <button
+          onClick={() => setShowBulk(true)}
+          className="bg-blue-600 text-white px-4 py-2 rounded-lg hover:bg-blue-700 flex items-center gap-2"
+        >
+          <svg className="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+            <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M12 19l9 2-9-18-9 18 9-2zm0 0v-8" />
+          </svg>
+          Send Bulk Message
+        </button>
+      </div>
+
+      <div className="grid grid-cols-1 lg:grid-cols-3 gap-6">
+        {/* Conversations Panel */}
+        <div className="lg:col-span-1 bg-white rounded-lg shadow">
+          <div className="p-4 border-b bg-gray-50 font-medium">Customer Conversations</div>
+          <div className="divide-y max-h-[300px] overflow-y-auto">
+            {customerConvs.length === 0 ? (
+              <div className="p-4 text-center text-gray-500 text-sm">No customer conversations</div>
+            ) : (
+              customerConvs.map(conv => (
+                <div
+                  key={conv.id}
+                  onClick={() => setSelectedConv(conv.id)}
+                  className={`p-3 cursor-pointer hover:bg-gray-50 ${selectedConv === conv.id ? 'bg-blue-50' : ''}`}
+                >
+                  <div className="flex justify-between items-start">
+                    <div className="font-medium text-sm">
+                      {conv.participants.filter(p => p.role === 'customer').map(getDisplayName).join(', ')}
+                    </div>
+                    {conv.unread_count > 0 && (
+                      <span className="bg-blue-600 text-white text-xs px-2 py-0.5 rounded-full">
+                        {conv.unread_count}
+                      </span>
+                    )}
+                  </div>
+                  {conv.last_message && (
+                    <div className="text-xs text-gray-500 truncate mt-1">{conv.last_message}</div>
+                  )}
+                  <div className="text-xs text-gray-400 mt-1">
+                    {conv.last_message_at ? formatDisplayDateTime(conv.last_message_at) : ''}
+                  </div>
+                </div>
+              ))
+            )}
+          </div>
+
+          <div className="p-4 border-b bg-gray-50 font-medium mt-4">Admin Conversations</div>
+          <div className="divide-y max-h-[300px] overflow-y-auto">
+            {adminConvs.length === 0 ? (
+              <div className="p-4 text-center text-gray-500 text-sm">No admin conversations</div>
+            ) : (
+              adminConvs.map(conv => (
+                <div
+                  key={conv.id}
+                  onClick={() => setSelectedConv(conv.id)}
+                  className={`p-3 cursor-pointer hover:bg-gray-50 ${selectedConv === conv.id ? 'bg-blue-50' : ''}`}
+                >
+                  <div className="font-medium text-sm">
+                    {conv.subject || conv.participants.map(getDisplayName).join(', ')}
+                  </div>
+                  {conv.last_message && (
+                    <div className="text-xs text-gray-500 truncate mt-1">{conv.last_message}</div>
+                  )}
+                </div>
+              ))
+            )}
+          </div>
+        </div>
+
+        {/* Messages Panel */}
+        <div className="lg:col-span-2 bg-white rounded-lg shadow flex flex-col h-[700px]">
+          {selectedConv ? (
+            <>
+              <div className="p-4 border-b bg-gray-50">
+                <div className="font-medium">
+                  Conversation with: {participants.filter(p => p.role === 'customer').map(getDisplayName).join(', ') || 'Admins'}
+                </div>
+              </div>
+
+              <div className="flex-1 overflow-y-auto p-4 space-y-3">
+                {messages.map(msg => (
+                  <div key={msg.id} className={`flex ${msg.role === 'admin' ? 'justify-end' : 'justify-start'}`}>
+                    <div className={`max-w-[70%] ${msg.role === 'admin' ? 'bg-blue-600 text-white' : 'bg-gray-100 text-gray-800'} rounded-lg px-4 py-2`}>
+                      <div className="flex items-center gap-2 mb-1">
+                        <span className="text-xs font-medium">
+                          {msg.first_name || msg.username}
+                        </span>
+                        <span className={`text-xs px-1.5 py-0.5 rounded ${msg.role === 'admin' ? 'bg-blue-500' : 'bg-gray-200 text-gray-600'}`}>
+                          {msg.role}
+                        </span>
+                      </div>
+                      <div>{msg.content}</div>
+                      <div className={`text-xs mt-1 ${msg.role === 'admin' ? 'text-blue-200' : 'text-gray-400'}`}>
+                        {formatDisplayDateTime(msg.created_at)}
+                      </div>
+                    </div>
+                  </div>
+                ))}
+                <div ref={messagesEndRef} />
+              </div>
+
+              <div className="p-3 border-t bg-gray-50">
+                <div className="flex gap-2">
+                  <input
+                    type="text"
+                    value={newMessage}
+                    onChange={e => setNewMessage(e.target.value)}
+                    onKeyDown={e => e.key === 'Enter' && sendMessage()}
+                    placeholder="Type a reply..."
+                    className="flex-1 border rounded-lg px-3 py-2 focus:outline-none focus:ring-2 focus:ring-blue-500"
+                  />
+                  <button
+                    onClick={sendMessage}
+                    disabled={!newMessage.trim()}
+                    className="bg-blue-600 text-white px-4 py-2 rounded-lg hover:bg-blue-700 disabled:opacity-50"
+                  >
+                    Send
+                  </button>
+                </div>
+              </div>
+            </>
+          ) : (
+            <div className="flex-1 flex items-center justify-center text-gray-500">
+              Select a conversation to view messages
+            </div>
+          )}
+        </div>
+      </div>
+
+      {/* Bulk Message Modal */}
+      {showBulk && (
+        <div className="fixed inset-0 bg-black/50 flex items-center justify-center z-50">
+          <div className="bg-white rounded-lg p-6 w-full max-w-lg mx-4 max-h-[90vh] overflow-y-auto">
+            <h2 className="text-xl font-bold mb-4">Send Bulk Message</h2>
+
+            <div className="space-y-4">
+              <div>
+                <label className="block text-sm font-medium text-gray-700 mb-1">Recipients</label>
+                <select
+                  value={bulkType}
+                  onChange={e => setBulkType(e.target.value as typeof bulkType)}
+                  className="w-full border rounded-lg px-3 py-2"
+                >
+                  <option value="all_customers">All Customers</option>
+                  <option value="specific_users">Specific Users</option>
+                  <option value="admins">Admins Only</option>
+                </select>
+              </div>
+
+              {bulkType === 'specific_users' && (
+                <div>
+                  <label className="block text-sm font-medium text-gray-700 mb-1">Select Users</label>
+                  <div className="max-h-48 overflow-y-auto border rounded-lg p-2 space-y-1">
+                    {users.filter(u => u.role === 'customer').map(user => (
+                      <label key={user.id} className="flex items-center gap-2 p-1 hover:bg-gray-50 rounded cursor-pointer">
+                        <input
+                          type="checkbox"
+                          checked={selectedUsers.includes(user.id)}
+                          onChange={e => {
+                            if (e.target.checked) {
+                              setSelectedUsers(prev => [...prev, user.id]);
+                            } else {
+                              setSelectedUsers(prev => prev.filter(id => id !== user.id));
+                            }
+                          }}
+                          className="rounded"
+                        />
+                        <span className="text-sm">{user.first_name || user.username} ({user.email})</span>
+                      </label>
+                    ))}
+                  </div>
+                  <div className="text-xs text-gray-500 mt-1">{selectedUsers.length} selected</div>
+                </div>
+              )}
+
+              <div>
+                <label className="block text-sm font-medium text-gray-700 mb-1">Subject (optional)</label>
+                <input
+                  type="text"
+                  value={bulkSubject}
+                  onChange={e => setBulkSubject(e.target.value)}
+                  placeholder="Message subject"
+                  className="w-full border rounded-lg px-3 py-2 focus:outline-none focus:ring-2 focus:ring-blue-500"
+                />
+              </div>
+
+              <div>
+                <label className="block text-sm font-medium text-gray-700 mb-1">Message *</label>
+                <textarea
+                  value={bulkContent}
+                  onChange={e => setBulkContent(e.target.value)}
+                  placeholder="Type your message..."
+                  rows={5}
+                  className="w-full border rounded-lg px-3 py-2 focus:outline-none focus:ring-2 focus:ring-blue-500"
+                />
+              </div>
+            </div>
+
+            <div className="flex justify-end gap-2 mt-6">
+              <button
+                onClick={() => setShowBulk(false)}
+                className="px-4 py-2 text-gray-600 hover:text-gray-800"
+              >
+                Cancel
+              </button>
+              <button
+                onClick={sendBulkMessage}
+                disabled={!bulkContent.trim() || sending}
+                className="bg-blue-600 text-white px-4 py-2 rounded-lg hover:bg-blue-700 disabled:opacity-50"
+              >
+                {sending ? 'Sending...' : 'Send Message'}
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/src/app/admin/page.tsx b/src/app/admin/page.tsx
index 9f03b75..92875c0 100644
--- a/src/app/admin/page.tsx
+++ b/src/app/admin/page.tsx
@@ -14,6 +14,9 @@ type Review = { id: number; author_name: string; author_email: string | null; ra
 type FooterConfig = { logo: string; favicon: string; tagline: string; facebook_url: string; instagram_url: string; whatsapp_url: string; address: string; phone: string; email: string };
 type SocialRes = { id: number; event_id: number; username: string; event_name: string; guests: number; notes: string; status: string; created_at: string };
 type Amenity = { id: number; name: string; icon_svg: string; sort_order: number };
+type RestaurantReservation = { id: number; user_id: number | null; date: string; time: string; guests: number; table_name: string; created_at: string; username?: string; first_name?: string; last_name?: string };
+type RoomReservation = { id: number; room_id: number; user_id: number | null; check_in: string; check_out: string; status: string; total_price: string; guest_name: string | null; guest_contact_method: string | null; guest_contact: string | null; created_at: string; room_name?: string; username?: string; first_name?: string; last_name?: string };
+type Order = { id: number; user_id: number | null; order_type: string; room_id: number | null; subtotal: string; service_fee: string; total: string; status: string; notes: string | null; created_at: string; room_name?: string; username?: string; first_name?: string; last_name?: string; items: { menu_item_id: number; name: string; quantity: number; unit_price: string; total_price: string }[] };
 
 const C = {
   gold: '#D4A853', goldLight: 'rgba(212,168,83,0.12)', navy: '#010D1E',
@@ -30,10 +33,13 @@ const NAV = [
   { id: 'social', label: 'Public Events', icon: '🎪' },
   { id: 'private-events', label: 'Private Events', icon: '🔒' },
   { id: 'rooms', label: 'Rooms', icon: '🏨' },
+  { id: 'room-reservations', label: 'Room Bookings', icon: '🛏️' },
+  { id: 'restaurant-reservations', label: 'Restaurant', icon: '🍽️' },
+  { id: 'orders', label: 'Food Orders', icon: '📦' },
   { id: 'amenities', label: 'Amenities', icon: '✨' },
   { id: 'trips', label: 'Trips', icon: '✈️' },
   { id: 'messages', label: 'Messages', icon: '💬' },
-  { id: 'menu', label: 'Menu', icon: '🍽️' },
+  { id: 'menu', label: 'Menu', icon: '📋' },
   { id: 'places', label: 'Places', icon: '🗺️' },
   { id: 'reviews', label: 'Reviews', icon: '⭐' },
   { id: 'users', label: 'Users', icon: '👥' },
@@ -1071,6 +1077,248 @@ function PrivateEventsSection({ onToast }: { onToast: (msg: string, type: 'succe
   );
 }
 
+/* ─── Room Reservations Section ─── */
+function RoomReservationsSection({ onToast }: { onToast: (msg: string, type: 'success' | 'error') => void }) {
+  const [reservations, setReservations] = useState<RoomReservation[]>([]);
+  const [statusFilter, setStatusFilter] = useState<'pending' | 'confirmed' | 'cancelled' | 'all'>('pending');
+  const [loading, setLoading] = useState(true);
+  const [confirmDel, setConfirmDel] = useState<number | null>(null);
+
+  useEffect(() => { loadReservations(); }, [statusFilter]);
+
+  const loadReservations = async () => {
+    setLoading(true);
+    try {
+      const url = statusFilter === 'all' ? '/api/admin/room-reservations?status=all' : `/api/admin/room-reservations?status=${statusFilter}`;
+      const res = await fetch(url);
+      const data = await res.json();
+      setReservations(data.reservations || []);
+    } catch { onToast('Error loading reservations', 'error'); }
+    setLoading(false);
+  };
+
+  const updateStatus = async (id: number, status: 'confirmed' | 'cancelled') => {
+    try {
+      const res = await fetch('/api/admin/room-reservations', {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ id, status }),
+      });
+      if (res.ok) {
+        setReservations(r => r.map(x => x.id === id ? { ...x, status } : x));
+        onToast(`Reservation ${status}`, 'success');
+      }
+    } catch { onToast('Error updating reservation', 'error'); }
+  };
+
+  const del = async (id: number) => {
+    try {
+      await fetch(`/api/admin/room-reservations?id=${id}`, { method: 'DELETE' });
+      setReservations(r => r.filter(x => x.id !== id));
+      onToast('Reservation deleted', 'success');
+    } catch { onToast('Error deleting reservation', 'error'); }
+    setConfirmDel(null);
+  };
+
+  const formatDate = (d: string) => new Date(d).toLocaleDateString();
+  const formatPrice = (p: string) => `$${parseFloat(p).toFixed(2)}`;
+
+  return (
+    <div>
+      <SecHead title="🛏️ Room Bookings" count={reservations.length} />
+      <div style={{ display: 'flex', gap: '8px', marginBottom: '16px' }}>
+        {(['pending', 'confirmed', 'cancelled', 'all'] as const).map(s => (
+          <Btn key={s} size="sm" variant={statusFilter === s ? 'primary' : 'secondary'} onClick={() => setStatusFilter(s)}>
+            {s.charAt(0).toUpperCase() + s.slice(1)}
+          </Btn>
+        ))}
+      </div>
+      {loading ? <Empty icon="⏳" title="Loading..." /> : reservations.length === 0 ? <Empty icon="🛏️" title="No bookings" desc={`No ${statusFilter === 'all' ? '' : statusFilter} bookings`} /> : (
+        <div style={{ display: 'grid', gap: '12px' }}>
+          {reservations.map((r) => (
+            <div key={r.id} style={{ background: '#fff', borderRadius: 12, padding: '16px', border: `1px solid ${r.status === 'pending' ? '#f59e0b' : r.status === 'confirmed' ? '#10b981' : '#ef4444'}` }}>
+              <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'flex-start', marginBottom: '12px' }}>
+                <div>
+                  <div style={{ fontWeight: 600, fontSize: '16px', color: C.navy }}>{r.room_name || `Room #${r.room_id}`}</div>
+                  <div style={{ fontSize: '13px', color: '#666', marginTop: '4px' }}>
+                    {formatDate(r.check_in)} → {formatDate(r.check_out)} • {formatPrice(r.total_price)}
+                  </div>
+                </div>
+                <span style={{
+                  padding: '4px 10px', borderRadius: 12, fontSize: '12px', fontWeight: 600,
+                  background: r.status === 'confirmed' ? '#d1fae5' : r.status === 'cancelled' ? '#fee2e2' : '#fef3c7',
+                  color: r.status === 'confirmed' ? '#047857' : r.status === 'cancelled' ? '#b91c1c' : '#b45309'
+                }}>{r.status}</span>
+              </div>
+              <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: '8px', fontSize: '13px', marginBottom: '12px' }}>
+                <div><strong>Guest:</strong> {r.guest_name || r.username || r.first_name || 'N/A'}</div>
+                {r.guest_contact && <div><strong>Contact:</strong> {r.guest_contact}</div>}
+                {r.guest_contact_method && <div><strong>Method:</strong> {r.guest_contact_method}</div>}
+              </div>
+              <div style={{ display: 'flex', gap: '8px' }}>
+                {r.status === 'pending' && (
+                  <>
+                    <Btn size="sm" variant="secondary" onClick={() => updateStatus(r.id, 'confirmed')}>✓ Confirm</Btn>
+                    <Btn size="sm" variant="danger" onClick={() => updateStatus(r.id, 'cancelled')}>✗ Cancel</Btn>
+                  </>
+                )}
+                {r.status === 'confirmed' && <Btn size="sm" variant="danger" onClick={() => updateStatus(r.id, 'cancelled')}>✗ Cancel</Btn>}
+                {r.status === 'cancelled' && <Btn size="sm" variant="secondary" onClick={() => updateStatus(r.id, 'confirmed')}>✓ Reactivate</Btn>}
+                <Btn size="sm" variant="danger" onClick={() => setConfirmDel(r.id)}>🗑 Delete</Btn>
+              </div>
+            </div>
+          ))}
+        </div>
+      )}
+      {confirmDel !== null && <Confirm message="Delete this booking?" onCancel={() => setConfirmDel(null)} onConfirm={() => del(confirmDel)} />}
+    </div>
+  );
+}
+
+/* ─── Restaurant Reservations Section ─── */
+function RestaurantReservationsSection({ onToast }: { onToast: (msg: string, type: 'success' | 'error') => void }) {
+  const [reservations, setReservations] = useState<RestaurantReservation[]>([]);
+  const [loading, setLoading] = useState(true);
+
+  useEffect(() => { loadReservations(); }, []);
+
+  const loadReservations = async () => {
+    setLoading(true);
+    try {
+      const res = await fetch('/api/admin/restaurant-reservations');
+      const data = await res.json();
+      setReservations(data.reservations || []);
+    } catch { onToast('Error loading reservations', 'error'); }
+    setLoading(false);
+  };
+
+  const del = async (id: number) => {
+    try {
+      await fetch(`/api/admin/restaurant-reservations?id=${id}`, { method: 'DELETE' });
+      setReservations(r => r.filter(x => x.id !== id));
+      onToast('Reservation deleted', 'success');
+    } catch { onToast('Error deleting reservation', 'error'); }
+  };
+
+  return (
+    <div>
+      <SecHead title="🍽️ Restaurant Reservations" count={reservations.length} />
+      {loading ? <Empty icon="⏳" title="Loading..." /> : reservations.length === 0 ? <Empty icon="🍽️" title="No reservations" desc="No restaurant reservations yet" /> : (
+        <div style={{ display: 'grid', gap: '12px' }}>
+          {reservations.map((r) => (
+            <div key={r.id} style={{ background: '#fff', borderRadius: 12, padding: '16px', border: `1px solid ${C.border}` }}>
+              <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'flex-start', marginBottom: '8px' }}>
+                <div>
+                  <div style={{ fontWeight: 600, fontSize: '16px', color: C.navy }}>{r.table_name}</div>
+                  <div style={{ fontSize: '13px', color: '#666', marginTop: '4px' }}>
+                    {formatDisplayDate(r.date)} at {r.time} • {r.guests} guests
+                  </div>
+                </div>
+                <div style={{ fontSize: '12px', color: C.textLight }}>{formatDisplayDateTime(r.created_at)}</div>
+              </div>
+              <div style={{ fontSize: '13px', color: '#666', marginBottom: '8px' }}>
+                <strong>Guest:</strong> {r.username || r.first_name || 'Guest'}
+              </div>
+              <Btn size="sm" variant="danger" onClick={() => del(r.id)}>🗑 Delete</Btn>
+            </div>
+          ))}
+        </div>
+      )}
+    </div>
+  );
+}
+
+/* ─── Orders Section ─── */
+function OrdersSection({ onToast }: { onToast: (msg: string, type: 'success' | 'error') => void }) {
+  const [orders, setOrders] = useState<Order[]>([]);
+  const [statusFilter, setStatusFilter] = useState<'pending' | 'preparing' | 'ready' | 'delivered' | 'cancelled' | 'all'>('pending');
+  const [loading, setLoading] = useState(true);
+
+  useEffect(() => { loadOrders(); }, [statusFilter]);
+
+  const loadOrders = async () => {
+    setLoading(true);
+    try {
+      const url = statusFilter === 'all' ? '/api/orders?status=all' : `/api/orders?status=${statusFilter}`;
+      const res = await fetch(url);
+      const data = await res.json();
+      setOrders(data.orders || []);
+    } catch { onToast('Error loading orders', 'error'); }
+    setLoading(false);
+  };
+
+  const updateStatus = async (id: number, status: string) => {
+    try {
+      const res = await fetch('/api/orders', {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ order_id: id, status }),
+      });
+      if (res.ok) {
+        setOrders(o => o.map(x => x.id === id ? { ...x, status } : x));
+        onToast(`Order ${status}`, 'success');
+      }
+    } catch { onToast('Error updating order', 'error'); }
+  };
+
+  const formatPrice = (p: string) => `$${parseFloat(p).toFixed(2)}`;
+  const statusColor = (s: string) => s === 'pending' ? '#f59e0b' : s === 'preparing' ? '#3b82f6' : s === 'ready' ? '#10b981' : s === 'delivered' ? '#6b7280' : '#ef4444';
+
+  return (
+    <div>
+      <SecHead title="📦 Food Orders" count={orders.length} />
+      <div style={{ display: 'flex', gap: '8px', marginBottom: '16px', flexWrap: 'wrap' }}>
+        {(['pending', 'preparing', 'ready', 'delivered', 'cancelled', 'all'] as const).map(s => (
+          <Btn key={s} size="sm" variant={statusFilter === s ? 'primary' : 'secondary'} onClick={() => setStatusFilter(s)}>
+            {s.charAt(0).toUpperCase() + s.slice(1)}
+          </Btn>
+        ))}
+      </div>
+      {loading ? <Empty icon="⏳" title="Loading..." /> : orders.length === 0 ? <Empty icon="📦" title="No orders" desc={`No ${statusFilter === 'all' ? '' : statusFilter} orders`} /> : (
+        <div style={{ display: 'grid', gap: '12px' }}>
+          {orders.map((o) => (
+            <div key={o.id} style={{ background: '#fff', borderRadius: 12, padding: '16px', border: `1px solid ${statusColor(o.status)}` }}>
+              <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'flex-start', marginBottom: '12px' }}>
+                <div>
+                  <div style={{ fontWeight: 600, fontSize: '16px', color: C.navy }}>
+                    {o.order_type === 'room_delivery' ? `🚪 Room ${o.room_name || o.room_id}` : o.order_type === 'dine_in' ? '🍽️ Dine-in' : '📦 Pickup'}
+                  </div>
+                  <div style={{ fontSize: '13px', color: '#666', marginTop: '4px' }}>
+                    {formatPrice(o.total)} • {formatDisplayDateTime(o.created_at)}
+                  </div>
+                </div>
+                <span style={{
+                  padding: '4px 10px', borderRadius: 12, fontSize: '12px', fontWeight: 600,
+                  background: `${statusColor(o.status)}20`, color: statusColor(o.status)
+                }}>{o.status}</span>
+              </div>
+              <div style={{ marginBottom: '12px' }}>
+                {o.items?.map((item, i) => (
+                  <div key={i} style={{ fontSize: '13px', color: '#666', display: 'flex', justifyContent: 'space-between' }}>
+                    <span>{item.quantity}x {item.name}</span>
+                    <span>{formatPrice(item.total_price)}</span>
+                  </div>
+                ))}
+              </div>
+              {o.notes && <div style={{ fontSize: '13px', color: '#666', fontStyle: 'italic', marginBottom: '12px' }}>"{o.notes}"</div>}
+              <div style={{ display: 'flex', gap: '8px', flexWrap: 'wrap' }}>
+                {o.status === 'pending' && (
+                  <>
+                    <Btn size="sm" variant="secondary" onClick={() => updateStatus(o.id, 'preparing')}>🍳 Start Preparing</Btn>
+                    <Btn size="sm" variant="danger" onClick={() => updateStatus(o.id, 'cancelled')}>✗ Cancel</Btn>
+                  </>
+                )}
+                {o.status === 'preparing' && <Btn size="sm" variant="secondary" onClick={() => updateStatus(o.id, 'ready')}>✓ Ready</Btn>}
+                {o.status === 'ready' && <Btn size="sm" variant="secondary" onClick={() => updateStatus(o.id, 'delivered')}>✓ Delivered</Btn>}
+              </div>
+            </div>
+          ))}
+        </div>
+      )}
+    </div>
+  );
+}
+
 function RoomsSection({ rooms, setRooms, images, onToast }: any) {
   const [editing, setEditing] = useState<Room | null>(null);
   const [confirmDel, setConfirmDel] = useState<number | null>(null);
@@ -2753,6 +3001,9 @@ export default function AdminPage() {
       case 'social': return <SocialSection events={socialEvents} setEvents={setSocialEvents} images={images} onToast={showToast} />;
       case 'private-events': return <PrivateEventsSection onToast={showToast} />;
       case 'rooms': return <RoomsSection rooms={rooms} setRooms={setRooms} images={images} onToast={showToast} />;
+      case 'room-reservations': return <RoomReservationsSection onToast={showToast} />;
+      case 'restaurant-reservations': return <RestaurantReservationsSection onToast={showToast} />;
+      case 'orders': return <OrdersSection onToast={showToast} />;
       case 'amenities': return <AmenitiesSection onToast={showToast} />;
       case 'menu': return <MenuSection items={menuItems} setItems={setMenuItems} images={images} onToast={showToast} />;
       case 'places': return <PlacesSection places={places} setPlaces={setPlaces} images={images} onToast={showToast} />;
diff --git a/src/app/api/admin/bulk-messages/route.ts b/src/app/api/admin/bulk-messages/route.ts
new file mode 100644
index 0000000..8b806e4
--- /dev/null
+++ b/src/app/api/admin/bulk-messages/route.ts
@@ -0,0 +1,113 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { requireRole } from '@/lib/auth';
+import { getErrorMessage } from '@/lib/errors';
+
+// Admin: Send bulk message to customers
+export async function POST(request: NextRequest) {
+  try {
+    const admin = await requireRole('admin');
+    
+    const { subject, content, recipient_type, recipient_ids } = await request.json();
+
+    if (!content || content.trim().length === 0) {
+      return NextResponse.json({ error: 'Message content is required' }, { status: 400 });
+    }
+
+    if (!['all_customers', 'specific_users', 'admins'].includes(recipient_type)) {
+      return NextResponse.json({ error: 'Invalid recipient type' }, { status: 400 });
+    }
+
+    // Get recipients based on type
+    let recipientList: number[] = [];
+
+    if (recipient_type === 'all_customers') {
+      const { rows } = await db.query(
+        "SELECT id FROM users WHERE role = 'customer'"
+      );
+      recipientList = rows.map((r: any) => r.id);
+    } else if (recipient_type === 'admins') {
+      const { rows } = await db.query(
+        "SELECT id FROM users WHERE role = 'admin'"
+      );
+      recipientList = rows.map((r: any) => r.id);
+    } else if (recipient_type === 'specific_users' && recipient_ids) {
+      recipientList = recipient_ids;
+    }
+
+    if (recipientList.length === 0) {
+      return NextResponse.json({ error: 'No recipients found' }, { status: 400 });
+    }
+
+    // Create bulk message record
+    const { rows: bulkRows } = await db.query(
+      'INSERT INTO bulk_messages (sender_id, subject, content, recipient_type) VALUES ($1, $2, $3, $4) RETURNING *',
+      [admin.id, subject || null, content, recipient_type]
+    );
+    const bulkMessage = bulkRows[0];
+
+    // Create recipient records
+    for (const userId of recipientList) {
+      await db.query(
+        'INSERT INTO bulk_message_recipients (bulk_message_id, user_id) VALUES ($1, $2)',
+        [bulkMessage.id, userId]
+      );
+    }
+
+    // Create individual conversations for each recipient if they don't exist
+    for (const userId of recipientList) {
+      // Check if there's an existing conversation between this admin and user
+      const { rows: existingConv } = await db.query(`
+        SELECT c.id FROM conversations c
+        JOIN conversation_participants cp1 ON c.id = cp1.conversation_id
+        JOIN conversation_participants cp2 ON c.id = cp2.conversation_id
+        WHERE cp1.user_id = $1 AND cp2.user_id = $2
+        GROUP BY c.id
+        HAVING COUNT(DISTINCT cp1.user_id) = 1 AND COUNT(DISTINCT cp2.user_id) = 1
+      `, [admin.id, userId]);
+
+      let conversationId: number;
+
+      if (existingConv.length > 0) {
+        conversationId = existingConv[0].id;
+      } else {
+        // Create new conversation
+        const { rows: convRows } = await db.query(
+          'INSERT INTO conversations (subject, created_by) VALUES ($1, $2) RETURNING id',
+          [subject || 'Admin Message', admin.id]
+        );
+        conversationId = convRows[0].id;
+
+        // Add participants
+        await db.query(
+          'INSERT INTO conversation_participants (conversation_id, user_id) VALUES ($1, $2), ($1, $3)',
+          [conversationId, admin.id, userId]
+        );
+      }
+
+      // Add the message to the conversation
+      await db.query(
+        'INSERT INTO direct_messages (conversation_id, sender_id, content) VALUES ($1, $2, $3)',
+        [conversationId, admin.id, content]
+      );
+
+      // Update conversation timestamp
+      await db.query(
+        'UPDATE conversations SET updated_at = NOW() WHERE id = $1',
+        [conversationId]
+      );
+    }
+
+    return NextResponse.json({
+      success: true,
+      sent_count: recipientList.length,
+      bulk_message: bulkMessage
+    });
+  } catch (error) {
+    console.error('Send bulk message error:', error);
+    return NextResponse.json(
+      { error: getErrorMessage(error, 'Failed to send bulk message') },
+      { status: 500 }
+    );
+  }
+}
\ No newline at end of file
diff --git a/src/app/api/admin/conversations/route.ts b/src/app/api/admin/conversations/route.ts
new file mode 100644
index 0000000..5ea04cb
--- /dev/null
+++ b/src/app/api/admin/conversations/route.ts
@@ -0,0 +1,63 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { requireRole } from '@/lib/auth';
+import { getErrorMessage } from '@/lib/errors';
+
+// Admin: Get all conversations
+export async function GET() {
+  try {
+    await requireRole('admin');
+
+    // Get all conversations with participant info and last message
+    const { rows } = await db.query(`
+      SELECT 
+        c.id,
+        c.subject,
+        c.created_at,
+        c.updated_at,
+        (SELECT content FROM direct_messages WHERE conversation_id = c.id ORDER BY created_at DESC LIMIT 1) as last_message,
+        (SELECT created_at FROM direct_messages WHERE conversation_id = c.id ORDER BY created_at DESC LIMIT 1) as last_message_at,
+        (SELECT COUNT(*) FROM direct_messages WHERE conversation_id = c.id) as message_count
+      FROM conversations c
+      ORDER BY c.updated_at DESC
+    `);
+
+    // Get participants for each conversation
+    const conversations = await Promise.all(rows.map(async (conv: any) => {
+      const { rows: participants } = await db.query(`
+        SELECT u.id, u.username, u.first_name, u.last_name, u.role
+        FROM conversation_participants cp
+        JOIN users u ON cp.user_id = u.id
+        WHERE cp.conversation_id = $1
+        ORDER BY u.role DESC, u.first_name
+      `, [conv.id]);
+
+      // Count unread for admins (messages from customers)
+      const { rows: unreadRows } = await db.query(`
+        SELECT COUNT(*) as unread
+        FROM direct_messages dm
+        JOIN users u ON dm.sender_id = u.id
+        WHERE dm.conversation_id = $1
+          AND u.role != 'admin'
+          AND dm.created_at > COALESCE(
+            (SELECT joined_at FROM conversation_participants WHERE conversation_id = $1 AND user_id = (SELECT id FROM users WHERE role = 'admin' LIMIT 1)),
+            '1970-01-01'::timestamp
+          )
+      `, [conv.id]);
+
+      return {
+        ...conv,
+        participants,
+        unread_count: parseInt(unreadRows[0]?.unread || '0')
+      };
+    }));
+
+    return NextResponse.json({ conversations });
+  } catch (error) {
+    console.error('Admin get conversations error:', error);
+    return NextResponse.json(
+      { error: getErrorMessage(error, 'Failed to get conversations') },
+      { status: 500 }
+    );
+  }
+}
\ No newline at end of file
diff --git a/src/app/api/admin/images/route.ts b/src/app/api/admin/images/route.ts
index 20ba0e0..afdd236 100644
--- a/src/app/api/admin/images/route.ts
+++ b/src/app/api/admin/images/route.ts
@@ -95,7 +95,7 @@ export async function POST(request: NextRequest) {
     const sizes = await generateImageSizes(data);
 
     const { rows } = await db.query(
-      'INSERT INTO images (filename, data, thumbnail, medium, category, room_id, location_target) VALUES ($1, $2, $3, $4, $5, $6, $7) RETURNING id, filename, category, room_id, location_target, uploaded_at',
+      'INSERT INTO images (filename, data, thumbnail, medium, category, room_id, location_target) VALUES ($1, $2, $3, $4, $5, $6, $7) RETURNING id, filename, data, thumbnail, medium, category, room_id, location_target, uploaded_at',
       [filename, sizes.data, sizes.thumbnail, sizes.medium, category || 'other', room_id || null, location_target || 'gallery']
     );
 
diff --git a/src/app/api/admin/restaurant-reservations/route.ts b/src/app/api/admin/restaurant-reservations/route.ts
new file mode 100644
index 0000000..ab11a81
--- /dev/null
+++ b/src/app/api/admin/restaurant-reservations/route.ts
@@ -0,0 +1,46 @@
+import { NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { getSession } from '@/lib/auth';
+
+export async function GET(request: Request) {
+  try {
+    const user = await getSession();
+    if (!user || user.role !== 'admin') {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const { rows } = await db.query(`
+      SELECT r.*, u.username, u.first_name, u.last_name
+      FROM reservations r
+      LEFT JOIN users u ON r.user_id = u.id
+      ORDER BY r.date DESC, r.time DESC
+    `);
+
+    return NextResponse.json({ reservations: rows });
+  } catch (error) {
+    console.error('Get restaurant reservations error:', error);
+    return NextResponse.json({ error: 'Failed to get reservations' }, { status: 500 });
+  }
+}
+
+export async function DELETE(request: Request) {
+  try {
+    const user = await getSession();
+    if (!user || user.role !== 'admin') {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const { searchParams } = new URL(request.url);
+    const id = searchParams.get('id');
+
+    if (!id) {
+      return NextResponse.json({ error: 'Reservation ID required' }, { status: 400 });
+    }
+
+    await db.query('DELETE FROM reservations WHERE id = $1', [id]);
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    console.error('Delete restaurant reservation error:', error);
+    return NextResponse.json({ error: 'Failed to delete reservation' }, { status: 500 });
+  }
+}
\ No newline at end of file
diff --git a/src/app/api/admin/room-reservations/route.ts b/src/app/api/admin/room-reservations/route.ts
new file mode 100644
index 0000000..7715652
--- /dev/null
+++ b/src/app/api/admin/room-reservations/route.ts
@@ -0,0 +1,118 @@
+import { NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { getSession } from '@/lib/auth';
+
+export async function GET(request: Request) {
+  try {
+    const user = await getSession();
+    if (!user || user.role !== 'admin') {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const { searchParams } = new URL(request.url);
+    const status = searchParams.get('status') || 'all';
+
+    let query = `
+      SELECT r.*, rm.name as room_name, 
+        u.username, u.first_name, u.last_name, u.email, u.phone
+      FROM room_reservations r
+      JOIN rooms rm ON r.room_id = rm.id
+      LEFT JOIN users u ON r.user_id = u.id
+    `;
+    
+    const params: any[] = [];
+    if (status !== 'all') {
+      query += ' WHERE r.status = $1';
+      params.push(status);
+    }
+    
+    query += ' ORDER BY r.created_at DESC';
+
+    const { rows } = await db.query(query, params);
+    return NextResponse.json({ reservations: rows });
+  } catch (error) {
+    console.error('Get room reservations error:', error);
+    return NextResponse.json({ error: 'Failed to get reservations' }, { status: 500 });
+  }
+}
+
+export async function PATCH(request: Request) {
+  try {
+    const user = await getSession();
+    if (!user || user.role !== 'admin') {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const body = await request.json();
+    const { id, status } = body;
+
+    if (!id || !status) {
+      return NextResponse.json({ error: 'ID and status required' }, { status: 400 });
+    }
+
+    await db.query(
+      'UPDATE room_reservations SET status = $1, updated_at = NOW() WHERE id = $2',
+      [status, id]
+    );
+
+    // If cancelling, free up the blocked dates
+    if (status === 'cancelled') {
+      const { rows: reservation } = await db.query(
+        'SELECT room_id, check_in, check_out FROM room_reservations WHERE id = $1',
+        [id]
+      );
+      
+      if (reservation.length > 0) {
+        const { room_id, check_in, check_out } = reservation[0];
+        await db.query(`
+          DELETE FROM room_availability 
+          WHERE room_id = $1 AND date >= $2 AND date < $3 AND reason = $4
+        `, [room_id, check_in, check_out, `Reservation #${id}`]);
+      }
+    }
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    console.error('Update room reservation error:', error);
+    return NextResponse.json({ error: 'Failed to update reservation' }, { status: 500 });
+  }
+}
+
+export async function DELETE(request: Request) {
+  try {
+    const user = await getSession();
+    if (!user || user.role !== 'admin') {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const { searchParams } = new URL(request.url);
+    const id = searchParams.get('id');
+
+    if (!id) {
+      return NextResponse.json({ error: 'Reservation ID required' }, { status: 400 });
+    }
+
+    // Get reservation details before deleting
+    const { rows: reservation } = await db.query(
+      'SELECT room_id, check_in, check_out FROM room_reservations WHERE id = $1',
+      [id]
+    );
+
+    // Delete the reservation
+    await db.query('DELETE FROM room_reservations WHERE id = $1', [id]);
+
+    // Free up blocked dates
+    if (reservation.length > 0) {
+      const { room_id, check_in, check_out } = reservation[0];
+      await db.query(`
+        DELETE FROM room_availability 
+        WHERE room_id = $1 AND date >= $2 AND date < $3 AND reason = $4
+      `, [room_id, check_in, check_out, `Reservation #${id}`]);
+    }
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    console.error('Delete room reservation error:', error);
+    return NextResponse.json({ error: 'Failed to delete reservation' }, { status: 500 });
+  }
+}
\ No newline at end of file
diff --git a/src/app/api/admin/users/route.ts b/src/app/api/admin/users/route.ts
index 3a548c4..7e40d65 100644
--- a/src/app/api/admin/users/route.ts
+++ b/src/app/api/admin/users/route.ts
@@ -1,114 +1,25 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { requireRole, createUser } from '@/lib/auth';
+import { NextResponse } from 'next/server';
 import { db } from '@/lib/db';
+import { requireRole } from '@/lib/auth';
+import { getErrorMessage } from '@/lib/errors';
 
+// Admin: Get all users for recipient selection
 export async function GET() {
   try {
     await requireRole('admin');
-    const { rows } = await db.query('SELECT id, username, role, comments_disabled, first_name, last_name, preferred_language, terms_accepted_at, email, phone, country, created_at FROM users ORDER BY created_at DESC');
-    return NextResponse.json({ data: rows });
-  } catch (err: any) {
-    return NextResponse.json({ error: err.message || 'Failed to fetch users' }, { status: err.message === 'Unauthorized' ? 401 : 500 });
-  }
-}
 
-export async function POST(request: NextRequest) {
-  try {
-    await requireRole('admin');
-    const body = await request.json();
-    const { username, password, role = 'user', first_name, last_name, email, phone, country, preferred_language = 'es' } = body;
+    const { rows } = await db.query(`
+      SELECT id, username, first_name, last_name, role, email, created_at
+      FROM users
+      ORDER BY role, first_name, last_name
+    `);
 
-    if (!username || !password) {
-      return NextResponse.json({ error: 'Username and password are required' }, { status: 400 });
-    }
-
-    if (role !== 'admin' && role !== 'user') {
-      return NextResponse.json({ error: 'Role must be admin or user' }, { status: 400 });
-    }
-
-    const user = await createUser(username, password, role as 'admin' | 'user', { first_name, last_name, email, phone, country, preferred_language });
-    return NextResponse.json({ ok: true, user: { id: user.id, username: user.username, role: user.role, first_name: user.first_name, last_name: user.last_name } });
-  } catch (err: any) {
-    return NextResponse.json({ error: err.message || 'Failed to create user' }, { status: err.message === 'Unauthorized' ? 401 : 500 });
-  }
-}
-
-export async function PUT(request: NextRequest) {
-  try {
-    await requireRole('admin');
-    const body = await request.json();
-    const { id, first_name, last_name, comments_disabled, preferred_language, email, phone, country, password } = body;
-
-    // Build dynamic update query
-    const updates: string[] = [];
-    const values: any[] = [];
-    let paramIndex = 1;
-
-    if (first_name !== undefined) {
-      updates.push(`first_name = $${paramIndex++}`);
-      values.push(first_name || null);
-    }
-    if (last_name !== undefined) {
-      updates.push(`last_name = $${paramIndex++}`);
-      values.push(last_name || null);
-    }
-    if (comments_disabled !== undefined) {
-      updates.push(`comments_disabled = $${paramIndex++}`);
-      values.push(comments_disabled === true);
-    }
-    if (preferred_language !== undefined) {
-      updates.push(`preferred_language = $${paramIndex++}`);
-      values.push(preferred_language || 'es');
-    }
-    if (email !== undefined) {
-      updates.push(`email = $${paramIndex++}`);
-      values.push(email || null);
-    }
-    if (phone !== undefined) {
-      updates.push(`phone = $${paramIndex++}`);
-      values.push(phone || null);
-    }
-    if (country !== undefined) {
-      updates.push(`country = $${paramIndex++}`);
-      values.push(country || null);
-    }
-    if (password !== undefined && password) {
-      const { hashPassword } = await import('@/lib/auth');
-      updates.push(`password_hash = $${paramIndex++}`);
-      values.push(await hashPassword(password));
-    }
-
-    if (updates.length === 0) {
-      return NextResponse.json({ error: 'No fields to update' }, { status: 400 });
-    }
-
-    values.push(id);
-    const { rows } = await db.query(
-      `UPDATE users SET ${updates.join(', ')} WHERE id = $${paramIndex} RETURNING id, username, role, first_name, last_name, comments_disabled, preferred_language, email, phone, country, created_at`,
-      values
+    return NextResponse.json({ users: rows });
+  } catch (error) {
+    console.error('Get users error:', error);
+    return NextResponse.json(
+      { error: getErrorMessage(error, 'Failed to get users') },
+      { status: 500 }
     );
-
-    if (rows.length === 0) {
-      return NextResponse.json({ error: 'User not found' }, { status: 404 });
-    }
-
-    return NextResponse.json({ data: rows[0] });
-  } catch (err: any) {
-    return NextResponse.json({ error: err.message || 'Failed to update user' }, { status: err.message === 'Unauthorized' ? 401 : 500 });
   }
-}
-
-export async function DELETE(request: NextRequest) {
-  try {
-    await requireRole('admin');
-    const { searchParams } = new URL(request.url);
-    const id = searchParams.get('id');
-    if (!id) {
-      return NextResponse.json({ error: 'User ID required' }, { status: 400 });
-    }
-    await db.query('DELETE FROM users WHERE id = $1', [id]);
-    return NextResponse.json({ ok: true });
-  } catch (err: any) {
-    return NextResponse.json({ error: err.message || 'Failed to delete user' }, { status: err.message === 'Unauthorized' ? 401 : 500 });
-  }
-}
+}
\ No newline at end of file
diff --git a/src/app/api/bootstrap-user/route.ts b/src/app/api/bootstrap-user/route.ts
index fbc09c7..1c92a14 100644
--- a/src/app/api/bootstrap-user/route.ts
+++ b/src/app/api/bootstrap-user/route.ts
@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server';
 import { createUser } from '@/lib/auth';
+import { getErrorMessage } from '@/lib/errors';
 
 export async function POST() {
   try {
@@ -12,7 +13,10 @@ export async function POST() {
 
     const user = await createUser(username, password, 'admin');
     return NextResponse.json({ ok: true, user: { id: user.id, username: user.username, role: user.role } });
-  } catch (err: any) {
-    return NextResponse.json({ error: err?.message || 'Failed to create bootstrap user' }, { status: 500 });
+  } catch (err: unknown) {
+    return NextResponse.json(
+      { error: getErrorMessage(err, 'Failed to create bootstrap user') },
+      { status: 500 }
+    );
   }
 }
diff --git a/src/app/api/conversations/[id]/messages/route.ts b/src/app/api/conversations/[id]/messages/route.ts
new file mode 100644
index 0000000..cf7dd22
--- /dev/null
+++ b/src/app/api/conversations/[id]/messages/route.ts
@@ -0,0 +1,69 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { requireAuth } from '@/lib/auth';
+import { getErrorMessage } from '@/lib/errors';
+
+// Send a message to a conversation
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const user = await requireAuth();
+    if (!user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const { id } = await params;
+    const { content } = await request.json();
+
+    if (!content || content.trim().length === 0) {
+      return NextResponse.json({ error: 'Message content is required' }, { status: 400 });
+    }
+
+    // Verify user is participant
+    const { rows: participants } = await db.query(
+      'SELECT * FROM conversation_participants WHERE conversation_id = $1 AND user_id = $2',
+      [id, user.id]
+    );
+
+    if (participants.length === 0) {
+      return NextResponse.json({ error: 'Not authorized for this conversation' }, { status: 403 });
+    }
+
+    // Create message
+    const { rows: msgRows } = await db.query(
+      'INSERT INTO direct_messages (conversation_id, sender_id, content) VALUES ($1, $2, $3) RETURNING *',
+      [id, user.id, content]
+    );
+
+    // Update conversation updated_at
+    await db.query(
+      'UPDATE conversations SET updated_at = NOW() WHERE id = $1',
+      [id]
+    );
+
+    // Get sender info
+    const { rows: userRows } = await db.query(
+      'SELECT id, username, first_name, last_name, role FROM users WHERE id = $1',
+      [user.id]
+    );
+
+    return NextResponse.json({
+      message: {
+        ...msgRows[0],
+        sender_id: user.id,
+        username: userRows[0].username,
+        first_name: userRows[0].first_name,
+        last_name: userRows[0].last_name,
+        role: userRows[0].role
+      }
+    });
+  } catch (error) {
+    console.error('Send message error:', error);
+    return NextResponse.json(
+      { error: getErrorMessage(error, 'Failed to send message') },
+      { status: 500 }
+    );
+  }
+}
\ No newline at end of file
diff --git a/src/app/api/conversations/[id]/route.ts b/src/app/api/conversations/[id]/route.ts
new file mode 100644
index 0000000..c978e11
--- /dev/null
+++ b/src/app/api/conversations/[id]/route.ts
@@ -0,0 +1,76 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { requireAuth } from '@/lib/auth';
+import { getErrorMessage } from '@/lib/errors';
+
+// Get messages for a conversation
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const user = await requireAuth();
+    if (!user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const { id } = await params;
+
+    // Verify user is participant
+    const { rows: participants } = await db.query(
+      'SELECT * FROM conversation_participants WHERE conversation_id = $1 AND user_id = $2',
+      [id, user.id]
+    );
+
+    if (participants.length === 0) {
+      return NextResponse.json({ error: 'Not authorized for this conversation' }, { status: 403 });
+    }
+
+    // Get all messages with sender info
+    const { rows: messages } = await db.query(`
+      SELECT 
+        dm.id,
+        dm.content,
+        dm.created_at,
+        u.id as sender_id,
+        u.username,
+        u.first_name,
+        u.last_name,
+        u.role
+      FROM direct_messages dm
+      JOIN users u ON dm.sender_id = u.id
+      WHERE dm.conversation_id = $1
+      ORDER BY dm.created_at ASC
+    `, [id]);
+
+    // Get conversation details with participants
+    const { rows: convRows } = await db.query(`
+      SELECT 
+        c.id,
+        c.subject,
+        c.created_at,
+        c.updated_at
+      FROM conversations c
+      WHERE c.id = $1
+    `, [id]);
+
+    const { rows: participantRows } = await db.query(`
+      SELECT u.id, u.username, u.first_name, u.last_name, u.role
+      FROM conversation_participants cp
+      JOIN users u ON cp.user_id = u.id
+      WHERE cp.conversation_id = $1
+    `, [id]);
+
+    return NextResponse.json({
+      conversation: convRows[0],
+      participants: participantRows,
+      messages
+    });
+  } catch (error) {
+    console.error('Get messages error:', error);
+    return NextResponse.json(
+      { error: getErrorMessage(error, 'Failed to get messages') },
+      { status: 500 }
+    );
+  }
+}
\ No newline at end of file
diff --git a/src/app/api/conversations/route.ts b/src/app/api/conversations/route.ts
new file mode 100644
index 0000000..06840a1
--- /dev/null
+++ b/src/app/api/conversations/route.ts
@@ -0,0 +1,127 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { requireAuth } from '@/lib/auth';
+import { getErrorMessage } from '@/lib/errors';
+
+// Get all conversations for the current user
+export async function GET() {
+  try {
+    const user = await requireAuth();
+    if (!user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    // Get all conversations where user is a participant
+    const { rows } = await db.query(`
+      SELECT 
+        c.id,
+        c.subject,
+        c.created_at,
+        c.updated_at,
+        (SELECT content FROM direct_messages WHERE conversation_id = c.id ORDER BY created_at DESC LIMIT 1) as last_message,
+        (SELECT created_at FROM direct_messages WHERE conversation_id = c.id ORDER BY created_at DESC LIMIT 1) as last_message_at,
+        (SELECT COUNT(*) FROM direct_messages WHERE conversation_id = c.id AND created_at > COALESCE(
+          (SELECT joined_at FROM conversation_participants WHERE conversation_id = c.id AND user_id = $1), c.created_at
+        )) as unread_count
+      FROM conversations c
+      JOIN conversation_participants cp ON c.id = cp.conversation_id
+      WHERE cp.user_id = $1
+      ORDER BY c.updated_at DESC
+    `, [user.id]);
+
+    // Get other participants for each conversation
+    const conversations = await Promise.all(rows.map(async (conv: any) => {
+      const { rows: participants } = await db.query(`
+        SELECT u.id, u.username, u.first_name, u.last_name, u.role
+        FROM conversation_participants cp
+        JOIN users u ON cp.user_id = u.id
+        WHERE cp.conversation_id = $1
+      `, [conv.id]);
+
+      return {
+        ...conv,
+        participants
+      };
+    }));
+
+    return NextResponse.json({ conversations });
+  } catch (error) {
+    console.error('Get conversations error:', error);
+    return NextResponse.json(
+      { error: getErrorMessage(error, 'Failed to get conversations') },
+      { status: 500 }
+    );
+  }
+}
+
+// Create a new conversation
+export async function POST(request: NextRequest) {
+  try {
+    const user = await requireAuth();
+    if (!user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const { subject, initial_message, recipient_ids } = await request.json();
+
+    if (!initial_message || initial_message.trim().length === 0) {
+      return NextResponse.json({ error: 'Message is required' }, { status: 400 });
+    }
+
+    // Create conversation
+    const { rows: convRows } = await db.query(
+      'INSERT INTO conversations (subject, created_by) VALUES ($1, $2) RETURNING *',
+      [subject || null, user.id]
+    );
+    const conversation = convRows[0];
+
+    // Add creator as participant
+    await db.query(
+      'INSERT INTO conversation_participants (conversation_id, user_id) VALUES ($1, $2)',
+      [conversation.id, user.id]
+    );
+
+    // Add other participants (admins for customer messages, specific user for direct)
+    if (recipient_ids && Array.isArray(recipient_ids)) {
+      for (const recipientId of recipient_ids) {
+        await db.query(
+          'INSERT INTO conversation_participants (conversation_id, user_id) VALUES ($1, $2) ON CONFLICT DO NOTHING',
+          [conversation.id, recipientId]
+        );
+      }
+    }
+
+    // If user is not admin, add all admins as participants
+    if (user.role !== 'admin') {
+      const { rows: admins } = await db.query(
+        "SELECT id FROM users WHERE role = 'admin'"
+      );
+      for (const admin of admins) {
+        await db.query(
+          'INSERT INTO conversation_participants (conversation_id, user_id) VALUES ($1, $2) ON CONFLICT DO NOTHING',
+          [conversation.id, admin.id]
+        );
+      }
+    }
+
+    // Add initial message
+    const { rows: msgRows } = await db.query(
+      'INSERT INTO direct_messages (conversation_id, sender_id, content) VALUES ($1, $2, $3) RETURNING *',
+      [conversation.id, user.id, initial_message]
+    );
+
+    // Update conversation updated_at
+    await db.query(
+      'UPDATE conversations SET updated_at = NOW() WHERE id = $1',
+      [conversation.id]
+    );
+
+    return NextResponse.json({ conversation, message: msgRows[0] });
+  } catch (error) {
+    console.error('Create conversation error:', error);
+    return NextResponse.json(
+      { error: getErrorMessage(error, 'Failed to create conversation') },
+      { status: 500 }
+    );
+  }
+}
\ No newline at end of file
diff --git a/src/app/api/private-event-reservations/route.ts b/src/app/api/private-event-reservations/route.ts
index 5c70f41..adb524c 100644
--- a/src/app/api/private-event-reservations/route.ts
+++ b/src/app/api/private-event-reservations/route.ts
@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { requireAuth } from '@/lib/auth';
 import { withRateLimit, getClientIp } from '@/lib/rate-limit';
+import { getErrorMessage } from '@/lib/errors';
 
 // Honeypot field name - bots often autofill all fields
 // This field should remain empty for legitimate submissions
@@ -38,7 +39,10 @@ export async function GET(request: NextRequest) {
     return NextResponse.json({ data: rows });
   } catch (error) {
     console.error('Error fetching private event reservations:', error);
-    return NextResponse.json({ error: 'Failed to fetch reservations' }, { status: 500 });
+    return NextResponse.json(
+      { error: getErrorMessage(error, 'Failed to fetch reservations') },
+      { status: 500 }
+    );
   }
 }
 
@@ -136,6 +140,9 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ data: rows[0] });
   } catch (error) {
     console.error('Error creating private event reservation:', error);
-    return NextResponse.json({ error: 'Failed to create reservation' }, { status: 500 });
+    return NextResponse.json(
+      { error: getErrorMessage(error, 'Failed to create reservation') },
+      { status: 500 }
+    );
   }
 }
\ No newline at end of file
diff --git a/src/app/api/reservations/route.ts b/src/app/api/reservations/route.ts
index d9fdd5f..e4bdb89 100644
--- a/src/app/api/reservations/route.ts
+++ b/src/app/api/reservations/route.ts
@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { getSession } from '@/lib/auth';
+import { getErrorMessage } from '@/lib/errors';
 
 export async function POST(request: Request) {
   try {
@@ -103,7 +104,10 @@ export async function POST(request: Request) {
     });
   } catch (error) {
     console.error('Reservation error:', error);
-    return NextResponse.json({ error: 'Failed to create reservation' }, { status: 500 });
+    return NextResponse.json(
+      { error: getErrorMessage(error, 'Failed to create reservation') },
+      { status: 500 }
+    );
   }
 }
 
@@ -137,6 +141,9 @@ export async function GET(request: Request) {
     return NextResponse.json({ reservations: rows });
   } catch (error) {
     console.error('Get reservations error:', error);
-    return NextResponse.json({ error: 'Failed to get reservations' }, { status: 500 });
+    return NextResponse.json(
+      { error: getErrorMessage(error, 'Failed to get reservations') },
+      { status: 500 }
+    );
   }
 }
\ No newline at end of file
diff --git a/src/app/api/user/password/route.ts b/src/app/api/user/password/route.ts
index defa2ef..c1f22e7 100644
--- a/src/app/api/user/password/route.ts
+++ b/src/app/api/user/password/route.ts
@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { requireAuth, hashPassword } from '@/lib/auth';
 import { db } from '@/lib/db';
+import { getErrorMessage } from '@/lib/errors';
 
 export async function POST(request: NextRequest) {
   try {
@@ -12,8 +13,12 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: 'Current and new password are required' }, { status: 400 });
     }
 
-    if (new_password.length < 4) {
-      return NextResponse.json({ error: 'Password must be at least 4 characters' }, { status: 400 });
+    if (new_password.length < 12) {
+      return NextResponse.json({ error: 'Password must be at least 12 characters' }, { status: 400 });
+    }
+    // Password complexity requirements
+    if (!/[A-Z]/.test(new_password) || !/[a-z]/.test(new_password) || !/[0-9]/.test(new_password)) {
+      return NextResponse.json({ error: 'Password must contain uppercase, lowercase, and numbers' }, { status: 400 });
     }
 
     // Verify current password
@@ -33,7 +38,11 @@ export async function POST(request: NextRequest) {
     await db.query('UPDATE users SET password_hash = $1 WHERE id = $2', [hash, session.id]);
 
     return NextResponse.json({ ok: true });
-  } catch (err: any) {
-    return NextResponse.json({ error: err.message || 'Failed to change password' }, { status: err.message === 'Unauthorized' ? 401 : 500 });
+  } catch (err: unknown) {
+    const message = err instanceof Error && err.message === 'Unauthorized' ? 'Unauthorized' : getErrorMessage(err, 'Failed to change password');
+    return NextResponse.json(
+      { error: message },
+      { status: err instanceof Error && err.message === 'Unauthorized' ? 401 : 500 }
+    );
   }
 }
\ No newline at end of file
diff --git a/src/app/globals.css b/src/app/globals.css
index 4e2337a..57052c8 100644
--- a/src/app/globals.css
+++ b/src/app/globals.css
@@ -88,6 +88,24 @@ a {
 
 .navbar-actions {
   margin-left: auto;
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+}
+
+.navbar-icon-link {
+  color: var(--gold);
+  padding: 0.5rem;
+  border-radius: 0.375rem;
+  transition: background 0.2s, color 0.2s;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+
+.navbar-icon-link:hover {
+  background: rgba(212, 175, 55, 0.1);
+  color: #fff;
 }
 
 .navbar-btn-ghost {
diff --git a/src/app/messages/page.tsx b/src/app/messages/page.tsx
new file mode 100644
index 0000000..bb51294
--- /dev/null
+++ b/src/app/messages/page.tsx
@@ -0,0 +1,333 @@
+'use client';
+
+import { useState, useEffect, useRef } from 'react';
+import { formatDisplayDateTime } from '@/lib/date';
+
+type User = { id: number; username: string; first_name: string; last_name: string; role: string };
+type Message = { id: number; content: string; created_at: string; sender_id: number; username: string; first_name: string; last_name: string; role: string };
+type Participant = { id: number; username: string; first_name: string; last_name: string; role: string };
+type Conversation = {
+  id: number;
+  subject: string | null;
+  last_message: string | null;
+  last_message_at: string | null;
+  unread_count: number;
+  participants: Participant[];
+};
+
+export default function MessagesPage() {
+  const [user, setUser] = useState<User | null>(null);
+  const [conversations, setConversations] = useState<Conversation[]>([]);
+  const [selectedConv, setSelectedConv] = useState<number | null>(null);
+  const [messages, setMessages] = useState<Message[]>([]);
+  const [participants, setParticipants] = useState<Participant[]>([]);
+  const [newMessage, setNewMessage] = useState('');
+  const [showNewConv, setShowNewConv] = useState(false);
+  const [convSubject, setConvSubject] = useState('');
+  const [convMessage, setConvMessage] = useState('');
+  const [loading, setLoading] = useState(true);
+  const messagesEndRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    fetchUser();
+  }, []);
+
+  useEffect(() => {
+    if (user) {
+      fetchConversations();
+    }
+  }, [user]);
+
+  useEffect(() => {
+    if (selectedConv) {
+      fetchMessages(selectedConv);
+    }
+  }, [selectedConv]);
+
+  useEffect(() => {
+    messagesEndRef.current?.scrollIntoView({ behavior: 'smooth' });
+  }, [messages]);
+
+  const fetchUser = async () => {
+    try {
+      const res = await fetch('/api/auth/me');
+      if (res.ok) {
+        const data = await res.json();
+        setUser(data.user);
+      } else {
+        window.location.href = '/login';
+      }
+    } catch {
+      window.location.href = '/login';
+    }
+  };
+
+  const fetchConversations = async () => {
+    try {
+      const res = await fetch('/api/conversations');
+      if (res.ok) {
+        const data = await res.json();
+        setConversations(data.conversations || []);
+      }
+    } catch (err) {
+      console.error('Failed to fetch conversations:', err);
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const fetchMessages = async (convId: number) => {
+    try {
+      const res = await fetch(`/api/conversations/${convId}`);
+      if (res.ok) {
+        const data = await res.json();
+        setMessages(data.messages || []);
+        setParticipants(data.participants || []);
+      }
+    } catch (err) {
+      console.error('Failed to fetch messages:', err);
+    }
+  };
+
+  const sendMessage = async () => {
+    if (!newMessage.trim() || !selectedConv) return;
+
+    try {
+      const res = await fetch(`/api/conversations/${selectedConv}/messages`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ content: newMessage.trim() }),
+      });
+
+      if (res.ok) {
+        const data = await res.json();
+        setMessages(prev => [...prev, data.message]);
+        setNewMessage('');
+        fetchConversations(); // Update last message in list
+      }
+    } catch (err) {
+      console.error('Failed to send message:', err);
+    }
+  };
+
+  const createConversation = async () => {
+    if (!convMessage.trim()) return;
+
+    try {
+      const res = await fetch('/api/conversations', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          subject: convSubject || null,
+          initial_message: convMessage.trim(),
+        }),
+      });
+
+      if (res.ok) {
+        const data = await res.json();
+        setConversations(prev => [data.conversation, ...prev]);
+        setSelectedConv(data.conversation.id);
+        setShowNewConv(false);
+        setConvSubject('');
+        setConvMessage('');
+      }
+    } catch (err) {
+      console.error('Failed to create conversation:', err);
+    }
+  };
+
+  const getOtherParticipants = (conv: Conversation) => {
+    return conv.participants.filter(p => p.id !== user?.id);
+  };
+
+  const getDisplayName = (p: Participant) => {
+    if (p.role === 'admin') {
+      return p.first_name || p.username;
+    }
+    return p.first_name || p.username;
+  };
+
+  if (loading) {
+    return (
+      <div className="min-h-screen bg-gray-50 flex items-center justify-center">
+        <div className="text-gray-500">Loading...</div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="min-h-screen bg-gray-50">
+      <div className="max-w-6xl mx-auto p-4">
+        <h1 className="text-2xl font-bold text-gray-800 mb-6">Messages</h1>
+
+        <div className="bg-white rounded-lg shadow overflow-hidden">
+          <div className="flex h-[600px]">
+            {/* Conversations List */}
+            <div className={`w-full md:w-1/3 border-r ${selectedConv ? 'hidden md:block' : ''}`}>
+              <div className="p-3 border-b bg-gray-50 flex justify-between items-center">
+                <span className="font-medium text-gray-700">Conversations</span>
+                <button
+                  onClick={() => setShowNewConv(true)}
+                  className="bg-blue-600 text-white px-3 py-1 rounded text-sm hover:bg-blue-700"
+                >
+                  New
+                </button>
+              </div>
+
+              <div className="overflow-y-auto h-[calc(100%-50px)]">
+                {conversations.length === 0 ? (
+                  <div className="p-4 text-center text-gray-500">
+                    No conversations yet. Start a new one!
+                  </div>
+                ) : (
+                  conversations.map(conv => (
+                    <div
+                      key={conv.id}
+                      onClick={() => setSelectedConv(conv.id)}
+                      className={`p-3 border-b cursor-pointer hover:bg-gray-50 ${
+                        selectedConv === conv.id ? 'bg-blue-50' : ''
+                      }`}
+                    >
+                      <div className="flex justify-between items-start">
+                        <div className="font-medium text-gray-800">
+                          {conv.subject || getOtherParticipants(conv).map(getDisplayName).join(', ') || 'Conversation'}
+                        </div>
+                        {conv.unread_count > 0 && (
+                          <span className="bg-blue-600 text-white text-xs px-2 py-0.5 rounded-full">
+                            {conv.unread_count}
+                          </span>
+                        )}
+                      </div>
+                      {conv.last_message && (
+                        <div className="text-sm text-gray-500 truncate mt-1">
+                          {conv.last_message}
+                        </div>
+                      )}
+                      <div className="text-xs text-gray-400 mt-1">
+                        {conv.last_message_at ? formatDisplayDateTime(conv.last_message_at) : ''}
+                      </div>
+                    </div>
+                  ))
+                )}
+              </div>
+            </div>
+
+            {/* Messages View */}
+            <div className={`flex-1 flex flex-col ${selectedConv ? '' : 'hidden md:flex'}`}>
+              {selectedConv ? (
+                <>
+                  {/* Header */}
+                  <div className="p-3 border-b bg-gray-50">
+                    <button
+                      onClick={() => setSelectedConv(null)}
+                      className="md:hidden text-blue-600 mr-3"
+                    >
+                      ← Back
+                    </button>
+                    <span className="font-medium text-gray-700">
+                      {participants.filter(p => p.id !== user?.id).map(getDisplayName).join(', ')}
+                    </span>
+                  </div>
+
+                  {/* Messages */}
+                  <div className="flex-1 overflow-y-auto p-4 space-y-3">
+                    {messages.map(msg => (
+                      <div
+                        key={msg.id}
+                        className={`flex ${msg.sender_id === user?.id ? 'justify-end' : 'justify-start'}`}
+                      >
+                        <div className={`max-w-[70%] ${msg.sender_id === user?.id ? 'bg-blue-600 text-white' : 'bg-gray-100 text-gray-800'} rounded-lg px-4 py-2`}>
+                          {msg.sender_id !== user?.id && (
+                            <div className="text-xs font-medium mb-1 text-gray-600">
+                              {msg.first_name || msg.username}
+                            </div>
+                          )}
+                          <div>{msg.content}</div>
+                          <div className={`text-xs mt-1 ${msg.sender_id === user?.id ? 'text-blue-200' : 'text-gray-400'}`}>
+                            {formatDisplayDateTime(msg.created_at)}
+                          </div>
+                        </div>
+                      </div>
+                    ))}
+                    <div ref={messagesEndRef} />
+                  </div>
+
+                  {/* Input */}
+                  <div className="p-3 border-t bg-gray-50">
+                    <div className="flex gap-2">
+                      <input
+                        type="text"
+                        value={newMessage}
+                        onChange={e => setNewMessage(e.target.value)}
+                        onKeyDown={e => e.key === 'Enter' && sendMessage()}
+                        placeholder="Type a message..."
+                        className="flex-1 border rounded-lg px-3 py-2 focus:outline-none focus:ring-2 focus:ring-blue-500"
+                      />
+                      <button
+                        onClick={sendMessage}
+                        disabled={!newMessage.trim()}
+                        className="bg-blue-600 text-white px-4 py-2 rounded-lg hover:bg-blue-700 disabled:opacity-50"
+                      >
+                        Send
+                      </button>
+                    </div>
+                  </div>
+                </>
+              ) : (
+                <div className="flex-1 flex items-center justify-center text-gray-500">
+                  Select a conversation or start a new one
+                </div>
+              )}
+            </div>
+          </div>
+        </div>
+      </div>
+
+      {/* New Conversation Modal */}
+      {showNewConv && (
+        <div className="fixed inset-0 bg-black/50 flex items-center justify-center z-50">
+          <div className="bg-white rounded-lg p-6 w-full max-w-md mx-4">
+            <h2 className="text-xl font-bold mb-4">New Conversation</h2>
+            <div className="space-y-4">
+              <div>
+                <label className="block text-sm font-medium text-gray-700 mb-1">Subject (optional)</label>
+                <input
+                  type="text"
+                  value={convSubject}
+                  onChange={e => setConvSubject(e.target.value)}
+                  placeholder="What is this about?"
+                  className="w-full border rounded-lg px-3 py-2 focus:outline-none focus:ring-2 focus:ring-blue-500"
+                />
+              </div>
+              <div>
+                <label className="block text-sm font-medium text-gray-700 mb-1">Message *</label>
+                <textarea
+                  value={convMessage}
+                  onChange={e => setConvMessage(e.target.value)}
+                  placeholder="Type your message..."
+                  rows={4}
+                  className="w-full border rounded-lg px-3 py-2 focus:outline-none focus:ring-2 focus:ring-blue-500"
+                />
+              </div>
+            </div>
+            <div className="flex justify-end gap-2 mt-6">
+              <button
+                onClick={() => setShowNewConv(false)}
+                className="px-4 py-2 text-gray-600 hover:text-gray-800"
+              >
+                Cancel
+              </button>
+              <button
+                onClick={createConversation}
+                disabled={!convMessage.trim()}
+                className="bg-blue-600 text-white px-4 py-2 rounded-lg hover:bg-blue-700 disabled:opacity-50"
+              >
+                Send
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/src/components/Navbar.tsx b/src/components/Navbar.tsx
index 9019c5c..374bfbb 100644
--- a/src/components/Navbar.tsx
+++ b/src/components/Navbar.tsx
@@ -85,6 +85,17 @@ export default function Navbar() {
         })}
       </ul>
       <div className="navbar-actions">
+        {auth?.authenticated && (
+          <Link 
+            href={auth?.role === 'admin' ? '/admin/messages' : '/messages'} 
+            className="navbar-icon-link"
+            title="Messages"
+          >
+            <svg className="w-6 h-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z" />
+            </svg>
+          </Link>
+        )}
         {auth?.authenticated ? (
           <button className="navbar-btn-ghost" onClick={handleLogout}>Logout</button>
         ) : (
diff --git a/src/lib/auth.ts b/src/lib/auth.ts
index 532bc3a..a94a788 100644
--- a/src/lib/auth.ts
+++ b/src/lib/auth.ts
@@ -54,9 +54,9 @@ export async function authenticateUser(username: string, password: string) {
 export async function createSession(user: { id: number; username: string; role: string }) {
   const token = await new SignJWT({ id: user.id, username: user.username, role: user.role })
     .setProtectedHeader({ alg: 'HS256' })
-    .setExpirationTime('7d')
+    .setExpirationTime('4h') // 4 hours for security (reduced from 7 days)
     .sign(getSecret());
-  cookies().set('session', token, { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', maxAge: 60 * 60 * 24 * 7 });
+  cookies().set('session', token, { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', maxAge: 60 * 60 * 4 }); // 4 hours
   return token;
 }
 
diff --git a/src/lib/errors.ts b/src/lib/errors.ts
new file mode 100644
index 0000000..485e053
--- /dev/null
+++ b/src/lib/errors.ts
@@ -0,0 +1,34 @@
+/**
+ * Production-safe error handling utility
+ * Returns detailed errors in development, generic errors in production
+ */
+
+export function getErrorMessage(error: unknown, fallback = 'An error occurred'): string {
+  if (process.env.NODE_ENV === 'production') {
+    return fallback;
+  }
+  
+  if (error instanceof Error) {
+    return error.message;
+  }
+  
+  if (typeof error === 'string') {
+    return error;
+  }
+  
+  return fallback;
+}
+
+/**
+ * Create a standardized error response
+ */
+export function errorResponse(message: string, status = 500, details?: Record<string, unknown>) {
+  const body: Record<string, unknown> = { error: message };
+  
+  // Only include details in development
+  if (process.env.NODE_ENV !== 'production' && details) {
+    body.details = details;
+  }
+  
+  return Response.json(body, { status });
+}
\ No newline at end of file
diff --git a/src/lib/schema.ts b/src/lib/schema.ts
index 4ffc135..1302742 100644
--- a/src/lib/schema.ts
+++ b/src/lib/schema.ts
@@ -112,6 +112,10 @@ export async function initSchema() {
     );
   `);
 
+  // Add columns if they don't exist (for existing databases)
+  await db.query(`ALTER TABLE menu_items ADD COLUMN IF NOT EXISTS photos TEXT[] DEFAULT '{}'`);
+  await db.query(`ALTER TABLE menu_items ADD COLUMN IF NOT EXISTS featured_photo VARCHAR(500)`);
+
   await db.query(`
     CREATE TABLE IF NOT EXISTS places (
       id SERIAL PRIMARY KEY,
@@ -128,6 +132,10 @@ export async function initSchema() {
     );
   `);
 
+  // Add columns if they don't exist (for existing databases)
+  await db.query(`ALTER TABLE places ADD COLUMN IF NOT EXISTS photos TEXT[] DEFAULT '{}'`);
+  await db.query(`ALTER TABLE places ADD COLUMN IF NOT EXISTS featured_photo VARCHAR(500)`);
+
   await db.query(`
     CREATE TABLE IF NOT EXISTS reviews (
       id SERIAL PRIMARY KEY,
@@ -376,6 +384,62 @@ export async function initSchema() {
   await db.query(`CREATE INDEX IF NOT EXISTS idx_room_availability_room_date ON room_availability(room_id, date)`);
   await db.query(`CREATE INDEX IF NOT EXISTS idx_messages_created_at ON messages(created_at DESC)`);
 
+  // ─── Conversations & Direct Messages ───
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS conversations (
+      id SERIAL PRIMARY KEY,
+      subject VARCHAR(255),
+      created_by INTEGER REFERENCES users(id),
+      created_at TIMESTAMP DEFAULT NOW(),
+      updated_at TIMESTAMP DEFAULT NOW()
+    );
+  `);
+
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS conversation_participants (
+      id SERIAL PRIMARY KEY,
+      conversation_id INTEGER NOT NULL REFERENCES conversations(id) ON DELETE CASCADE,
+      user_id INTEGER NOT NULL REFERENCES users(id),
+      joined_at TIMESTAMP DEFAULT NOW(),
+      UNIQUE(conversation_id, user_id)
+    );
+  `);
+
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS direct_messages (
+      id SERIAL PRIMARY KEY,
+      conversation_id INTEGER NOT NULL REFERENCES conversations(id) ON DELETE CASCADE,
+      sender_id INTEGER NOT NULL REFERENCES users(id),
+      content TEXT NOT NULL,
+      created_at TIMESTAMP DEFAULT NOW()
+    );
+  `);
+
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_conversation_participants_user ON conversation_participants(user_id)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_direct_messages_conversation ON direct_messages(conversation_id, created_at DESC)`);
+
+  // ─── Bulk Messages ───
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS bulk_messages (
+      id SERIAL PRIMARY KEY,
+      sender_id INTEGER NOT NULL REFERENCES users(id),
+      subject VARCHAR(255),
+      content TEXT NOT NULL,
+      recipient_type VARCHAR(20) NOT NULL DEFAULT 'all_customers',
+      created_at TIMESTAMP DEFAULT NOW()
+    );
+  `);
+
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS bulk_message_recipients (
+      id SERIAL PRIMARY KEY,
+      bulk_message_id INTEGER NOT NULL REFERENCES bulk_messages(id) ON DELETE CASCADE,
+      user_id INTEGER NOT NULL REFERENCES users(id),
+      read_at TIMESTAMP,
+      UNIQUE(bulk_message_id, user_id)
+    );
+  `);
+
   // Orders tables for coffee/kitchen
   await db.query(`
     CREATE TABLE IF NOT EXISTS orders (
diff --git a/src/middleware.ts b/src/middleware.ts
index 157a8ad..16f7d98 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -1,14 +1,62 @@
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 
-// Middleware runs on edge runtime - we can't verify JWT here easily
-// Let the pages handle auth checks via /api/auth/me
-export function middleware(request: NextRequest) {
-  // No redirects - login and admin pages handle their own auth UI
-  return NextResponse.next();
+// Paths that require authentication
+const PROTECTED_PATHS = ['/admin'];
+// Paths that require no authentication (login page should not redirect logged-in users)
+const AUTH_PATHS = ['/login'];
+
+export async function middleware(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+  
+  // Check if this is a protected path
+  const isProtectedPath = PROTECTED_PATHS.some(path => pathname.startsWith(path));
+  const isAuthPath = AUTH_PATHS.some(path => pathname.startsWith(path));
+  
+  if (isProtectedPath) {
+    // Get session token from cookie
+    const sessionToken = request.cookies.get('session')?.value;
+    
+    if (!sessionToken) {
+      // No session, redirect to login
+      const loginUrl = new URL('/login', request.url);
+      return NextResponse.redirect(loginUrl);
+    }
+    
+    // Session exists - actual auth validation happens in API routes
+    // We can't verify JWT in Edge runtime without external libraries
+    // The login page and API routes handle full auth checks
+  }
+  
+  // Add security headers to all responses
+  const response = NextResponse.next();
+  
+  response.headers.set('X-Content-Type-Options', 'nosniff');
+  response.headers.set('X-Frame-Options', 'DENY');
+  response.headers.set('X-XSS-Protection', '1; mode=block');
+  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+  
+  // Content Security Policy - allow inline styles for Next.js
+  response.headers.set(
+    'Content-Security-Policy',
+    "default-src 'self'; " +
+    "script-src 'self' 'unsafe-inline' 'unsafe-eval'; " +
+    "style-src 'self' 'unsafe-inline'; " +
+    "img-src 'self' data: blob: https:; " +
+    "font-src 'self' data:; " +
+    "connect-src 'self'; " +
+    "frame-ancestors 'none';"
+  );
+  
+  // HSTS for production (assuming TLS termination at proxy)
+  if (process.env.NODE_ENV === 'production') {
+    response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+  }
+  
+  return response;
 }
 
 // Configure which paths the middleware should run on
 export const config = {
-  matcher: ['/admin/:path*', '/login'],
+  matcher: ['/admin/:path*', '/login', '/api/:path*'],
 };
\ No newline at end of file