@rebasepro/server-core 0.2.1 → 0.2.4

package/dist/index.umd.js

@@ -1,6 +1,6 @@
 (function(global2, factory) {
-  typeof exports === "object" && typeof module !== "undefined" ? factory(exports, require("fs"), require("path"), require("url"), require("hono"), require("buffer"), require("stream"), require("util"), require("crypto"), require("hono/body-limit"), require("hono/csrf"), require("child_process"), require("https"), require("net"), require("tls"), require("assert"), require("http"), require("os"), require("node:events"), require("node:process"), require("node:util"), require("events"), require("@aws-sdk/client-s3"), require("@aws-sdk/s3-request-presigner"), require("hono/cors"), require("hono/secure-headers"), require("@hono/node-server"), require("ts-morph"), require("drizzle-orm"), require("@hono/node-server/serve-static")) : typeof define === "function" && define.amd ? define(["exports", "fs", "path", "url", "hono", "buffer", "stream", "util", "crypto", "hono/body-limit", "hono/csrf", "child_process", "https", "net", "tls", "assert", "http", "os", "node:events", "node:process", "node:util", "events", "@aws-sdk/client-s3", "@aws-sdk/s3-request-presigner", "hono/cors", "hono/secure-headers", "@hono/node-server", "ts-morph", "drizzle-orm", "@hono/node-server/serve-static"], factory) : (global2 = typeof globalThis !== "undefined" ? globalThis : global2 || self, factory(global2["Rebase Backend"] = {}, global2.fs$4, global2.path$3, global2.require$$0$2, global2.hono, global2.require$$0$3, global2.require$$0$4, global2.require$$5, global2.require$$0$5, global2.bodyLimit, global2.csrf, global2.require$$0$a, global2.require$$1, global2.require$$0$7, global2.require$$1$1, global2.require$$2, global2.require$$0$6, global2.require$$1$2, global2.require$$0$8, global2.require$$1$3, global2.require$$2$1, global2.require$$0$9, global2.clientS3, global2.s3RequestPresigner, global2.cors, global2.secureHeaders, global2.nodeServer, global2.tsMorph, global2.drizzleOrm, global2.serveStatic));
-})(this, function(exports2, fs$4, path$3, require$$0$2, hono, require$$0$3, require$$0$4, require$$5, require$$0$5, bodyLimit, csrf, require$$0$a, require$$1, require$$0$7, require$$1$1, require$$2, require$$0$6, require$$1$2, require$$0$8, require$$1$3, require$$2$1, require$$0$9, clientS3, s3RequestPresigner, cors, secureHeaders, nodeServer, tsMorph, drizzleOrm, serveStatic) {
+  typeof exports === "object" && typeof module !== "undefined" ? factory(exports, require("fs"), require("path"), require("url"), require("hono"), require("buffer"), require("stream"), require("util"), require("crypto"), require("hono/body-limit"), require("hono/csrf"), require("child_process"), require("https"), require("querystring"), require("net"), require("tls"), require("assert"), require("http"), require("os"), require("node:events"), require("node:process"), require("node:util"), require("events"), require("@aws-sdk/client-s3"), require("@aws-sdk/s3-request-presigner"), require("fs/promises"), require("zlib"), require("dns"), require("hono/cors"), require("hono/secure-headers"), require("@hono/node-server"), require("ts-morph"), require("drizzle-orm"), require("@hono/node-server/serve-static")) : typeof define === "function" && define.amd ? define(["exports", "fs", "path", "url", "hono", "buffer", "stream", "util", "crypto", "hono/body-limit", "hono/csrf", "child_process", "https", "querystring", "net", "tls", "assert", "http", "os", "node:events", "node:process", "node:util", "events", "@aws-sdk/client-s3", "@aws-sdk/s3-request-presigner", "fs/promises", "zlib", "dns", "hono/cors", "hono/secure-headers", "@hono/node-server", "ts-morph", "drizzle-orm", "@hono/node-server/serve-static"], factory) : (global2 = typeof globalThis !== "undefined" ? globalThis : global2 || self, factory(global2["Rebase Backend"] = {}, global2.fs$4, global2.path$3, global2.require$$0$2, global2.hono, global2.require$$0$3, global2.require$$0$4, global2.require$$5, global2.require$$0$5, global2.bodyLimit, global2.csrf, global2.require$$0$a, global2.require$$1, global2.require$$1$2, global2.require$$0$7, global2.require$$1$1, global2.require$$2, global2.require$$0$6, global2.require$$1$3, global2.require$$0$8, global2.require$$1$4, global2.require$$2$1, global2.require$$0$9, global2.clientS3, global2.s3RequestPresigner, global2.promises, global2.require$$3, global2.require$$4$1, global2.cors, global2.secureHeaders, global2.nodeServer, global2.tsMorph, global2.drizzleOrm, global2.serveStatic));
+})(this, function(exports2, fs$4, path$3, require$$0$2, hono, require$$0$3, require$$0$4, require$$5, require$$0$5, bodyLimit, csrf, require$$0$a, require$$1, require$$1$2, require$$0$7, require$$1$1, require$$2, require$$0$6, require$$1$3, require$$0$8, require$$1$4, require$$2$1, require$$0$9, clientS3, s3RequestPresigner, promises, require$$3, require$$4$1, cors, secureHeaders, nodeServer, tsMorph, drizzleOrm, serveStatic) {
   "use strict";
   function _interopNamespaceDefault(e) {
     const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
@@ -202,30 +202,6 @@
   function getDefaultExportFromCjs(x) {
     return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, "default") ? x["default"] : x;
   }
-  function getAugmentedNamespace(n) {
-    if (n.__esModule) return n;
-    var f2 = n.default;
-    if (typeof f2 == "function") {
-      var a2 = function a3() {
-        if (this instanceof a3) {
-          return Reflect.construct(f2, arguments, this.constructor);
-        }
-        return f2.apply(this, arguments);
-      };
-      a2.prototype = f2.prototype;
-    } else a2 = {};
-    Object.defineProperty(a2, "__esModule", { value: true });
-    Object.keys(n).forEach(function(k) {
-      var d2 = Object.getOwnPropertyDescriptor(n, k);
-      Object.defineProperty(a2, k, d2.get ? d2 : {
-        enumerable: true,
-        get: function() {
-          return n[k];
-        }
-      });
-    });
-    return a2;
-  }
   function commonjsRequire(path2) {
     throw new Error('Could not dynamically require "' + path2 + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriately for this require call to work.');
   }
@@ -1057,6 +1033,9 @@
       return output;
     }
     for (const key in source) {
+      if (key === "__proto__" || key === "constructor" || key === "prototype") {
+        continue;
+      }
       if (Object.prototype.hasOwnProperty.call(source, key)) {
         const sourceValue = source[key];
         const outputValue = output[key];
@@ -1156,42 +1135,6 @@
       });
     }
   }
-  function getSubcollections(collection) {
-    if (collection.childCollections) {
-      return collection.childCollections() ?? [];
-    }
-    if (getDataSourceCapabilities(collection.driver).supportsSubcollections && collection.subcollections) {
-      return collection.subcollections() ?? [];
-    }
-    if (getDataSourceCapabilities(collection.driver).supportsRelations && collection.relations) {
-      const manyRelations = collection.relations.filter((r) => r.cardinality === "many");
-      return manyRelations.map((r) => {
-        const target = r.target();
-        if (!target) return void 0;
-        const relationKey = r.relationName || target.slug;
-        let customName;
-        if (collection.properties) {
-          const prop = Object.entries(collection.properties).find(([_, p]) => p.type === "relation" && p.relationName === relationKey);
-          if (prop && prop[1].name) {
-            customName = prop[1].name;
-          }
-        }
-        const baseOverrides = {
-          slug: relationKey
-        };
-        if (customName) {
-          baseOverrides.name = customName;
-          baseOverrides.singularName = customName;
-        }
-        const targetWithOverrides = {
-          ...target,
-          ...baseOverrides
-        };
-        return r.overrides ? mergeDeep(targetWithOverrides, r.overrides) : targetWithOverrides;
-      }).filter((c) => Boolean(c));
-    }
-    return [];
-  }
   function sanitizeRelation(relation, sourceCollection, resolveCollection) {
     if (!relation.target) {
       throw new Error("Relation is missing a `target` collection.");
@@ -1223,6 +1166,8 @@
       } else {
         targetCollection = evaluated;
       }
+    } else if (rawTarget && typeof rawTarget === "object") {
+      targetCollection = rawTarget;
     }
     if (!targetCollection) {
       throw new Error("Relation is missing a valid `target` collection.");
@@ -1279,8 +1224,8 @@
           } catch (e) {
           }
           if (!foundForeignKey) {
-            const keyPrefix = newRelation.inverseRelationName ? toSnakeCase(newRelation.inverseRelationName) : sourceName;
-            newRelation.foreignKeyOnTarget = generateForeignKeyName(keyPrefix);
+            const keyPrefix2 = newRelation.inverseRelationName ? toSnakeCase(newRelation.inverseRelationName) : sourceName;
+            newRelation.foreignKeyOnTarget = generateForeignKeyName(keyPrefix2);
           }
         }
       } else if (newRelation.cardinality === "many" && newRelation.direction === "inverse") {
@@ -1342,11 +1287,14 @@
     const registeredRelationNames = /* @__PURE__ */ new Set();
     if (relCollection.relations) {
       relCollection.relations.forEach((relation) => {
-        const normalizedRelation = sanitizeRelation(relation, collection);
-        const relationKey = normalizedRelation.relationName;
-        if (relationKey) {
-          relations[relationKey] = normalizedRelation;
-          registeredRelationNames.add(relationKey);
+        try {
+          const normalizedRelation = sanitizeRelation(relation, collection);
+          const relationKey = normalizedRelation.relationName;
+          if (relationKey) {
+            relations[relationKey] = normalizedRelation;
+            registeredRelationNames.add(relationKey);
+          }
+        } catch (e) {
         }
       });
     }
@@ -1394,12 +1342,8 @@
         overrides: relProp.overrides
       };
     }
-    const relation = (sourceCollection.relations ?? []).find((rel) => rel.relationName === relProp.relationName);
-    if (!relation) {
-      console.warn(`Unrecognized relation format for property '${propertyKey}' in collection '${sourceCollection.slug}'`);
-      return void 0;
-    }
-    return relation;
+    console.warn(`Unrecognized or missing relation target for property '${propertyKey}' in collection '${sourceCollection.slug}'`);
+    return void 0;
   }
   function getTableName(collection) {
     if (getDataSourceCapabilities(collection.driver).supportsRelations) {
@@ -1415,6 +1359,43 @@
     if (snakeKey !== key && resolvedRelations[snakeKey]) return resolvedRelations[snakeKey];
     return void 0;
   }
+  function getSubcollections(collection) {
+    if (collection.childCollections) {
+      return collection.childCollections() ?? [];
+    }
+    if (getDataSourceCapabilities(collection.driver).supportsSubcollections && collection.subcollections) {
+      return collection.subcollections() ?? [];
+    }
+    if (getDataSourceCapabilities(collection.driver).supportsRelations) {
+      const resolvedRelations = resolveCollectionRelations(collection);
+      const manyRelations = Object.values(resolvedRelations).filter((r) => r.cardinality === "many");
+      return manyRelations.map((r) => {
+        const target = r.target();
+        if (!target) return void 0;
+        const relationKey = r.relationName || target.slug;
+        let customName;
+        if (collection.properties) {
+          const prop = Object.entries(collection.properties).find(([_, p]) => p.type === "relation" && p.relationName === relationKey);
+          if (prop && prop[1].name) {
+            customName = prop[1].name;
+          }
+        }
+        const baseOverrides = {
+          slug: relationKey
+        };
+        if (customName) {
+          baseOverrides.name = customName;
+          baseOverrides.singularName = customName;
+        }
+        const targetWithOverrides = {
+          ...target,
+          ...baseOverrides
+        };
+        return r.overrides ? mergeDeep(targetWithOverrides, r.overrides) : targetWithOverrides;
+      }).filter((c) => Boolean(c));
+    }
+    return [];
+  }
   var logic = { exports: {} };
   (function(module2, exports3) {
     (function(root, factory) {
@@ -2322,8 +2303,18 @@
       const mergedRelationsRaw = [...extractedRelations];
       for (const manual of manualRelations) {
         const name2 = manual.relationName;
-        if (!name2 || !mergedRelationsRaw.find((r) => r.relationName === name2)) {
+        if (!name2) {
           mergedRelationsRaw.push(manual);
+        } else {
+          const existingIndex = mergedRelationsRaw.findIndex((r) => r.relationName === name2);
+          if (existingIndex === -1) {
+            mergedRelationsRaw.push(manual);
+          } else {
+            mergedRelationsRaw[existingIndex] = {
+              ...manual,
+              ...mergedRelationsRaw[existingIndex]
+            };
+          }
         }
       }
       let mergedRelations = mergedRelationsRaw;
@@ -2543,6 +2534,118 @@
       };
     }
   }
+  function mapOperator$1(op) {
+    switch (op) {
+      case "==":
+        return "eq";
+      case "!=":
+        return "neq";
+      case ">":
+        return "gt";
+      case ">=":
+        return "gte";
+      case "<":
+        return "lt";
+      case "<=":
+        return "lte";
+      case "array-contains":
+        return "cs";
+      case "array-contains-any":
+        return "csa";
+      case "not-in":
+        return "nin";
+      default:
+        return op;
+    }
+  }
+  class QueryBuilder {
+    constructor(collection) {
+      this.collection = collection;
+    }
+    params = {
+      where: {}
+    };
+    /**
+     * Add a filter condition to your query.
+     * @example
+     * client.collection('users').where('age', '>=', 18).find()
+     */
+    where(column, operator, value) {
+      if (!this.params.where) {
+        this.params.where = {};
+      }
+      const mappedOp = mapOperator$1(operator);
+      let formattedValue = value;
+      if (Array.isArray(value) && ["in", "nin", "cs", "csa"].includes(mappedOp)) {
+        formattedValue = `(${value.join(",")})`;
+      } else if (value === null) {
+        formattedValue = "null";
+      }
+      this.params.where[column] = mappedOp === "eq" ? String(formattedValue) : `${mappedOp}.${formattedValue}`;
+      return this;
+    }
+    /**
+     * Order the results by a specific column.
+     * @example
+     * client.collection('users').orderBy('createdAt', 'desc').find()
+     */
+    orderBy(column, ascending = "asc") {
+      this.params.orderBy = `${column}:${ascending}`;
+      return this;
+    }
+    /**
+     * Limit the number of results returned.
+     */
+    limit(count) {
+      this.params.limit = count;
+      return this;
+    }
+    /**
+     * Skip the first N results.
+     */
+    offset(count) {
+      this.params.offset = count;
+      return this;
+    }
+    /**
+     * Set a free-text search string if supported by the backend.
+     */
+    search(searchString) {
+      this.params.searchString = searchString;
+      return this;
+    }
+    /**
+     * Include related entities in the response.
+     * Relations will be populated with full entity data instead of just IDs.
+     *
+     * @param relations - Relation names to include, or "*" for all.
+     * @example
+     * // Include specific relations
+     * client.data.posts.include("tags", "author").find()
+     *
+     * // Include all relations
+     * client.data.posts.include("*").find()
+     */
+    include(...relations) {
+      this.params.include = relations;
+      return this;
+    }
+    /**
+     * Execute the find query and return the results.
+     */
+    async find() {
+      return this.collection.find(this.params);
+    }
+    /**
+     * Listen to realtime updates matching this query.
+     */
+    listen(onUpdate, onError) {
+      if (!this.collection.listen) {
+        throw new Error("Listen is only available when RebaseClient is configured with a websocketUrl.");
+      }
+      return this.collection.listen(this.params, onUpdate, onError);
+    }
+  }
   class BackendCollectionRegistry extends CollectionRegistry {
     /**
      * Get the available relation keys for a given collection path.
@@ -2722,10 +2825,15 @@
       const issue = error2.code === "42703" ? "column" : "table";
       logMessage = `Database schema mismatch (${issue} missing): ${error2.message}. Did you forget to run migrations ('pnpm db:push' or 'pnpm db:migrate')?`;
     }
-    console.error(`❌ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code2}: ${logMessage}`);
     const causePg = error2.cause && typeof error2.cause === "object" ? error2.cause : void 0;
     const pgErrorCode = causePg?.code || error2.code;
-    const suppressStack = pgErrorCode === "42703" || pgErrorCode === "42P01" || statusCode < 500 && code2 === "BAD_REQUEST";
+    const isDbSchemaMismatch = pgErrorCode === "42703" || pgErrorCode === "42P01";
+    if (isDbSchemaMismatch) {
+      console.warn(`⚠️ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code2}: ${logMessage}`);
+    } else {
+      console.error(`❌ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code2}: ${logMessage}`);
+    }
+    const suppressStack = isDbSchemaMismatch || statusCode < 500 && code2 === "BAD_REQUEST";
     if (!suppressStack) {
       console.error(error2.stack || error2);
     }
@@ -2770,7 +2878,7 @@
     };
     return map2[code2];
   }
-  function mapOperator$1(op) {
+  function mapOperator(op) {
     switch (op) {
       case "eq":
         return "==";
@@ -2806,7 +2914,7 @@
       options2.offset = (page - 1) * limit;
     }
     options2.where = {};
-    const reservedQueryKeys = ["limit", "offset", "page", "orderBy", "include", "fields", "searchString"];
+    const reservedQueryKeys = ["limit", "offset", "page", "orderBy", "include", "fields", "searchString", "vector_search", "vector", "vector_distance", "vector_threshold"];
     for (const [key, rawValue] of Object.entries(query)) {
       if (reservedQueryKeys.includes(key)) continue;
       const value = Array.isArray(rawValue) ? rawValue[rawValue.length - 1] : rawValue;
@@ -2815,7 +2923,7 @@
         if (parts.length >= 2) {
           const op = parts[0];
           const val = parts.slice(1).join(".");
-          const rebaseOp = mapOperator$1(op);
+          const rebaseOp = mapOperator(op);
           if (rebaseOp) {
             let parsedVal = val;
             if (val === "true") parsedVal = true;
@@ -2878,8 +2986,63 @@
       const fieldsStr = String(query.fields).trim();
       options2.fields = fieldsStr.split(",").map((s2) => s2.trim()).filter(Boolean);
     }
+    if (query.vector_search && query.vector) {
+      const vectorStr = String(query.vector);
+      let queryVector;
+      try {
+        queryVector = JSON.parse(vectorStr);
+        if (!Array.isArray(queryVector) || !queryVector.every((v) => typeof v === "number")) {
+          throw new Error("Expected array of numbers");
+        }
+      } catch {
+        throw new Error("Invalid vector format. Expected JSON array of numbers, e.g. [0.1,0.2,0.3]");
+      }
+      const distanceParam = query.vector_distance ? String(query.vector_distance) : "cosine";
+      if (distanceParam !== "cosine" && distanceParam !== "l2" && distanceParam !== "inner_product") {
+        throw new Error(`Invalid vector_distance: ${distanceParam}. Expected: cosine, l2, or inner_product`);
+      }
+      const vectorSearch = {
+        property: String(query.vector_search),
+        vector: queryVector,
+        distance: distanceParam
+      };
+      if (query.vector_threshold) {
+        const threshold = parseFloat(String(query.vector_threshold));
+        if (isNaN(threshold)) {
+          throw new Error("Invalid vector_threshold. Expected a number.");
+        }
+        vectorSearch.threshold = threshold;
+      }
+      options2.vectorSearch = vectorSearch;
+    }
     return options2;
   }
+  function httpMethodToOperation(method) {
+    const upper = method.toUpperCase();
+    switch (upper) {
+      case "GET":
+      case "HEAD":
+      case "OPTIONS":
+        return "read";
+      case "POST":
+      case "PUT":
+      case "PATCH":
+        return "write";
+      case "DELETE":
+        return "delete";
+      default:
+        return "read";
+    }
+  }
+  function isOperationAllowed(permissions, collection, operation) {
+    for (const perm of permissions) {
+      const collectionMatch = perm.collection === "*" || perm.collection === collection;
+      if (collectionMatch && perm.operations.includes(operation)) {
+        return true;
+      }
+    }
+    return false;
+  }
   class RestApiGenerator {
     collections;
     router;
@@ -2912,6 +3075,19 @@
       this.createSubcollectionRoutes();
       return this.router;
     }
+    /**
+     * Check API key permissions for a collection operation.
+     * Throws 403 if the key doesn't have the required permission.
+     * No-ops if the request is not authenticated via an API key.
+     */
+    enforceApiKeyPermission(c, collectionSlug) {
+      const apiKey = c.get("apiKey");
+      if (!apiKey) return;
+      const operation = httpMethodToOperation(c.req.method);
+      if (!isOperationAllowed(apiKey.permissions, collectionSlug, operation)) {
+        throw ApiError.forbidden(`API key does not have "${operation}" permission for collection "${collectionSlug}"`, "API_KEY_FORBIDDEN");
+      }
+    }
     /**
      * Get the typed RestFetchService from a driver if it exposes one (for include support).
      */
@@ -2925,6 +3101,7 @@
       const basePath = `/${collection.slug}`;
       const resolvedCollection = collection;
       this.router.get(`${basePath}/count`, async (c) => {
+        this.enforceApiKeyPermission(c, collection.slug);
         const queryDict = c.req.query();
         const queryOptions = parseQueryOptions(queryDict);
         const searchString = queryDict.searchString;
@@ -2935,6 +3112,7 @@
         });
       });
       this.router.get(basePath, async (c) => {
+        this.enforceApiKeyPermission(c, collection.slug);
         const queryDict = c.req.query();
         const queryOptions = parseQueryOptions(queryDict);
         const searchString = queryDict.searchString;
@@ -2949,7 +3127,8 @@
             offset: queryOptions.offset,
             orderBy: queryOptions.orderBy?.[0]?.field,
             order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
-            searchString
+            searchString,
+            vectorSearch: queryOptions.vectorSearch
           }, queryOptions.include);
           entities2 = await this.applyAfterReadBatch(collection.slug, entities2, hookCtx);
           const total2 = await this.countRawEntities(driver, resolvedCollection, queryOptions, searchString);
@@ -2977,6 +3156,7 @@
         });
       });
       this.router.get(`${basePath}/:id`, async (c) => {
+        this.enforceApiKeyPermission(c, collection.slug);
         const id = c.req.param("id");
         const queryDict = c.req.query();
         const queryOptions = parseQueryOptions(queryDict);
@@ -3007,6 +3187,7 @@
       });
       this.router.post(basePath, async (c) => {
         try {
+          this.enforceApiKeyPermission(c, collection.slug);
           const driver = c.get("driver") || this.driver;
           const path2 = collection.slug;
           const hookCtx = this.buildHookContext(c, "POST");
@@ -3035,6 +3216,7 @@
       });
       this.router.put(`${basePath}/:id`, async (c) => {
         try {
+          this.enforceApiKeyPermission(c, collection.slug);
           const id = c.req.param("id");
           const driver = c.get("driver") || this.driver;
           const hookCtx = this.buildHookContext(c, "PUT");
@@ -3071,6 +3253,7 @@
         }
       });
       this.router.delete(`${basePath}/:id`, async (c) => {
+        this.enforceApiKeyPermission(c, collection.slug);
         const id = c.req.param("id");
         const driver = c.get("driver") || this.driver;
         const hookCtx = this.buildHookContext(c, "DELETE");
@@ -3142,6 +3325,7 @@
         const parsed = parseSubPath(rawPath);
         if (!parsed) return next();
         const driver = c.get("driver") || this.driver;
+        this.enforceApiKeyPermission(c, c.req.param("parent"));
         if (parsed.entityId === "count") {
           const queryDict = c.req.query();
           const queryOptions = parseQueryOptions(queryDict);
@@ -3189,6 +3373,7 @@
         const parsed = parseSubPath(rawPath);
         if (!parsed || parsed.entityId) return next();
         const driver = c.get("driver") || this.driver;
+        this.enforceApiKeyPermission(c, c.req.param("parent"));
         const body = await c.req.json().catch(() => ({}));
         const entity = await driver.saveEntity({
           path: parsed.collectionPath,
@@ -3204,6 +3389,7 @@
         const parsed = parseSubPath(rawPath);
         if (!parsed || !parsed.entityId) return next();
         const driver = c.get("driver") || this.driver;
+        this.enforceApiKeyPermission(c, c.req.param("parent"));
         const body = await c.req.json().catch(() => ({}));
         const entity = await driver.saveEntity({
           path: parsed.collectionPath,
@@ -3220,6 +3406,7 @@
         const parsed = parseSubPath(rawPath);
         if (!parsed || !parsed.entityId) return next();
         const driver = c.get("driver") || this.driver;
+        this.enforceApiKeyPermission(c, c.req.param("parent"));
         const existingEntity = await driver.fetchEntity({
           path: parsed.collectionPath,
           entityId: parsed.entityId
@@ -3285,7 +3472,8 @@
         orderBy: queryOptions.orderBy?.[0]?.field,
         order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
         startAfter: queryOptions.offset ? String(queryOptions.offset) : void 0,
-        searchString
+        searchString,
+        vectorSearch: queryOptions.vectorSearch
       });
       return entities.map((entity) => this.flattenEntity(entity));
     }
@@ -4811,7 +4999,7 @@
   const SemVer$6 = semver$4;
   const parse$6 = parse_1;
   const { safeRe: re, t } = reExports;
-  const coerce$1 = (version2, options2) => {
+  const coerce$2 = (version2, options2) => {
     if (version2 instanceof SemVer$6) {
       return version2;
     }
@@ -4846,7 +5034,7 @@
     const build = options2.includePrerelease && match[6] ? `+${match[6]}` : "";
     return parse$6(`${major2}.${minor2}.${patch2}${prerelease2}${build}`, options2);
   };
-  var coerce_1 = coerce$1;
+  var coerce_1 = coerce$2;
   const parse$5 = parse_1;
   const constants$1 = constants$2;
   const SemVer$5 = semver$4;
@@ -5132,19 +5320,19 @@
     const replaceCaret = (comp, options2) => {
       debug2("caret", comp, options2);
       const r = options2.loose ? re2[t2.CARETLOOSE] : re2[t2.CARET];
-      const z = options2.includePrerelease ? "-0" : "";
+      const z2 = options2.includePrerelease ? "-0" : "";
       return comp.replace(r, (_, M, m2, p, pr) => {
         debug2("caret", comp, _, M, m2, p, pr);
         let ret;
         if (isX(M)) {
           ret = "";
         } else if (isX(m2)) {
-          ret = `>=${M}.0.0${z} <${+M + 1}.0.0-0`;
+          ret = `>=${M}.0.0${z2} <${+M + 1}.0.0-0`;
         } else if (isX(p)) {
           if (M === "0") {
-            ret = `>=${M}.${m2}.0${z} <${M}.${+m2 + 1}.0-0`;
+            ret = `>=${M}.${m2}.0${z2} <${M}.${+m2 + 1}.0-0`;
           } else {
-            ret = `>=${M}.${m2}.0${z} <${+M + 1}.0.0-0`;
+            ret = `>=${M}.${m2}.0${z2} <${+M + 1}.0.0-0`;
           }
         } else if (pr) {
           debug2("replaceCaret pr", pr);
@@ -5161,9 +5349,9 @@
           debug2("no pr");
           if (M === "0") {
             if (m2 === "0") {
-              ret = `>=${M}.${m2}.${p}${z} <${M}.${m2}.${+p + 1}-0`;
+              ret = `>=${M}.${m2}.${p}${z2} <${M}.${m2}.${+p + 1}-0`;
             } else {
-              ret = `>=${M}.${m2}.${p}${z} <${M}.${+m2 + 1}.0-0`;
+              ret = `>=${M}.${m2}.${p}${z2} <${M}.${+m2 + 1}.0-0`;
             }
           } else {
             ret = `>=${M}.${m2}.${p} <${+M + 1}.0.0-0`;
@@ -5820,7 +6008,7 @@
   const gte = gte_1;
   const lte = lte_1;
   const cmp = cmp_1;
-  const coerce = coerce_1;
+  const coerce$1 = coerce_1;
   const truncate = truncate_1;
   const Comparator = requireComparator();
   const Range = requireRange();
@@ -5859,7 +6047,7 @@
     gte,
     lte,
     cmp,
-    coerce,
+    coerce: coerce$1,
     truncate,
     Comparator,
     Range,
@@ -6740,7 +6928,7 @@
     NotBeforeError: NotBeforeError_1,
     TokenExpiredError: TokenExpiredError_1
   };
-  const jwt = /* @__PURE__ */ getDefaultExportFromCjs(jsonwebtoken);
+  const jwt$1 = /* @__PURE__ */ getDefaultExportFromCjs(jsonwebtoken);
   let jwtConfig = {
     secret: "",
     accessExpiresIn: "1h",
@@ -6759,15 +6947,17 @@
       ...config
     };
   }
-  function generateAccessToken(userId, roles) {
+  function generateAccessToken(userId, roles, aal = "aal1", customClaims) {
     if (!jwtConfig.secret) {
       throw new Error("JWT secret not configured. Call configureJwt() first.");
     }
     const payload = {
       userId,
-      roles
+      roles,
+      aal,
+      ...customClaims
     };
-    return jwt.sign(payload, jwtConfig.secret, {
+    return jwt$1.sign(payload, jwtConfig.secret, {
       expiresIn: jwtConfig.accessExpiresIn,
       algorithm: "HS256"
     });
@@ -6801,7 +6991,7 @@
       throw new Error("JWT secret not configured. Call configureJwt() first.");
     }
     try {
-      const decoded = jwt.verify(token, jwtConfig.secret, {
+      const decoded = jwt$1.verify(token, jwtConfig.secret, {
         algorithms: ["HS256"]
       });
       const id = decoded.userId || decoded.uid || decoded.sub;
@@ -6809,9 +6999,11 @@
         console.error("[JWT] Verification failed: missing id in payload", decoded);
         return null;
       }
+      const aal = decoded.aal === "aal1" || decoded.aal === "aal2" ? decoded.aal : "aal1";
       return {
         userId: id,
-        roles: decoded.roles || []
+        roles: decoded.roles || [],
+        aal
       };
     } catch (error2) {
       console.error("[JWT] Verification failed:", error2, "Token start:", token.substring(0, 15));
@@ -6851,6 +7043,17 @@
     }
     return new Date(Date.now() + ms2);
   }
+  const jwt = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+    __proto__: null,
+    configureJwt,
+    generateAccessToken,
+    generateRefreshToken,
+    getAccessTokenExpiry,
+    getAccessTokenExpiryMs,
+    getRefreshTokenExpiry,
+    hashRefreshToken,
+    verifyAccessToken
+  }, Symbol.toStringTag, { value: "Module" }));
   function isRLSScopedDriver(driver) {
     return "withAuth" in driver && typeof driver.withAuth === "function";
   }
@@ -6873,6 +7076,81 @@
       return false;
     }
   }
+  function isApiKeyToken(token) {
+    return token.startsWith("rk_");
+  }
+  function hashToken$2(token) {
+    return require$$0$5.createHash("sha256").update(token).digest("hex");
+  }
+  async function validateApiKey(c, token, options2) {
+    const {
+      store,
+      driver
+    } = options2;
+    const hash = hashToken$2(token);
+    const apiKey = await store.findByKeyHash(hash);
+    if (!apiKey) {
+      return c.json({
+        error: {
+          message: "Invalid API key",
+          code: "UNAUTHORIZED"
+        }
+      }, 401);
+    }
+    if (apiKey.revoked_at) {
+      return c.json({
+        error: {
+          message: "API key has been revoked",
+          code: "UNAUTHORIZED"
+        }
+      }, 401);
+    }
+    if (apiKey.expires_at && new Date(apiKey.expires_at) < /* @__PURE__ */ new Date()) {
+      return c.json({
+        error: {
+          message: "API key has expired",
+          code: "UNAUTHORIZED"
+        }
+      }, 401);
+    }
+    const userId = `api-key:${apiKey.id}`;
+    c.set("user", {
+      userId,
+      roles: []
+    });
+    const masked = {
+      id: apiKey.id,
+      name: apiKey.name,
+      key_prefix: apiKey.key_prefix,
+      permissions: apiKey.permissions,
+      rate_limit: apiKey.rate_limit,
+      created_by: apiKey.created_by,
+      created_at: apiKey.created_at,
+      updated_at: apiKey.updated_at,
+      last_used_at: apiKey.last_used_at,
+      expires_at: apiKey.expires_at,
+      revoked_at: apiKey.revoked_at
+    };
+    c.set("apiKey", masked);
+    try {
+      const scopedDriver = await scopeDataDriver(driver, {
+        uid: userId,
+        roles: ["service"]
+      });
+      c.set("driver", scopedDriver);
+    } catch (error2) {
+      console.error("[AUTH] RLS scoping failed for API key:", error2);
+      return c.json({
+        error: {
+          message: "Internal authentication error",
+          code: "INTERNAL_ERROR"
+        }
+      }, 500);
+    }
+    store.updateLastUsed(apiKey.id).catch(() => {
+    });
+    return true;
+  }
   const requireAuth = async (c, next) => {
     const authHeader = c.req.header("authorization");
     const queryToken = c.req.query("token");
@@ -6979,7 +7257,8 @@
       driver,
       requireAuth: enforceAuth = true,
       validator,
-      serviceKey
+      serviceKey,
+      apiKeyStore
     } = options2;
     return async (c, next) => {
       if (validator) {
@@ -7054,6 +7333,14 @@
                 }
               }, 500);
             }
+          } else if (apiKeyStore && isApiKeyToken(token)) {
+            const result = await validateApiKey(c, token, {
+              store: apiKeyStore,
+              driver
+            });
+            if (result !== true) {
+              return result;
+            }
           } else {
             const payload = extractUserFromToken(token);
             if (payload) {
@@ -7114,9 +7401,22 @@
     const {
       adapter,
       driver,
-      requireAuth: enforceAuth = true
+      requireAuth: enforceAuth = true,
+      apiKeyStore
     } = options2;
     return async (c, next) => {
+      if (apiKeyStore) {
+        const authHeader = c.req.header("authorization") || "";
+        const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
+        if (token.startsWith("rk_")) {
+          const result = await validateApiKey(c, token, {
+            store: apiKeyStore,
+            driver
+          });
+          if (result === true) return next();
+          return result;
+        }
+      }
       let authenticatedUser = null;
       try {
         authenticatedUser = await adapter.verifyRequest(c.req.raw);
@@ -7212,11 +7512,11 @@
     const derivedKey = await scryptAsync(password, salt, KEY_LENGTH);
     return require$$0$5.timingSafeEqual(derivedKey, storedKey);
   }
-  function resolveAuthOverrides(overrides) {
+  function resolveAuthHooks(hooks) {
     return {
-      hashPassword: overrides?.hashPassword ?? hashPassword,
-      verifyPassword: overrides?.verifyPassword ?? verifyPassword,
-      validatePasswordStrength: overrides?.validatePasswordStrength ?? validatePasswordStrength
+      hashPassword: hooks?.hashPassword ?? hashPassword,
+      verifyPassword: hooks?.verifyPassword ?? verifyPassword,
+      validatePasswordStrength: hooks?.validatePasswordStrength ?? validatePasswordStrength
     };
   }
   function getGreeting(user) {
@@ -7618,6 +7918,63 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
     limit: 50,
     message: "Too many requests to this sensitive endpoint, please try again later."
   });
+  function apiKeyKeyGenerator(c) {
+    const apiKey = c.get("apiKey");
+    if (apiKey) {
+      return `api-key:${apiKey.id}`;
+    }
+    return defaultKeyGenerator(c);
+  }
+  function createApiKeyRateLimiter(defaultLimit = 1e3, windowMs = 15 * 60 * 1e3) {
+    const store = /* @__PURE__ */ new Map();
+    const cleanupInterval = setInterval(() => {
+      const now = Date.now();
+      for (const [key, entry] of store.entries()) {
+        entry.timestamps = entry.timestamps.filter((t2) => now - t2 < windowMs);
+        if (entry.timestamps.length === 0) {
+          store.delete(key);
+        }
+      }
+    }, windowMs);
+    if (cleanupInterval.unref) {
+      cleanupInterval.unref();
+    }
+    return async (c, next) => {
+      const apiKey = c.get("apiKey");
+      if (!apiKey) {
+        return next();
+      }
+      const limit = apiKey.rate_limit ?? defaultLimit;
+      const key = `api-key:${apiKey.id}`;
+      const now = Date.now();
+      let entry = store.get(key);
+      if (!entry) {
+        entry = {
+          timestamps: []
+        };
+        store.set(key, entry);
+      }
+      entry.timestamps = entry.timestamps.filter((t2) => now - t2 < windowMs);
+      if (entry.timestamps.length >= limit) {
+        const retryAfterMs = entry.timestamps[0] + windowMs - now;
+        const retryAfterSec = Math.ceil(retryAfterMs / 1e3);
+        c.header("Retry-After", String(retryAfterSec));
+        c.header("X-RateLimit-Limit", String(limit));
+        c.header("X-RateLimit-Remaining", "0");
+        c.header("X-RateLimit-Reset", String(Math.ceil((now + retryAfterMs) / 1e3)));
+        return c.json({
+          error: {
+            message: "API key rate limit exceeded, please try again later.",
+            code: "RATE_LIMITED"
+          }
+        }, 429);
+      }
+      entry.timestamps.push(now);
+      c.header("X-RateLimit-Limit", String(limit));
+      c.header("X-RateLimit-Remaining", String(limit - entry.timestamps.length));
+      return next();
+    };
+  }
   var util$3;
   (function(util2) {
     util2.assertEqual = (_) => {
@@ -7768,6 +8125,10 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
     "not_multiple_of",
     "not_finite"
   ]);
+  const quotelessJson = (obj) => {
+    const json = JSON.stringify(obj, null, 2);
+    return json.replace(/"([^"]+)":/g, "$1:");
+  };
   class ZodError extends Error {
     get errors() {
       return this.issues;
@@ -7963,6 +8324,9 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
     return { message };
   };
   let overrideErrorMap = errorMap;
+  function setErrorMap(map2) {
+    overrideErrorMap = map2;
+  }
   function getErrorMap() {
     return overrideErrorMap;
   }
@@ -7991,6 +8355,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       message: errorMessage
     };
   };
+  const EMPTY_PATH = [];
   function addIssueToContext(ctx, issueData) {
     const overrideMap = getErrorMap();
     const issue = makeIssue({
@@ -10281,6 +10646,113 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       ...processCreateParams(params)
     });
   };
+  const getDiscriminator = (type) => {
+    if (type instanceof ZodLazy) {
+      return getDiscriminator(type.schema);
+    } else if (type instanceof ZodEffects) {
+      return getDiscriminator(type.innerType());
+    } else if (type instanceof ZodLiteral) {
+      return [type.value];
+    } else if (type instanceof ZodEnum) {
+      return type.options;
+    } else if (type instanceof ZodNativeEnum) {
+      return util$3.objectValues(type.enum);
+    } else if (type instanceof ZodDefault) {
+      return getDiscriminator(type._def.innerType);
+    } else if (type instanceof ZodUndefined) {
+      return [void 0];
+    } else if (type instanceof ZodNull) {
+      return [null];
+    } else if (type instanceof ZodOptional) {
+      return [void 0, ...getDiscriminator(type.unwrap())];
+    } else if (type instanceof ZodNullable) {
+      return [null, ...getDiscriminator(type.unwrap())];
+    } else if (type instanceof ZodBranded) {
+      return getDiscriminator(type.unwrap());
+    } else if (type instanceof ZodReadonly) {
+      return getDiscriminator(type.unwrap());
+    } else if (type instanceof ZodCatch) {
+      return getDiscriminator(type._def.innerType);
+    } else {
+      return [];
+    }
+  };
+  class ZodDiscriminatedUnion extends ZodType {
+    _parse(input) {
+      const { ctx } = this._processInputParams(input);
+      if (ctx.parsedType !== ZodParsedType.object) {
+        addIssueToContext(ctx, {
+          code: ZodIssueCode.invalid_type,
+          expected: ZodParsedType.object,
+          received: ctx.parsedType
+        });
+        return INVALID;
+      }
+      const discriminator = this.discriminator;
+      const discriminatorValue = ctx.data[discriminator];
+      const option = this.optionsMap.get(discriminatorValue);
+      if (!option) {
+        addIssueToContext(ctx, {
+          code: ZodIssueCode.invalid_union_discriminator,
+          options: Array.from(this.optionsMap.keys()),
+          path: [discriminator]
+        });
+        return INVALID;
+      }
+      if (ctx.common.async) {
+        return option._parseAsync({
+          data: ctx.data,
+          path: ctx.path,
+          parent: ctx
+        });
+      } else {
+        return option._parseSync({
+          data: ctx.data,
+          path: ctx.path,
+          parent: ctx
+        });
+      }
+    }
+    get discriminator() {
+      return this._def.discriminator;
+    }
+    get options() {
+      return this._def.options;
+    }
+    get optionsMap() {
+      return this._def.optionsMap;
+    }
+    /**
+     * The constructor of the discriminated union schema. Its behaviour is very similar to that of the normal z.union() constructor.
+     * However, it only allows a union of objects, all of which need to share a discriminator property. This property must
+     * have a different value for each object in the union.
+     * @param discriminator the name of the discriminator property
+     * @param types an array of object schemas
+     * @param params
+     */
+    static create(discriminator, options2, params) {
+      const optionsMap = /* @__PURE__ */ new Map();
+      for (const type of options2) {
+        const discriminatorValues = getDiscriminator(type.shape[discriminator]);
+        if (!discriminatorValues.length) {
+          throw new Error(`A discriminator value for key \`${discriminator}\` could not be extracted from all schema options`);
+        }
+        for (const value of discriminatorValues) {
+          if (optionsMap.has(value)) {
+            throw new Error(`Discriminator property ${String(discriminator)} has duplicate value ${String(value)}`);
+          }
+          optionsMap.set(value, type);
+        }
+      }
+      return new ZodDiscriminatedUnion({
+        typeName: ZodFirstPartyTypeKind.ZodDiscriminatedUnion,
+        discriminator,
+        options: options2,
+        optionsMap,
+        ...processCreateParams(params)
+      });
+    }
+  }
   function mergeValues(a2, b) {
     const aType = getParsedType(a2);
     const bType = getParsedType(b);
@@ -10439,6 +10911,59 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       ...processCreateParams(params)
     });
   };
+  class ZodRecord extends ZodType {
+    get keySchema() {
+      return this._def.keyType;
+    }
+    get valueSchema() {
+      return this._def.valueType;
+    }
+    _parse(input) {
+      const { status, ctx } = this._processInputParams(input);
+      if (ctx.parsedType !== ZodParsedType.object) {
+        addIssueToContext(ctx, {
+          code: ZodIssueCode.invalid_type,
+          expected: ZodParsedType.object,
+          received: ctx.parsedType
+        });
+        return INVALID;
+      }
+      const pairs = [];
+      const keyType = this._def.keyType;
+      const valueType = this._def.valueType;
+      for (const key in ctx.data) {
+        pairs.push({
+          key: keyType._parse(new ParseInputLazyPath(ctx, key, ctx.path, key)),
+          value: valueType._parse(new ParseInputLazyPath(ctx, ctx.data[key], ctx.path, key)),
+          alwaysSet: key in ctx.data
+        });
+      }
+      if (ctx.common.async) {
+        return ParseStatus.mergeObjectAsync(status, pairs);
+      } else {
+        return ParseStatus.mergeObjectSync(status, pairs);
+      }
+    }
+    get element() {
+      return this._def.valueType;
+    }
+    static create(first, second, third) {
+      if (second instanceof ZodType) {
+        return new ZodRecord({
+          keyType: first,
+          valueType: second,
+          typeName: ZodFirstPartyTypeKind.ZodRecord,
+          ...processCreateParams(third)
+        });
+      }
+      return new ZodRecord({
+        keyType: ZodString.create(),
+        valueType: first,
+        typeName: ZodFirstPartyTypeKind.ZodRecord,
+        ...processCreateParams(second)
+      });
+    }
+  }
   class ZodMap extends ZodType {
     get keySchema() {
       return this._def.keyType;
@@ -10590,6 +11115,111 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       ...processCreateParams(params)
     });
   };
+  class ZodFunction extends ZodType {
+    constructor() {
+      super(...arguments);
+      this.validate = this.implement;
+    }
+    _parse(input) {
+      const { ctx } = this._processInputParams(input);
+      if (ctx.parsedType !== ZodParsedType.function) {
+        addIssueToContext(ctx, {
+          code: ZodIssueCode.invalid_type,
+          expected: ZodParsedType.function,
+          received: ctx.parsedType
+        });
+        return INVALID;
+      }
+      function makeArgsIssue(args, error2) {
+        return makeIssue({
+          data: args,
+          path: ctx.path,
+          errorMaps: [ctx.common.contextualErrorMap, ctx.schemaErrorMap, getErrorMap(), errorMap].filter((x) => !!x),
+          issueData: {
+            code: ZodIssueCode.invalid_arguments,
+            argumentsError: error2
+          }
+        });
+      }
+      function makeReturnsIssue(returns, error2) {
+        return makeIssue({
+          data: returns,
+          path: ctx.path,
+          errorMaps: [ctx.common.contextualErrorMap, ctx.schemaErrorMap, getErrorMap(), errorMap].filter((x) => !!x),
+          issueData: {
+            code: ZodIssueCode.invalid_return_type,
+            returnTypeError: error2
+          }
+        });
+      }
+      const params = { errorMap: ctx.common.contextualErrorMap };
+      const fn = ctx.data;
+      if (this._def.returns instanceof ZodPromise) {
+        const me = this;
+        return OK(async function(...args) {
+          const error2 = new ZodError([]);
+          const parsedArgs = await me._def.args.parseAsync(args, params).catch((e) => {
+            error2.addIssue(makeArgsIssue(args, e));
+            throw error2;
+          });
+          const result = await Reflect.apply(fn, this, parsedArgs);
+          const parsedReturns = await me._def.returns._def.type.parseAsync(result, params).catch((e) => {
+            error2.addIssue(makeReturnsIssue(result, e));
+            throw error2;
+          });
+          return parsedReturns;
+        });
+      } else {
+        const me = this;
+        return OK(function(...args) {
+          const parsedArgs = me._def.args.safeParse(args, params);
+          if (!parsedArgs.success) {
+            throw new ZodError([makeArgsIssue(args, parsedArgs.error)]);
+          }
+          const result = Reflect.apply(fn, this, parsedArgs.data);
+          const parsedReturns = me._def.returns.safeParse(result, params);
+          if (!parsedReturns.success) {
+            throw new ZodError([makeReturnsIssue(result, parsedReturns.error)]);
+          }
+          return parsedReturns.data;
+        });
+      }
+    }
+    parameters() {
+      return this._def.args;
+    }
+    returnType() {
+      return this._def.returns;
+    }
+    args(...items) {
+      return new ZodFunction({
+        ...this._def,
+        args: ZodTuple.create(items).rest(ZodUnknown.create())
+      });
+    }
+    returns(returnType) {
+      return new ZodFunction({
+        ...this._def,
+        returns: returnType
+      });
+    }
+    implement(func) {
+      const validatedFunc = this.parse(func);
+      return validatedFunc;
+    }
+    strictImplement(func) {
+      const validatedFunc = this.parse(func);
+      return validatedFunc;
+    }
+    static create(args, returns, params) {
+      return new ZodFunction({
+        args: args ? args : ZodTuple.create([]).rest(ZodUnknown.create()),
+        returns: returns || ZodUnknown.create(),
+        typeName: ZodFirstPartyTypeKind.ZodFunction,
+        ...processCreateParams(params)
+      });
+    }
+  }
   class ZodLazy extends ZodType {
     get schema() {
       return this._def.getter();
@@ -11047,6 +11677,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       ...processCreateParams(params)
     });
   };
+  const BRAND = Symbol("zod_brand");
   class ZodBranded extends ZodType {
     _parse(input) {
       const { ctx } = this._processInputParams(input);
@@ -11138,6 +11769,36 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       ...processCreateParams(params)
     });
   };
+  function cleanParams(params, data) {
+    const p = typeof params === "function" ? params(data) : typeof params === "string" ? { message: params } : params;
+    const p2 = typeof p === "string" ? { message: p } : p;
+    return p2;
+  }
+  function custom(check, _params = {}, fatal) {
+    if (check)
+      return ZodAny.create().superRefine((data, ctx) => {
+        const r = check(data);
+        if (r instanceof Promise) {
+          return r.then((r2) => {
+            if (!r2) {
+              const params = cleanParams(_params, data);
+              const _fatal = params.fatal ?? fatal ?? true;
+              ctx.addIssue({ code: "custom", ...params, fatal: _fatal });
+            }
+          });
+        }
+        if (!r) {
+          const params = cleanParams(_params, data);
+          const _fatal = params.fatal ?? fatal ?? true;
+          ctx.addIssue({ code: "custom", ...params, fatal: _fatal });
+        }
+        return;
+      });
+    return ZodAny.create();
+  }
+  const late = {
+    object: ZodObject.lazycreate
+  };
   var ZodFirstPartyTypeKind;
   (function(ZodFirstPartyTypeKind2) {
     ZodFirstPartyTypeKind2["ZodString"] = "ZodString";
@@ -11177,17 +11838,251 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
     ZodFirstPartyTypeKind2["ZodPipeline"] = "ZodPipeline";
     ZodFirstPartyTypeKind2["ZodReadonly"] = "ZodReadonly";
   })(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
+  const instanceOfType = (cls, params = {
+    message: `Input not instance of ${cls.name}`
+  }) => custom((data) => data instanceof cls, params);
   const stringType = ZodString.create;
-  ZodNever.create;
-  ZodArray.create;
+  const numberType = ZodNumber.create;
+  const nanType = ZodNaN.create;
+  const bigIntType = ZodBigInt.create;
+  const booleanType = ZodBoolean.create;
+  const dateType = ZodDate.create;
+  const symbolType = ZodSymbol.create;
+  const undefinedType = ZodUndefined.create;
+  const nullType = ZodNull.create;
+  const anyType = ZodAny.create;
+  const unknownType = ZodUnknown.create;
+  const neverType = ZodNever.create;
+  const voidType = ZodVoid.create;
+  const arrayType = ZodArray.create;
   const objectType = ZodObject.create;
-  ZodUnion.create;
-  ZodIntersection.create;
-  ZodTuple.create;
+  const strictObjectType = ZodObject.strictCreate;
+  const unionType = ZodUnion.create;
+  const discriminatedUnionType = ZodDiscriminatedUnion.create;
+  const intersectionType = ZodIntersection.create;
+  const tupleType = ZodTuple.create;
+  const recordType = ZodRecord.create;
+  const mapType = ZodMap.create;
+  const setType = ZodSet.create;
+  const functionType = ZodFunction.create;
+  const lazyType = ZodLazy.create;
+  const literalType = ZodLiteral.create;
   const enumType = ZodEnum.create;
-  ZodPromise.create;
-  ZodOptional.create;
-  ZodNullable.create;
+  const nativeEnumType = ZodNativeEnum.create;
+  const promiseType = ZodPromise.create;
+  const effectsType = ZodEffects.create;
+  const optionalType = ZodOptional.create;
+  const nullableType = ZodNullable.create;
+  const preprocessType = ZodEffects.createWithPreprocess;
+  const pipelineType = ZodPipeline.create;
+  const ostring = () => stringType().optional();
+  const onumber = () => numberType().optional();
+  const oboolean = () => booleanType().optional();
+  const coerce = {
+    string: (arg) => ZodString.create({ ...arg, coerce: true }),
+    number: (arg) => ZodNumber.create({ ...arg, coerce: true }),
+    boolean: (arg) => ZodBoolean.create({
+      ...arg,
+      coerce: true
+    }),
+    bigint: (arg) => ZodBigInt.create({ ...arg, coerce: true }),
+    date: (arg) => ZodDate.create({ ...arg, coerce: true })
+  };
+  const NEVER = INVALID;
+  const z = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+    __proto__: null,
+    BRAND,
+    DIRTY,
+    EMPTY_PATH,
+    INVALID,
+    NEVER,
+    OK,
+    ParseStatus,
+    Schema: ZodType,
+    ZodAny,
+    ZodArray,
+    ZodBigInt,
+    ZodBoolean,
+    ZodBranded,
+    ZodCatch,
+    ZodDate,
+    ZodDefault,
+    ZodDiscriminatedUnion,
+    ZodEffects,
+    ZodEnum,
+    ZodError,
+    get ZodFirstPartyTypeKind() {
+      return ZodFirstPartyTypeKind;
+    },
+    ZodFunction,
+    ZodIntersection,
+    ZodIssueCode,
+    ZodLazy,
+    ZodLiteral,
+    ZodMap,
+    ZodNaN,
+    ZodNativeEnum,
+    ZodNever,
+    ZodNull,
+    ZodNullable,
+    ZodNumber,
+    ZodObject,
+    ZodOptional,
+    ZodParsedType,
+    ZodPipeline,
+    ZodPromise,
+    ZodReadonly,
+    ZodRecord,
+    ZodSchema: ZodType,
+    ZodSet,
+    ZodString,
+    ZodSymbol,
+    ZodTransformer: ZodEffects,
+    ZodTuple,
+    ZodType,
+    ZodUndefined,
+    ZodUnion,
+    ZodUnknown,
+    ZodVoid,
+    addIssueToContext,
+    any: anyType,
+    array: arrayType,
+    bigint: bigIntType,
+    boolean: booleanType,
+    coerce,
+    custom,
+    date: dateType,
+    datetimeRegex,
+    defaultErrorMap: errorMap,
+    discriminatedUnion: discriminatedUnionType,
+    effect: effectsType,
+    enum: enumType,
+    function: functionType,
+    getErrorMap,
+    getParsedType,
+    instanceof: instanceOfType,
+    intersection: intersectionType,
+    isAborted,
+    isAsync,
+    isDirty,
+    isValid,
+    late,
+    lazy: lazyType,
+    literal: literalType,
+    makeIssue,
+    map: mapType,
+    nan: nanType,
+    nativeEnum: nativeEnumType,
+    never: neverType,
+    null: nullType,
+    nullable: nullableType,
+    number: numberType,
+    object: objectType,
+    get objectUtil() {
+      return objectUtil;
+    },
+    oboolean,
+    onumber,
+    optional: optionalType,
+    ostring,
+    pipeline: pipelineType,
+    preprocess: preprocessType,
+    promise: promiseType,
+    quotelessJson,
+    record: recordType,
+    set: setType,
+    setErrorMap,
+    strictObject: strictObjectType,
+    string: stringType,
+    symbol: symbolType,
+    transformer: effectsType,
+    tuple: tupleType,
+    undefined: undefinedType,
+    union: unionType,
+    unknown: unknownType,
+    get util() {
+      return util$3;
+    },
+    void: voidType
+  }, Symbol.toStringTag, { value: "Module" }));
+  const BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  function base32Encode(buffer) {
+    let bits = 0;
+    let value = 0;
+    let output = "";
+    for (let i2 = 0; i2 < buffer.length; i2++) {
+      value = value << 8 | buffer[i2];
+      bits += 8;
+      while (bits >= 5) {
+        output += BASE32_ALPHABET[value >>> bits - 5 & 31];
+        bits -= 5;
+      }
+    }
+    if (bits > 0) {
+      output += BASE32_ALPHABET[value << 5 - bits & 31];
+    }
+    return output;
+  }
+  function base32Decode(encoded) {
+    const cleanInput = encoded.replace(/=+$/, "").toUpperCase();
+    const bytes = [];
+    let bits = 0;
+    let value = 0;
+    for (let i2 = 0; i2 < cleanInput.length; i2++) {
+      const index2 = BASE32_ALPHABET.indexOf(cleanInput[i2]);
+      if (index2 === -1) continue;
+      value = value << 5 | index2;
+      bits += 5;
+      if (bits >= 8) {
+        bytes.push(value >>> bits - 8 & 255);
+        bits -= 8;
+      }
+    }
+    return Buffer.from(bytes);
+  }
+  function generateHotp(secret, counter) {
+    const hmac = require$$0$5.createHmac("sha1", secret);
+    const counterBuffer = Buffer.alloc(8);
+    counterBuffer.writeBigInt64BE(counter);
+    hmac.update(counterBuffer);
+    const hash = hmac.digest();
+    const offset = hash[hash.length - 1] & 15;
+    const code2 = ((hash[offset] & 127) << 24 | hash[offset + 1] << 16 | hash[offset + 2] << 8 | hash[offset + 3]) % 1e6;
+    return code2.toString().padStart(6, "0");
+  }
+  function verifyTotp(secret, token, window2 = 1) {
+    const timeStep = 30;
+    const counter = BigInt(Math.floor(Date.now() / 1e3 / timeStep));
+    for (let i2 = -window2; i2 <= window2; i2++) {
+      if (generateHotp(secret, counter + BigInt(i2)) === token) {
+        return true;
+      }
+    }
+    return false;
+  }
+  function generateTotpSecret(issuer, accountName) {
+    const secretBuffer = require$$0$5.randomBytes(20);
+    const secret = base32Encode(secretBuffer);
+    const encodedIssuer = encodeURIComponent(issuer);
+    const encodedAccount = encodeURIComponent(accountName);
+    const uri = `otpauth://totp/${encodedIssuer}:${encodedAccount}?secret=${secret}&issuer=${encodedIssuer}&algorithm=SHA1&digits=6&period=30`;
+    return {
+      secret,
+      uri
+    };
+  }
+  function generateRecoveryCodes(count = 10) {
+    return Array.from({
+      length: count
+    }, () => {
+      const raw = require$$0$5.randomBytes(5).toString("hex").toUpperCase();
+      const parts = raw.match(/.{1,5}/g);
+      return parts ? parts.join("-") : raw;
+    });
+  }
+  function hashRecoveryCode(code2) {
+    return require$$0$5.createHash("sha256").update(code2.replace(/-/g, "").toUpperCase()).digest("hex");
+  }
   function buildAuthResponse(user, roleIds, accessToken, refreshToken) {
     return {
       user: {
@@ -11225,9 +12120,9 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       emailService,
       emailConfig,
       allowRegistration = false,
-      overrides
+      authHooks
     } = config;
-    const ops = resolveAuthOverrides(overrides);
+    const ops = resolveAuthHooks(authHooks);
     const registerSchema = objectType({
       email: stringType().email("Invalid email address").max(255),
       password: stringType().min(1, "Password is required").max(128),
@@ -11291,7 +12186,19 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
     async function createSessionAndTokens(userId, userAgent, ipAddress) {
       const roles = await authRepo.getUserRoles(userId);
       const roleIds = roles.map((r) => r.id);
-      const accessToken = generateAccessToken(userId, roleIds);
+      let customClaims;
+      if (authHooks?.customizeAccessToken) {
+        const user = await authRepo.getUserById(userId);
+        if (user) {
+          const defaultClaims = {
+            userId,
+            roles: roleIds,
+            aal: "aal1"
+          };
+          customClaims = await authHooks.customizeAccessToken(defaultClaims, user);
+        }
+      }
+      const accessToken = generateAccessToken(userId, roleIds, "aal1", customClaims);
       const refreshToken = generateRefreshToken();
       await authRepo.createRefreshToken(userId, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), userAgent, ipAddress);
       return {
@@ -11326,8 +12233,8 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
         passwordHash,
         displayName: displayName || void 0
       };
-      if (overrides?.beforeUserCreate) {
-        createData = await overrides.beforeUserCreate(createData);
+      if (authHooks?.beforeUserCreate) {
+        createData = await authHooks.beforeUserCreate(createData);
       }
       const user = await authRepo.createUser(createData);
       const existingUsers = await authRepo.listUsers();
@@ -11346,14 +12253,16 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
         email: user.email,
         displayName: user.displayName
       });
-      if (overrides?.afterUserCreate) {
-        overrides.afterUserCreate(user).catch((err) => {
-          console.error("[AuthOverrides] afterUserCreate error:", err instanceof Error ? err.message : err);
-        });
+      if (authHooks?.afterUserCreate) {
+        try {
+          await authHooks.afterUserCreate(user);
+        } catch (err) {
+          console.error("[AuthHooks] afterUserCreate error:", err instanceof Error ? err.message : err);
+        }
       }
-      if (overrides?.onAuthenticated) {
-        overrides.onAuthenticated(user, "register").catch((err) => {
-          console.error("[AuthOverrides] onAuthenticated error:", err instanceof Error ? err.message : err);
+      if (authHooks?.onAuthenticated) {
+        authHooks.onAuthenticated(user, "register").catch((err) => {
+          console.error("[AuthHooks] onAuthenticated error:", err instanceof Error ? err.message : err);
         });
       }
       return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken), 201);
@@ -11363,9 +12272,12 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
         email,
         password
       } = parseBody2(loginSchema, await c.req.json());
+      if (authHooks?.beforeLogin) {
+        await authHooks.beforeLogin(email, "login");
+      }
       let user;
-      if (overrides?.verifyCredentials) {
-        user = await overrides.verifyCredentials(email, password, authRepo);
+      if (authHooks?.verifyCredentials) {
+        user = await authHooks.verifyCredentials(email, password, authRepo);
         if (!user) {
           throw ApiError.unauthorized("Invalid email or password", "INVALID_CREDENTIALS");
         }
@@ -11387,9 +12299,9 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
         accessToken,
         refreshToken
       } = await createSessionAndTokens(user.id, c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
-      if (overrides?.onAuthenticated) {
-        overrides.onAuthenticated(user, "login").catch((err) => {
-          console.error("[AuthOverrides] onAuthenticated error:", err instanceof Error ? err.message : err);
+      if (authHooks?.onAuthenticated) {
+        authHooks.onAuthenticated(user, "login").catch((err) => {
+          console.error("[AuthHooks] onAuthenticated error:", err instanceof Error ? err.message : err);
         });
       }
       return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken));
@@ -11428,6 +12340,13 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
               await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, {
                 email: externalUser.email
               });
+              if (authHooks?.afterUserCreate) {
+                try {
+                  await authHooks.afterUserCreate(user);
+                } catch (err) {
+                  console.error("[AuthHooks] afterUserCreate error:", err instanceof Error ? err.message : err);
+                }
+              }
               const allUsers = await authRepo.listUsers();
               const isFirstUser = allUsers.length === 1 && allUsers[0].id === user.id;
               if (isFirstUser) {
@@ -11513,6 +12432,11 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       await authRepo.updatePassword(storedToken.userId, passwordHash);
       await authRepo.markPasswordResetTokenUsed(tokenHash);
       await authRepo.deleteAllRefreshTokensForUser(storedToken.userId);
+      if (authHooks?.onPasswordReset) {
+        authHooks.onPasswordReset(storedToken.userId).catch((err) => {
+          console.error("[AuthHooks] onPasswordReset error:", err instanceof Error ? err.message : err);
+        });
+      }
       return c.json({
         success: true,
         message: "Password has been reset successfully"
@@ -11616,7 +12540,19 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       }
       const roles = await authRepo.getUserRoles(storedToken.userId);
       const roleIds = roles.map((r) => r.id);
-      const newAccessToken = generateAccessToken(storedToken.userId, roleIds);
+      let customClaims;
+      if (authHooks?.customizeAccessToken) {
+        const user = await authRepo.getUserById(storedToken.userId);
+        if (user) {
+          const defaultClaims = {
+            userId: storedToken.userId,
+            roles: roleIds,
+            aal: "aal1"
+          };
+          customClaims = await authHooks.customizeAccessToken(defaultClaims, user);
+        }
+      }
+      const newAccessToken = generateAccessToken(storedToken.userId, roleIds, "aal1", customClaims);
       const newRefreshToken = generateRefreshToken();
       const userAgent = c.req.header("user-agent") || "unknown";
       const ipAddress = c.req.header("x-forwarded-for") || "unknown";
@@ -11638,6 +12574,18 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
         const tokenHash = hashRefreshToken(refreshToken);
         await authRepo.deleteRefreshToken(tokenHash);
       }
+      const authHeader = c.req.header("authorization");
+      if (authHooks?.afterLogout && authHeader?.startsWith("Bearer ")) {
+        const {
+          verifyAccessToken: verifyAccessToken2
+        } = await Promise.resolve().then(() => jwt);
+        const payload = verifyAccessToken2(authHeader.substring(7));
+        if (payload) {
+          authHooks.afterLogout(payload.userId).catch((err) => {
+            console.error("[AuthHooks] afterLogout error:", err instanceof Error ? err.message : err);
+          });
+        }
+      }
       return c.json({
         success: true
       });
@@ -11757,6 +12705,270 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
         enabledProviders
       });
     });
+    router.post("/anonymous", strictAuthLimiter, async (c) => {
+      const anonId = require$$0$5.randomBytes(16).toString("hex");
+      const anonEmail = `anon_${anonId.slice(0, 8)}@anonymous.local`;
+      let createData = {
+        email: anonEmail,
+        emailVerified: false,
+        isAnonymous: true
+      };
+      if (authHooks?.beforeUserCreate) {
+        createData = await authHooks.beforeUserCreate(createData);
+      }
+      const user = await authRepo.createUser(createData);
+      if (config.defaultRole) {
+        await authRepo.assignDefaultRole(user.id, config.defaultRole);
+      }
+      const {
+        roleIds,
+        accessToken,
+        refreshToken
+      } = await createSessionAndTokens(user.id, c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
+      if (authHooks?.afterUserCreate) {
+        authHooks.afterUserCreate(user).catch((err) => {
+          console.error("[AuthHooks] afterUserCreate error:", err instanceof Error ? err.message : err);
+        });
+      }
+      if (authHooks?.onAuthenticated) {
+        authHooks.onAuthenticated(user, "anonymous").catch((err) => {
+          console.error("[AuthHooks] onAuthenticated error:", err instanceof Error ? err.message : err);
+        });
+      }
+      return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken), 201);
+    });
+    router.post("/anonymous/link", requireAuth, async (c) => {
+      const userCtx = c.get("user");
+      if (!userCtx) {
+        throw ApiError.unauthorized("Not authenticated");
+      }
+      const user = await authRepo.getUserById(userCtx.userId);
+      if (!user?.isAnonymous) {
+        throw ApiError.badRequest("User is not anonymous", "NOT_ANONYMOUS");
+      }
+      const linkSchema = objectType({
+        email: stringType().email("Invalid email address").max(255),
+        password: stringType().min(1, "Password is required").max(128)
+      });
+      const {
+        email,
+        password
+      } = parseBody2(linkSchema, await c.req.json());
+      const passwordValidation = ops.validatePasswordStrength(password);
+      if (!passwordValidation.valid) {
+        throw ApiError.badRequest(passwordValidation.errors.join(". "), "WEAK_PASSWORD");
+      }
+      const existingUser = await authRepo.getUserByEmail(email.toLowerCase());
+      if (existingUser) {
+        throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
+      }
+      const passwordHash = await ops.hashPassword(password);
+      const updatedUser = await authRepo.updateUser(user.id, {
+        email: email.toLowerCase(),
+        passwordHash,
+        isAnonymous: false
+      });
+      if (!updatedUser) {
+        throw ApiError.notFound("User not found");
+      }
+      const {
+        roleIds,
+        accessToken,
+        refreshToken
+      } = await createSessionAndTokens(user.id, c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
+      return c.json(buildAuthResponse(updatedUser, roleIds, accessToken, refreshToken));
+    });
+    router.post("/mfa/enroll", requireAuth, async (c) => {
+      const userCtx = c.get("user");
+      if (!userCtx) {
+        throw ApiError.unauthorized("Not authenticated");
+      }
+      const body = await c.req.json().catch(() => ({}));
+      const friendlyName = typeof body.friendlyName === "string" ? body.friendlyName : void 0;
+      const issuer = typeof body.issuer === "string" ? body.issuer : emailConfig?.appName || "Rebase";
+      const user = await authRepo.getUserById(userCtx.userId);
+      if (!user) {
+        throw ApiError.notFound("User not found");
+      }
+      const {
+        secret,
+        uri
+      } = generateTotpSecret(issuer, user.email);
+      const factor = await authRepo.createMfaFactor(
+        user.id,
+        "totp",
+        secret,
+        // In production, encrypt this before storage
+        friendlyName
+      );
+      const codes = generateRecoveryCodes(10);
+      const codeHashes = codes.map(hashRecoveryCode);
+      await authRepo.createRecoveryCodes(user.id, codeHashes);
+      return c.json({
+        factor: {
+          id: factor.id,
+          factorType: factor.factorType,
+          friendlyName: factor.friendlyName
+        },
+        totp: {
+          secret,
+          uri,
+          qrUri: uri
+          // Client can use a QR library to render this
+        },
+        recoveryCodes: codes
+      }, 201);
+    });
+    router.post("/mfa/verify", requireAuth, async (c) => {
+      const userCtx = c.get("user");
+      if (!userCtx) {
+        throw ApiError.unauthorized("Not authenticated");
+      }
+      const verifySchema = objectType({
+        factorId: stringType().min(1, "Factor ID is required"),
+        code: stringType().length(6, "Code must be 6 digits")
+      });
+      const {
+        factorId,
+        code: code2
+      } = parseBody2(verifySchema, await c.req.json());
+      const factor = await authRepo.getMfaFactorById(factorId);
+      if (!factor || factor.userId !== userCtx.userId) {
+        throw ApiError.notFound("MFA factor not found");
+      }
+      if (factor.verified) {
+        throw ApiError.badRequest("Factor is already verified", "ALREADY_VERIFIED");
+      }
+      const secretBuffer = base32Decode(factor.secretEncrypted);
+      const isValid2 = verifyTotp(secretBuffer, code2);
+      if (!isValid2) {
+        throw ApiError.unauthorized("Invalid TOTP code", "INVALID_CODE");
+      }
+      await authRepo.verifyMfaFactor(factorId);
+      return c.json({
+        success: true,
+        message: "MFA factor verified and enrolled"
+      });
+    });
+    router.post("/mfa/challenge", requireAuth, async (c) => {
+      const userCtx = c.get("user");
+      if (!userCtx) {
+        throw ApiError.unauthorized("Not authenticated");
+      }
+      const challengeSchema = objectType({
+        factorId: stringType().min(1, "Factor ID is required")
+      });
+      const {
+        factorId
+      } = parseBody2(challengeSchema, await c.req.json());
+      const factor = await authRepo.getMfaFactorById(factorId);
+      if (!factor || factor.userId !== userCtx.userId) {
+        throw ApiError.notFound("MFA factor not found");
+      }
+      if (!factor.verified) {
+        throw ApiError.badRequest("MFA factor is not yet verified", "FACTOR_NOT_VERIFIED");
+      }
+      const ipAddress = c.req.header("x-forwarded-for") || "unknown";
+      const challenge = await authRepo.createMfaChallenge(factorId, ipAddress);
+      return c.json({
+        challengeId: challenge.id,
+        factorId: challenge.factorId,
+        expiresAt: new Date(Date.now() + 5 * 60 * 1e3).toISOString()
+      });
+    });
+    router.post("/mfa/challenge/verify", requireAuth, async (c) => {
+      const userCtx = c.get("user");
+      if (!userCtx) {
+        throw ApiError.unauthorized("Not authenticated");
+      }
+      const challengeVerifySchema = objectType({
+        challengeId: stringType().min(1, "Challenge ID is required"),
+        code: stringType().min(1, "Code is required")
+      });
+      const {
+        challengeId,
+        code: code2
+      } = parseBody2(challengeVerifySchema, await c.req.json());
+      const challenge = await authRepo.getMfaChallengeById(challengeId);
+      if (!challenge) {
+        throw ApiError.badRequest("Invalid or expired challenge", "INVALID_CHALLENGE");
+      }
+      const factor = await authRepo.getMfaFactorById(challenge.factorId);
+      if (!factor || factor.userId !== userCtx.userId) {
+        throw ApiError.notFound("MFA factor not found");
+      }
+      const isRecoveryCode = code2.length > 6;
+      let isValid2 = false;
+      if (isRecoveryCode) {
+        const codeHash = hashRecoveryCode(code2);
+        isValid2 = await authRepo.useRecoveryCode(userCtx.userId, codeHash);
+      } else {
+        const secretBuffer = base32Decode(factor.secretEncrypted);
+        isValid2 = verifyTotp(secretBuffer, code2);
+      }
+      if (!isValid2) {
+        throw ApiError.unauthorized("Invalid verification code", "INVALID_CODE");
+      }
+      await authRepo.verifyMfaChallenge(challengeId);
+      const roles = await authRepo.getUserRoles(userCtx.userId);
+      const roleIds = roles.map((r) => r.id);
+      const accessToken = generateAccessToken(userCtx.userId, roleIds, "aal2");
+      const refreshToken = generateRefreshToken();
+      await authRepo.createRefreshToken(userCtx.userId, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
+      if (authHooks?.onMfaVerified) {
+        authHooks.onMfaVerified(userCtx.userId, factor.id).catch((err) => {
+          console.error("[AuthHooks] onMfaVerified error:", err instanceof Error ? err.message : err);
+        });
+      }
+      return c.json({
+        tokens: {
+          accessToken,
+          refreshToken,
+          accessTokenExpiresAt: getAccessTokenExpiry()
+        }
+      });
+    });
+    router.get("/mfa/factors", requireAuth, async (c) => {
+      const userCtx = c.get("user");
+      if (!userCtx) {
+        throw ApiError.unauthorized("Not authenticated");
+      }
+      const factors = await authRepo.getMfaFactors(userCtx.userId);
+      return c.json({
+        factors: factors.map((f2) => ({
+          id: f2.id,
+          factorType: f2.factorType,
+          friendlyName: f2.friendlyName,
+          verified: f2.verified,
+          createdAt: f2.createdAt
+        }))
+      });
+    });
+    router.delete("/mfa/unenroll", requireAuth, async (c) => {
+      const userCtx = c.get("user");
+      if (!userCtx) {
+        throw ApiError.unauthorized("Not authenticated");
+      }
+      const unenrollSchema = objectType({
+        factorId: stringType().min(1, "Factor ID is required")
+      });
+      const {
+        factorId
+      } = parseBody2(unenrollSchema, await c.req.json());
+      const factor = await authRepo.getMfaFactorById(factorId);
+      if (!factor || factor.userId !== userCtx.userId) {
+        throw ApiError.notFound("MFA factor not found");
+      }
+      await authRepo.deleteMfaFactor(factorId, userCtx.userId);
+      const hasFactors = await authRepo.hasVerifiedMfaFactors(userCtx.userId);
+      if (!hasFactors) {
+        await authRepo.deleteAllRecoveryCodes(userCtx.userId);
+      }
+      return c.json({
+        success: true,
+        message: "MFA factor removed"
+      });
+    });
     return router;
   }
   function generateSecurePassword() {
@@ -11788,9 +13000,9 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       emailService,
       emailConfig,
       hooks,
-      overrides
+      authHooks
     } = config;
-    const ops = resolveAuthOverrides(overrides);
+    const ops = resolveAuthHooks(authHooks);
     function buildHookContext(c, method) {
       const user = c.get("user");
       return {
@@ -11858,6 +13070,10 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       if (!userId) {
         throw ApiError.unauthorized("User ID not found in auth context");
       }
+      const caller = await authRepo.getUserById(userId);
+      if (!caller) {
+        throw ApiError.notFound("Authenticated user does not exist in the database. Please sign out and sign in/register again.", "USER_NOT_FOUND");
+      }
       await authRepo.setUserRoles(userId, ["admin"]);
       if (config.setBootstrapCompleted) {
         await config.setBootstrapCompleted();
@@ -12109,6 +13325,18 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
         await authRepo.updateUser(userId, updates);
       }
       if (roles !== void 0 && Array.isArray(roles)) {
+        const currentRoles = await authRepo.getUserRoleIds(userId);
+        const wasAdmin = currentRoles.includes("admin");
+        const willBeAdmin = roles.includes("admin");
+        if (wasAdmin && !willBeAdmin) {
+          const adminUsers = await authRepo.listUsersPaginated({
+            roleId: "admin",
+            limit: 1
+          });
+          if (adminUsers.total <= 1) {
+            throw ApiError.forbidden("Cannot demote the last administrator", "LAST_ADMIN");
+          }
+        }
         await authRepo.setUserRoles(userId, roles);
       }
       const result = await authRepo.getUserWithRoles(userId);
@@ -12133,6 +13361,16 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       if (!existing) {
         throw ApiError.notFound("User not found");
       }
+      const roles = await authRepo.getUserRoleIds(userId);
+      if (roles.includes("admin")) {
+        const adminUsers = await authRepo.listUsersPaginated({
+          roleId: "admin",
+          limit: 1
+        });
+        if (adminUsers.total <= 1) {
+          throw ApiError.forbidden("Cannot delete the last administrator", "LAST_ADMIN");
+        }
+      }
       const hookCtx = buildHookContext(c, "DELETE");
       if (hooks?.users?.beforeDelete) {
         await hooks.users.beforeDelete(userId, hookCtx);
@@ -12154,8 +13392,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
         id: r.id,
         name: r.name,
         isAdmin: r.isAdmin,
-        defaultPermissions: r.defaultPermissions,
-        config: r.config
+        defaultPermissions: r.defaultPermissions
       }));
       adminRoles = await applyRoleAfterReadBatch(adminRoles, hookCtx);
       return c.json({
@@ -12178,8 +13415,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
         id,
         name: name2,
         isAdmin,
-        defaultPermissions,
-        config: config2
+        defaultPermissions
       } = body;
       if (!id || !name2) {
         throw ApiError.badRequest("Role ID and name are required", "INVALID_INPUT");
@@ -12192,8 +13428,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
         id,
         name: name2,
         isAdmin: isAdmin ?? false,
-        defaultPermissions: defaultPermissions ?? null,
-        config: config2 ?? null
+        defaultPermissions: defaultPermissions ?? null
       });
       return c.json({
         role
@@ -12205,8 +13440,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       const {
         name: name2,
         isAdmin,
-        defaultPermissions,
-        config: config2
+        defaultPermissions
       } = body;
       const existing = await authRepo.getRoleById(roleId);
       if (!existing) {
@@ -12215,8 +13449,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       const role = await authRepo.updateRole(roleId, {
         name: name2,
         isAdmin,
-        defaultPermissions,
-        config: config2
+        defaultPermissions
       });
       return c.json({
         role
@@ -12248,9 +13481,9 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       oauthProviders = [],
       serviceKey,
       hooks,
-      overrides
+      authHooks
     } = config;
-    const resolvedOps = resolveAuthOverrides(overrides);
+    const resolvedOps = resolveAuthHooks(authHooks);
     const adapter = {
       id: "rebase-builtin",
       serviceKey,
@@ -12324,7 +13557,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
           rawToken: token
         };
       },
-      userManagement: createUserManagementFromRepo(authRepository, resolvedOps, overrides),
+      userManagement: createUserManagementFromRepo(authRepository, resolvedOps, authHooks),
       roleManagement: createRoleManagementFromRepo(authRepository),
       createAuthRoutes() {
         return createAuthRoutes({
@@ -12334,7 +13567,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
           allowRegistration,
           defaultRole,
           oauthProviders,
-          overrides
+          authHooks
         });
       },
       createAdminRoutes() {
@@ -12344,7 +13577,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
           emailConfig,
           serviceKey,
           hooks,
-          overrides
+          authHooks
         });
       },
       async getCapabilities() {
@@ -12373,7 +13606,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
     };
     return adapter;
   }
-  function createUserManagementFromRepo(repo, resolvedOps, overrides) {
+  function createUserManagementFromRepo(repo, resolvedOps, authHooks) {
     return {
       async listUsers(options2) {
         const result = await repo.listUsersPaginated({
@@ -12404,14 +13637,16 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
           photoUrl: data.photoUrl,
           metadata: data.metadata
         };
-        if (overrides?.beforeUserCreate) {
-          createData = await overrides.beforeUserCreate(createData);
+        if (authHooks?.beforeUserCreate) {
+          createData = await authHooks.beforeUserCreate(createData);
         }
         const user = await repo.createUser(createData);
-        if (overrides?.afterUserCreate) {
-          overrides.afterUserCreate(user).catch((err) => {
-            console.error("[AuthOverrides] afterUserCreate error:", err instanceof Error ? err.message : err);
-          });
+        if (authHooks?.afterUserCreate) {
+          try {
+            await authHooks.afterUserCreate(user);
+          } catch (err) {
+            console.error("[AuthHooks] afterUserCreate error:", err instanceof Error ? err.message : err);
+          }
         }
         return toAuthUserData(user);
       },
@@ -12428,7 +13663,15 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
         return user ? toAuthUserData(user) : null;
       },
       async deleteUser(id) {
+        if (authHooks?.beforeUserDelete) {
+          await authHooks.beforeUserDelete(id);
+        }
         await repo.deleteUser(id);
+        if (authHooks?.afterUserDelete) {
+          authHooks.afterUserDelete(id).catch((err) => {
+            console.error("[AuthHooks] afterUserDelete error:", err instanceof Error ? err.message : err);
+          });
+        }
       },
       async getUserRoles(userId) {
         const roles = await repo.getUserRoles(userId);
@@ -12455,8 +13698,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
           name: data.name,
           isAdmin: data.isAdmin,
           defaultPermissions: data.defaultPermissions,
-          collectionPermissions: data.collectionPermissions,
-          config: data.config
+          collectionPermissions: data.collectionPermissions
         });
         return toAuthRoleData(role);
       },
@@ -12487,8 +13729,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
       name: role.name,
       isAdmin: role.isAdmin,
       defaultPermissions: role.defaultPermissions,
-      collectionPermissions: role.collectionPermissions,
-      config: role.config
+      collectionPermissions: role.collectionPermissions
     };
   }
   function configureLogLevel(logLevel) {
@@ -12509,20 +13750,20 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
     if (currentLevel < 0) console.error = () => {
     };
   }
+  let originalConsole;
   function resetConsole() {
-    if (!global.__originalConsole) {
-      global.__originalConsole = {
+    if (!originalConsole) {
+      originalConsole = {
         log: console.log,
         warn: console.warn,
         error: console.error,
         debug: console.debug
       };
     }
-    const original = global.__originalConsole;
-    console.log = original.log;
-    console.warn = original.warn;
-    console.error = original.error;
-    console.debug = original.debug;
+    console.log = originalConsole.log;
+    console.warn = originalConsole.warn;
+    console.error = originalConsole.error;
+    console.debug = originalConsole.debug;
   }
   const GCP_SEVERITY = {
     debug: "DEBUG",
@@ -12764,12 +14005,6 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
     exports3.Response = globalObject.Response;
   })(browser$1, browser$1.exports);
   var browserExports = browser$1.exports;
-  const __viteBrowserExternal = {};
-  const __viteBrowserExternal$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
-    __proto__: null,
-    default: __viteBrowserExternal
-  }, Symbol.toStringTag, { value: "Module" }));
-  const require$$11 = /* @__PURE__ */ getAugmentedNamespace(__viteBrowserExternal$1);
   const isStream = (stream2) => stream2 !== null && typeof stream2 === "object" && typeof stream2.pipe === "function";
   isStream.writable = (stream2) => isStream(stream2) && stream2.writable !== false && typeof stream2._write === "function" && typeof stream2._writableState === "object";
   isStream.readable = (stream2) => isStream(stream2) && stream2.readable !== false && typeof stream2._read === "function" && typeof stream2._readableState === "object";
@@ -13554,16 +14789,16 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
     value: true
   });
   sha1$1.default = void 0;
-  function f(s2, x, y2, z) {
+  function f(s2, x, y2, z2) {
     switch (s2) {
       case 0:
-        return x & y2 ^ ~x & z;
+        return x & y2 ^ ~x & z2;
       case 1:
-        return x ^ y2 ^ z;
+        return x ^ y2 ^ z2;
       case 2:
-        return x & y2 ^ x & z ^ y2 & z;
+        return x & y2 ^ x & z2 ^ y2 & z2;
       case 3:
-        return x ^ y2 ^ z;
+        return x ^ y2 ^ z2;
     }
   }
   function ROTL(x, n) {
@@ -14612,7 +15847,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
   const extend_1 = __importDefault(extend);
   const https_1 = require$$1;
   const node_fetch_1 = __importDefault(browserExports);
-  const querystring_1$1 = __importDefault(require$$11);
+  const querystring_1$1 = __importDefault(require$$1$2);
   const is_stream_1 = __importDefault(isStream_1);
   const url_1 = require$$0$2;
   const common_1 = common$1;
@@ -16290,11 +17525,11 @@ Content-Type: ${partContentType}\r
         return n > 0 || n === i2 ? i2 : i2 - 1;
       }
       function coeffToString(a2) {
-        var s2, z, i2 = 1, j = a2.length, r = a2[0] + "";
+        var s2, z2, i2 = 1, j = a2.length, r = a2[0] + "";
         for (; i2 < j; ) {
           s2 = a2[i2++] + "";
-          z = LOG_BASE - s2.length;
-          for (; z--; s2 = "0" + s2) ;
+          z2 = LOG_BASE - s2.length;
+          for (; z2--; s2 = "0" + s2) ;
           r += s2;
         }
         for (j = r.length; r.charCodeAt(--j) === 48; ) ;
@@ -16327,15 +17562,15 @@ Content-Type: ${partContentType}\r
       function toExponential(str, e) {
         return (str.length > 1 ? str.charAt(0) + "." + str.slice(1) : str) + (e < 0 ? "e" : "e+") + e;
       }
-      function toFixedPoint(str, e, z) {
+      function toFixedPoint(str, e, z2) {
         var len2, zs;
         if (e < 0) {
-          for (zs = z + "."; ++e; zs += z) ;
+          for (zs = z2 + "."; ++e; zs += z2) ;
           str = zs + str;
         } else {
           len2 = str.length;
           if (++e > len2) {
-            for (zs = z, e -= len2; --e; zs += z) ;
+            for (zs = z2, e -= len2; --e; zs += z2) ;
             str += zs;
           } else if (e < len2) {
             str = str.slice(0, e) + "." + str.slice(e);
@@ -16754,7 +17989,7 @@ Content-Type: ${partContentType}\r
     exports3.isGoogleComputeEngine = isGoogleComputeEngine;
     exports3.detectGCPResidency = detectGCPResidency;
     const fs_1 = fs$4;
-    const os_1 = require$$1$2;
+    const os_1 = require$$1$3;
     exports3.GCE_LINUX_BIOS_PATHS = {
       BIOS_DATE: "/sys/class/dmi/id/bios_date",
       BIOS_VENDOR: "/sys/class/dmi/id/bios_vendor"
@@ -16887,7 +18122,7 @@ Content-Type: ${partContentType}\r
     exports3.setBackend = setBackend;
     exports3.log = log;
     const node_events_1 = require$$0$8;
-    const process2 = __importStar2(require$$1$3);
+    const process2 = __importStar2(require$$1$4);
     const util2 = __importStar2(require$$2$1);
     const colours_1 = colours;
     var LogSeverity;
@@ -17959,7 +19194,7 @@ Content-Type: ${partContentType}\r
   Object.defineProperty(oauth2client, "__esModule", { value: true });
   oauth2client.OAuth2Client = oauth2client.ClientAuthentication = oauth2client.CertificateFormat = oauth2client.CodeChallengeMethod = void 0;
   const gaxios_1$5 = src$2;
-  const querystring$2 = require$$11;
+  const querystring$2 = require$$1$2;
   const stream$4 = require$$0$4;
   const formatEcdsa = ecdsaSigFormatter;
   const crypto_1$2 = requireCrypto();
@@ -19447,7 +20682,7 @@ Content-Type: ${partContentType}\r
   Object.defineProperty(refreshclient, "__esModule", { value: true });
   refreshclient.UserRefreshClient = refreshclient.USER_REFRESH_ACCOUNT_TYPE = void 0;
   const oauth2client_1$1 = oauth2client;
-  const querystring_1 = require$$11;
+  const querystring_1 = require$$1$2;
   refreshclient.USER_REFRESH_ACCOUNT_TYPE = "authorized_user";
   class UserRefreshClient extends oauth2client_1$1.OAuth2Client {
     constructor(optionsOrClientId, clientSecret, refreshToken, eagerRefreshThresholdMillis, forceRefreshOnFailure) {
@@ -19722,7 +20957,7 @@ Content-Type: ${partContentType}\r
   Object.defineProperty(oauth2common, "__esModule", { value: true });
   oauth2common.OAuthClientAuthHandler = void 0;
   oauth2common.getErrorFromOAuthErrorResponse = getErrorFromOAuthErrorResponse;
-  const querystring$1 = require$$11;
+  const querystring$1 = require$$1$2;
   const crypto_1$1 = requireCrypto();
   const METHODS_SUPPORTING_REQUEST_BODY = ["PUT", "POST", "PATCH"];
   class OAuthClientAuthHandler {
@@ -19868,7 +21103,7 @@ Content-Type: ${partContentType}\r
   Object.defineProperty(stscredentials, "__esModule", { value: true });
   stscredentials.StsCredentials = void 0;
   const gaxios_1$1 = src$2;
-  const querystring = require$$11;
+  const querystring = require$$1$2;
   const transporters_1 = transporters;
   const oauth2common_1$1 = oauth2common;
   class StsCredentials extends oauth2common_1$1.OAuthClientAuthHandler {
@@ -21474,7 +22709,7 @@ ${credentialScope}
     const child_process_1 = require$$0$a;
     const fs2 = fs$4;
     const gcpMetadata2 = src$3;
-    const os2 = require$$1$2;
+    const os2 = require$$1$3;
     const path2 = path$3;
     const crypto_12 = requireCrypto();
     const transporters_12 = transporters;
@@ -22838,7 +24073,7 @@ ${credentialScope}
   }
   function createAppleProvider(config) {
     async function generateClientSecret() {
-      return jwt.sign({}, config.privateKey, {
+      return jwt$1.sign({}, config.privateKey, {
         algorithm: "ES256",
         keyid: config.keyId,
         issuer: config.teamId,
@@ -23318,6 +24553,341 @@ ${credentialScope}
       }
     };
   }
+  const TABLE$1 = "rebase.api_keys";
+  function generateApiKey() {
+    const random = require$$0$5.randomBytes(16).toString("hex");
+    return `rk_live_${random}`;
+  }
+  function hashKey(plaintext) {
+    return require$$0$5.createHash("sha256").update(plaintext).digest("hex");
+  }
+  function keyPrefix(plaintext) {
+    return plaintext.substring(0, 12);
+  }
+  function toMasked(row) {
+    return {
+      id: row.id,
+      name: row.name,
+      key_prefix: row.key_prefix,
+      permissions: row.permissions,
+      rate_limit: row.rate_limit,
+      created_by: row.created_by,
+      created_at: row.created_at,
+      updated_at: row.updated_at,
+      last_used_at: row.last_used_at,
+      expires_at: row.expires_at,
+      revoked_at: row.revoked_at
+    };
+  }
+  function rowToApiKey(row) {
+    const permissions = typeof row.permissions === "string" ? JSON.parse(row.permissions) : row.permissions ?? [];
+    return {
+      id: row.id,
+      name: row.name,
+      key_prefix: row.key_prefix,
+      key_hash: row.key_hash,
+      permissions,
+      rate_limit: row.rate_limit !== null && row.rate_limit !== void 0 ? Number(row.rate_limit) : null,
+      created_by: row.created_by,
+      created_at: new Date(row.created_at).toISOString(),
+      updated_at: new Date(row.updated_at).toISOString(),
+      last_used_at: row.last_used_at ? new Date(row.last_used_at).toISOString() : null,
+      expires_at: row.expires_at ? new Date(row.expires_at).toISOString() : null,
+      revoked_at: row.revoked_at ? new Date(row.revoked_at).toISOString() : null
+    };
+  }
+  function esc(value) {
+    return value.replace(/'/g, "''");
+  }
+  function createApiKeyStore(driver) {
+    const admin = driver.admin;
+    if (!isSQLAdmin(admin)) {
+      logger.warn("⚠️ [api-key-store] DataDriver does not support SQL admin — API keys will not be available.");
+      return void 0;
+    }
+    const exec = admin.executeSql.bind(admin);
+    return {
+      // ── Schema bootstrap ────────────────────────────────────────
+      async ensureTable() {
+        try {
+          await exec("CREATE SCHEMA IF NOT EXISTS rebase");
+          await exec(`
+                    CREATE TABLE IF NOT EXISTS ${TABLE$1} (
+                        id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                        name TEXT NOT NULL,
+                        key_prefix TEXT NOT NULL,
+                        key_hash TEXT NOT NULL UNIQUE,
+                        permissions JSONB NOT NULL DEFAULT '[]'::jsonb,
+                        rate_limit INTEGER,
+                        created_by TEXT NOT NULL,
+                        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                        last_used_at TIMESTAMPTZ,
+                        expires_at TIMESTAMPTZ,
+                        revoked_at TIMESTAMPTZ
+                    )
+                `);
+          await exec(`
+                    CREATE INDEX IF NOT EXISTS idx_api_keys_hash
+                    ON ${TABLE$1}(key_hash)
+                `);
+          await exec(`
+                    CREATE INDEX IF NOT EXISTS idx_api_keys_prefix
+                    ON ${TABLE$1}(key_prefix)
+                `);
+          logger.info("✅ API keys table ready");
+        } catch (err) {
+          logger.error("❌ Failed to create API keys table", {
+            error: err
+          });
+          logger.warn("⚠️ Continuing without API keys support.");
+        }
+      },
+      // ── Create ──────────────────────────────────────────────────
+      async createApiKey(request, createdBy) {
+        const plaintext = generateApiKey();
+        const hash = hashKey(plaintext);
+        const prefix = keyPrefix(plaintext);
+        const permissionsJson = JSON.stringify(request.permissions);
+        const rateLimitSql = request.rate_limit !== null && request.rate_limit !== void 0 ? String(request.rate_limit) : "NULL";
+        const expiresAtSql = request.expires_at ? `'${esc(request.expires_at)}'` : "NULL";
+        const rows = await exec(`
+                INSERT INTO ${TABLE$1} (name, key_prefix, key_hash, permissions, rate_limit, created_by, expires_at)
+                VALUES (
+                    '${esc(request.name)}',
+                    '${esc(prefix)}',
+                    '${esc(hash)}',
+                    '${esc(permissionsJson)}'::jsonb,
+                    ${rateLimitSql},
+                    '${esc(createdBy)}',
+                    ${expiresAtSql}
+                )
+                RETURNING *
+            `);
+        const apiKey = rowToApiKey(rows[0]);
+        return {
+          ...toMasked(apiKey),
+          key: plaintext
+        };
+      },
+      // ── Lookup by hash ──────────────────────────────────────────
+      async findByKeyHash(hash) {
+        const rows = await exec(`
+                SELECT * FROM ${TABLE$1}
+                WHERE key_hash = '${esc(hash)}'
+                LIMIT 1
+            `);
+        if (rows.length === 0) return null;
+        return rowToApiKey(rows[0]);
+      },
+      // ── List all (masked) ───────────────────────────────────────
+      async listApiKeys() {
+        const rows = await exec(`
+                SELECT * FROM ${TABLE$1}
+                ORDER BY created_at DESC
+            `);
+        return rows.map((r) => toMasked(rowToApiKey(r)));
+      },
+      // ── Get by ID (masked) ──────────────────────────────────────
+      async getApiKeyById(id) {
+        const rows = await exec(`
+                SELECT * FROM ${TABLE$1}
+                WHERE id = '${esc(id)}'
+                LIMIT 1
+            `);
+        if (rows.length === 0) return null;
+        return toMasked(rowToApiKey(rows[0]));
+      },
+      // ── Update ──────────────────────────────────────────────────
+      async updateApiKey(id, updates) {
+        const setClauses = [];
+        if (updates.name !== void 0) {
+          setClauses.push(`name = '${esc(updates.name)}'`);
+        }
+        if (updates.permissions !== void 0) {
+          setClauses.push(`permissions = '${esc(JSON.stringify(updates.permissions))}'::jsonb`);
+        }
+        if (updates.rate_limit !== void 0) {
+          setClauses.push(updates.rate_limit !== null ? `rate_limit = ${updates.rate_limit}` : "rate_limit = NULL");
+        }
+        if (updates.expires_at !== void 0) {
+          setClauses.push(updates.expires_at !== null ? `expires_at = '${esc(updates.expires_at)}'` : "expires_at = NULL");
+        }
+        if (setClauses.length === 0) {
+          return this.getApiKeyById(id);
+        }
+        setClauses.push("updated_at = NOW()");
+        const rows = await exec(`
+                UPDATE ${TABLE$1}
+                SET ${setClauses.join(", ")}
+                WHERE id = '${esc(id)}'
+                RETURNING *
+            `);
+        if (rows.length === 0) return null;
+        return toMasked(rowToApiKey(rows[0]));
+      },
+      // ── Revoke (soft-delete) ────────────────────────────────────
+      async revokeApiKey(id) {
+        const rows = await exec(`
+                UPDATE ${TABLE$1}
+                SET revoked_at = NOW(), updated_at = NOW()
+                WHERE id = '${esc(id)}' AND revoked_at IS NULL
+                RETURNING id
+            `);
+        return rows.length > 0;
+      },
+      // ── Touch last_used_at ──────────────────────────────────────
+      async updateLastUsed(id) {
+        try {
+          await exec(`
+                    UPDATE ${TABLE$1}
+                    SET last_used_at = NOW()
+                    WHERE id = '${esc(id)}'
+                `);
+        } catch (err) {
+          logger.error("[api-key-store] Failed to update last_used_at", {
+            error: err
+          });
+        }
+      }
+    };
+  }
+  function validatePermissions(permissions) {
+    if (!Array.isArray(permissions)) return false;
+    for (const perm of permissions) {
+      if (typeof perm !== "object" || perm === null) return false;
+      if (typeof perm.collection !== "string" || perm.collection.length === 0) return false;
+      if (!Array.isArray(perm.operations) || perm.operations.length === 0) return false;
+      const validOps = /* @__PURE__ */ new Set(["read", "write", "delete"]);
+      for (const op of perm.operations) {
+        if (!validOps.has(op)) return false;
+      }
+    }
+    return true;
+  }
+  function createApiKeyRoutes(options2) {
+    const {
+      store,
+      serviceKey
+    } = options2;
+    const router = new hono.Hono();
+    router.onError(errorHandler);
+    router.use("/*", createRequireAuth({
+      serviceKey
+    }));
+    router.use("/*", requireAdmin);
+    router.get("/", async (c) => {
+      const keys2 = await store.listApiKeys();
+      return c.json({
+        keys: keys2
+      });
+    });
+    router.post("/", async (c) => {
+      const body = await c.req.json();
+      const {
+        name: name2,
+        permissions,
+        rate_limit,
+        expires_at
+      } = body;
+      if (!name2 || typeof name2 !== "string" || name2.trim().length === 0) {
+        throw ApiError.badRequest("Name is required", "INVALID_INPUT");
+      }
+      if (!validatePermissions(permissions)) {
+        throw ApiError.badRequest("Permissions must be an array of { collection: string, operations: ('read' | 'write' | 'delete')[] }", "INVALID_INPUT");
+      }
+      if (rate_limit !== void 0 && rate_limit !== null) {
+        if (typeof rate_limit !== "number" || rate_limit < 1 || !Number.isInteger(rate_limit)) {
+          throw ApiError.badRequest("rate_limit must be a positive integer or null", "INVALID_INPUT");
+        }
+      }
+      if (expires_at !== void 0 && expires_at !== null) {
+        const parsed = new Date(expires_at);
+        if (isNaN(parsed.getTime())) {
+          throw ApiError.badRequest("expires_at must be a valid ISO-8601 date", "INVALID_INPUT");
+        }
+        if (parsed <= /* @__PURE__ */ new Date()) {
+          throw ApiError.badRequest("expires_at must be in the future", "INVALID_INPUT");
+        }
+      }
+      const user = c.get("user");
+      const createdBy = user && typeof user === "object" && "userId" in user ? user.userId : "unknown";
+      const request = {
+        name: name2.trim(),
+        permissions,
+        rate_limit: rate_limit ?? null,
+        expires_at: expires_at ?? null
+      };
+      const keyWithSecret = await store.createApiKey(request, createdBy);
+      return c.json({
+        key: keyWithSecret
+      }, 201);
+    });
+    router.get("/:id", async (c) => {
+      const id = c.req.param("id");
+      const key = await store.getApiKeyById(id);
+      if (!key) {
+        throw ApiError.notFound("API key not found");
+      }
+      return c.json({
+        key
+      });
+    });
+    router.put("/:id", async (c) => {
+      const id = c.req.param("id");
+      const body = await c.req.json();
+      const {
+        name: name2,
+        permissions,
+        rate_limit,
+        expires_at
+      } = body;
+      if (name2 !== void 0) {
+        if (typeof name2 !== "string" || name2.trim().length === 0) {
+          throw ApiError.badRequest("Name must be a non-empty string", "INVALID_INPUT");
+        }
+      }
+      if (permissions !== void 0) {
+        if (!validatePermissions(permissions)) {
+          throw ApiError.badRequest("Permissions must be an array of { collection: string, operations: ('read' | 'write' | 'delete')[] }", "INVALID_INPUT");
+        }
+      }
+      if (rate_limit !== void 0 && rate_limit !== null) {
+        if (typeof rate_limit !== "number" || rate_limit < 1 || !Number.isInteger(rate_limit)) {
+          throw ApiError.badRequest("rate_limit must be a positive integer or null", "INVALID_INPUT");
+        }
+      }
+      if (expires_at !== void 0 && expires_at !== null) {
+        const parsed = new Date(expires_at);
+        if (isNaN(parsed.getTime())) {
+          throw ApiError.badRequest("expires_at must be a valid ISO-8601 date", "INVALID_INPUT");
+        }
+      }
+      const updates = {};
+      if (name2 !== void 0) updates.name = name2.trim();
+      if (permissions !== void 0) updates.permissions = permissions;
+      if (rate_limit !== void 0) updates.rate_limit = rate_limit;
+      if (expires_at !== void 0) updates.expires_at = expires_at;
+      const key = await store.updateApiKey(id, updates);
+      if (!key) {
+        throw ApiError.notFound("API key not found");
+      }
+      return c.json({
+        key
+      });
+    });
+    router.delete("/:id", async (c) => {
+      const id = c.req.param("id");
+      const revoked = await store.revokeApiKey(id);
+      if (!revoked) {
+        throw ApiError.notFound("API key not found or already revoked");
+      }
+      return c.json({
+        success: true
+      });
+    });
+    return router;
+  }
   function createCustomAuthAdapter(options2) {
     const defaultCapabilities = {
       hasBuiltInAuthRoutes: false,
@@ -23352,9 +24922,13 @@ ${credentialScope}
   }
   const index = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
     __proto__: null,
+    apiKeyKeyGenerator,
     configureJwt,
     createAdapterAuthMiddleware,
     createAdminRoutes,
+    createApiKeyRateLimiter,
+    createApiKeyRoutes,
+    createApiKeyStore,
     createAppleProvider,
     createAuthMiddleware,
     createAuthRoutes,
@@ -23380,11 +24954,15 @@ ${credentialScope}
     getRefreshTokenExpiry,
     hashPassword,
     hashRefreshToken,
+    httpMethodToOperation,
+    isApiKeyToken,
+    isOperationAllowed,
     optionalAuth,
     requireAdmin,
     requireAuth,
-    resolveAuthOverrides,
+    resolveAuthHooks,
     strictAuthLimiter,
+    validateApiKey,
     validatePasswordStrength,
     verifyAccessToken,
     verifyPassword
@@ -23909,6 +25487,409 @@ ${credentialScope}
       };
     }
   }
+  let sharpFactory;
+  async function getSharp() {
+    if (!sharpFactory) {
+      try {
+        const mod = await import("sharp");
+        sharpFactory = mod.default;
+      } catch (err) {
+        throw new Error("Failed to load optional 'sharp' dependency for image transformation.");
+      }
+    }
+    if (!sharpFactory) {
+      throw new Error("Failed to load optional 'sharp' dependency for image transformation.");
+    }
+    return sharpFactory;
+  }
+  const MAX_DIMENSION = 4096;
+  const MAX_QUALITY = 100;
+  const MIN_QUALITY = 1;
+  const VALID_FORMATS = /* @__PURE__ */ new Set(["webp", "avif", "jpeg", "png"]);
+  const VALID_FITS = /* @__PURE__ */ new Set(["cover", "contain", "fill", "inside", "outside"]);
+  function parseTransformOptions(query) {
+    const opts = {};
+    let hasTransform = false;
+    if (query.width) {
+      const w2 = parseInt(query.width, 10);
+      if (!Number.isNaN(w2) && w2 > 0) {
+        opts.width = Math.min(w2, MAX_DIMENSION);
+        hasTransform = true;
+      }
+    }
+    if (query.height) {
+      const h2 = parseInt(query.height, 10);
+      if (!Number.isNaN(h2) && h2 > 0) {
+        opts.height = Math.min(h2, MAX_DIMENSION);
+        hasTransform = true;
+      }
+    }
+    if (query.quality) {
+      const q = parseInt(query.quality, 10);
+      if (!Number.isNaN(q)) {
+        opts.quality = Math.min(Math.max(q, MIN_QUALITY), MAX_QUALITY);
+        hasTransform = true;
+      }
+    }
+    if (query.format && VALID_FORMATS.has(query.format)) {
+      opts.format = query.format;
+      hasTransform = true;
+    }
+    if (query.fit && VALID_FITS.has(query.fit)) {
+      opts.fit = query.fit;
+      hasTransform = true;
+    }
+    return hasTransform ? opts : null;
+  }
+  const FORMAT_CONTENT_TYPES = {
+    webp: "image/webp",
+    avif: "image/avif",
+    jpeg: "image/jpeg",
+    png: "image/png"
+  };
+  function isTransformableImage(contentType) {
+    return contentType.startsWith("image/") && !contentType.includes("svg") && !contentType.includes("gif");
+  }
+  async function transformImage(buffer, options2) {
+    const sharp = await getSharp();
+    let pipeline = sharp(buffer);
+    if (options2.width || options2.height) {
+      pipeline = pipeline.resize({
+        width: options2.width,
+        height: options2.height,
+        fit: options2.fit || "cover",
+        withoutEnlargement: true
+      });
+    }
+    const format = options2.format || "webp";
+    const quality = options2.quality || 80;
+    switch (format) {
+      case "webp":
+        pipeline = pipeline.webp({
+          quality
+        });
+        break;
+      case "avif":
+        pipeline = pipeline.avif({
+          quality
+        });
+        break;
+      case "jpeg":
+        pipeline = pipeline.jpeg({
+          quality
+        });
+        break;
+      case "png":
+        pipeline = pipeline.png({
+          quality
+        });
+        break;
+    }
+    const data = await pipeline.toBuffer();
+    return {
+      data,
+      contentType: FORMAT_CONTENT_TYPES[format]
+    };
+  }
+  class TransformCache {
+    cache = /* @__PURE__ */ new Map();
+    maxEntries;
+    maxAgeMs;
+    constructor(maxEntries = 500, maxAgeMs = 36e5) {
+      this.maxEntries = maxEntries;
+      this.maxAgeMs = maxAgeMs;
+    }
+    /** Build a deterministic cache key from file key + transform options. */
+    buildKey(fileKey, options2) {
+      return `${fileKey}::${JSON.stringify(options2)}`;
+    }
+    get(cacheKey) {
+      const entry = this.cache.get(cacheKey);
+      if (!entry) return null;
+      if (Date.now() - entry.timestamp > this.maxAgeMs) {
+        this.cache.delete(cacheKey);
+        return null;
+      }
+      this.cache.delete(cacheKey);
+      this.cache.set(cacheKey, entry);
+      return {
+        data: entry.data,
+        contentType: entry.contentType
+      };
+    }
+    set(cacheKey, data, contentType) {
+      if (this.cache.size >= this.maxEntries) {
+        const oldest = this.cache.keys().next().value;
+        if (oldest !== void 0) this.cache.delete(oldest);
+      }
+      this.cache.set(cacheKey, {
+        data,
+        contentType,
+        timestamp: Date.now()
+      });
+    }
+  }
+  const MAX_UPLOAD_SIZE = 5 * 1024 * 1024 * 1024;
+  const UPLOAD_EXPIRY_MS = 24 * 60 * 60 * 1e3;
+  class TusHandler {
+    constructor(storageBaseDir, storageController) {
+      this.storageController = storageController;
+      this.tusDir = path$3.join(storageBaseDir, ".tus-uploads");
+    }
+    uploads = /* @__PURE__ */ new Map();
+    tusDir;
+    cleanupTimer;
+    /** Ensure the temp directory exists. */
+    async ensureDir() {
+      if (!fs$4.existsSync(this.tusDir)) {
+        await promises.mkdir(this.tusDir, {
+          recursive: true
+        });
+      }
+    }
+    /** Start periodic cleanup of stale uploads. */
+    startCleanup() {
+      if (this.cleanupTimer) return;
+      this.cleanupTimer = setInterval(() => {
+        void this.cleanupStale();
+      }, 6e4);
+    }
+    /** Remove uploads that have been idle for longer than UPLOAD_EXPIRY_MS. */
+    async cleanupStale() {
+      const now = Date.now();
+      for (const [id, upload] of this.uploads) {
+        if (now - upload.createdAt > UPLOAD_EXPIRY_MS && !upload.completed) {
+          try {
+            await promises.unlink(upload.filePath);
+          } catch {
+          }
+          this.uploads.delete(id);
+        }
+      }
+    }
+    // -----------------------------------------------------------------------
+    // TUS Metadata Parsing
+    // -----------------------------------------------------------------------
+    /**
+     * Parse the `Upload-Metadata` header.
+     *
+     * Format: `key base64value,key2 base64value2`
+     */
+    parseMetadata(header) {
+      const metadata = {};
+      if (!header) return metadata;
+      for (const pair of header.split(",")) {
+        const trimmed = pair.trim();
+        const spaceIdx = trimmed.indexOf(" ");
+        if (spaceIdx === -1) {
+          metadata[trimmed] = "";
+        } else {
+          const key = trimmed.substring(0, spaceIdx);
+          const value = Buffer.from(trimmed.substring(spaceIdx + 1), "base64").toString("utf-8");
+          metadata[key] = value;
+        }
+      }
+      return metadata;
+    }
+    // -----------------------------------------------------------------------
+    // Protocol Endpoints
+    // -----------------------------------------------------------------------
+    /** `OPTIONS /tus` — TUS capability discovery. */
+    options() {
+      return new Response(null, {
+        status: 204,
+        headers: {
+          "Tus-Resumable": "1.0.0",
+          "Tus-Version": "1.0.0",
+          "Tus-Extension": "creation,termination",
+          "Tus-Max-Size": String(MAX_UPLOAD_SIZE)
+        }
+      });
+    }
+    /** `POST /tus` — Create a new upload. */
+    async create(c) {
+      await this.ensureDir();
+      const uploadLengthHeader = c.req.header("Upload-Length");
+      if (!uploadLengthHeader) {
+        return c.json({
+          error: "Upload-Length header is required"
+        }, 400);
+      }
+      const uploadLength = parseInt(uploadLengthHeader, 10);
+      if (Number.isNaN(uploadLength) || uploadLength <= 0) {
+        return c.json({
+          error: "Invalid Upload-Length"
+        }, 400);
+      }
+      if (uploadLength > MAX_UPLOAD_SIZE) {
+        return c.json({
+          error: `Upload-Length exceeds maximum of ${MAX_UPLOAD_SIZE} bytes`
+        }, 413);
+      }
+      const metadata = this.parseMetadata(c.req.header("Upload-Metadata") || "");
+      const id = require$$0$5.randomUUID();
+      const filePath = path$3.join(this.tusDir, id);
+      await promises.writeFile(filePath, Buffer.alloc(0));
+      const upload = {
+        id,
+        size: uploadLength,
+        offset: 0,
+        metadata,
+        createdAt: Date.now(),
+        filePath,
+        bucket: metadata.bucket || void 0,
+        key: metadata.key || metadata.filename || void 0,
+        completed: false
+      };
+      this.uploads.set(id, upload);
+      const reqUrl = new URL(c.req.url);
+      const location = `${reqUrl.origin}${reqUrl.pathname}/${id}`;
+      return new Response(null, {
+        status: 201,
+        headers: {
+          Location: location,
+          "Tus-Resumable": "1.0.0",
+          "Upload-Offset": "0"
+        }
+      });
+    }
+    /** `HEAD /tus/:id` — Query upload progress. */
+    head(c, id) {
+      const upload = this.uploads.get(id);
+      if (!upload) {
+        return c.json({
+          error: "Upload not found"
+        }, 404);
+      }
+      return new Response(null, {
+        status: 200,
+        headers: {
+          "Tus-Resumable": "1.0.0",
+          "Upload-Offset": String(upload.offset),
+          "Upload-Length": String(upload.size),
+          "Cache-Control": "no-store"
+        }
+      });
+    }
+    /** `PATCH /tus/:id` — Append data to an upload. */
+    async patch(c, id) {
+      const upload = this.uploads.get(id);
+      if (!upload) {
+        return c.json({
+          error: "Upload not found"
+        }, 404);
+      }
+      if (upload.completed) {
+        return c.json({
+          error: "Upload already completed"
+        }, 400);
+      }
+      const offsetHeader = c.req.header("Upload-Offset");
+      if (!offsetHeader) {
+        return c.json({
+          error: "Upload-Offset header is required"
+        }, 400);
+      }
+      const offset = parseInt(offsetHeader, 10);
+      if (offset !== upload.offset) {
+        return c.json({
+          error: "Offset mismatch"
+        }, 409);
+      }
+      const contentType = c.req.header("Content-Type");
+      if (contentType !== "application/offset+octet-stream") {
+        return c.json({
+          error: "Content-Type must be application/offset+octet-stream"
+        }, 415);
+      }
+      const body = await c.req.arrayBuffer();
+      const chunk = Buffer.from(body);
+      if (upload.offset + chunk.length > upload.size) {
+        return c.json({
+          error: "Chunk exceeds declared Upload-Length"
+        }, 413);
+      }
+      const fh = await promises.open(upload.filePath, "a");
+      try {
+        await fh.write(chunk);
+      } finally {
+        await fh.close();
+      }
+      upload.offset += chunk.length;
+      if (upload.offset >= upload.size) {
+        await this.finalize(upload);
+      }
+      return new Response(null, {
+        status: 204,
+        headers: {
+          "Tus-Resumable": "1.0.0",
+          "Upload-Offset": String(upload.offset)
+        }
+      });
+    }
+    /** `DELETE /tus/:id` — Cancel and remove an upload. */
+    async delete(c, id) {
+      const upload = this.uploads.get(id);
+      if (!upload) {
+        return c.json({
+          error: "Upload not found"
+        }, 404);
+      }
+      try {
+        await promises.unlink(upload.filePath);
+      } catch {
+      }
+      this.uploads.delete(id);
+      return new Response(null, {
+        status: 204,
+        headers: {
+          "Tus-Resumable": "1.0.0"
+        }
+      });
+    }
+    // -----------------------------------------------------------------------
+    // Finalization
+    // -----------------------------------------------------------------------
+    /**
+     * Move a completed upload into the storage controller.
+     */
+    async finalize(upload) {
+      upload.completed = true;
+      if (!this.storageController) {
+        logger.warn("[TUS] Upload completed but no StorageController configured. Temp file remains:", {
+          filePath: upload.filePath
+        });
+        return;
+      }
+      try {
+        const {
+          readFile: readFile2
+        } = await import("fs/promises");
+        const data = await readFile2(upload.filePath);
+        const fileName = upload.key || upload.metadata.filename || upload.id;
+        const mimeType = upload.metadata.contentType || upload.metadata.filetype || "application/octet-stream";
+        const file = new File([data], fileName, {
+          type: mimeType
+        });
+        await this.storageController.putObject({
+          file,
+          key: fileName,
+          bucket: upload.bucket
+        });
+        try {
+          await promises.unlink(upload.filePath);
+        } catch {
+        }
+        this.uploads.delete(upload.id);
+        logger.info(`[TUS] Upload ${upload.id} finalized → ${fileName}`);
+      } catch (err) {
+        logger.error(`[TUS] Failed to finalize upload ${upload.id}`, {
+          error: err
+        });
+      }
+    }
+  }
+  const transformCache = new TransformCache();
   function extractWildcardPath(c) {
     const routePath = c.req.routePath;
     const prefix = routePath.replace("/*", "");
@@ -23972,6 +25953,7 @@ ${credentialScope}
         throw ApiError.notFound("File not found");
       }
       const filePath = decodeURIComponent(rawPath);
+      const transformOpts = parseTransformOptions(c.req.query());
       if (controller.getType() === "local") {
         const localController = controller;
         const {
@@ -23991,8 +25973,19 @@ ${credentialScope}
           } catch {
           }
         }
-        c.header("Content-Type", contentType);
         const fileContent = fs__namespace.readFileSync(absolutePath);
+        if (transformOpts && isTransformableImage(contentType)) {
+          const cacheKey = transformCache.buildKey(filePath, transformOpts);
+          let cached = transformCache.get(cacheKey);
+          if (!cached) {
+            cached = await transformImage(Buffer.from(fileContent), transformOpts);
+            transformCache.set(cacheKey, cached.data, cached.contentType);
+          }
+          c.header("Content-Type", cached.contentType);
+          c.header("Cache-Control", "public, max-age=31536000, immutable");
+          return c.body(new Uint8Array(cached.data));
+        }
+        c.header("Content-Type", contentType);
         return c.body(new Uint8Array(fileContent));
       }
       const {
@@ -24003,7 +25996,20 @@ ${credentialScope}
       if (!fileObject) {
         throw ApiError.notFound("File not found");
       }
-      c.header("Content-Type", fileObject.type || "application/octet-stream");
+      const remoteContentType = fileObject.type || "application/octet-stream";
+      if (transformOpts && isTransformableImage(remoteContentType)) {
+        const cacheKey = transformCache.buildKey(filePath, transformOpts);
+        let cached = transformCache.get(cacheKey);
+        if (!cached) {
+          const buf2 = Buffer.from(await fileObject.arrayBuffer());
+          cached = await transformImage(buf2, transformOpts);
+          transformCache.set(cacheKey, cached.data, cached.contentType);
+        }
+        c.header("Content-Type", cached.contentType);
+        c.header("Cache-Control", "public, max-age=31536000, immutable");
+        return c.body(new Uint8Array(cached.data));
+      }
+      c.header("Content-Type", remoteContentType);
       c.header("Cache-Control", "public, max-age=3600, immutable");
       const buf = await fileObject.arrayBuffer();
       return c.body(new Uint8Array(buf));
@@ -24099,6 +26105,14 @@ ${credentialScope}
         message: "Folder created"
       }, 201);
     });
+    const tusBaseDir = controller.getType() === "local" ? controller.getBasePath() : process.env.STORAGE_PATH || "./uploads";
+    const tusHandler = new TusHandler(tusBaseDir, controller);
+    tusHandler.startCleanup();
+    router.options("/tus", (_c2) => tusHandler.options());
+    router.post("/tus", writeAuthMiddleware, async (c) => tusHandler.create(c));
+    router.get("/tus/:id", readAuthMiddleware, (c) => tusHandler.head(c, c.req.param("id")));
+    router.patch("/tus/:id", writeAuthMiddleware, async (c) => tusHandler.patch(c, c.req.param("id")));
+    router.delete("/tus/:id", writeAuthMiddleware, async (c) => tusHandler.delete(c, c.req.param("id")));
     return router;
   }
   const DEFAULT_STORAGE_ID = "(default)";
@@ -24322,6 +26336,13 @@ ${credentialScope}
         } catch (e) {
         }
       }
+      const getErrorField = (obj, field) => {
+        const err = obj?.error;
+        if (err && typeof err === "object" && err !== null && field in err) {
+          return err[field];
+        }
+        return obj?.[field];
+      };
       if (res.status === 401 && onUnauthorizedHandler) {
         const retried = await onUnauthorizedHandler();
         if (retried) {
@@ -24355,7 +26376,7 @@ ${credentialScope}
               const method = init?.method || "GET";
               fallbackMessage = `Endpoint not found (${method} ${path2}). This usually means the collection is not registered on the backend, or the frontend API URL configuration (e.g. VITE_API_URL) is missing or pointing to the wrong host.`;
             }
-            throw new RebaseApiError(retryRes.status, retryBody?.error?.message || retryBody?.message || fallbackMessage || `Request failed with status ${retryRes.status}`, retryBody?.error?.code || retryBody?.code, retryBody?.error?.details || retryBody?.details);
+            throw new RebaseApiError(retryRes.status, String(getErrorField(retryBody, "message") || fallbackMessage || `Request failed with status ${retryRes.status}`), getErrorField(retryBody, "code"), getErrorField(retryBody, "details"));
           }
           return retryBody;
         }
@@ -24366,7 +26387,7 @@ ${credentialScope}
           const method = init?.method || "GET";
           fallbackMessage = `Endpoint not found (${method} ${path2}). This usually means the collection is not registered on the backend, or the frontend API URL configuration (e.g. VITE_API_URL) is missing or pointing to the wrong host.`;
         }
-        throw new RebaseApiError(res.status, body?.error?.message || body?.message || fallbackMessage || `Request failed with status ${res.status}`, body?.error?.code || body?.code, body?.error?.details || body?.details);
+        throw new RebaseApiError(res.status, String(getErrorField(body, "message") || fallbackMessage || `Request failed with status ${res.status}`), getErrorField(body, "code"), getErrorField(body, "details"));
       }
       return body;
     }
@@ -25028,118 +27049,6 @@ ${credentialScope}
       toggleJob
     };
   }
-  function mapOperator(op) {
-    switch (op) {
-      case "==":
-        return "eq";
-      case "!=":
-        return "neq";
-      case ">":
-        return "gt";
-      case ">=":
-        return "gte";
-      case "<":
-        return "lt";
-      case "<=":
-        return "lte";
-      case "array-contains":
-        return "cs";
-      case "array-contains-any":
-        return "csa";
-      case "not-in":
-        return "nin";
-      default:
-        return op;
-    }
-  }
-  class QueryBuilder {
-    constructor(collection) {
-      this.collection = collection;
-    }
-    params = {
-      where: {}
-    };
-    /**
-     * Add a filter condition to your query.
-     * @example
-     * client.collection('users').where('age', '>=', 18).find()
-     */
-    where(column, operator, value) {
-      if (!this.params.where) {
-        this.params.where = {};
-      }
-      const mappedOp = mapOperator(operator);
-      let formattedValue = value;
-      if (Array.isArray(value) && ["in", "nin", "cs", "csa"].includes(mappedOp)) {
-        formattedValue = `(${value.join(",")})`;
-      } else if (value === null) {
-        formattedValue = "null";
-      }
-      this.params.where[column] = mappedOp === "eq" ? String(formattedValue) : `${mappedOp}.${formattedValue}`;
-      return this;
-    }
-    /**
-     * Order the results by a specific column.
-     * @example
-     * client.collection('users').orderBy('createdAt', 'desc').find()
-     */
-    orderBy(column, ascending = "asc") {
-      this.params.orderBy = `${column}:${ascending}`;
-      return this;
-    }
-    /**
-     * Limit the number of results returned.
-     */
-    limit(count) {
-      this.params.limit = count;
-      return this;
-    }
-    /**
-     * Skip the first N results.
-     */
-    offset(count) {
-      this.params.offset = count;
-      return this;
-    }
-    /**
-     * Set a free-text search string if supported by the backend.
-     */
-    search(searchString) {
-      this.params.searchString = searchString;
-      return this;
-    }
-    /**
-     * Include related entities in the response.
-     * Relations will be populated with full entity data instead of just IDs.
-     *
-     * @param relations - Relation names to include, or "*" for all.
-     * @example
-     * // Include specific relations
-     * client.data.posts.include("tags", "author").find()
-     *
-     * // Include all relations
-     * client.data.posts.include("*").find()
-     */
-    include(...relations) {
-      this.params.include = relations;
-      return this;
-    }
-    /**
-     * Execute the find query and return the results.
-     */
-    async find() {
-      return this.collection.find(this.params);
-    }
-    /**
-     * Listen to realtime updates matching this query.
-     */
-    listen(onUpdate, onError) {
-      if (!this.collection.listen) {
-        throw new Error("Listen is only available when RebaseClient is configured with a websocketUrl.");
-      }
-      return this.collection.listen(this.params, onUpdate, onError);
-    }
-  }
   function rowToEntity(row, slug) {
     return {
       id: row.id,
@@ -25734,7 +27643,7 @@ ${credentialScope}
   const http = require$$0$6;
   const https = require$$1;
   const urllib$2 = require$$0$2;
-  const zlib = require$$11;
+  const zlib = require$$3;
   const PassThrough$3 = require$$0$4.PassThrough;
   const Cookies = cookies;
   const packageData$7 = require$$9;
@@ -25969,9 +27878,9 @@ ${credentialScope}
     const util2 = require$$5;
     const fs2 = fs$4;
     const nmfetch2 = fetchExports;
-    const dns2 = require$$11;
+    const dns2 = require$$4$1;
     const net2 = require$$0$7;
-    const os2 = require$$1$2;
+    const os2 = require$$1$3;
     const DNS_TTL = 5 * 60 * 1e3;
     let networkInterfaces;
     try {
@@ -32117,7 +34026,7 @@ ${credentialScope}
   const packageData$6 = require$$9;
   const MailMessage = mailMessage;
   const net$1 = require$$0$7;
-  const dns = require$$11;
+  const dns = require$$4$1;
   const crypto$3 = require$$0$5;
   class Mail extends EventEmitter$5 {
     constructor(transporter, options2, defaults) {
@@ -32553,7 +34462,7 @@ ${credentialScope}
   const EventEmitter$4 = require$$0$9.EventEmitter;
   const net = require$$0$7;
   const tls = require$$1$1;
-  const os = require$$1$2;
+  const os = require$$1$3;
   const crypto$2 = require$$0$5;
   const DataStream = dataStream;
   const PassThrough = require$$0$4.PassThrough;
@@ -36741,7 +38650,7 @@ ${credentialScope}
               oauthProviders,
               serviceKey,
               hooks: config.hooks,
-              overrides: safeAuthConfig.overrides
+              authHooks: safeAuthConfig.hooks
             });
           }
           logger.info("Authentication initialized");
@@ -36886,7 +38795,7 @@ ${credentialScope}
           oauthProviders,
           serviceKey,
           hooks: config.hooks,
-          overrides: safeAuthConfig.overrides
+          authHooks: safeAuthConfig.hooks
         });
       }
       if (authAdapter.createAuthRoutes) {
@@ -36908,6 +38817,21 @@ ${credentialScope}
         }
       }
     }
+    let apiKeyStore;
+    const apiKeyStoreResult = createApiKeyStore(defaultDriver);
+    if (apiKeyStoreResult) {
+      apiKeyStore = apiKeyStoreResult;
+      await apiKeyStore.ensureTable();
+      logger.info("Service API Keys initialized");
+      const apiKeyRoutes = createApiKeyRoutes({
+        store: apiKeyStore,
+        serviceKey
+      });
+      config.app.route(`${basePath}/admin/api-keys`, apiKeyRoutes);
+      logger.info("API key admin routes mounted", {
+        path: `${basePath}/admin/api-keys`
+      });
+    }
     if (config.collectionsDir) {
       if (process.env.NODE_ENV !== "production") {
         const {
@@ -36958,15 +38882,20 @@ ${credentialScope}
         dataRouter.use("/*", createAdapterAuthMiddleware({
           adapter: authAdapter,
           driver: defaultDriver,
-          requireAuth: dataRequireAuth
+          requireAuth: dataRequireAuth,
+          apiKeyStore
         }));
       } else {
         dataRouter.use("/*", createAuthMiddleware({
           driver: defaultDriver,
           requireAuth: dataRequireAuth,
-          serviceKey
+          serviceKey,
+          apiKeyStore
         }));
       }
+      if (apiKeyStore) {
+        dataRouter.use("/*", createApiKeyRateLimiter());
+      }
       if (historyConfigResult && historyConfigResult.historyService) {
         const historyRoutes = createHistoryRoutes({
           historyService: historyConfigResult.historyService,
@@ -37060,13 +38989,15 @@ ${credentialScope}
           functionsRouter.use("/*", createAdapterAuthMiddleware({
             adapter: authAdapter,
             driver: defaultDriver,
-            requireAuth: functionsRequireAuth
+            requireAuth: functionsRequireAuth,
+            apiKeyStore
           }));
         } else {
           functionsRouter.use("/*", createAuthMiddleware({
             driver: defaultDriver,
             requireAuth: functionsRequireAuth,
-            serviceKey
+            serviceKey,
+            apiKeyStore
           }));
         }
         const fnRoutes = createFunctionRoutes2(loadedFunctions);
@@ -47065,7 +48996,7 @@ spurious results.`);
         return "undefined";
       }
       if (typeof obj === "string") {
-        return `"${obj.replace(/"/g, '\\"')}"`;
+        return JSON.stringify(obj);
       }
       if (typeof obj === "number" || typeof obj === "boolean") {
         return String(obj);
@@ -47096,7 +49027,7 @@ ${indent2}]`;
                   const kind = init.getKind();
                   const isCode = kind === tsMorph.SyntaxKind.ArrowFunction || kind === tsMorph.SyntaxKind.FunctionExpression || kind === tsMorph.SyntaxKind.Identifier || kind === tsMorph.SyntaxKind.CallExpression || kind === tsMorph.SyntaxKind.JsxElement;
                   if (isCode || name2 === "target" || name2 === "callbacks" || name2 === "permissions" || name2 === "securityRules") {
-                    const keyStr = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name2) ? name2 : `"${name2}"`;
+                    const keyStr = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name2) ? name2 : JSON.stringify(name2);
                     preservedProps.push(`${keyStr}: ${init.getText()}`);
                   }
                 }
@@ -47106,7 +49037,7 @@ ${indent2}]`;
         }
         if (keys2.length === 0 && preservedProps.length === 0) return "{}";
         const props = keys2.map((key) => {
-          const keyStr = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : `"${key}"`;
+          const keyStr = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : JSON.stringify(key);
           let childAstNode;
           if (oldAstNode && typeof record[key] === "object" && record[key] !== null && !Array.isArray(record[key])) {
             const oldProp = oldAstNode.getProperty((p) => "getName" in p && typeof p.getName === "function" && (p.getName() === key || p.getName() === `"${key}"` || p.getName() === `'${key}'`));
@@ -47148,7 +49079,7 @@ ${indent2}}`;
           }
         } else {
           propsObj.addPropertyAssignment({
-            name: /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(propertyKey) ? propertyKey : `"${propertyKey}"`,
+            name: /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(propertyKey) ? propertyKey : JSON.stringify(propertyKey),
             initializer: newInitializer
           });
         }
@@ -48219,7 +50150,7 @@ export default ${safeId}Collection;
           const mod = await dynamicImport(fileUrl);
           const exported = mod.default;
           if (!exported) {
-            console.warn(`[functions] ${file}: no default export. Skipping.`);
+            logger.warn(`[functions] ${file}: no default export. Skipping.`);
             continue;
           }
           if (isHonoLike(exported)) {
@@ -48228,7 +50159,7 @@ export default ${safeId}Collection;
               name: name2,
               app: exported
             });
-            console.log(`⚡ Loaded function route: ${name2}`);
+            logger.info(`⚡ Loaded function route: ${name2}`);
             continue;
           }
           if (typeof exported === "function") {
@@ -48239,20 +50170,20 @@ export default ${safeId}Collection;
                 name: name2,
                 app: result
               });
-              console.log(`⚡ Loaded function route: ${name2}`);
+              logger.info(`⚡ Loaded function route: ${name2}`);
               continue;
             }
           }
           const exportType = typeof exported;
           const keys2 = exported && typeof exported === "object" ? Object.getOwnPropertyNames(Object.getPrototypeOf(exported)).slice(0, 10).join(", ") : "N/A";
-          console.warn(`[functions] ${file}: default export is not a Hono app or factory. Skipping.
+          logger.warn(`[functions] ${file}: default export is not a Hono app or factory. Skipping.
   export type: ${exportType}${exported?.constructor?.name ? ` (${exported.constructor.name})` : ""}
   prototype methods: ${keys2}
   Hint: ensure the function exports a Hono app created with the same hono version as the server.
   The loader checks for .fetch() and .routes — any Hono-compatible app will work.`);
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          console.error(`[functions] Failed to load ${file}: ${message}`);
+          logger.error(`[functions] Failed to load ${file}: ${message}`);
         }
       }
     }
@@ -48301,12 +50232,12 @@ export default ${safeId}Collection;
           const mod = await dynamicImport(fileUrl);
           const exported = mod.default;
           if (!exported || typeof exported !== "object") {
-            console.warn(`[cron] ${file}: no valid default export. Skipping.`);
+            logger.warn(`[cron] ${file}: no valid default export. Skipping.`);
             continue;
           }
           const def = exported;
           if (typeof def.schedule !== "string" || typeof def.handler !== "function") {
-            console.warn(`[cron] ${file}: default export missing required 'schedule' or 'handler'. Skipping.`);
+            logger.warn(`[cron] ${file}: default export missing required 'schedule' or 'handler'. Skipping.`);
             continue;
           }
           const id = path__namespace.basename(file, path__namespace.extname(file));
@@ -48322,10 +50253,10 @@ export default ${safeId}Collection;
             id,
             definition
           });
-          console.log(`⏰ Loaded cron job: ${id} (${definition.schedule})`);
+          logger.info(`⏰ Loaded cron job: ${id} (${definition.schedule})`);
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          console.error(`[cron] Failed to load ${file}: ${message}`);
+          logger.error(`[cron] Failed to load ${file}: ${message}`);
         }
       }
     }
@@ -48480,12 +50411,12 @@ export default ${safeId}Collection;
       for (const loaded of loadedJobs) {
         const validation = validateCronExpression(loaded.definition.schedule);
         if (!validation.valid) {
-          console.error(`[cron] Rejecting job "${loaded.id}": invalid schedule "${loaded.definition.schedule}" — ${validation.reason}`);
+          logger.error(`[cron] Rejecting job "${loaded.id}": invalid schedule "${loaded.definition.schedule}" — ${validation.reason}`);
           continue;
         }
         const existing = this.jobs.get(loaded.id);
         if (existing) {
-          console.warn(`[cron] Duplicate cron job id: "${loaded.id}". Overwriting.`);
+          logger.warn(`[cron] Duplicate cron job id: "${loaded.id}". Overwriting.`);
           this.stopJob(loaded.id);
         }
         const enabled = loaded.definition.enabled !== false;
@@ -48523,7 +50454,9 @@ export default ${safeId}Collection;
             }
           }
         }).catch((err) => {
-          console.warn("[cron] Failed to seed job stats from database:", err);
+          logger.warn("[cron] Failed to seed job stats from database", {
+            error: err
+          });
         });
       }
       for (const [id, job] of this.jobs) {
@@ -48531,7 +50464,7 @@ export default ${safeId}Collection;
           this.scheduleNext(id);
         }
       }
-      console.log(`⏰ Cron scheduler started with ${this.jobs.size} job(s)`);
+      logger.info(`⏰ Cron scheduler started with ${this.jobs.size} job(s)`);
     }
     /**
      * Stop the scheduler and clear all timers.
@@ -48605,7 +50538,7 @@ export default ${safeId}Collection;
       const job = this.jobs.get(id);
       if (!job) return void 0;
       if (job.executing) {
-        console.warn(`[cron] Skipping manual trigger of "${id}" — already executing`);
+        logger.warn(`[cron] Skipping manual trigger of "${id}" — already executing`);
         const logEntry = {
           jobId: id,
           startedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -48649,7 +50582,7 @@ export default ${safeId}Collection;
         const timer = setTimeout(async () => {
           if (!job.enabled || !this.started) return;
           if (job.executing) {
-            console.warn(`[cron] Skipping scheduled run of "${id}" — still executing from previous run`);
+            logger.warn(`[cron] Skipping scheduled run of "${id}" — still executing from previous run`);
             this.scheduleNext(id);
             return;
           }
@@ -48663,7 +50596,9 @@ export default ${safeId}Collection;
         }
         job.timerId = timer;
       } catch (err) {
-        console.error(`[cron] Failed to schedule "${id}":`, err);
+        logger.error(`[cron] Failed to schedule "${id}"`, {
+          error: err
+        });
         job.state = "error";
         job.lastError = err instanceof Error ? err.message : String(err);
       }
@@ -48748,13 +50683,15 @@ export default ${safeId}Collection;
       }
       if (this.store) {
         this.store.insertLog(logEntry).catch((persistErr) => {
-          console.error(`[cron] Failed to persist log for "${job.id}":`, persistErr);
+          logger.error(`[cron] Failed to persist log for "${job.id}"`, {
+            error: persistErr
+          });
         });
       }
       if (success) {
-        console.log(`✅ [cron] "${job.id}" completed in ${durationMs}ms`);
+        logger.info(`✅ [cron] "${job.id}" completed in ${durationMs}ms`);
       } else {
-        console.error(`❌ [cron] "${job.id}" failed in ${durationMs}ms: ${error2}`);
+        logger.error(`❌ [cron] "${job.id}" failed in ${durationMs}ms: ${error2}`);
       }
       return logEntry;
     }
@@ -48872,7 +50809,7 @@ export default ${safeId}Collection;
   function createCronStore(driver) {
     const admin = driver.admin;
     if (!isSQLAdmin(admin)) {
-      console.warn("⚠️ [cron-store] DataDriver does not support SQL admin — cron logs will not be persisted.");
+      logger.warn("⚠️ [cron-store] DataDriver does not support SQL admin — cron logs will not be persisted.");
       return void 0;
     }
     const exec = admin.executeSql.bind(admin);
@@ -48898,10 +50835,12 @@ export default ${safeId}Collection;
                     CREATE INDEX IF NOT EXISTS idx_cron_logs_job
                     ON ${TABLE}(job_id, started_at DESC)
                 `);
-          console.log("✅ Cron logs table ready");
+          logger.info("✅ Cron logs table ready");
         } catch (err) {
-          console.error("❌ Failed to create cron logs table:", err);
-          console.warn("⚠️ Continuing without cron log persistence.");
+          logger.error("❌ Failed to create cron logs table", {
+            error: err
+          });
+          logger.warn("⚠️ Continuing without cron log persistence.");
         }
       },
       async insertLog(entry) {
@@ -48924,7 +50863,9 @@ export default ${safeId}Collection;
                     )
                 `);
         } catch (err) {
-          console.error(`[cron-store] Failed to persist log for "${entry.jobId}":`, err);
+          logger.error(`[cron-store] Failed to persist log for "${entry.jobId}"`, {
+            error: err
+          });
         }
       },
       async fetchLogs(jobId, limit = 50) {
@@ -48938,7 +50879,9 @@ export default ${safeId}Collection;
                 `);
           return rows.map(rowToLogEntry);
         } catch (err) {
-          console.error(`[cron-store] Failed to fetch logs for "${jobId}":`, err);
+          logger.error(`[cron-store] Failed to fetch logs for "${jobId}"`, {
+            error: err
+          });
           return [];
         }
       },
@@ -48962,7 +50905,9 @@ export default ${safeId}Collection;
             });
           }
         } catch (err) {
-          console.error("[cron-store] Failed to fetch job stats:", err);
+          logger.error("[cron-store] Failed to fetch job stats", {
+            error: err
+          });
         }
         return stats;
       }
@@ -48993,8 +50938,8 @@ export default ${safeId}Collection;
       indexFile = "index.html"
     } = config;
     if (!fs__namespace.existsSync(frontendPath)) {
-      console.warn(`⚠️ Frontend build path does not exist: ${frontendPath}`);
-      console.warn("   SPA serving is disabled. Build your frontend first.");
+      logger.warn(`⚠️ Frontend build path does not exist: ${frontendPath}`);
+      logger.warn("   SPA serving is disabled. Build your frontend first.");
       return;
     }
     app.use("/*", serveStatic.serveStatic({
@@ -49007,13 +50952,13 @@ export default ${safeId}Collection;
       }
       const indexPath = path__namespace.join(frontendPath, indexFile);
       if (!fs__namespace.existsSync(indexPath)) {
-        console.warn(`⚠️ Index file not found: ${indexPath}`);
+        logger.warn(`⚠️ Index file not found: ${indexPath}`);
         return next();
       }
       const html = fs__namespace.readFileSync(indexPath, "utf-8");
       return c.html(html);
     });
-    console.log(`✅ SPA serving enabled from: ${frontendPath}`);
+    logger.info(`✅ SPA serving enabled from: ${frontendPath}`);
   }
   const MAX_PORT_ATTEMPTS = 20;
   const DEV_PORT_FILENAME = ".rebase-dev-port";
@@ -49021,6 +50966,19 @@ export default ${safeId}Collection;
     const host = options2?.host ?? "0.0.0.0";
     const maxAttempts = options2?.maxAttempts ?? MAX_PORT_ATTEMPTS;
     const portFileDir = options2?.portFileDir;
+    const isProd = process.env.NODE_ENV === "production";
+    if (isProd) {
+      return new Promise((resolve, reject) => {
+        const onError = (err) => {
+          reject(err);
+        };
+        server.once("error", onError);
+        server.listen(startPort, host, () => {
+          server.removeListener("error", onError);
+          resolve(startPort);
+        });
+      });
+    }
     let affinityPort = null;
     if (portFileDir) {
       try {
@@ -49163,6 +51121,8 @@ export default ${safeId}Collection;
     DB_POOL_MAX: stringType().default("20").transform(Number),
     DB_POOL_IDLE_TIMEOUT: stringType().default("30000").transform(Number),
     DB_POOL_CONNECT_TIMEOUT: stringType().default("10000").transform(Number),
+    DATABASE_DIRECT_URL: stringType().url().optional(),
+    DATABASE_READ_URL: stringType().url().optional(),
     FORCE_LOCAL_STORAGE: optionalBoolString,
     STORAGE_TYPE: enumType(["local", "s3"]).default("local"),
     STORAGE_PATH: stringType().optional(),
@@ -49238,8 +51198,11 @@ export default ${safeId}Collection;
   exports2.RestApiGenerator = RestApiGenerator;
   exports2.S3StorageController = S3StorageController;
   exports2.SMTPEmailService = SMTPEmailService;
+  exports2.TransformCache = TransformCache;
+  exports2.TusHandler = TusHandler;
   exports2._resetRebaseMock = _resetRebaseMock;
   exports2._setRebaseMock = _setRebaseMock;
+  exports2.apiKeyKeyGenerator = apiKeyKeyGenerator;
   exports2.authJwt = authJwt;
   exports2.authRoles = authRoles;
   exports2.authUid = authUid;
@@ -49248,6 +51211,9 @@ export default ${safeId}Collection;
   exports2.configureLogLevel = configureLogLevel;
   exports2.createAdapterAuthMiddleware = createAdapterAuthMiddleware;
   exports2.createAdminRoutes = createAdminRoutes;
+  exports2.createApiKeyRateLimiter = createApiKeyRateLimiter;
+  exports2.createApiKeyRoutes = createApiKeyRoutes;
+  exports2.createApiKeyStore = createApiKeyStore;
   exports2.createAppleProvider = createAppleProvider;
   exports2.createAuthMiddleware = createAuthMiddleware;
   exports2.createAuthRoutes = createAuthRoutes;
@@ -49285,27 +51251,35 @@ export default ${safeId}Collection;
   exports2.getWelcomeEmailTemplate = getWelcomeEmailTemplate;
   exports2.hashPassword = hashPassword;
   exports2.hashRefreshToken = hashRefreshToken;
+  exports2.httpMethodToOperation = httpMethodToOperation;
   exports2.initializeRebaseBackend = initializeRebaseBackend;
+  exports2.isApiKeyToken = isApiKeyToken;
   exports2.isAuthAdapter = isAuthAdapter;
   exports2.isDatabaseAdapter = isDatabaseAdapter;
+  exports2.isOperationAllowed = isOperationAllowed;
+  exports2.isTransformableImage = isTransformableImage;
   exports2.listenWithPortRetry = listenWithPortRetry;
   exports2.loadCronJobsFromDirectory = loadCronJobsFromDirectory;
   exports2.loadEnv = loadEnv;
   exports2.loadFunctionsFromDirectory = loadFunctionsFromDirectory;
   exports2.logger = logger;
   exports2.optionalAuth = optionalAuth;
+  exports2.parseTransformOptions = parseTransformOptions;
   exports2.rebase = rebase;
   exports2.requestLogger = requestLogger;
   exports2.requireAdmin = requireAdmin;
   exports2.requireAuth = requireAuth;
   exports2.resetConsole = resetConsole;
-  exports2.resolveAuthOverrides = resolveAuthOverrides;
+  exports2.resolveAuthHooks = resolveAuthHooks;
   exports2.serveSPA = serveSPA;
   exports2.strictAuthLimiter = strictAuthLimiter;
+  exports2.transformImage = transformImage;
+  exports2.validateApiKey = validateApiKey;
   exports2.validateCronExpression = validateCronExpression;
   exports2.validatePasswordStrength = validatePasswordStrength;
   exports2.verifyAccessToken = verifyAccessToken;
   exports2.verifyPassword = verifyPassword;
+  exports2.z = z;
   Object.defineProperty(exports2, Symbol.toStringTag, { value: "Module" });
 });
 //# sourceMappingURL=index.umd.js.map