@rebasepro/server-core 0.2.3 → 0.2.5

package/dist/index.es.js

@@ -1,29 +1,33 @@
 import * as fs$4 from "fs";
-import fs__default from "fs";
+import fs__default, { existsSync } from "fs";
 import * as path$3 from "path";
-import path__default from "path";
+import path__default, { join as join$1 } from "path";
 import require$$0$5, { pathToFileURL } from "url";
 import { Hono } from "hono";
 import require$$0$3 from "buffer";
 import require$$0$4 from "stream";
 import require$$5, { promisify } from "util";
 import * as require$$0$2 from "crypto";
-import require$$0__default, { randomBytes, createHash, timingSafeEqual as timingSafeEqual$1, scrypt } from "crypto";
+import require$$0__default, { randomBytes, createHash, timingSafeEqual as timingSafeEqual$1, scrypt, createHmac, randomUUID as randomUUID$1 } from "crypto";
 import { bodyLimit } from "hono/body-limit";
 import { csrf } from "hono/csrf";
 import require$$0$a from "child_process";
 import require$$1 from "https";
+import require$$1$2 from "querystring";
 import require$$0$7 from "net";
 import require$$1$1 from "tls";
 import require$$2 from "assert";
 import require$$0$6 from "http";
-import require$$1$2 from "os";
+import require$$1$3 from "os";
 import require$$0$8 from "node:events";
-import require$$1$3 from "node:process";
+import require$$1$4 from "node:process";
 import require$$2$1 from "node:util";
 import require$$0$9 from "events";
 import { S3Client, PutObjectCommand, HeadObjectCommand, GetObjectCommand, DeleteObjectCommand, ListObjectsV2Command } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { mkdir as mkdir$1, unlink as unlink$1, writeFile as writeFile$1, open } from "fs/promises";
+import require$$3 from "zlib";
+import require$$4$1 from "dns";
 import { cors } from "hono/cors";
 import { secureHeaders } from "hono/secure-headers";
 import { serve } from "@hono/node-server";
@@ -211,30 +215,6 @@ var commonjsGlobal = typeof globalThis !== "undefined" ? globalThis : typeof win
 function getDefaultExportFromCjs(x) {
   return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, "default") ? x["default"] : x;
 }
-function getAugmentedNamespace(n) {
-  if (n.__esModule) return n;
-  var f2 = n.default;
-  if (typeof f2 == "function") {
-    var a2 = function a3() {
-      if (this instanceof a3) {
-        return Reflect.construct(f2, arguments, this.constructor);
-      }
-      return f2.apply(this, arguments);
-    };
-    a2.prototype = f2.prototype;
-  } else a2 = {};
-  Object.defineProperty(a2, "__esModule", { value: true });
-  Object.keys(n).forEach(function(k) {
-    var d2 = Object.getOwnPropertyDescriptor(n, k);
-    Object.defineProperty(a2, k, d2.get ? d2 : {
-      enumerable: true,
-      get: function() {
-        return n[k];
-      }
-    });
-  });
-  return a2;
-}
 function commonjsRequire(path2) {
   throw new Error('Could not dynamically require "' + path2 + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriately for this require call to work.');
 }
@@ -1066,6 +1046,9 @@ function mergeDeep(target, source, ignoreUndefined = false) {
     return output;
   }
   for (const key in source) {
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      continue;
+    }
     if (Object.prototype.hasOwnProperty.call(source, key)) {
       const sourceValue = source[key];
       const outputValue = output[key];
@@ -1254,8 +1237,8 @@ function sanitizeRelation(relation, sourceCollection, resolveCollection) {
         } catch (e) {
         }
         if (!foundForeignKey) {
-          const keyPrefix = newRelation.inverseRelationName ? toSnakeCase(newRelation.inverseRelationName) : sourceName;
-          newRelation.foreignKeyOnTarget = generateForeignKeyName(keyPrefix);
+          const keyPrefix2 = newRelation.inverseRelationName ? toSnakeCase(newRelation.inverseRelationName) : sourceName;
+          newRelation.foreignKeyOnTarget = generateForeignKeyName(keyPrefix2);
         }
       }
     } else if (newRelation.cardinality === "many" && newRelation.direction === "inverse") {
@@ -2564,6 +2547,142 @@ class CollectionRegistry {
     };
   }
 }
+const defaultUsersCollection = {
+  name: "Users",
+  singularName: "User",
+  slug: "users",
+  table: "users",
+  schema: "rebase",
+  icon: "Users",
+  group: "Settings",
+  openEntityMode: "dialog",
+  disableDefaultActions: ["copy"],
+  sort: ["createdAt", "desc"],
+  properties: {
+    id: {
+      name: "ID",
+      type: "string",
+      isId: "uuid",
+      ui: {
+        readOnly: true
+      }
+    },
+    email: {
+      name: "Email",
+      type: "string",
+      validation: {
+        required: true,
+        unique: true
+      }
+    },
+    displayName: {
+      name: "Name",
+      type: "string",
+      columnName: "display_name",
+      validation: {
+        required: true
+      }
+    },
+    photoURL: {
+      name: "Photo URL",
+      type: "string",
+      columnName: "photo_url",
+      url: "image"
+    },
+    roles: {
+      name: "Roles",
+      type: "array",
+      columnType: "text[]",
+      of: {
+        name: "Role",
+        type: "string",
+        enum: {
+          admin: "Admin",
+          editor: "Editor",
+          viewer: "Viewer"
+        }
+      }
+    },
+    passwordHash: {
+      name: "Password Hash",
+      type: "string",
+      columnName: "password_hash",
+      ui: {
+        hideFromCollection: true,
+        disabled: {
+          hidden: true
+        }
+      }
+    },
+    emailVerified: {
+      name: "Email Verified",
+      type: "boolean",
+      columnName: "email_verified",
+      defaultValue: false,
+      ui: {
+        hideFromCollection: true,
+        disabled: {
+          hidden: true
+        }
+      }
+    },
+    emailVerificationToken: {
+      name: "Email Verification Token",
+      type: "string",
+      columnName: "email_verification_token",
+      ui: {
+        hideFromCollection: true,
+        disabled: {
+          hidden: true
+        }
+      }
+    },
+    emailVerificationSentAt: {
+      name: "Email Verification Sent At",
+      type: "date",
+      columnName: "email_verification_sent_at",
+      ui: {
+        hideFromCollection: true,
+        disabled: {
+          hidden: true
+        }
+      }
+    },
+    metadata: {
+      name: "Metadata",
+      type: "map",
+      defaultValue: {},
+      ui: {
+        hideFromCollection: true,
+        disabled: {
+          hidden: true
+        }
+      }
+    },
+    createdAt: {
+      name: "Created At",
+      type: "date",
+      columnName: "created_at",
+      ui: {
+        readOnly: true
+      }
+    },
+    updatedAt: {
+      name: "Updated At",
+      type: "date",
+      columnName: "updated_at",
+      autoValue: "on_update",
+      ui: {
+        hideFromCollection: true,
+        disabled: {
+          hidden: true
+        }
+      }
+    }
+  },
+  listProperties: ["displayName", "email", "roles", "createdAt"],
+  propertiesOrder: ["id", "email", "displayName", "roles", "createdAt"]
+};
 function mapOperator$1(op) {
   switch (op) {
     case "==":
@@ -2855,10 +2974,15 @@ const errorHandler = (err, c) => {
     const issue = error2.code === "42703" ? "column" : "table";
     logMessage = `Database schema mismatch (${issue} missing): ${error2.message}. Did you forget to run migrations ('pnpm db:push' or 'pnpm db:migrate')?`;
   }
-  console.error(`❌ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code2}: ${logMessage}`);
   const causePg = error2.cause && typeof error2.cause === "object" ? error2.cause : void 0;
   const pgErrorCode = causePg?.code || error2.code;
-  const suppressStack = pgErrorCode === "42703" || pgErrorCode === "42P01" || statusCode < 500 && code2 === "BAD_REQUEST";
+  const isDbSchemaMismatch = pgErrorCode === "42703" || pgErrorCode === "42P01";
+  if (isDbSchemaMismatch) {
+    console.warn(`⚠️ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code2}: ${logMessage}`);
+  } else {
+    console.error(`❌ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code2}: ${logMessage}`);
+  }
+  const suppressStack = isDbSchemaMismatch || statusCode < 500 && code2 === "BAD_REQUEST";
   if (!suppressStack) {
     console.error(error2.stack || error2);
   }
@@ -2939,7 +3063,7 @@ function parseQueryOptions(query) {
     options2.offset = (page - 1) * limit;
   }
   options2.where = {};
-  const reservedQueryKeys = ["limit", "offset", "page", "orderBy", "include", "fields", "searchString"];
+  const reservedQueryKeys = ["limit", "offset", "page", "orderBy", "include", "fields", "searchString", "vector_search", "vector", "vector_distance", "vector_threshold"];
   for (const [key, rawValue] of Object.entries(query)) {
     if (reservedQueryKeys.includes(key)) continue;
     const value = Array.isArray(rawValue) ? rawValue[rawValue.length - 1] : rawValue;
@@ -3011,8 +3135,63 @@ function parseQueryOptions(query) {
     const fieldsStr = String(query.fields).trim();
     options2.fields = fieldsStr.split(",").map((s2) => s2.trim()).filter(Boolean);
   }
+  if (query.vector_search && query.vector) {
+    const vectorStr = String(query.vector);
+    let queryVector;
+    try {
+      queryVector = JSON.parse(vectorStr);
+      if (!Array.isArray(queryVector) || !queryVector.every((v) => typeof v === "number")) {
+        throw new Error("Expected array of numbers");
+      }
+    } catch {
+      throw new Error("Invalid vector format. Expected JSON array of numbers, e.g. [0.1,0.2,0.3]");
+    }
+    const distanceParam = query.vector_distance ? String(query.vector_distance) : "cosine";
+    if (distanceParam !== "cosine" && distanceParam !== "l2" && distanceParam !== "inner_product") {
+      throw new Error(`Invalid vector_distance: ${distanceParam}. Expected: cosine, l2, or inner_product`);
+    }
+    const vectorSearch = {
+      property: String(query.vector_search),
+      vector: queryVector,
+      distance: distanceParam
+    };
+    if (query.vector_threshold) {
+      const threshold = parseFloat(String(query.vector_threshold));
+      if (isNaN(threshold)) {
+        throw new Error("Invalid vector_threshold. Expected a number.");
+      }
+      vectorSearch.threshold = threshold;
+    }
+    options2.vectorSearch = vectorSearch;
+  }
   return options2;
 }
+function httpMethodToOperation(method) {
+  const upper = method.toUpperCase();
+  switch (upper) {
+    case "GET":
+    case "HEAD":
+    case "OPTIONS":
+      return "read";
+    case "POST":
+    case "PUT":
+    case "PATCH":
+      return "write";
+    case "DELETE":
+      return "delete";
+    default:
+      return "read";
+  }
+}
+function isOperationAllowed(permissions, collection, operation) {
+  for (const perm of permissions) {
+    const collectionMatch = perm.collection === "*" || perm.collection === collection;
+    if (collectionMatch && perm.operations.includes(operation)) {
+      return true;
+    }
+  }
+  return false;
+}
 class RestApiGenerator {
   collections;
   router;
@@ -3045,6 +3224,19 @@ class RestApiGenerator {
     this.createSubcollectionRoutes();
     return this.router;
   }
+  /**
+   * Check API key permissions for a collection operation.
+   * Throws 403 if the key doesn't have the required permission.
+   * No-ops if the request is not authenticated via an API key.
+   */
+  enforceApiKeyPermission(c, collectionSlug) {
+    const apiKey = c.get("apiKey");
+    if (!apiKey) return;
+    const operation = httpMethodToOperation(c.req.method);
+    if (!isOperationAllowed(apiKey.permissions, collectionSlug, operation)) {
+      throw ApiError.forbidden(`API key does not have "${operation}" permission for collection "${collectionSlug}"`, "API_KEY_FORBIDDEN");
+    }
+  }
   /**
    * Get the typed RestFetchService from a driver if it exposes one (for include support).
    */
@@ -3058,6 +3250,7 @@ class RestApiGenerator {
     const basePath = `/${collection.slug}`;
     const resolvedCollection = collection;
     this.router.get(`${basePath}/count`, async (c) => {
+      this.enforceApiKeyPermission(c, collection.slug);
       const queryDict = c.req.query();
       const queryOptions = parseQueryOptions(queryDict);
       const searchString = queryDict.searchString;
@@ -3068,6 +3261,7 @@ class RestApiGenerator {
       });
     });
     this.router.get(basePath, async (c) => {
+      this.enforceApiKeyPermission(c, collection.slug);
       const queryDict = c.req.query();
       const queryOptions = parseQueryOptions(queryDict);
       const searchString = queryDict.searchString;
@@ -3082,7 +3276,8 @@ class RestApiGenerator {
           offset: queryOptions.offset,
           orderBy: queryOptions.orderBy?.[0]?.field,
           order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
-          searchString
+          searchString,
+          vectorSearch: queryOptions.vectorSearch
         }, queryOptions.include);
         entities2 = await this.applyAfterReadBatch(collection.slug, entities2, hookCtx);
         const total2 = await this.countRawEntities(driver, resolvedCollection, queryOptions, searchString);
@@ -3110,6 +3305,7 @@ class RestApiGenerator {
       });
     });
     this.router.get(`${basePath}/:id`, async (c) => {
+      this.enforceApiKeyPermission(c, collection.slug);
       const id = c.req.param("id");
       const queryDict = c.req.query();
       const queryOptions = parseQueryOptions(queryDict);
@@ -3140,6 +3336,7 @@ class RestApiGenerator {
     });
     this.router.post(basePath, async (c) => {
       try {
+        this.enforceApiKeyPermission(c, collection.slug);
         const driver = c.get("driver") || this.driver;
         const path2 = collection.slug;
         const hookCtx = this.buildHookContext(c, "POST");
@@ -3168,6 +3365,7 @@ class RestApiGenerator {
     });
     this.router.put(`${basePath}/:id`, async (c) => {
       try {
+        this.enforceApiKeyPermission(c, collection.slug);
         const id = c.req.param("id");
         const driver = c.get("driver") || this.driver;
         const hookCtx = this.buildHookContext(c, "PUT");
@@ -3204,6 +3402,7 @@ class RestApiGenerator {
       }
     });
     this.router.delete(`${basePath}/:id`, async (c) => {
+      this.enforceApiKeyPermission(c, collection.slug);
       const id = c.req.param("id");
       const driver = c.get("driver") || this.driver;
       const hookCtx = this.buildHookContext(c, "DELETE");
@@ -3275,6 +3474,7 @@ class RestApiGenerator {
       const parsed = parseSubPath(rawPath);
       if (!parsed) return next();
       const driver = c.get("driver") || this.driver;
+      this.enforceApiKeyPermission(c, c.req.param("parent"));
       if (parsed.entityId === "count") {
         const queryDict = c.req.query();
         const queryOptions = parseQueryOptions(queryDict);
@@ -3322,6 +3522,7 @@ class RestApiGenerator {
       const parsed = parseSubPath(rawPath);
       if (!parsed || parsed.entityId) return next();
       const driver = c.get("driver") || this.driver;
+      this.enforceApiKeyPermission(c, c.req.param("parent"));
       const body = await c.req.json().catch(() => ({}));
       const entity = await driver.saveEntity({
         path: parsed.collectionPath,
@@ -3337,6 +3538,7 @@ class RestApiGenerator {
       const parsed = parseSubPath(rawPath);
       if (!parsed || !parsed.entityId) return next();
       const driver = c.get("driver") || this.driver;
+      this.enforceApiKeyPermission(c, c.req.param("parent"));
       const body = await c.req.json().catch(() => ({}));
       const entity = await driver.saveEntity({
         path: parsed.collectionPath,
@@ -3353,6 +3555,7 @@ class RestApiGenerator {
       const parsed = parseSubPath(rawPath);
       if (!parsed || !parsed.entityId) return next();
       const driver = c.get("driver") || this.driver;
+      this.enforceApiKeyPermission(c, c.req.param("parent"));
       const existingEntity = await driver.fetchEntity({
         path: parsed.collectionPath,
         entityId: parsed.entityId
@@ -3418,7 +3621,8 @@ class RestApiGenerator {
       orderBy: queryOptions.orderBy?.[0]?.field,
       order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
       startAfter: queryOptions.offset ? String(queryOptions.offset) : void 0,
-      searchString
+      searchString,
+      vectorSearch: queryOptions.vectorSearch
     });
     return entities.map((entity) => this.flattenEntity(entity));
   }
@@ -4944,7 +5148,7 @@ var cmp_1 = cmp$1;
 const SemVer$6 = semver$4;
 const parse$6 = parse_1;
 const { safeRe: re, t } = reExports;
-const coerce$1 = (version2, options2) => {
+const coerce$2 = (version2, options2) => {
   if (version2 instanceof SemVer$6) {
     return version2;
   }
@@ -4979,7 +5183,7 @@ const coerce$1 = (version2, options2) => {
   const build = options2.includePrerelease && match[6] ? `+${match[6]}` : "";
   return parse$6(`${major2}.${minor2}.${patch2}${prerelease2}${build}`, options2);
 };
-var coerce_1 = coerce$1;
+var coerce_1 = coerce$2;
 const parse$5 = parse_1;
 const constants$1 = constants$2;
 const SemVer$5 = semver$4;
@@ -5265,19 +5469,19 @@ function requireRange() {
   const replaceCaret = (comp, options2) => {
     debug2("caret", comp, options2);
     const r = options2.loose ? re2[t2.CARETLOOSE] : re2[t2.CARET];
-    const z = options2.includePrerelease ? "-0" : "";
+    const z2 = options2.includePrerelease ? "-0" : "";
     return comp.replace(r, (_, M, m2, p, pr) => {
       debug2("caret", comp, _, M, m2, p, pr);
       let ret;
       if (isX(M)) {
         ret = "";
       } else if (isX(m2)) {
-        ret = `>=${M}.0.0${z} <${+M + 1}.0.0-0`;
+        ret = `>=${M}.0.0${z2} <${+M + 1}.0.0-0`;
       } else if (isX(p)) {
         if (M === "0") {
-          ret = `>=${M}.${m2}.0${z} <${M}.${+m2 + 1}.0-0`;
+          ret = `>=${M}.${m2}.0${z2} <${M}.${+m2 + 1}.0-0`;
         } else {
-          ret = `>=${M}.${m2}.0${z} <${+M + 1}.0.0-0`;
+          ret = `>=${M}.${m2}.0${z2} <${+M + 1}.0.0-0`;
         }
       } else if (pr) {
         debug2("replaceCaret pr", pr);
@@ -5294,9 +5498,9 @@ function requireRange() {
         debug2("no pr");
         if (M === "0") {
           if (m2 === "0") {
-            ret = `>=${M}.${m2}.${p}${z} <${M}.${m2}.${+p + 1}-0`;
+            ret = `>=${M}.${m2}.${p}${z2} <${M}.${m2}.${+p + 1}-0`;
           } else {
-            ret = `>=${M}.${m2}.${p}${z} <${M}.${+m2 + 1}.0-0`;
+            ret = `>=${M}.${m2}.${p}${z2} <${M}.${+m2 + 1}.0-0`;
           }
         } else {
           ret = `>=${M}.${m2}.${p} <${+M + 1}.0.0-0`;
@@ -5953,7 +6157,7 @@ const neq = neq_1;
 const gte = gte_1;
 const lte = lte_1;
 const cmp = cmp_1;
-const coerce = coerce_1;
+const coerce$1 = coerce_1;
 const truncate = truncate_1;
 const Comparator = requireComparator();
 const Range = requireRange();
@@ -5992,7 +6196,7 @@ var semver$3 = {
   gte,
   lte,
   cmp,
-  coerce,
+  coerce: coerce$1,
   truncate,
   Comparator,
   Range,
@@ -6873,7 +7077,7 @@ var jsonwebtoken = {
   NotBeforeError: NotBeforeError_1,
   TokenExpiredError: TokenExpiredError_1
 };
-const jwt = /* @__PURE__ */ getDefaultExportFromCjs(jsonwebtoken);
+const jwt$1 = /* @__PURE__ */ getDefaultExportFromCjs(jsonwebtoken);
 let jwtConfig = {
   secret: "",
   accessExpiresIn: "1h",
@@ -6892,15 +7096,17 @@ function configureJwt(config) {
     ...config
   };
 }
-function generateAccessToken(userId, roles) {
+function generateAccessToken(userId, roles, aal = "aal1", customClaims) {
   if (!jwtConfig.secret) {
     throw new Error("JWT secret not configured. Call configureJwt() first.");
   }
   const payload = {
     userId,
-    roles
+    roles,
+    aal,
+    ...customClaims
   };
-  return jwt.sign(payload, jwtConfig.secret, {
+  return jwt$1.sign(payload, jwtConfig.secret, {
     expiresIn: jwtConfig.accessExpiresIn,
     algorithm: "HS256"
   });
@@ -6934,7 +7140,7 @@ function verifyAccessToken(token) {
     throw new Error("JWT secret not configured. Call configureJwt() first.");
   }
   try {
-    const decoded = jwt.verify(token, jwtConfig.secret, {
+    const decoded = jwt$1.verify(token, jwtConfig.secret, {
       algorithms: ["HS256"]
     });
     const id = decoded.userId || decoded.uid || decoded.sub;
@@ -6942,9 +7148,11 @@ function verifyAccessToken(token) {
       console.error("[JWT] Verification failed: missing id in payload", decoded);
       return null;
     }
+    const aal = decoded.aal === "aal1" || decoded.aal === "aal2" ? decoded.aal : "aal1";
     return {
       userId: id,
-      roles: decoded.roles || []
+      roles: decoded.roles || [],
+      aal
     };
   } catch (error2) {
     console.error("[JWT] Verification failed:", error2, "Token start:", token.substring(0, 15));
@@ -6984,6 +7192,17 @@ function getRefreshTokenExpiry() {
   }
   return new Date(Date.now() + ms2);
 }
+const jwt = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  configureJwt,
+  generateAccessToken,
+  generateRefreshToken,
+  getAccessTokenExpiry,
+  getAccessTokenExpiryMs,
+  getRefreshTokenExpiry,
+  hashRefreshToken,
+  verifyAccessToken
+}, Symbol.toStringTag, { value: "Module" }));
 function isRLSScopedDriver(driver) {
   return "withAuth" in driver && typeof driver.withAuth === "function";
 }
@@ -7006,6 +7225,81 @@ function safeCompare(a2, b) {
     return false;
   }
 }
+function isApiKeyToken(token) {
+  return token.startsWith("rk_");
+}
+function hashToken$2(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+async function validateApiKey(c, token, options2) {
+  const {
+    store,
+    driver
+  } = options2;
+  const hash = hashToken$2(token);
+  const apiKey = await store.findByKeyHash(hash);
+  if (!apiKey) {
+    return c.json({
+      error: {
+        message: "Invalid API key",
+        code: "UNAUTHORIZED"
+      }
+    }, 401);
+  }
+  if (apiKey.revoked_at) {
+    return c.json({
+      error: {
+        message: "API key has been revoked",
+        code: "UNAUTHORIZED"
+      }
+    }, 401);
+  }
+  if (apiKey.expires_at && new Date(apiKey.expires_at) < /* @__PURE__ */ new Date()) {
+    return c.json({
+      error: {
+        message: "API key has expired",
+        code: "UNAUTHORIZED"
+      }
+    }, 401);
+  }
+  const userId = `api-key:${apiKey.id}`;
+  c.set("user", {
+    userId,
+    roles: []
+  });
+  const masked = {
+    id: apiKey.id,
+    name: apiKey.name,
+    key_prefix: apiKey.key_prefix,
+    permissions: apiKey.permissions,
+    rate_limit: apiKey.rate_limit,
+    created_by: apiKey.created_by,
+    created_at: apiKey.created_at,
+    updated_at: apiKey.updated_at,
+    last_used_at: apiKey.last_used_at,
+    expires_at: apiKey.expires_at,
+    revoked_at: apiKey.revoked_at
+  };
+  c.set("apiKey", masked);
+  try {
+    const scopedDriver = await scopeDataDriver(driver, {
+      uid: userId,
+      roles: ["service"]
+    });
+    c.set("driver", scopedDriver);
+  } catch (error2) {
+    console.error("[AUTH] RLS scoping failed for API key:", error2);
+    return c.json({
+      error: {
+        message: "Internal authentication error",
+        code: "INTERNAL_ERROR"
+      }
+    }, 500);
+  }
+  store.updateLastUsed(apiKey.id).catch(() => {
+  });
+  return true;
+}
 const requireAuth = async (c, next) => {
   const authHeader = c.req.header("authorization");
   const queryToken = c.req.query("token");
@@ -7112,7 +7406,8 @@ function createAuthMiddleware(options2) {
     driver,
     requireAuth: enforceAuth = true,
     validator,
-    serviceKey
+    serviceKey,
+    apiKeyStore
   } = options2;
   return async (c, next) => {
     if (validator) {
@@ -7187,6 +7482,14 @@ function createAuthMiddleware(options2) {
               }
             }, 500);
           }
+        } else if (apiKeyStore && isApiKeyToken(token)) {
+          const result = await validateApiKey(c, token, {
+            store: apiKeyStore,
+            driver
+          });
+          if (result !== true) {
+            return result;
+          }
         } else {
           const payload = extractUserFromToken(token);
           if (payload) {
@@ -7247,9 +7550,22 @@ function createAdapterAuthMiddleware(options2) {
   const {
     adapter,
     driver,
-    requireAuth: enforceAuth = true
+    requireAuth: enforceAuth = true,
+    apiKeyStore
   } = options2;
   return async (c, next) => {
+    if (apiKeyStore) {
+      const authHeader = c.req.header("authorization") || "";
+      const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
+      if (token.startsWith("rk_")) {
+        const result = await validateApiKey(c, token, {
+          store: apiKeyStore,
+          driver
+        });
+        if (result === true) return next();
+        return result;
+      }
+    }
     let authenticatedUser = null;
     try {
       authenticatedUser = await adapter.verifyRequest(c.req.raw);
@@ -7345,11 +7661,11 @@ async function verifyPassword(password, storedHash) {
   const derivedKey = await scryptAsync(password, salt, KEY_LENGTH);
   return timingSafeEqual$1(derivedKey, storedKey);
 }
-function resolveAuthOverrides(overrides) {
+function resolveAuthHooks(hooks) {
   return {
-    hashPassword: overrides?.hashPassword ?? hashPassword,
-    verifyPassword: overrides?.verifyPassword ?? verifyPassword,
-    validatePasswordStrength: overrides?.validatePasswordStrength ?? validatePasswordStrength
+    hashPassword: hooks?.hashPassword ?? hashPassword,
+    verifyPassword: hooks?.verifyPassword ?? verifyPassword,
+    validatePasswordStrength: hooks?.validatePasswordStrength ?? validatePasswordStrength
   };
 }
 function getGreeting(user) {
@@ -7751,6 +8067,63 @@ const strictAuthLimiter = createRateLimiter({
   limit: 50,
   message: "Too many requests to this sensitive endpoint, please try again later."
 });
+function apiKeyKeyGenerator(c) {
+  const apiKey = c.get("apiKey");
+  if (apiKey) {
+    return `api-key:${apiKey.id}`;
+  }
+  return defaultKeyGenerator(c);
+}
+function createApiKeyRateLimiter(defaultLimit = 1e3, windowMs = 15 * 60 * 1e3) {
+  const store = /* @__PURE__ */ new Map();
+  const cleanupInterval = setInterval(() => {
+    const now = Date.now();
+    for (const [key, entry] of store.entries()) {
+      entry.timestamps = entry.timestamps.filter((t2) => now - t2 < windowMs);
+      if (entry.timestamps.length === 0) {
+        store.delete(key);
+      }
+    }
+  }, windowMs);
+  if (cleanupInterval.unref) {
+    cleanupInterval.unref();
+  }
+  return async (c, next) => {
+    const apiKey = c.get("apiKey");
+    if (!apiKey) {
+      return next();
+    }
+    const limit = apiKey.rate_limit ?? defaultLimit;
+    const key = `api-key:${apiKey.id}`;
+    const now = Date.now();
+    let entry = store.get(key);
+    if (!entry) {
+      entry = {
+        timestamps: []
+      };
+      store.set(key, entry);
+    }
+    entry.timestamps = entry.timestamps.filter((t2) => now - t2 < windowMs);
+    if (entry.timestamps.length >= limit) {
+      const retryAfterMs = entry.timestamps[0] + windowMs - now;
+      const retryAfterSec = Math.ceil(retryAfterMs / 1e3);
+      c.header("Retry-After", String(retryAfterSec));
+      c.header("X-RateLimit-Limit", String(limit));
+      c.header("X-RateLimit-Remaining", "0");
+      c.header("X-RateLimit-Reset", String(Math.ceil((now + retryAfterMs) / 1e3)));
+      return c.json({
+        error: {
+          message: "API key rate limit exceeded, please try again later.",
+          code: "RATE_LIMITED"
+        }
+      }, 429);
+    }
+    entry.timestamps.push(now);
+    c.header("X-RateLimit-Limit", String(limit));
+    c.header("X-RateLimit-Remaining", String(limit - entry.timestamps.length));
+    return next();
+  };
+}
 var util$3;
 (function(util2) {
   util2.assertEqual = (_) => {
@@ -7901,6 +8274,10 @@ const ZodIssueCode = util$3.arrayToEnum([
   "not_multiple_of",
   "not_finite"
 ]);
+const quotelessJson = (obj) => {
+  const json = JSON.stringify(obj, null, 2);
+  return json.replace(/"([^"]+)":/g, "$1:");
+};
 class ZodError extends Error {
   get errors() {
     return this.issues;
@@ -8096,6 +8473,9 @@ const errorMap = (issue, _ctx) => {
   return { message };
 };
 let overrideErrorMap = errorMap;
+function setErrorMap(map2) {
+  overrideErrorMap = map2;
+}
 function getErrorMap() {
   return overrideErrorMap;
 }
@@ -8124,6 +8504,7 @@ const makeIssue = (params) => {
     message: errorMessage
   };
 };
+const EMPTY_PATH = [];
 function addIssueToContext(ctx, issueData) {
   const overrideMap = getErrorMap();
   const issue = makeIssue({
@@ -10414,6 +10795,113 @@ ZodUnion.create = (types2, params) => {
     ...processCreateParams(params)
   });
 };
+const getDiscriminator = (type) => {
+  if (type instanceof ZodLazy) {
+    return getDiscriminator(type.schema);
+  } else if (type instanceof ZodEffects) {
+    return getDiscriminator(type.innerType());
+  } else if (type instanceof ZodLiteral) {
+    return [type.value];
+  } else if (type instanceof ZodEnum) {
+    return type.options;
+  } else if (type instanceof ZodNativeEnum) {
+    return util$3.objectValues(type.enum);
+  } else if (type instanceof ZodDefault) {
+    return getDiscriminator(type._def.innerType);
+  } else if (type instanceof ZodUndefined) {
+    return [void 0];
+  } else if (type instanceof ZodNull) {
+    return [null];
+  } else if (type instanceof ZodOptional) {
+    return [void 0, ...getDiscriminator(type.unwrap())];
+  } else if (type instanceof ZodNullable) {
+    return [null, ...getDiscriminator(type.unwrap())];
+  } else if (type instanceof ZodBranded) {
+    return getDiscriminator(type.unwrap());
+  } else if (type instanceof ZodReadonly) {
+    return getDiscriminator(type.unwrap());
+  } else if (type instanceof ZodCatch) {
+    return getDiscriminator(type._def.innerType);
+  } else {
+    return [];
+  }
+};
+class ZodDiscriminatedUnion extends ZodType {
+  _parse(input) {
+    const { ctx } = this._processInputParams(input);
+    if (ctx.parsedType !== ZodParsedType.object) {
+      addIssueToContext(ctx, {
+        code: ZodIssueCode.invalid_type,
+        expected: ZodParsedType.object,
+        received: ctx.parsedType
+      });
+      return INVALID;
+    }
+    const discriminator = this.discriminator;
+    const discriminatorValue = ctx.data[discriminator];
+    const option = this.optionsMap.get(discriminatorValue);
+    if (!option) {
+      addIssueToContext(ctx, {
+        code: ZodIssueCode.invalid_union_discriminator,
+        options: Array.from(this.optionsMap.keys()),
+        path: [discriminator]
+      });
+      return INVALID;
+    }
+    if (ctx.common.async) {
+      return option._parseAsync({
+        data: ctx.data,
+        path: ctx.path,
+        parent: ctx
+      });
+    } else {
+      return option._parseSync({
+        data: ctx.data,
+        path: ctx.path,
+        parent: ctx
+      });
+    }
+  }
+  get discriminator() {
+    return this._def.discriminator;
+  }
+  get options() {
+    return this._def.options;
+  }
+  get optionsMap() {
+    return this._def.optionsMap;
+  }
+  /**
+   * The constructor of the discriminated union schema. Its behaviour is very similar to that of the normal z.union() constructor.
+   * However, it only allows a union of objects, all of which need to share a discriminator property. This property must
+   * have a different value for each object in the union.
+   * @param discriminator the name of the discriminator property
+   * @param types an array of object schemas
+   * @param params
+   */
+  static create(discriminator, options2, params) {
+    const optionsMap = /* @__PURE__ */ new Map();
+    for (const type of options2) {
+      const discriminatorValues = getDiscriminator(type.shape[discriminator]);
+      if (!discriminatorValues.length) {
+        throw new Error(`A discriminator value for key \`${discriminator}\` could not be extracted from all schema options`);
+      }
+      for (const value of discriminatorValues) {
+        if (optionsMap.has(value)) {
+          throw new Error(`Discriminator property ${String(discriminator)} has duplicate value ${String(value)}`);
+        }
+        optionsMap.set(value, type);
+      }
+    }
+    return new ZodDiscriminatedUnion({
+      typeName: ZodFirstPartyTypeKind.ZodDiscriminatedUnion,
+      discriminator,
+      options: options2,
+      optionsMap,
+      ...processCreateParams(params)
+    });
+  }
+}
 function mergeValues(a2, b) {
   const aType = getParsedType(a2);
   const bType = getParsedType(b);
@@ -10572,6 +11060,59 @@ ZodTuple.create = (schemas, params) => {
     ...processCreateParams(params)
   });
 };
+class ZodRecord extends ZodType {
+  get keySchema() {
+    return this._def.keyType;
+  }
+  get valueSchema() {
+    return this._def.valueType;
+  }
+  _parse(input) {
+    const { status, ctx } = this._processInputParams(input);
+    if (ctx.parsedType !== ZodParsedType.object) {
+      addIssueToContext(ctx, {
+        code: ZodIssueCode.invalid_type,
+        expected: ZodParsedType.object,
+        received: ctx.parsedType
+      });
+      return INVALID;
+    }
+    const pairs = [];
+    const keyType = this._def.keyType;
+    const valueType = this._def.valueType;
+    for (const key in ctx.data) {
+      pairs.push({
+        key: keyType._parse(new ParseInputLazyPath(ctx, key, ctx.path, key)),
+        value: valueType._parse(new ParseInputLazyPath(ctx, ctx.data[key], ctx.path, key)),
+        alwaysSet: key in ctx.data
+      });
+    }
+    if (ctx.common.async) {
+      return ParseStatus.mergeObjectAsync(status, pairs);
+    } else {
+      return ParseStatus.mergeObjectSync(status, pairs);
+    }
+  }
+  get element() {
+    return this._def.valueType;
+  }
+  static create(first, second, third) {
+    if (second instanceof ZodType) {
+      return new ZodRecord({
+        keyType: first,
+        valueType: second,
+        typeName: ZodFirstPartyTypeKind.ZodRecord,
+        ...processCreateParams(third)
+      });
+    }
+    return new ZodRecord({
+      keyType: ZodString.create(),
+      valueType: first,
+      typeName: ZodFirstPartyTypeKind.ZodRecord,
+      ...processCreateParams(second)
+    });
+  }
+}
 class ZodMap extends ZodType {
   get keySchema() {
     return this._def.keyType;
@@ -10723,6 +11264,111 @@ ZodSet.create = (valueType, params) => {
     ...processCreateParams(params)
   });
 };
+class ZodFunction extends ZodType {
+  constructor() {
+    super(...arguments);
+    this.validate = this.implement;
+  }
+  _parse(input) {
+    const { ctx } = this._processInputParams(input);
+    if (ctx.parsedType !== ZodParsedType.function) {
+      addIssueToContext(ctx, {
+        code: ZodIssueCode.invalid_type,
+        expected: ZodParsedType.function,
+        received: ctx.parsedType
+      });
+      return INVALID;
+    }
+    function makeArgsIssue(args, error2) {
+      return makeIssue({
+        data: args,
+        path: ctx.path,
+        errorMaps: [ctx.common.contextualErrorMap, ctx.schemaErrorMap, getErrorMap(), errorMap].filter((x) => !!x),
+        issueData: {
+          code: ZodIssueCode.invalid_arguments,
+          argumentsError: error2
+        }
+      });
+    }
+    function makeReturnsIssue(returns, error2) {
+      return makeIssue({
+        data: returns,
+        path: ctx.path,
+        errorMaps: [ctx.common.contextualErrorMap, ctx.schemaErrorMap, getErrorMap(), errorMap].filter((x) => !!x),
+        issueData: {
+          code: ZodIssueCode.invalid_return_type,
+          returnTypeError: error2
+        }
+      });
+    }
+    const params = { errorMap: ctx.common.contextualErrorMap };
+    const fn = ctx.data;
+    if (this._def.returns instanceof ZodPromise) {
+      const me = this;
+      return OK(async function(...args) {
+        const error2 = new ZodError([]);
+        const parsedArgs = await me._def.args.parseAsync(args, params).catch((e) => {
+          error2.addIssue(makeArgsIssue(args, e));
+          throw error2;
+        });
+        const result = await Reflect.apply(fn, this, parsedArgs);
+        const parsedReturns = await me._def.returns._def.type.parseAsync(result, params).catch((e) => {
+          error2.addIssue(makeReturnsIssue(result, e));
+          throw error2;
+        });
+        return parsedReturns;
+      });
+    } else {
+      const me = this;
+      return OK(function(...args) {
+        const parsedArgs = me._def.args.safeParse(args, params);
+        if (!parsedArgs.success) {
+          throw new ZodError([makeArgsIssue(args, parsedArgs.error)]);
+        }
+        const result = Reflect.apply(fn, this, parsedArgs.data);
+        const parsedReturns = me._def.returns.safeParse(result, params);
+        if (!parsedReturns.success) {
+          throw new ZodError([makeReturnsIssue(result, parsedReturns.error)]);
+        }
+        return parsedReturns.data;
+      });
+    }
+  }
+  parameters() {
+    return this._def.args;
+  }
+  returnType() {
+    return this._def.returns;
+  }
+  args(...items) {
+    return new ZodFunction({
+      ...this._def,
+      args: ZodTuple.create(items).rest(ZodUnknown.create())
+    });
+  }
+  returns(returnType) {
+    return new ZodFunction({
+      ...this._def,
+      returns: returnType
+    });
+  }
+  implement(func) {
+    const validatedFunc = this.parse(func);
+    return validatedFunc;
+  }
+  strictImplement(func) {
+    const validatedFunc = this.parse(func);
+    return validatedFunc;
+  }
+  static create(args, returns, params) {
+    return new ZodFunction({
+      args: args ? args : ZodTuple.create([]).rest(ZodUnknown.create()),
+      returns: returns || ZodUnknown.create(),
+      typeName: ZodFirstPartyTypeKind.ZodFunction,
+      ...processCreateParams(params)
+    });
+  }
+}
 class ZodLazy extends ZodType {
   get schema() {
     return this._def.getter();
@@ -11180,6 +11826,7 @@ ZodNaN.create = (params) => {
     ...processCreateParams(params)
   });
 };
+const BRAND = Symbol("zod_brand");
 class ZodBranded extends ZodType {
   _parse(input) {
     const { ctx } = this._processInputParams(input);
@@ -11271,6 +11918,36 @@ ZodReadonly.create = (type, params) => {
     ...processCreateParams(params)
   });
 };
+function cleanParams(params, data) {
+  const p = typeof params === "function" ? params(data) : typeof params === "string" ? { message: params } : params;
+  const p2 = typeof p === "string" ? { message: p } : p;
+  return p2;
+}
+function custom(check, _params = {}, fatal) {
+  if (check)
+    return ZodAny.create().superRefine((data, ctx) => {
+      const r = check(data);
+      if (r instanceof Promise) {
+        return r.then((r2) => {
+          if (!r2) {
+            const params = cleanParams(_params, data);
+            const _fatal = params.fatal ?? fatal ?? true;
+            ctx.addIssue({ code: "custom", ...params, fatal: _fatal });
+          }
+        });
+      }
+      if (!r) {
+        const params = cleanParams(_params, data);
+        const _fatal = params.fatal ?? fatal ?? true;
+        ctx.addIssue({ code: "custom", ...params, fatal: _fatal });
+      }
+      return;
+    });
+  return ZodAny.create();
+}
+const late = {
+  object: ZodObject.lazycreate
+};
 var ZodFirstPartyTypeKind;
 (function(ZodFirstPartyTypeKind2) {
   ZodFirstPartyTypeKind2["ZodString"] = "ZodString";
@@ -11310,17 +11987,251 @@ var ZodFirstPartyTypeKind;
   ZodFirstPartyTypeKind2["ZodPipeline"] = "ZodPipeline";
   ZodFirstPartyTypeKind2["ZodReadonly"] = "ZodReadonly";
 })(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
+const instanceOfType = (cls, params = {
+  message: `Input not instance of ${cls.name}`
+}) => custom((data) => data instanceof cls, params);
 const stringType = ZodString.create;
-ZodNever.create;
-ZodArray.create;
+const numberType = ZodNumber.create;
+const nanType = ZodNaN.create;
+const bigIntType = ZodBigInt.create;
+const booleanType = ZodBoolean.create;
+const dateType = ZodDate.create;
+const symbolType = ZodSymbol.create;
+const undefinedType = ZodUndefined.create;
+const nullType = ZodNull.create;
+const anyType = ZodAny.create;
+const unknownType = ZodUnknown.create;
+const neverType = ZodNever.create;
+const voidType = ZodVoid.create;
+const arrayType = ZodArray.create;
 const objectType = ZodObject.create;
-ZodUnion.create;
-ZodIntersection.create;
-ZodTuple.create;
+const strictObjectType = ZodObject.strictCreate;
+const unionType = ZodUnion.create;
+const discriminatedUnionType = ZodDiscriminatedUnion.create;
+const intersectionType = ZodIntersection.create;
+const tupleType = ZodTuple.create;
+const recordType = ZodRecord.create;
+const mapType = ZodMap.create;
+const setType = ZodSet.create;
+const functionType = ZodFunction.create;
+const lazyType = ZodLazy.create;
+const literalType = ZodLiteral.create;
 const enumType = ZodEnum.create;
-ZodPromise.create;
-ZodOptional.create;
-ZodNullable.create;
+const nativeEnumType = ZodNativeEnum.create;
+const promiseType = ZodPromise.create;
+const effectsType = ZodEffects.create;
+const optionalType = ZodOptional.create;
+const nullableType = ZodNullable.create;
+const preprocessType = ZodEffects.createWithPreprocess;
+const pipelineType = ZodPipeline.create;
+const ostring = () => stringType().optional();
+const onumber = () => numberType().optional();
+const oboolean = () => booleanType().optional();
+const coerce = {
+  string: (arg) => ZodString.create({ ...arg, coerce: true }),
+  number: (arg) => ZodNumber.create({ ...arg, coerce: true }),
+  boolean: (arg) => ZodBoolean.create({
+    ...arg,
+    coerce: true
+  }),
+  bigint: (arg) => ZodBigInt.create({ ...arg, coerce: true }),
+  date: (arg) => ZodDate.create({ ...arg, coerce: true })
+};
+const NEVER = INVALID;
+const z = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  BRAND,
+  DIRTY,
+  EMPTY_PATH,
+  INVALID,
+  NEVER,
+  OK,
+  ParseStatus,
+  Schema: ZodType,
+  ZodAny,
+  ZodArray,
+  ZodBigInt,
+  ZodBoolean,
+  ZodBranded,
+  ZodCatch,
+  ZodDate,
+  ZodDefault,
+  ZodDiscriminatedUnion,
+  ZodEffects,
+  ZodEnum,
+  ZodError,
+  get ZodFirstPartyTypeKind() {
+    return ZodFirstPartyTypeKind;
+  },
+  ZodFunction,
+  ZodIntersection,
+  ZodIssueCode,
+  ZodLazy,
+  ZodLiteral,
+  ZodMap,
+  ZodNaN,
+  ZodNativeEnum,
+  ZodNever,
+  ZodNull,
+  ZodNullable,
+  ZodNumber,
+  ZodObject,
+  ZodOptional,
+  ZodParsedType,
+  ZodPipeline,
+  ZodPromise,
+  ZodReadonly,
+  ZodRecord,
+  ZodSchema: ZodType,
+  ZodSet,
+  ZodString,
+  ZodSymbol,
+  ZodTransformer: ZodEffects,
+  ZodTuple,
+  ZodType,
+  ZodUndefined,
+  ZodUnion,
+  ZodUnknown,
+  ZodVoid,
+  addIssueToContext,
+  any: anyType,
+  array: arrayType,
+  bigint: bigIntType,
+  boolean: booleanType,
+  coerce,
+  custom,
+  date: dateType,
+  datetimeRegex,
+  defaultErrorMap: errorMap,
+  discriminatedUnion: discriminatedUnionType,
+  effect: effectsType,
+  enum: enumType,
+  function: functionType,
+  getErrorMap,
+  getParsedType,
+  instanceof: instanceOfType,
+  intersection: intersectionType,
+  isAborted,
+  isAsync,
+  isDirty,
+  isValid,
+  late,
+  lazy: lazyType,
+  literal: literalType,
+  makeIssue,
+  map: mapType,
+  nan: nanType,
+  nativeEnum: nativeEnumType,
+  never: neverType,
+  null: nullType,
+  nullable: nullableType,
+  number: numberType,
+  object: objectType,
+  get objectUtil() {
+    return objectUtil;
+  },
+  oboolean,
+  onumber,
+  optional: optionalType,
+  ostring,
+  pipeline: pipelineType,
+  preprocess: preprocessType,
+  promise: promiseType,
+  quotelessJson,
+  record: recordType,
+  set: setType,
+  setErrorMap,
+  strictObject: strictObjectType,
+  string: stringType,
+  symbol: symbolType,
+  transformer: effectsType,
+  tuple: tupleType,
+  undefined: undefinedType,
+  union: unionType,
+  unknown: unknownType,
+  get util() {
+    return util$3;
+  },
+  void: voidType
+}, Symbol.toStringTag, { value: "Module" }));
+const BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function base32Encode(buffer) {
+  let bits = 0;
+  let value = 0;
+  let output = "";
+  for (let i = 0; i < buffer.length; i++) {
+    value = value << 8 | buffer[i];
+    bits += 8;
+    while (bits >= 5) {
+      output += BASE32_ALPHABET[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) {
+    output += BASE32_ALPHABET[value << 5 - bits & 31];
+  }
+  return output;
+}
+function base32Decode(encoded) {
+  const cleanInput = encoded.replace(/=+$/, "").toUpperCase();
+  const bytes = [];
+  let bits = 0;
+  let value = 0;
+  for (let i = 0; i < cleanInput.length; i++) {
+    const index = BASE32_ALPHABET.indexOf(cleanInput[i]);
+    if (index === -1) continue;
+    value = value << 5 | index;
+    bits += 5;
+    if (bits >= 8) {
+      bytes.push(value >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(bytes);
+}
+function generateHotp(secret, counter) {
+  const hmac = createHmac("sha1", secret);
+  const counterBuffer = Buffer.alloc(8);
+  counterBuffer.writeBigInt64BE(counter);
+  hmac.update(counterBuffer);
+  const hash = hmac.digest();
+  const offset = hash[hash.length - 1] & 15;
+  const code2 = ((hash[offset] & 127) << 24 | hash[offset + 1] << 16 | hash[offset + 2] << 8 | hash[offset + 3]) % 1e6;
+  return code2.toString().padStart(6, "0");
+}
+function verifyTotp(secret, token, window2 = 1) {
+  const timeStep = 30;
+  const counter = BigInt(Math.floor(Date.now() / 1e3 / timeStep));
+  for (let i = -window2; i <= window2; i++) {
+    if (generateHotp(secret, counter + BigInt(i)) === token) {
+      return true;
+    }
+  }
+  return false;
+}
+function generateTotpSecret(issuer, accountName) {
+  const secretBuffer = randomBytes(20);
+  const secret = base32Encode(secretBuffer);
+  const encodedIssuer = encodeURIComponent(issuer);
+  const encodedAccount = encodeURIComponent(accountName);
+  const uri = `otpauth://totp/${encodedIssuer}:${encodedAccount}?secret=${secret}&issuer=${encodedIssuer}&algorithm=SHA1&digits=6&period=30`;
+  return {
+    secret,
+    uri
+  };
+}
+function generateRecoveryCodes(count = 10) {
+  return Array.from({
+    length: count
+  }, () => {
+    const raw = randomBytes(5).toString("hex").toUpperCase();
+    const parts = raw.match(/.{1,5}/g);
+    return parts ? parts.join("-") : raw;
+  });
+}
+function hashRecoveryCode(code2) {
+  return createHash("sha256").update(code2.replace(/-/g, "").toUpperCase()).digest("hex");
+}
 function buildAuthResponse(user, roleIds, accessToken, refreshToken) {
   return {
     user: {
@@ -11358,9 +12269,9 @@ function createAuthRoutes(config) {
     emailService,
     emailConfig,
     allowRegistration = false,
-    overrides
+    authHooks
   } = config;
-  const ops = resolveAuthOverrides(overrides);
+  const ops = resolveAuthHooks(authHooks);
   const registerSchema = objectType({
     email: stringType().email("Invalid email address").max(255),
     password: stringType().min(1, "Password is required").max(128),
@@ -11424,7 +12335,19 @@ function createAuthRoutes(config) {
   async function createSessionAndTokens(userId, userAgent, ipAddress) {
     const roles = await authRepo.getUserRoles(userId);
     const roleIds = roles.map((r) => r.id);
-    const accessToken = generateAccessToken(userId, roleIds);
+    let customClaims;
+    if (authHooks?.customizeAccessToken) {
+      const user = await authRepo.getUserById(userId);
+      if (user) {
+        const defaultClaims = {
+          userId,
+          roles: roleIds,
+          aal: "aal1"
+        };
+        customClaims = await authHooks.customizeAccessToken(defaultClaims, user);
+      }
+    }
+    const accessToken = generateAccessToken(userId, roleIds, "aal1", customClaims);
     const refreshToken = generateRefreshToken();
     await authRepo.createRefreshToken(userId, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), userAgent, ipAddress);
     return {
@@ -11459,8 +12382,8 @@ function createAuthRoutes(config) {
       passwordHash,
       displayName: displayName || void 0
     };
-    if (overrides?.beforeUserCreate) {
-      createData = await overrides.beforeUserCreate(createData);
+    if (authHooks?.beforeUserCreate) {
+      createData = await authHooks.beforeUserCreate(createData);
     }
     const user = await authRepo.createUser(createData);
     const existingUsers = await authRepo.listUsers();
@@ -11479,14 +12402,16 @@ function createAuthRoutes(config) {
       email: user.email,
       displayName: user.displayName
     });
-    if (overrides?.afterUserCreate) {
-      overrides.afterUserCreate(user).catch((err) => {
-        console.error("[AuthOverrides] afterUserCreate error:", err instanceof Error ? err.message : err);
-      });
+    if (authHooks?.afterUserCreate) {
+      try {
+        await authHooks.afterUserCreate(user);
+      } catch (err) {
+        console.error("[AuthHooks] afterUserCreate error:", err instanceof Error ? err.message : err);
+      }
     }
-    if (overrides?.onAuthenticated) {
-      overrides.onAuthenticated(user, "register").catch((err) => {
-        console.error("[AuthOverrides] onAuthenticated error:", err instanceof Error ? err.message : err);
+    if (authHooks?.onAuthenticated) {
+      authHooks.onAuthenticated(user, "register").catch((err) => {
+        console.error("[AuthHooks] onAuthenticated error:", err instanceof Error ? err.message : err);
       });
     }
     return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken), 201);
@@ -11496,9 +12421,12 @@ function createAuthRoutes(config) {
       email,
       password
     } = parseBody2(loginSchema, await c.req.json());
+    if (authHooks?.beforeLogin) {
+      await authHooks.beforeLogin(email, "login");
+    }
     let user;
-    if (overrides?.verifyCredentials) {
-      user = await overrides.verifyCredentials(email, password, authRepo);
+    if (authHooks?.verifyCredentials) {
+      user = await authHooks.verifyCredentials(email, password, authRepo);
       if (!user) {
         throw ApiError.unauthorized("Invalid email or password", "INVALID_CREDENTIALS");
       }
@@ -11520,9 +12448,9 @@ function createAuthRoutes(config) {
       accessToken,
       refreshToken
     } = await createSessionAndTokens(user.id, c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
-    if (overrides?.onAuthenticated) {
-      overrides.onAuthenticated(user, "login").catch((err) => {
-        console.error("[AuthOverrides] onAuthenticated error:", err instanceof Error ? err.message : err);
+    if (authHooks?.onAuthenticated) {
+      authHooks.onAuthenticated(user, "login").catch((err) => {
+        console.error("[AuthHooks] onAuthenticated error:", err instanceof Error ? err.message : err);
       });
     }
     return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken));
@@ -11561,6 +12489,13 @@ function createAuthRoutes(config) {
             await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, {
               email: externalUser.email
             });
+            if (authHooks?.afterUserCreate) {
+              try {
+                await authHooks.afterUserCreate(user);
+              } catch (err) {
+                console.error("[AuthHooks] afterUserCreate error:", err instanceof Error ? err.message : err);
+              }
+            }
             const allUsers = await authRepo.listUsers();
             const isFirstUser = allUsers.length === 1 && allUsers[0].id === user.id;
             if (isFirstUser) {
@@ -11646,6 +12581,11 @@ function createAuthRoutes(config) {
     await authRepo.updatePassword(storedToken.userId, passwordHash);
     await authRepo.markPasswordResetTokenUsed(tokenHash);
     await authRepo.deleteAllRefreshTokensForUser(storedToken.userId);
+    if (authHooks?.onPasswordReset) {
+      authHooks.onPasswordReset(storedToken.userId).catch((err) => {
+        console.error("[AuthHooks] onPasswordReset error:", err instanceof Error ? err.message : err);
+      });
+    }
     return c.json({
       success: true,
       message: "Password has been reset successfully"
@@ -11749,7 +12689,19 @@ function createAuthRoutes(config) {
     }
     const roles = await authRepo.getUserRoles(storedToken.userId);
     const roleIds = roles.map((r) => r.id);
-    const newAccessToken = generateAccessToken(storedToken.userId, roleIds);
+    let customClaims;
+    if (authHooks?.customizeAccessToken) {
+      const user = await authRepo.getUserById(storedToken.userId);
+      if (user) {
+        const defaultClaims = {
+          userId: storedToken.userId,
+          roles: roleIds,
+          aal: "aal1"
+        };
+        customClaims = await authHooks.customizeAccessToken(defaultClaims, user);
+      }
+    }
+    const newAccessToken = generateAccessToken(storedToken.userId, roleIds, "aal1", customClaims);
     const newRefreshToken = generateRefreshToken();
     const userAgent = c.req.header("user-agent") || "unknown";
     const ipAddress = c.req.header("x-forwarded-for") || "unknown";
@@ -11771,6 +12723,18 @@ function createAuthRoutes(config) {
       const tokenHash = hashRefreshToken(refreshToken);
       await authRepo.deleteRefreshToken(tokenHash);
     }
+    const authHeader = c.req.header("authorization");
+    if (authHooks?.afterLogout && authHeader?.startsWith("Bearer ")) {
+      const {
+        verifyAccessToken: verifyAccessToken2
+      } = await Promise.resolve().then(() => jwt);
+      const payload = verifyAccessToken2(authHeader.substring(7));
+      if (payload) {
+        authHooks.afterLogout(payload.userId).catch((err) => {
+          console.error("[AuthHooks] afterLogout error:", err instanceof Error ? err.message : err);
+        });
+      }
+    }
     return c.json({
       success: true
     });
@@ -11890,6 +12854,270 @@ function createAuthRoutes(config) {
       enabledProviders
     });
   });
+  router.post("/anonymous", strictAuthLimiter, async (c) => {
+    const anonId = randomBytes(16).toString("hex");
+    const anonEmail = `anon_${anonId.slice(0, 8)}@anonymous.local`;
+    let createData = {
+      email: anonEmail,
+      emailVerified: false,
+      isAnonymous: true
+    };
+    if (authHooks?.beforeUserCreate) {
+      createData = await authHooks.beforeUserCreate(createData);
+    }
+    const user = await authRepo.createUser(createData);
+    if (config.defaultRole) {
+      await authRepo.assignDefaultRole(user.id, config.defaultRole);
+    }
+    const {
+      roleIds,
+      accessToken,
+      refreshToken
+    } = await createSessionAndTokens(user.id, c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
+    if (authHooks?.afterUserCreate) {
+      authHooks.afterUserCreate(user).catch((err) => {
+        console.error("[AuthHooks] afterUserCreate error:", err instanceof Error ? err.message : err);
+      });
+    }
+    if (authHooks?.onAuthenticated) {
+      authHooks.onAuthenticated(user, "anonymous").catch((err) => {
+        console.error("[AuthHooks] onAuthenticated error:", err instanceof Error ? err.message : err);
+      });
+    }
+    return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken), 201);
+  });
+  router.post("/anonymous/link", requireAuth, async (c) => {
+    const userCtx = c.get("user");
+    if (!userCtx) {
+      throw ApiError.unauthorized("Not authenticated");
+    }
+    const user = await authRepo.getUserById(userCtx.userId);
+    if (!user?.isAnonymous) {
+      throw ApiError.badRequest("User is not anonymous", "NOT_ANONYMOUS");
+    }
+    const linkSchema = objectType({
+      email: stringType().email("Invalid email address").max(255),
+      password: stringType().min(1, "Password is required").max(128)
+    });
+    const {
+      email,
+      password
+    } = parseBody2(linkSchema, await c.req.json());
+    const passwordValidation = ops.validatePasswordStrength(password);
+    if (!passwordValidation.valid) {
+      throw ApiError.badRequest(passwordValidation.errors.join(". "), "WEAK_PASSWORD");
+    }
+    const existingUser = await authRepo.getUserByEmail(email.toLowerCase());
+    if (existingUser) {
+      throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
+    }
+    const passwordHash = await ops.hashPassword(password);
+    const updatedUser = await authRepo.updateUser(user.id, {
+      email: email.toLowerCase(),
+      passwordHash,
+      isAnonymous: false
+    });
+    if (!updatedUser) {
+      throw ApiError.notFound("User not found");
+    }
+    const {
+      roleIds,
+      accessToken,
+      refreshToken
+    } = await createSessionAndTokens(user.id, c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
+    return c.json(buildAuthResponse(updatedUser, roleIds, accessToken, refreshToken));
+  });
+  router.post("/mfa/enroll", requireAuth, async (c) => {
+    const userCtx = c.get("user");
+    if (!userCtx) {
+      throw ApiError.unauthorized("Not authenticated");
+    }
+    const body = await c.req.json().catch(() => ({}));
+    const friendlyName = typeof body.friendlyName === "string" ? body.friendlyName : void 0;
+    const issuer = typeof body.issuer === "string" ? body.issuer : emailConfig?.appName || "Rebase";
+    const user = await authRepo.getUserById(userCtx.userId);
+    if (!user) {
+      throw ApiError.notFound("User not found");
+    }
+    const {
+      secret,
+      uri
+    } = generateTotpSecret(issuer, user.email);
+    const factor = await authRepo.createMfaFactor(
+      user.id,
+      "totp",
+      secret,
+      // In production, encrypt this before storage
+      friendlyName
+    );
+    const codes = generateRecoveryCodes(10);
+    const codeHashes = codes.map(hashRecoveryCode);
+    await authRepo.createRecoveryCodes(user.id, codeHashes);
+    return c.json({
+      factor: {
+        id: factor.id,
+        factorType: factor.factorType,
+        friendlyName: factor.friendlyName
+      },
+      totp: {
+        secret,
+        uri,
+        qrUri: uri
+        // Client can use a QR library to render this
+      },
+      recoveryCodes: codes
+    }, 201);
+  });
+  router.post("/mfa/verify", requireAuth, async (c) => {
+    const userCtx = c.get("user");
+    if (!userCtx) {
+      throw ApiError.unauthorized("Not authenticated");
+    }
+    const verifySchema = objectType({
+      factorId: stringType().min(1, "Factor ID is required"),
+      code: stringType().length(6, "Code must be 6 digits")
+    });
+    const {
+      factorId,
+      code: code2
+    } = parseBody2(verifySchema, await c.req.json());
+    const factor = await authRepo.getMfaFactorById(factorId);
+    if (!factor || factor.userId !== userCtx.userId) {
+      throw ApiError.notFound("MFA factor not found");
+    }
+    if (factor.verified) {
+      throw ApiError.badRequest("Factor is already verified", "ALREADY_VERIFIED");
+    }
+    const secretBuffer = base32Decode(factor.secretEncrypted);
+    const isValid2 = verifyTotp(secretBuffer, code2);
+    if (!isValid2) {
+      throw ApiError.unauthorized("Invalid TOTP code", "INVALID_CODE");
+    }
+    await authRepo.verifyMfaFactor(factorId);
+    return c.json({
+      success: true,
+      message: "MFA factor verified and enrolled"
+    });
+  });
+  router.post("/mfa/challenge", requireAuth, async (c) => {
+    const userCtx = c.get("user");
+    if (!userCtx) {
+      throw ApiError.unauthorized("Not authenticated");
+    }
+    const challengeSchema = objectType({
+      factorId: stringType().min(1, "Factor ID is required")
+    });
+    const {
+      factorId
+    } = parseBody2(challengeSchema, await c.req.json());
+    const factor = await authRepo.getMfaFactorById(factorId);
+    if (!factor || factor.userId !== userCtx.userId) {
+      throw ApiError.notFound("MFA factor not found");
+    }
+    if (!factor.verified) {
+      throw ApiError.badRequest("MFA factor is not yet verified", "FACTOR_NOT_VERIFIED");
+    }
+    const ipAddress = c.req.header("x-forwarded-for") || "unknown";
+    const challenge = await authRepo.createMfaChallenge(factorId, ipAddress);
+    return c.json({
+      challengeId: challenge.id,
+      factorId: challenge.factorId,
+      expiresAt: new Date(Date.now() + 5 * 60 * 1e3).toISOString()
+    });
+  });
+  router.post("/mfa/challenge/verify", requireAuth, async (c) => {
+    const userCtx = c.get("user");
+    if (!userCtx) {
+      throw ApiError.unauthorized("Not authenticated");
+    }
+    const challengeVerifySchema = objectType({
+      challengeId: stringType().min(1, "Challenge ID is required"),
+      code: stringType().min(1, "Code is required")
+    });
+    const {
+      challengeId,
+      code: code2
+    } = parseBody2(challengeVerifySchema, await c.req.json());
+    const challenge = await authRepo.getMfaChallengeById(challengeId);
+    if (!challenge) {
+      throw ApiError.badRequest("Invalid or expired challenge", "INVALID_CHALLENGE");
+    }
+    const factor = await authRepo.getMfaFactorById(challenge.factorId);
+    if (!factor || factor.userId !== userCtx.userId) {
+      throw ApiError.notFound("MFA factor not found");
+    }
+    const isRecoveryCode = code2.length > 6;
+    let isValid2 = false;
+    if (isRecoveryCode) {
+      const codeHash = hashRecoveryCode(code2);
+      isValid2 = await authRepo.useRecoveryCode(userCtx.userId, codeHash);
+    } else {
+      const secretBuffer = base32Decode(factor.secretEncrypted);
+      isValid2 = verifyTotp(secretBuffer, code2);
+    }
+    if (!isValid2) {
+      throw ApiError.unauthorized("Invalid verification code", "INVALID_CODE");
+    }
+    await authRepo.verifyMfaChallenge(challengeId);
+    const roles = await authRepo.getUserRoles(userCtx.userId);
+    const roleIds = roles.map((r) => r.id);
+    const accessToken = generateAccessToken(userCtx.userId, roleIds, "aal2");
+    const refreshToken = generateRefreshToken();
+    await authRepo.createRefreshToken(userCtx.userId, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
+    if (authHooks?.onMfaVerified) {
+      authHooks.onMfaVerified(userCtx.userId, factor.id).catch((err) => {
+        console.error("[AuthHooks] onMfaVerified error:", err instanceof Error ? err.message : err);
+      });
+    }
+    return c.json({
+      tokens: {
+        accessToken,
+        refreshToken,
+        accessTokenExpiresAt: getAccessTokenExpiry()
+      }
+    });
+  });
+  router.get("/mfa/factors", requireAuth, async (c) => {
+    const userCtx = c.get("user");
+    if (!userCtx) {
+      throw ApiError.unauthorized("Not authenticated");
+    }
+    const factors = await authRepo.getMfaFactors(userCtx.userId);
+    return c.json({
+      factors: factors.map((f2) => ({
+        id: f2.id,
+        factorType: f2.factorType,
+        friendlyName: f2.friendlyName,
+        verified: f2.verified,
+        createdAt: f2.createdAt
+      }))
+    });
+  });
+  router.delete("/mfa/unenroll", requireAuth, async (c) => {
+    const userCtx = c.get("user");
+    if (!userCtx) {
+      throw ApiError.unauthorized("Not authenticated");
+    }
+    const unenrollSchema = objectType({
+      factorId: stringType().min(1, "Factor ID is required")
+    });
+    const {
+      factorId
+    } = parseBody2(unenrollSchema, await c.req.json());
+    const factor = await authRepo.getMfaFactorById(factorId);
+    if (!factor || factor.userId !== userCtx.userId) {
+      throw ApiError.notFound("MFA factor not found");
+    }
+    await authRepo.deleteMfaFactor(factorId, userCtx.userId);
+    const hasFactors = await authRepo.hasVerifiedMfaFactors(userCtx.userId);
+    if (!hasFactors) {
+      await authRepo.deleteAllRecoveryCodes(userCtx.userId);
+    }
+    return c.json({
+      success: true,
+      message: "MFA factor removed"
+    });
+  });
   return router;
 }
 function generateSecurePassword() {
@@ -11921,9 +13149,9 @@ function createAdminRoutes(config) {
     emailService,
     emailConfig,
     hooks,
-    overrides
+    authHooks
   } = config;
-  const ops = resolveAuthOverrides(overrides);
+  const ops = resolveAuthHooks(authHooks);
   function buildHookContext(c, method) {
     const user = c.get("user");
     return {
@@ -11943,11 +13171,6 @@ function createAdminRoutes(config) {
     const results = await Promise.all(users.map((u) => applyUserAfterRead(u, ctx)));
     return results.filter((u) => u !== null);
   }
-  async function applyRoleAfterReadBatch(roles, ctx) {
-    if (!hooks?.roles?.afterRead) return roles;
-    const results = await Promise.all(roles.map((r) => hooks.roles.afterRead(r, ctx)));
-    return results.filter((r) => r !== null);
-  }
   function toAdminUser(u, roles) {
     return {
       uid: u.id,
@@ -11991,6 +13214,10 @@ function createAdminRoutes(config) {
     if (!userId) {
       throw ApiError.unauthorized("User ID not found in auth context");
     }
+    const caller = await authRepo.getUserById(userId);
+    if (!caller) {
+      throw ApiError.notFound("Authenticated user does not exist in the database. Please sign out and sign in/register again.", "USER_NOT_FOUND");
+    }
     await authRepo.setUserRoles(userId, ["admin"]);
     if (config.setBootstrapCompleted) {
       await config.setBootstrapCompleted();
@@ -12242,6 +13469,18 @@ function createAdminRoutes(config) {
       await authRepo.updateUser(userId, updates);
     }
     if (roles !== void 0 && Array.isArray(roles)) {
+      const currentRoles = await authRepo.getUserRoleIds(userId);
+      const wasAdmin = currentRoles.includes("admin");
+      const willBeAdmin = roles.includes("admin");
+      if (wasAdmin && !willBeAdmin) {
+        const adminUsers = await authRepo.listUsersPaginated({
+          roleId: "admin",
+          limit: 1
+        });
+        if (adminUsers.total <= 1) {
+          throw ApiError.forbidden("Cannot demote the last administrator", "LAST_ADMIN");
+        }
+      }
       await authRepo.setUserRoles(userId, roles);
     }
     const result = await authRepo.getUserWithRoles(userId);
@@ -12266,6 +13505,16 @@ function createAdminRoutes(config) {
     if (!existing) {
       throw ApiError.notFound("User not found");
     }
+    const roles = await authRepo.getUserRoleIds(userId);
+    if (roles.includes("admin")) {
+      const adminUsers = await authRepo.listUsersPaginated({
+        roleId: "admin",
+        limit: 1
+      });
+      if (adminUsers.total <= 1) {
+        throw ApiError.forbidden("Cannot delete the last administrator", "LAST_ADMIN");
+      }
+    }
     const hookCtx = buildHookContext(c, "DELETE");
     if (hooks?.users?.beforeDelete) {
       await hooks.users.beforeDelete(userId, hookCtx);
@@ -12280,95 +13529,6 @@ function createAdminRoutes(config) {
       success: true
     });
   });
-  router.get("/roles", requireAdmin, async (c) => {
-    const roles = await authRepo.listRoles();
-    const hookCtx = buildHookContext(c, "GET");
-    let adminRoles = roles.map((r) => ({
-      id: r.id,
-      name: r.name,
-      isAdmin: r.isAdmin,
-      defaultPermissions: r.defaultPermissions,
-      config: r.config
-    }));
-    adminRoles = await applyRoleAfterReadBatch(adminRoles, hookCtx);
-    return c.json({
-      roles: adminRoles
-    });
-  });
-  router.get("/roles/:roleId", requireAdmin, async (c) => {
-    const roleId = c.req.param("roleId");
-    const role = await authRepo.getRoleById(roleId);
-    if (!role) {
-      throw ApiError.notFound("Role not found");
-    }
-    return c.json({
-      role
-    });
-  });
-  router.post("/roles", requireAdmin, async (c) => {
-    const body = await c.req.json();
-    const {
-      id,
-      name: name2,
-      isAdmin,
-      defaultPermissions,
-      config: config2
-    } = body;
-    if (!id || !name2) {
-      throw ApiError.badRequest("Role ID and name are required", "INVALID_INPUT");
-    }
-    const existing = await authRepo.getRoleById(id);
-    if (existing) {
-      throw ApiError.conflict("Role already exists", "ROLE_EXISTS");
-    }
-    const role = await authRepo.createRole({
-      id,
-      name: name2,
-      isAdmin: isAdmin ?? false,
-      defaultPermissions: defaultPermissions ?? null,
-      config: config2 ?? null
-    });
-    return c.json({
-      role
-    }, 201);
-  });
-  router.put("/roles/:roleId", requireAdmin, async (c) => {
-    const roleId = c.req.param("roleId");
-    const body = await c.req.json();
-    const {
-      name: name2,
-      isAdmin,
-      defaultPermissions,
-      config: config2
-    } = body;
-    const existing = await authRepo.getRoleById(roleId);
-    if (!existing) {
-      throw ApiError.notFound("Role not found");
-    }
-    const role = await authRepo.updateRole(roleId, {
-      name: name2,
-      isAdmin,
-      defaultPermissions,
-      config: config2
-    });
-    return c.json({
-      role
-    });
-  });
-  router.delete("/roles/:roleId", requireAdmin, async (c) => {
-    const roleId = c.req.param("roleId");
-    if (["admin", "editor", "viewer"].includes(roleId)) {
-      throw ApiError.badRequest("Cannot delete built-in roles", "BUILTIN_ROLE");
-    }
-    const existing = await authRepo.getRoleById(roleId);
-    if (!existing) {
-      throw ApiError.notFound("Role not found");
-    }
-    await authRepo.deleteRole(roleId);
-    return c.json({
-      success: true
-    });
-  });
   return router;
 }
 function createBuiltinAuthAdapter(config) {
@@ -12381,9 +13541,9 @@ function createBuiltinAuthAdapter(config) {
     oauthProviders = [],
     serviceKey,
     hooks,
-    overrides
+    authHooks
   } = config;
-  const resolvedOps = resolveAuthOverrides(overrides);
+  const resolvedOps = resolveAuthHooks(authHooks);
   const adapter = {
     id: "rebase-builtin",
     serviceKey,
@@ -12412,8 +13572,7 @@ function createBuiltinAuthAdapter(config) {
       const extendedPayload = payload;
       let roles = payload.roles || [];
       try {
-        const userRoles = await authRepository.getUserRoles(payload.userId);
-        roles = userRoles.map((r) => r.id);
+        roles = await authRepository.getUserRoleIds(payload.userId);
       } catch {
       }
       const isAdmin = roles.some((r) => r === "admin" || r === "schema-admin");
@@ -12443,8 +13602,7 @@ function createBuiltinAuthAdapter(config) {
       const extendedPayload = payload;
       let roles = payload.roles || [];
       try {
-        const userRoles = await authRepository.getUserRoles(payload.userId);
-        roles = userRoles.map((r) => r.id);
+        roles = await authRepository.getUserRoleIds(payload.userId);
       } catch {
       }
       const isAdmin = roles.some((r) => r === "admin" || r === "schema-admin");
@@ -12457,8 +13615,7 @@ function createBuiltinAuthAdapter(config) {
         rawToken: token
       };
     },
-    userManagement: createUserManagementFromRepo(authRepository, resolvedOps, overrides),
-    roleManagement: createRoleManagementFromRepo(authRepository),
+    userManagement: createUserManagementFromRepo(authRepository, resolvedOps, authHooks),
     createAuthRoutes() {
       return createAuthRoutes({
         authRepo: authRepository,
@@ -12467,7 +13624,7 @@ function createBuiltinAuthAdapter(config) {
         allowRegistration,
         defaultRole,
         oauthProviders,
-        overrides
+        authHooks
       });
     },
     createAdminRoutes() {
@@ -12477,7 +13634,7 @@ function createBuiltinAuthAdapter(config) {
         emailConfig,
         serviceKey,
         hooks,
-        overrides
+        authHooks
       });
     },
     async getCapabilities() {
@@ -12506,7 +13663,7 @@ function createBuiltinAuthAdapter(config) {
   };
   return adapter;
 }
-function createUserManagementFromRepo(repo, resolvedOps, overrides) {
+function createUserManagementFromRepo(repo, resolvedOps, authHooks) {
   return {
     async listUsers(options2) {
       const result = await repo.listUsersPaginated({
@@ -12537,14 +13694,16 @@ function createUserManagementFromRepo(repo, resolvedOps, overrides) {
         photoUrl: data.photoUrl,
         metadata: data.metadata
       };
-      if (overrides?.beforeUserCreate) {
-        createData = await overrides.beforeUserCreate(createData);
+      if (authHooks?.beforeUserCreate) {
+        createData = await authHooks.beforeUserCreate(createData);
       }
       const user = await repo.createUser(createData);
-      if (overrides?.afterUserCreate) {
-        overrides.afterUserCreate(user).catch((err) => {
-          console.error("[AuthOverrides] afterUserCreate error:", err instanceof Error ? err.message : err);
-        });
+      if (authHooks?.afterUserCreate) {
+        try {
+          await authHooks.afterUserCreate(user);
+        } catch (err) {
+          console.error("[AuthHooks] afterUserCreate error:", err instanceof Error ? err.message : err);
+        }
       }
       return toAuthUserData(user);
     },
@@ -12561,47 +13720,24 @@ function createUserManagementFromRepo(repo, resolvedOps, overrides) {
       return user ? toAuthUserData(user) : null;
     },
     async deleteUser(id) {
+      if (authHooks?.beforeUserDelete) {
+        await authHooks.beforeUserDelete(id);
+      }
       await repo.deleteUser(id);
+      if (authHooks?.afterUserDelete) {
+        authHooks.afterUserDelete(id).catch((err) => {
+          console.error("[AuthHooks] afterUserDelete error:", err instanceof Error ? err.message : err);
+        });
+      }
     },
     async getUserRoles(userId) {
-      const roles = await repo.getUserRoles(userId);
-      return roles.map(toAuthRoleData);
+      return repo.getUserRoleIds(userId);
     },
     async setUserRoles(userId, roleIds) {
       await repo.setUserRoles(userId, roleIds);
     }
   };
 }
-function createRoleManagementFromRepo(repo) {
-  return {
-    async listRoles() {
-      const roles = await repo.listRoles();
-      return roles.map(toAuthRoleData);
-    },
-    async getRoleById(id) {
-      const role = await repo.getRoleById(id);
-      return role ? toAuthRoleData(role) : null;
-    },
-    async createRole(data) {
-      const role = await repo.createRole({
-        id: data.id,
-        name: data.name,
-        isAdmin: data.isAdmin,
-        defaultPermissions: data.defaultPermissions,
-        collectionPermissions: data.collectionPermissions,
-        config: data.config
-      });
-      return toAuthRoleData(role);
-    },
-    async updateRole(id, data) {
-      const role = await repo.updateRole(id, data);
-      return role ? toAuthRoleData(role) : null;
-    },
-    async deleteRole(id) {
-      await repo.deleteRole(id);
-    }
-  };
-}
 function toAuthUserData(user) {
   return {
     id: user.id,
@@ -12614,16 +13750,6 @@ function toAuthUserData(user) {
     updatedAt: user.updatedAt
   };
 }
-function toAuthRoleData(role) {
-  return {
-    id: role.id,
-    name: role.name,
-    isAdmin: role.isAdmin,
-    defaultPermissions: role.defaultPermissions,
-    collectionPermissions: role.collectionPermissions,
-    config: role.config
-  };
-}
 function configureLogLevel(logLevel) {
   const LOG_LEVEL = logLevel || process.env.LOG_LEVEL || "info";
   const logLevels = {
@@ -12642,20 +13768,20 @@ function configureLogLevel(logLevel) {
   if (currentLevel < 0) console.error = () => {
   };
 }
+let originalConsole;
 function resetConsole() {
-  if (!global.__originalConsole) {
-    global.__originalConsole = {
+  if (!originalConsole) {
+    originalConsole = {
       log: console.log,
       warn: console.warn,
       error: console.error,
       debug: console.debug
     };
   }
-  const original = global.__originalConsole;
-  console.log = original.log;
-  console.warn = original.warn;
-  console.error = original.error;
-  console.debug = original.debug;
+  console.log = originalConsole.log;
+  console.warn = originalConsole.warn;
+  console.error = originalConsole.error;
+  console.debug = originalConsole.debug;
 }
 const GCP_SEVERITY = {
   debug: "DEBUG",
@@ -12897,12 +14023,6 @@ var browser$1 = { exports: {} };
   exports.Response = globalObject.Response;
 })(browser$1, browser$1.exports);
 var browserExports = browser$1.exports;
-const __viteBrowserExternal = {};
-const __viteBrowserExternal$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
-  __proto__: null,
-  default: __viteBrowserExternal
-}, Symbol.toStringTag, { value: "Module" }));
-const require$$11 = /* @__PURE__ */ getAugmentedNamespace(__viteBrowserExternal$1);
 const isStream = (stream2) => stream2 !== null && typeof stream2 === "object" && typeof stream2.pipe === "function";
 isStream.writable = (stream2) => isStream(stream2) && stream2.writable !== false && typeof stream2._write === "function" && typeof stream2._writableState === "object";
 isStream.readable = (stream2) => isStream(stream2) && stream2.readable !== false && typeof stream2._read === "function" && typeof stream2._readableState === "object";
@@ -13687,16 +14807,16 @@ Object.defineProperty(sha1$1, "__esModule", {
   value: true
 });
 sha1$1.default = void 0;
-function f(s2, x, y2, z) {
+function f(s2, x, y2, z2) {
   switch (s2) {
     case 0:
-      return x & y2 ^ ~x & z;
+      return x & y2 ^ ~x & z2;
     case 1:
-      return x ^ y2 ^ z;
+      return x ^ y2 ^ z2;
     case 2:
-      return x & y2 ^ x & z ^ y2 & z;
+      return x & y2 ^ x & z2 ^ y2 & z2;
     case 3:
-      return x ^ y2 ^ z;
+      return x ^ y2 ^ z2;
   }
 }
 function ROTL(x, n) {
@@ -14745,7 +15865,7 @@ gaxios.Gaxios = void 0;
 const extend_1 = __importDefault(extend);
 const https_1 = require$$1;
 const node_fetch_1 = __importDefault(browserExports);
-const querystring_1$1 = __importDefault(require$$11);
+const querystring_1$1 = __importDefault(require$$1$2);
 const is_stream_1 = __importDefault(isStream_1);
 const url_1 = require$$0$5;
 const common_1 = common$1;
@@ -16423,11 +17543,11 @@ var bignumber = { exports: {} };
       return n > 0 || n === i ? i : i - 1;
     }
     function coeffToString(a2) {
-      var s2, z, i = 1, j = a2.length, r = a2[0] + "";
+      var s2, z2, i = 1, j = a2.length, r = a2[0] + "";
       for (; i < j; ) {
         s2 = a2[i++] + "";
-        z = LOG_BASE - s2.length;
-        for (; z--; s2 = "0" + s2) ;
+        z2 = LOG_BASE - s2.length;
+        for (; z2--; s2 = "0" + s2) ;
         r += s2;
       }
       for (j = r.length; r.charCodeAt(--j) === 48; ) ;
@@ -16460,15 +17580,15 @@ var bignumber = { exports: {} };
     function toExponential(str, e) {
       return (str.length > 1 ? str.charAt(0) + "." + str.slice(1) : str) + (e < 0 ? "e" : "e+") + e;
     }
-    function toFixedPoint(str, e, z) {
+    function toFixedPoint(str, e, z2) {
       var len, zs;
       if (e < 0) {
-        for (zs = z + "."; ++e; zs += z) ;
+        for (zs = z2 + "."; ++e; zs += z2) ;
         str = zs + str;
       } else {
         len = str.length;
         if (++e > len) {
-          for (zs = z, e -= len; --e; zs += z) ;
+          for (zs = z2, e -= len; --e; zs += z2) ;
           str += zs;
         } else if (e < len) {
           str = str.slice(0, e) + "." + str.slice(e);
@@ -16887,7 +18007,7 @@ var gcpResidency = {};
   exports.isGoogleComputeEngine = isGoogleComputeEngine;
   exports.detectGCPResidency = detectGCPResidency;
   const fs_1 = fs__default;
-  const os_1 = require$$1$2;
+  const os_1 = require$$1$3;
   exports.GCE_LINUX_BIOS_PATHS = {
     BIOS_DATE: "/sys/class/dmi/id/bios_date",
     BIOS_VENDOR: "/sys/class/dmi/id/bios_vendor"
@@ -17020,7 +18140,7 @@ Colours.refresh();
   exports.setBackend = setBackend;
   exports.log = log;
   const node_events_1 = require$$0$8;
-  const process2 = __importStar2(require$$1$3);
+  const process2 = __importStar2(require$$1$4);
   const util2 = __importStar2(require$$2$1);
   const colours_1 = colours;
   var LogSeverity;
@@ -18092,7 +19212,7 @@ loginticket.LoginTicket = LoginTicket;
 Object.defineProperty(oauth2client, "__esModule", { value: true });
 oauth2client.OAuth2Client = oauth2client.ClientAuthentication = oauth2client.CertificateFormat = oauth2client.CodeChallengeMethod = void 0;
 const gaxios_1$5 = src$2;
-const querystring$2 = require$$11;
+const querystring$2 = require$$1$2;
 const stream$4 = require$$0$4;
 const formatEcdsa = ecdsaSigFormatter;
 const crypto_1$2 = requireCrypto();
@@ -19580,7 +20700,7 @@ var refreshclient = {};
 Object.defineProperty(refreshclient, "__esModule", { value: true });
 refreshclient.UserRefreshClient = refreshclient.USER_REFRESH_ACCOUNT_TYPE = void 0;
 const oauth2client_1$1 = oauth2client;
-const querystring_1 = require$$11;
+const querystring_1 = require$$1$2;
 refreshclient.USER_REFRESH_ACCOUNT_TYPE = "authorized_user";
 class UserRefreshClient extends oauth2client_1$1.OAuth2Client {
   constructor(optionsOrClientId, clientSecret, refreshToken, eagerRefreshThresholdMillis, forceRefreshOnFailure) {
@@ -19855,7 +20975,7 @@ var oauth2common = {};
 Object.defineProperty(oauth2common, "__esModule", { value: true });
 oauth2common.OAuthClientAuthHandler = void 0;
 oauth2common.getErrorFromOAuthErrorResponse = getErrorFromOAuthErrorResponse;
-const querystring$1 = require$$11;
+const querystring$1 = require$$1$2;
 const crypto_1$1 = requireCrypto();
 const METHODS_SUPPORTING_REQUEST_BODY = ["PUT", "POST", "PATCH"];
 class OAuthClientAuthHandler {
@@ -20001,7 +21121,7 @@ function getErrorFromOAuthErrorResponse(resp, err) {
 Object.defineProperty(stscredentials, "__esModule", { value: true });
 stscredentials.StsCredentials = void 0;
 const gaxios_1$1 = src$2;
-const querystring = require$$11;
+const querystring = require$$1$2;
 const transporters_1 = transporters;
 const oauth2common_1$1 = oauth2common;
 class StsCredentials extends oauth2common_1$1.OAuthClientAuthHandler {
@@ -21607,7 +22727,7 @@ externalAccountAuthorizedUserClient.ExternalAccountAuthorizedUserClient = Extern
   const child_process_1 = require$$0$a;
   const fs2 = fs__default;
   const gcpMetadata2 = src$3;
-  const os2 = require$$1$2;
+  const os2 = require$$1$3;
   const path2 = path__default;
   const crypto_12 = requireCrypto();
   const transporters_12 = transporters;
@@ -22971,7 +24091,7 @@ function createMicrosoftProvider(config) {
 }
 function createAppleProvider(config) {
   async function generateClientSecret() {
-    return jwt.sign({}, config.privateKey, {
+    return jwt$1.sign({}, config.privateKey, {
       algorithm: "ES256",
       keyid: config.keyId,
       issuer: config.teamId,
@@ -23451,6 +24571,341 @@ function createSpotifyProvider(config) {
     }
   };
 }
+const TABLE$1 = "rebase.api_keys";
+function generateApiKey() {
+  const random = randomBytes(16).toString("hex");
+  return `rk_live_${random}`;
+}
+function hashKey(plaintext) {
+  return createHash("sha256").update(plaintext).digest("hex");
+}
+function keyPrefix(plaintext) {
+  return plaintext.substring(0, 12);
+}
+function toMasked(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    key_prefix: row.key_prefix,
+    permissions: row.permissions,
+    rate_limit: row.rate_limit,
+    created_by: row.created_by,
+    created_at: row.created_at,
+    updated_at: row.updated_at,
+    last_used_at: row.last_used_at,
+    expires_at: row.expires_at,
+    revoked_at: row.revoked_at
+  };
+}
+function rowToApiKey(row) {
+  const permissions = typeof row.permissions === "string" ? JSON.parse(row.permissions) : row.permissions ?? [];
+  return {
+    id: row.id,
+    name: row.name,
+    key_prefix: row.key_prefix,
+    key_hash: row.key_hash,
+    permissions,
+    rate_limit: row.rate_limit !== null && row.rate_limit !== void 0 ? Number(row.rate_limit) : null,
+    created_by: row.created_by,
+    created_at: new Date(row.created_at).toISOString(),
+    updated_at: new Date(row.updated_at).toISOString(),
+    last_used_at: row.last_used_at ? new Date(row.last_used_at).toISOString() : null,
+    expires_at: row.expires_at ? new Date(row.expires_at).toISOString() : null,
+    revoked_at: row.revoked_at ? new Date(row.revoked_at).toISOString() : null
+  };
+}
+function esc(value) {
+  return value.replace(/'/g, "''");
+}
+function createApiKeyStore(driver) {
+  const admin = driver.admin;
+  if (!isSQLAdmin(admin)) {
+    logger.warn("⚠️ [api-key-store] DataDriver does not support SQL admin — API keys will not be available.");
+    return void 0;
+  }
+  const exec = admin.executeSql.bind(admin);
+  return {
+    // ── Schema bootstrap ────────────────────────────────────────
+    async ensureTable() {
+      try {
+        await exec("CREATE SCHEMA IF NOT EXISTS rebase");
+        await exec(`
+                    CREATE TABLE IF NOT EXISTS ${TABLE$1} (
+                        id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                        name TEXT NOT NULL,
+                        key_prefix TEXT NOT NULL,
+                        key_hash TEXT NOT NULL UNIQUE,
+                        permissions JSONB NOT NULL DEFAULT '[]'::jsonb,
+                        rate_limit INTEGER,
+                        created_by TEXT NOT NULL,
+                        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                        last_used_at TIMESTAMPTZ,
+                        expires_at TIMESTAMPTZ,
+                        revoked_at TIMESTAMPTZ
+                    )
+                `);
+        await exec(`
+                    CREATE INDEX IF NOT EXISTS idx_api_keys_hash
+                    ON ${TABLE$1}(key_hash)
+                `);
+        await exec(`
+                    CREATE INDEX IF NOT EXISTS idx_api_keys_prefix
+                    ON ${TABLE$1}(key_prefix)
+                `);
+        logger.info("✅ API keys table ready");
+      } catch (err) {
+        logger.error("❌ Failed to create API keys table", {
+          error: err
+        });
+        logger.warn("⚠️ Continuing without API keys support.");
+      }
+    },
+    // ── Create ──────────────────────────────────────────────────
+    async createApiKey(request, createdBy) {
+      const plaintext = generateApiKey();
+      const hash = hashKey(plaintext);
+      const prefix = keyPrefix(plaintext);
+      const permissionsJson = JSON.stringify(request.permissions);
+      const rateLimitSql = request.rate_limit !== null && request.rate_limit !== void 0 ? String(request.rate_limit) : "NULL";
+      const expiresAtSql = request.expires_at ? `'${esc(request.expires_at)}'` : "NULL";
+      const rows = await exec(`
+                INSERT INTO ${TABLE$1} (name, key_prefix, key_hash, permissions, rate_limit, created_by, expires_at)
+                VALUES (
+                    '${esc(request.name)}',
+                    '${esc(prefix)}',
+                    '${esc(hash)}',
+                    '${esc(permissionsJson)}'::jsonb,
+                    ${rateLimitSql},
+                    '${esc(createdBy)}',
+                    ${expiresAtSql}
+                )
+                RETURNING *
+            `);
+      const apiKey = rowToApiKey(rows[0]);
+      return {
+        ...toMasked(apiKey),
+        key: plaintext
+      };
+    },
+    // ── Lookup by hash ──────────────────────────────────────────
+    async findByKeyHash(hash) {
+      const rows = await exec(`
+                SELECT * FROM ${TABLE$1}
+                WHERE key_hash = '${esc(hash)}'
+                LIMIT 1
+            `);
+      if (rows.length === 0) return null;
+      return rowToApiKey(rows[0]);
+    },
+    // ── List all (masked) ───────────────────────────────────────
+    async listApiKeys() {
+      const rows = await exec(`
+                SELECT * FROM ${TABLE$1}
+                ORDER BY created_at DESC
+            `);
+      return rows.map((r) => toMasked(rowToApiKey(r)));
+    },
+    // ── Get by ID (masked) ──────────────────────────────────────
+    async getApiKeyById(id) {
+      const rows = await exec(`
+                SELECT * FROM ${TABLE$1}
+                WHERE id = '${esc(id)}'
+                LIMIT 1
+            `);
+      if (rows.length === 0) return null;
+      return toMasked(rowToApiKey(rows[0]));
+    },
+    // ── Update ──────────────────────────────────────────────────
+    async updateApiKey(id, updates) {
+      const setClauses = [];
+      if (updates.name !== void 0) {
+        setClauses.push(`name = '${esc(updates.name)}'`);
+      }
+      if (updates.permissions !== void 0) {
+        setClauses.push(`permissions = '${esc(JSON.stringify(updates.permissions))}'::jsonb`);
+      }
+      if (updates.rate_limit !== void 0) {
+        setClauses.push(updates.rate_limit !== null ? `rate_limit = ${updates.rate_limit}` : "rate_limit = NULL");
+      }
+      if (updates.expires_at !== void 0) {
+        setClauses.push(updates.expires_at !== null ? `expires_at = '${esc(updates.expires_at)}'` : "expires_at = NULL");
+      }
+      if (setClauses.length === 0) {
+        return this.getApiKeyById(id);
+      }
+      setClauses.push("updated_at = NOW()");
+      const rows = await exec(`
+                UPDATE ${TABLE$1}
+                SET ${setClauses.join(", ")}
+                WHERE id = '${esc(id)}'
+                RETURNING *
+            `);
+      if (rows.length === 0) return null;
+      return toMasked(rowToApiKey(rows[0]));
+    },
+    // ── Revoke (soft-delete) ────────────────────────────────────
+    async revokeApiKey(id) {
+      const rows = await exec(`
+                UPDATE ${TABLE$1}
+                SET revoked_at = NOW(), updated_at = NOW()
+                WHERE id = '${esc(id)}' AND revoked_at IS NULL
+                RETURNING id
+            `);
+      return rows.length > 0;
+    },
+    // ── Touch last_used_at ──────────────────────────────────────
+    async updateLastUsed(id) {
+      try {
+        await exec(`
+                    UPDATE ${TABLE$1}
+                    SET last_used_at = NOW()
+                    WHERE id = '${esc(id)}'
+                `);
+      } catch (err) {
+        logger.error("[api-key-store] Failed to update last_used_at", {
+          error: err
+        });
+      }
+    }
+  };
+}
+function validatePermissions(permissions) {
+  if (!Array.isArray(permissions)) return false;
+  for (const perm of permissions) {
+    if (typeof perm !== "object" || perm === null) return false;
+    if (typeof perm.collection !== "string" || perm.collection.length === 0) return false;
+    if (!Array.isArray(perm.operations) || perm.operations.length === 0) return false;
+    const validOps = /* @__PURE__ */ new Set(["read", "write", "delete"]);
+    for (const op of perm.operations) {
+      if (!validOps.has(op)) return false;
+    }
+  }
+  return true;
+}
+function createApiKeyRoutes(options2) {
+  const {
+    store,
+    serviceKey
+  } = options2;
+  const router = new Hono();
+  router.onError(errorHandler);
+  router.use("/*", createRequireAuth({
+    serviceKey
+  }));
+  router.use("/*", requireAdmin);
+  router.get("/", async (c) => {
+    const keys2 = await store.listApiKeys();
+    return c.json({
+      keys: keys2
+    });
+  });
+  router.post("/", async (c) => {
+    const body = await c.req.json();
+    const {
+      name: name2,
+      permissions,
+      rate_limit,
+      expires_at
+    } = body;
+    if (!name2 || typeof name2 !== "string" || name2.trim().length === 0) {
+      throw ApiError.badRequest("Name is required", "INVALID_INPUT");
+    }
+    if (!validatePermissions(permissions)) {
+      throw ApiError.badRequest("Permissions must be an array of { collection: string, operations: ('read' | 'write' | 'delete')[] }", "INVALID_INPUT");
+    }
+    if (rate_limit !== void 0 && rate_limit !== null) {
+      if (typeof rate_limit !== "number" || rate_limit < 1 || !Number.isInteger(rate_limit)) {
+        throw ApiError.badRequest("rate_limit must be a positive integer or null", "INVALID_INPUT");
+      }
+    }
+    if (expires_at !== void 0 && expires_at !== null) {
+      const parsed = new Date(expires_at);
+      if (isNaN(parsed.getTime())) {
+        throw ApiError.badRequest("expires_at must be a valid ISO-8601 date", "INVALID_INPUT");
+      }
+      if (parsed <= /* @__PURE__ */ new Date()) {
+        throw ApiError.badRequest("expires_at must be in the future", "INVALID_INPUT");
+      }
+    }
+    const user = c.get("user");
+    const createdBy = user && typeof user === "object" && "userId" in user ? user.userId : "unknown";
+    const request = {
+      name: name2.trim(),
+      permissions,
+      rate_limit: rate_limit ?? null,
+      expires_at: expires_at ?? null
+    };
+    const keyWithSecret = await store.createApiKey(request, createdBy);
+    return c.json({
+      key: keyWithSecret
+    }, 201);
+  });
+  router.get("/:id", async (c) => {
+    const id = c.req.param("id");
+    const key = await store.getApiKeyById(id);
+    if (!key) {
+      throw ApiError.notFound("API key not found");
+    }
+    return c.json({
+      key
+    });
+  });
+  router.put("/:id", async (c) => {
+    const id = c.req.param("id");
+    const body = await c.req.json();
+    const {
+      name: name2,
+      permissions,
+      rate_limit,
+      expires_at
+    } = body;
+    if (name2 !== void 0) {
+      if (typeof name2 !== "string" || name2.trim().length === 0) {
+        throw ApiError.badRequest("Name must be a non-empty string", "INVALID_INPUT");
+      }
+    }
+    if (permissions !== void 0) {
+      if (!validatePermissions(permissions)) {
+        throw ApiError.badRequest("Permissions must be an array of { collection: string, operations: ('read' | 'write' | 'delete')[] }", "INVALID_INPUT");
+      }
+    }
+    if (rate_limit !== void 0 && rate_limit !== null) {
+      if (typeof rate_limit !== "number" || rate_limit < 1 || !Number.isInteger(rate_limit)) {
+        throw ApiError.badRequest("rate_limit must be a positive integer or null", "INVALID_INPUT");
+      }
+    }
+    if (expires_at !== void 0 && expires_at !== null) {
+      const parsed = new Date(expires_at);
+      if (isNaN(parsed.getTime())) {
+        throw ApiError.badRequest("expires_at must be a valid ISO-8601 date", "INVALID_INPUT");
+      }
+    }
+    const updates = {};
+    if (name2 !== void 0) updates.name = name2.trim();
+    if (permissions !== void 0) updates.permissions = permissions;
+    if (rate_limit !== void 0) updates.rate_limit = rate_limit;
+    if (expires_at !== void 0) updates.expires_at = expires_at;
+    const key = await store.updateApiKey(id, updates);
+    if (!key) {
+      throw ApiError.notFound("API key not found");
+    }
+    return c.json({
+      key
+    });
+  });
+  router.delete("/:id", async (c) => {
+    const id = c.req.param("id");
+    const revoked = await store.revokeApiKey(id);
+    if (!revoked) {
+      throw ApiError.notFound("API key not found or already revoked");
+    }
+    return c.json({
+      success: true
+    });
+  });
+  return router;
+}
 function createCustomAuthAdapter(options2) {
   const defaultCapabilities = {
     hasBuiltInAuthRoutes: false,
@@ -23477,7 +24932,6 @@ function createCustomAuthAdapter(options2) {
     verifyRequest: options2.verifyRequest,
     verifyToken: resolvedVerifyToken,
     userManagement: options2.userManagement,
-    roleManagement: options2.roleManagement,
     getCapabilities() {
       return defaultCapabilities;
     }
@@ -24003,6 +25457,409 @@ class S3StorageController {
     };
   }
 }
+let sharpFactory;
+async function getSharp() {
+  if (!sharpFactory) {
+    try {
+      const mod = await import("sharp");
+      sharpFactory = mod.default;
+    } catch (err) {
+      throw new Error("Failed to load optional 'sharp' dependency for image transformation.");
+    }
+  }
+  if (!sharpFactory) {
+    throw new Error("Failed to load optional 'sharp' dependency for image transformation.");
+  }
+  return sharpFactory;
+}
+const MAX_DIMENSION = 4096;
+const MAX_QUALITY = 100;
+const MIN_QUALITY = 1;
+const VALID_FORMATS = /* @__PURE__ */ new Set(["webp", "avif", "jpeg", "png"]);
+const VALID_FITS = /* @__PURE__ */ new Set(["cover", "contain", "fill", "inside", "outside"]);
+function parseTransformOptions(query) {
+  const opts = {};
+  let hasTransform = false;
+  if (query.width) {
+    const w2 = parseInt(query.width, 10);
+    if (!Number.isNaN(w2) && w2 > 0) {
+      opts.width = Math.min(w2, MAX_DIMENSION);
+      hasTransform = true;
+    }
+  }
+  if (query.height) {
+    const h2 = parseInt(query.height, 10);
+    if (!Number.isNaN(h2) && h2 > 0) {
+      opts.height = Math.min(h2, MAX_DIMENSION);
+      hasTransform = true;
+    }
+  }
+  if (query.quality) {
+    const q = parseInt(query.quality, 10);
+    if (!Number.isNaN(q)) {
+      opts.quality = Math.min(Math.max(q, MIN_QUALITY), MAX_QUALITY);
+      hasTransform = true;
+    }
+  }
+  if (query.format && VALID_FORMATS.has(query.format)) {
+    opts.format = query.format;
+    hasTransform = true;
+  }
+  if (query.fit && VALID_FITS.has(query.fit)) {
+    opts.fit = query.fit;
+    hasTransform = true;
+  }
+  return hasTransform ? opts : null;
+}
+const FORMAT_CONTENT_TYPES = {
+  webp: "image/webp",
+  avif: "image/avif",
+  jpeg: "image/jpeg",
+  png: "image/png"
+};
+function isTransformableImage(contentType) {
+  return contentType.startsWith("image/") && !contentType.includes("svg") && !contentType.includes("gif");
+}
+async function transformImage(buffer, options2) {
+  const sharp = await getSharp();
+  let pipeline = sharp(buffer);
+  if (options2.width || options2.height) {
+    pipeline = pipeline.resize({
+      width: options2.width,
+      height: options2.height,
+      fit: options2.fit || "cover",
+      withoutEnlargement: true
+    });
+  }
+  const format = options2.format || "webp";
+  const quality = options2.quality || 80;
+  switch (format) {
+    case "webp":
+      pipeline = pipeline.webp({
+        quality
+      });
+      break;
+    case "avif":
+      pipeline = pipeline.avif({
+        quality
+      });
+      break;
+    case "jpeg":
+      pipeline = pipeline.jpeg({
+        quality
+      });
+      break;
+    case "png":
+      pipeline = pipeline.png({
+        quality
+      });
+      break;
+  }
+  const data = await pipeline.toBuffer();
+  return {
+    data,
+    contentType: FORMAT_CONTENT_TYPES[format]
+  };
+}
+class TransformCache {
+  cache = /* @__PURE__ */ new Map();
+  maxEntries;
+  maxAgeMs;
+  constructor(maxEntries = 500, maxAgeMs = 36e5) {
+    this.maxEntries = maxEntries;
+    this.maxAgeMs = maxAgeMs;
+  }
+  /** Build a deterministic cache key from file key + transform options. */
+  buildKey(fileKey, options2) {
+    return `${fileKey}::${JSON.stringify(options2)}`;
+  }
+  get(cacheKey) {
+    const entry = this.cache.get(cacheKey);
+    if (!entry) return null;
+    if (Date.now() - entry.timestamp > this.maxAgeMs) {
+      this.cache.delete(cacheKey);
+      return null;
+    }
+    this.cache.delete(cacheKey);
+    this.cache.set(cacheKey, entry);
+    return {
+      data: entry.data,
+      contentType: entry.contentType
+    };
+  }
+  set(cacheKey, data, contentType) {
+    if (this.cache.size >= this.maxEntries) {
+      const oldest = this.cache.keys().next().value;
+      if (oldest !== void 0) this.cache.delete(oldest);
+    }
+    this.cache.set(cacheKey, {
+      data,
+      contentType,
+      timestamp: Date.now()
+    });
+  }
+}
+const MAX_UPLOAD_SIZE = 5 * 1024 * 1024 * 1024;
+const UPLOAD_EXPIRY_MS = 24 * 60 * 60 * 1e3;
+class TusHandler {
+  constructor(storageBaseDir, storageController) {
+    this.storageController = storageController;
+    this.tusDir = join$1(storageBaseDir, ".tus-uploads");
+  }
+  uploads = /* @__PURE__ */ new Map();
+  tusDir;
+  cleanupTimer;
+  /** Ensure the temp directory exists. */
+  async ensureDir() {
+    if (!existsSync(this.tusDir)) {
+      await mkdir$1(this.tusDir, {
+        recursive: true
+      });
+    }
+  }
+  /** Start periodic cleanup of stale uploads. */
+  startCleanup() {
+    if (this.cleanupTimer) return;
+    this.cleanupTimer = setInterval(() => {
+      void this.cleanupStale();
+    }, 6e4);
+  }
+  /** Remove uploads that have been idle for longer than UPLOAD_EXPIRY_MS. */
+  async cleanupStale() {
+    const now = Date.now();
+    for (const [id, upload] of this.uploads) {
+      if (now - upload.createdAt > UPLOAD_EXPIRY_MS && !upload.completed) {
+        try {
+          await unlink$1(upload.filePath);
+        } catch {
+        }
+        this.uploads.delete(id);
+      }
+    }
+  }
+  // -----------------------------------------------------------------------
+  // TUS Metadata Parsing
+  // -----------------------------------------------------------------------
+  /**
+   * Parse the `Upload-Metadata` header.
+   *
+   * Format: `key base64value,key2 base64value2`
+   */
+  parseMetadata(header) {
+    const metadata = {};
+    if (!header) return metadata;
+    for (const pair of header.split(",")) {
+      const trimmed = pair.trim();
+      const spaceIdx = trimmed.indexOf(" ");
+      if (spaceIdx === -1) {
+        metadata[trimmed] = "";
+      } else {
+        const key = trimmed.substring(0, spaceIdx);
+        const value = Buffer.from(trimmed.substring(spaceIdx + 1), "base64").toString("utf-8");
+        metadata[key] = value;
+      }
+    }
+    return metadata;
+  }
+  // -----------------------------------------------------------------------
+  // Protocol Endpoints
+  // -----------------------------------------------------------------------
+  /** `OPTIONS /tus` — TUS capability discovery. */
+  options() {
+    return new Response(null, {
+      status: 204,
+      headers: {
+        "Tus-Resumable": "1.0.0",
+        "Tus-Version": "1.0.0",
+        "Tus-Extension": "creation,termination",
+        "Tus-Max-Size": String(MAX_UPLOAD_SIZE)
+      }
+    });
+  }
+  /** `POST /tus` — Create a new upload. */
+  async create(c) {
+    await this.ensureDir();
+    const uploadLengthHeader = c.req.header("Upload-Length");
+    if (!uploadLengthHeader) {
+      return c.json({
+        error: "Upload-Length header is required"
+      }, 400);
+    }
+    const uploadLength = parseInt(uploadLengthHeader, 10);
+    if (Number.isNaN(uploadLength) || uploadLength <= 0) {
+      return c.json({
+        error: "Invalid Upload-Length"
+      }, 400);
+    }
+    if (uploadLength > MAX_UPLOAD_SIZE) {
+      return c.json({
+        error: `Upload-Length exceeds maximum of ${MAX_UPLOAD_SIZE} bytes`
+      }, 413);
+    }
+    const metadata = this.parseMetadata(c.req.header("Upload-Metadata") || "");
+    const id = randomUUID$1();
+    const filePath = join$1(this.tusDir, id);
+    await writeFile$1(filePath, Buffer.alloc(0));
+    const upload = {
+      id,
+      size: uploadLength,
+      offset: 0,
+      metadata,
+      createdAt: Date.now(),
+      filePath,
+      bucket: metadata.bucket || void 0,
+      key: metadata.key || metadata.filename || void 0,
+      completed: false
+    };
+    this.uploads.set(id, upload);
+    const reqUrl = new URL(c.req.url);
+    const location = `${reqUrl.origin}${reqUrl.pathname}/${id}`;
+    return new Response(null, {
+      status: 201,
+      headers: {
+        Location: location,
+        "Tus-Resumable": "1.0.0",
+        "Upload-Offset": "0"
+      }
+    });
+  }
+  /** `HEAD /tus/:id` — Query upload progress. */
+  head(c, id) {
+    const upload = this.uploads.get(id);
+    if (!upload) {
+      return c.json({
+        error: "Upload not found"
+      }, 404);
+    }
+    return new Response(null, {
+      status: 200,
+      headers: {
+        "Tus-Resumable": "1.0.0",
+        "Upload-Offset": String(upload.offset),
+        "Upload-Length": String(upload.size),
+        "Cache-Control": "no-store"
+      }
+    });
+  }
+  /** `PATCH /tus/:id` — Append data to an upload. */
+  async patch(c, id) {
+    const upload = this.uploads.get(id);
+    if (!upload) {
+      return c.json({
+        error: "Upload not found"
+      }, 404);
+    }
+    if (upload.completed) {
+      return c.json({
+        error: "Upload already completed"
+      }, 400);
+    }
+    const offsetHeader = c.req.header("Upload-Offset");
+    if (!offsetHeader) {
+      return c.json({
+        error: "Upload-Offset header is required"
+      }, 400);
+    }
+    const offset = parseInt(offsetHeader, 10);
+    if (offset !== upload.offset) {
+      return c.json({
+        error: "Offset mismatch"
+      }, 409);
+    }
+    const contentType = c.req.header("Content-Type");
+    if (contentType !== "application/offset+octet-stream") {
+      return c.json({
+        error: "Content-Type must be application/offset+octet-stream"
+      }, 415);
+    }
+    const body = await c.req.arrayBuffer();
+    const chunk = Buffer.from(body);
+    if (upload.offset + chunk.length > upload.size) {
+      return c.json({
+        error: "Chunk exceeds declared Upload-Length"
+      }, 413);
+    }
+    const fh = await open(upload.filePath, "a");
+    try {
+      await fh.write(chunk);
+    } finally {
+      await fh.close();
+    }
+    upload.offset += chunk.length;
+    if (upload.offset >= upload.size) {
+      await this.finalize(upload);
+    }
+    return new Response(null, {
+      status: 204,
+      headers: {
+        "Tus-Resumable": "1.0.0",
+        "Upload-Offset": String(upload.offset)
+      }
+    });
+  }
+  /** `DELETE /tus/:id` — Cancel and remove an upload. */
+  async delete(c, id) {
+    const upload = this.uploads.get(id);
+    if (!upload) {
+      return c.json({
+        error: "Upload not found"
+      }, 404);
+    }
+    try {
+      await unlink$1(upload.filePath);
+    } catch {
+    }
+    this.uploads.delete(id);
+    return new Response(null, {
+      status: 204,
+      headers: {
+        "Tus-Resumable": "1.0.0"
+      }
+    });
+  }
+  // -----------------------------------------------------------------------
+  // Finalization
+  // -----------------------------------------------------------------------
+  /**
+   * Move a completed upload into the storage controller.
+   */
+  async finalize(upload) {
+    upload.completed = true;
+    if (!this.storageController) {
+      logger.warn("[TUS] Upload completed but no StorageController configured. Temp file remains:", {
+        filePath: upload.filePath
+      });
+      return;
+    }
+    try {
+      const {
+        readFile: readFile2
+      } = await import("fs/promises");
+      const data = await readFile2(upload.filePath);
+      const fileName = upload.key || upload.metadata.filename || upload.id;
+      const mimeType = upload.metadata.contentType || upload.metadata.filetype || "application/octet-stream";
+      const file = new File([data], fileName, {
+        type: mimeType
+      });
+      await this.storageController.putObject({
+        file,
+        key: fileName,
+        bucket: upload.bucket
+      });
+      try {
+        await unlink$1(upload.filePath);
+      } catch {
+      }
+      this.uploads.delete(upload.id);
+      logger.info(`[TUS] Upload ${upload.id} finalized → ${fileName}`);
+    } catch (err) {
+      logger.error(`[TUS] Failed to finalize upload ${upload.id}`, {
+        error: err
+      });
+    }
+  }
+}
+const transformCache = new TransformCache();
 function extractWildcardPath(c) {
   const routePath = c.req.routePath;
   const prefix = routePath.replace("/*", "");
@@ -24066,6 +25923,7 @@ function createStorageRoutes(config) {
       throw ApiError.notFound("File not found");
     }
     const filePath = decodeURIComponent(rawPath);
+    const transformOpts = parseTransformOptions(c.req.query());
     if (controller.getType() === "local") {
       const localController = controller;
       const {
@@ -24085,8 +25943,19 @@ function createStorageRoutes(config) {
         } catch {
         }
       }
-      c.header("Content-Type", contentType);
       const fileContent = fs$4.readFileSync(absolutePath);
+      if (transformOpts && isTransformableImage(contentType)) {
+        const cacheKey = transformCache.buildKey(filePath, transformOpts);
+        let cached = transformCache.get(cacheKey);
+        if (!cached) {
+          cached = await transformImage(Buffer.from(fileContent), transformOpts);
+          transformCache.set(cacheKey, cached.data, cached.contentType);
+        }
+        c.header("Content-Type", cached.contentType);
+        c.header("Cache-Control", "public, max-age=31536000, immutable");
+        return c.body(new Uint8Array(cached.data));
+      }
+      c.header("Content-Type", contentType);
       return c.body(new Uint8Array(fileContent));
     }
     const {
@@ -24097,7 +25966,20 @@ function createStorageRoutes(config) {
     if (!fileObject) {
       throw ApiError.notFound("File not found");
     }
-    c.header("Content-Type", fileObject.type || "application/octet-stream");
+    const remoteContentType = fileObject.type || "application/octet-stream";
+    if (transformOpts && isTransformableImage(remoteContentType)) {
+      const cacheKey = transformCache.buildKey(filePath, transformOpts);
+      let cached = transformCache.get(cacheKey);
+      if (!cached) {
+        const buf2 = Buffer.from(await fileObject.arrayBuffer());
+        cached = await transformImage(buf2, transformOpts);
+        transformCache.set(cacheKey, cached.data, cached.contentType);
+      }
+      c.header("Content-Type", cached.contentType);
+      c.header("Cache-Control", "public, max-age=31536000, immutable");
+      return c.body(new Uint8Array(cached.data));
+    }
+    c.header("Content-Type", remoteContentType);
     c.header("Cache-Control", "public, max-age=3600, immutable");
     const buf = await fileObject.arrayBuffer();
     return c.body(new Uint8Array(buf));
@@ -24193,6 +26075,14 @@ function createStorageRoutes(config) {
       message: "Folder created"
     }, 201);
   });
+  const tusBaseDir = controller.getType() === "local" ? controller.getBasePath() : process.env.STORAGE_PATH || "./uploads";
+  const tusHandler = new TusHandler(tusBaseDir, controller);
+  tusHandler.startCleanup();
+  router.options("/tus", (_c2) => tusHandler.options());
+  router.post("/tus", writeAuthMiddleware, async (c) => tusHandler.create(c));
+  router.get("/tus/:id", readAuthMiddleware, (c) => tusHandler.head(c, c.req.param("id")));
+  router.patch("/tus/:id", writeAuthMiddleware, async (c) => tusHandler.patch(c, c.req.param("id")));
+  router.delete("/tus/:id", writeAuthMiddleware, async (c) => tusHandler.delete(c, c.req.param("id")));
   return router;
 }
 const DEFAULT_STORAGE_ID = "(default)";
@@ -24416,6 +26306,13 @@ function createTransport$1(config) {
       } catch (e) {
       }
     }
+    const getErrorField = (obj, field) => {
+      const err = obj?.error;
+      if (err && typeof err === "object" && err !== null && field in err) {
+        return err[field];
+      }
+      return obj?.[field];
+    };
     if (res.status === 401 && onUnauthorizedHandler) {
       const retried = await onUnauthorizedHandler();
       if (retried) {
@@ -24449,7 +26346,7 @@ function createTransport$1(config) {
             const method = init?.method || "GET";
             fallbackMessage = `Endpoint not found (${method} ${path2}). This usually means the collection is not registered on the backend, or the frontend API URL configuration (e.g. VITE_API_URL) is missing or pointing to the wrong host.`;
           }
-          throw new RebaseApiError(retryRes.status, retryBody?.error?.message || retryBody?.message || fallbackMessage || `Request failed with status ${retryRes.status}`, retryBody?.error?.code || retryBody?.code, retryBody?.error?.details || retryBody?.details);
+          throw new RebaseApiError(retryRes.status, String(getErrorField(retryBody, "message") || fallbackMessage || `Request failed with status ${retryRes.status}`), getErrorField(retryBody, "code"), getErrorField(retryBody, "details"));
         }
         return retryBody;
       }
@@ -24460,7 +26357,7 @@ function createTransport$1(config) {
         const method = init?.method || "GET";
         fallbackMessage = `Endpoint not found (${method} ${path2}). This usually means the collection is not registered on the backend, or the frontend API URL configuration (e.g. VITE_API_URL) is missing or pointing to the wrong host.`;
       }
-      throw new RebaseApiError(res.status, body?.error?.message || body?.message || fallbackMessage || `Request failed with status ${res.status}`, body?.error?.code || body?.code, body?.error?.details || body?.details);
+      throw new RebaseApiError(res.status, String(getErrorField(body, "message") || fallbackMessage || `Request failed with status ${res.status}`), getErrorField(body, "code"), getErrorField(body, "details"));
     }
     return body;
   }
@@ -25034,33 +26931,6 @@ function createAdmin(transport, options2) {
       method: "DELETE"
     });
   }
-  async function listRoles() {
-    return transport.request(adminPath + "/roles", {
-      method: "GET"
-    });
-  }
-  async function getRole(roleId) {
-    return transport.request(adminPath + "/roles/" + encodeURIComponent(roleId), {
-      method: "GET"
-    });
-  }
-  async function createRole(data) {
-    return transport.request(adminPath + "/roles", {
-      method: "POST",
-      body: JSON.stringify(data)
-    });
-  }
-  async function updateRole(roleId, data) {
-    return transport.request(adminPath + "/roles/" + encodeURIComponent(roleId), {
-      method: "PUT",
-      body: JSON.stringify(data)
-    });
-  }
-  async function deleteRole(roleId) {
-    return transport.request(adminPath + "/roles/" + encodeURIComponent(roleId), {
-      method: "DELETE"
-    });
-  }
   async function bootstrap() {
     return transport.request(adminPath + "/bootstrap", {
       method: "POST"
@@ -25073,11 +26943,6 @@ function createAdmin(transport, options2) {
     createUser,
     updateUser,
     deleteUser,
-    listRoles,
-    getRole,
-    createRole,
-    updateRole,
-    deleteRole,
     bootstrap
   };
 }
@@ -25716,7 +27581,7 @@ const require$$9 = {
 const http = require$$0$6;
 const https = require$$1;
 const urllib$2 = require$$0$5;
-const zlib = require$$11;
+const zlib = require$$3;
 const PassThrough$3 = require$$0$4.PassThrough;
 const Cookies2 = cookies;
 const packageData$7 = require$$9;
@@ -25951,9 +27816,9 @@ var fetchExports = fetch$1.exports;
   const util2 = require$$5;
   const fs2 = fs__default;
   const nmfetch2 = fetchExports;
-  const dns2 = require$$11;
+  const dns2 = require$$4$1;
   const net2 = require$$0$7;
-  const os2 = require$$1$2;
+  const os2 = require$$1$3;
   const DNS_TTL = 5 * 60 * 1e3;
   let networkInterfaces;
   try {
@@ -32099,7 +33964,7 @@ const urllib = require$$0$5;
 const packageData$6 = require$$9;
 const MailMessage2 = mailMessage;
 const net$1 = require$$0$7;
-const dns = require$$11;
+const dns = require$$4$1;
 const crypto$3 = require$$0__default;
 class Mail extends EventEmitter$5 {
   constructor(transporter, options2, defaults) {
@@ -32535,7 +34400,7 @@ const packageInfo = require$$9;
 const EventEmitter$4 = require$$0$9.EventEmitter;
 const net = require$$0$7;
 const tls = require$$1$1;
-const os = require$$1$2;
+const os = require$$1$3;
 const crypto$2 = require$$0__default;
 const DataStream2 = dataStream;
 const PassThrough = require$$0$4.PassThrough;
@@ -36622,6 +38487,9 @@ async function _initializeRebaseBackend(config) {
       dir: config.collectionsDir
     });
   }
+  if (config.auth) {
+    activeCollections = Array.from(new Map([defaultUsersCollection, ...activeCollections].map((c) => [c.slug, c])).values());
+  }
   const realtimeServices = {};
   const delegates = {};
   let bootstrappers = config.bootstrappers || [];
@@ -36690,8 +38558,7 @@ async function _initializeRebaseBackend(config) {
         id: authAdapter.id
       });
       authConfigResult = {
-        userService: authAdapter.userManagement ?? {},
-        roleService: authAdapter.roleManagement ?? {}
+        userService: authAdapter.userManagement ?? {}
       };
     } else {
       const safeAuthConfig = config.auth;
@@ -36723,7 +38590,7 @@ async function _initializeRebaseBackend(config) {
             oauthProviders,
             serviceKey,
             hooks: config.hooks,
-            overrides: safeAuthConfig.overrides
+            authHooks: safeAuthConfig.hooks
           });
         }
         logger.info("Authentication initialized");
@@ -36790,73 +38657,73 @@ async function _initializeRebaseBackend(config) {
       if (safeAuthConfig.google?.clientId) {
         const {
           createGoogleProvider: createGoogleProvider2
-        } = await import("./index-BZoAtuqi.js");
+        } = await import("./index-Cr1D21av.js");
         oauthProviders.push(createGoogleProvider2(safeAuthConfig.google));
       }
       if (safeAuthConfig.linkedin?.clientId && safeAuthConfig.linkedin?.clientSecret) {
         const {
           createLinkedinProvider: createLinkedinProvider2
-        } = await import("./index-BZoAtuqi.js");
+        } = await import("./index-Cr1D21av.js");
         oauthProviders.push(createLinkedinProvider2(safeAuthConfig.linkedin));
       }
       if (safeAuthConfig.github?.clientId && safeAuthConfig.github?.clientSecret) {
         const {
           createGitHubProvider: createGitHubProvider2
-        } = await import("./index-BZoAtuqi.js");
+        } = await import("./index-Cr1D21av.js");
         oauthProviders.push(createGitHubProvider2(safeAuthConfig.github));
       }
       if (safeAuthConfig.microsoft?.clientId && safeAuthConfig.microsoft?.clientSecret) {
         const {
           createMicrosoftProvider: createMicrosoftProvider2
-        } = await import("./index-BZoAtuqi.js");
+        } = await import("./index-Cr1D21av.js");
         oauthProviders.push(createMicrosoftProvider2(safeAuthConfig.microsoft));
       }
       if (safeAuthConfig.apple?.clientId && safeAuthConfig.apple?.teamId && safeAuthConfig.apple?.keyId && safeAuthConfig.apple?.privateKey) {
         const {
           createAppleProvider: createAppleProvider2
-        } = await import("./index-BZoAtuqi.js");
+        } = await import("./index-Cr1D21av.js");
         oauthProviders.push(createAppleProvider2(safeAuthConfig.apple));
       }
       if (safeAuthConfig.facebook?.clientId && safeAuthConfig.facebook?.clientSecret) {
         const {
           createFacebookProvider: createFacebookProvider2
-        } = await import("./index-BZoAtuqi.js");
+        } = await import("./index-Cr1D21av.js");
         oauthProviders.push(createFacebookProvider2(safeAuthConfig.facebook));
       }
       if (safeAuthConfig.twitter?.clientId && safeAuthConfig.twitter?.clientSecret) {
         const {
           createTwitterProvider: createTwitterProvider2
-        } = await import("./index-BZoAtuqi.js");
+        } = await import("./index-Cr1D21av.js");
         oauthProviders.push(createTwitterProvider2(safeAuthConfig.twitter));
       }
       if (safeAuthConfig.discord?.clientId && safeAuthConfig.discord?.clientSecret) {
         const {
           createDiscordProvider: createDiscordProvider2
-        } = await import("./index-BZoAtuqi.js");
+        } = await import("./index-Cr1D21av.js");
         oauthProviders.push(createDiscordProvider2(safeAuthConfig.discord));
       }
       if (safeAuthConfig.gitlab?.clientId && safeAuthConfig.gitlab?.clientSecret) {
         const {
           createGitLabProvider: createGitLabProvider2
-        } = await import("./index-BZoAtuqi.js");
+        } = await import("./index-Cr1D21av.js");
         oauthProviders.push(createGitLabProvider2(safeAuthConfig.gitlab));
       }
       if (safeAuthConfig.bitbucket?.clientId && safeAuthConfig.bitbucket?.clientSecret) {
         const {
           createBitbucketProvider: createBitbucketProvider2
-        } = await import("./index-BZoAtuqi.js");
+        } = await import("./index-Cr1D21av.js");
         oauthProviders.push(createBitbucketProvider2(safeAuthConfig.bitbucket));
       }
       if (safeAuthConfig.slack?.clientId && safeAuthConfig.slack?.clientSecret) {
         const {
           createSlackProvider: createSlackProvider2
-        } = await import("./index-BZoAtuqi.js");
+        } = await import("./index-Cr1D21av.js");
         oauthProviders.push(createSlackProvider2(safeAuthConfig.slack));
       }
       if (safeAuthConfig.spotify?.clientId && safeAuthConfig.spotify?.clientSecret) {
         const {
           createSpotifyProvider: createSpotifyProvider2
-        } = await import("./index-BZoAtuqi.js");
+        } = await import("./index-Cr1D21av.js");
         oauthProviders.push(createSpotifyProvider2(safeAuthConfig.spotify));
       }
       authAdapter = createBuiltinAuthAdapter({
@@ -36868,7 +38735,7 @@ async function _initializeRebaseBackend(config) {
         oauthProviders,
         serviceKey,
         hooks: config.hooks,
-        overrides: safeAuthConfig.overrides
+        authHooks: safeAuthConfig.hooks
       });
     }
     if (authAdapter.createAuthRoutes) {
@@ -36890,6 +38757,21 @@ async function _initializeRebaseBackend(config) {
       }
     }
   }
+  let apiKeyStore;
+  const apiKeyStoreResult = createApiKeyStore(defaultDriver);
+  if (apiKeyStoreResult) {
+    apiKeyStore = apiKeyStoreResult;
+    await apiKeyStore.ensureTable();
+    logger.info("Service API Keys initialized");
+    const apiKeyRoutes = createApiKeyRoutes({
+      store: apiKeyStore,
+      serviceKey
+    });
+    config.app.route(`${basePath}/admin/api-keys`, apiKeyRoutes);
+    logger.info("API key admin routes mounted", {
+      path: `${basePath}/admin/api-keys`
+    });
+  }
   if (config.collectionsDir) {
     if (process.env.NODE_ENV !== "production") {
       const {
@@ -36940,15 +38822,20 @@ async function _initializeRebaseBackend(config) {
       dataRouter.use("/*", createAdapterAuthMiddleware({
         adapter: authAdapter,
         driver: defaultDriver,
-        requireAuth: dataRequireAuth
+        requireAuth: dataRequireAuth,
+        apiKeyStore
       }));
     } else {
       dataRouter.use("/*", createAuthMiddleware({
         driver: defaultDriver,
         requireAuth: dataRequireAuth,
-        serviceKey
+        serviceKey,
+        apiKeyStore
       }));
     }
+    if (apiKeyStore) {
+      dataRouter.use("/*", createApiKeyRateLimiter());
+    }
     if (historyConfigResult && historyConfigResult.historyService) {
       const historyRoutes = createHistoryRoutes({
         historyService: historyConfigResult.historyService,
@@ -37017,6 +38904,13 @@ async function _initializeRebaseBackend(config) {
       configured: emailService.isConfigured()
     });
   }
+  const driverAdmin = defaultBootstrapper.getAdmin?.(defaultDriverResult);
+  if (isSQLAdmin(driverAdmin)) {
+    Object.assign(serverClient, {
+      sql: (query, options2) => driverAdmin.executeSql(query, options2)
+    });
+    logger.info("SQL capability attached to singleton");
+  }
   _initRebase(serverClient);
   logger.info("Rebase singleton initialized");
   if (defaultDriverResult.internals) {
@@ -37042,13 +38936,15 @@ async function _initializeRebaseBackend(config) {
         functionsRouter.use("/*", createAdapterAuthMiddleware({
           adapter: authAdapter,
           driver: defaultDriver,
-          requireAuth: functionsRequireAuth
+          requireAuth: functionsRequireAuth,
+          apiKeyStore
         }));
       } else {
         functionsRouter.use("/*", createAuthMiddleware({
           driver: defaultDriver,
           requireAuth: functionsRequireAuth,
-          serviceKey
+          serviceKey,
+          apiKeyStore
         }));
       }
       const fnRoutes = createFunctionRoutes2(loadedFunctions);
@@ -47039,7 +48935,7 @@ class AstSchemaEditor {
       return "undefined";
     }
     if (typeof obj === "string") {
-      return `"${obj.replace(/"/g, '\\"')}"`;
+      return JSON.stringify(obj);
     }
     if (typeof obj === "number" || typeof obj === "boolean") {
       return String(obj);
@@ -47070,7 +48966,7 @@ ${indent2}]`;
                 const kind = init.getKind();
                 const isCode = kind === SyntaxKind.ArrowFunction || kind === SyntaxKind.FunctionExpression || kind === SyntaxKind.Identifier || kind === SyntaxKind.CallExpression || kind === SyntaxKind.JsxElement;
                 if (isCode || name2 === "target" || name2 === "callbacks" || name2 === "permissions" || name2 === "securityRules") {
-                  const keyStr = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name2) ? name2 : `"${name2}"`;
+                  const keyStr = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name2) ? name2 : JSON.stringify(name2);
                   preservedProps.push(`${keyStr}: ${init.getText()}`);
                 }
               }
@@ -47080,7 +48976,7 @@ ${indent2}]`;
       }
       if (keys2.length === 0 && preservedProps.length === 0) return "{}";
       const props = keys2.map((key) => {
-        const keyStr = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : `"${key}"`;
+        const keyStr = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : JSON.stringify(key);
         let childAstNode;
         if (oldAstNode && typeof record[key] === "object" && record[key] !== null && !Array.isArray(record[key])) {
           const oldProp = oldAstNode.getProperty((p) => "getName" in p && typeof p.getName === "function" && (p.getName() === key || p.getName() === `"${key}"` || p.getName() === `'${key}'`));
@@ -47122,7 +49018,7 @@ ${indent2}}`;
         }
       } else {
         propsObj.addPropertyAssignment({
-          name: /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(propertyKey) ? propertyKey : `"${propertyKey}"`,
+          name: /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(propertyKey) ? propertyKey : JSON.stringify(propertyKey),
           initializer: newInitializer
         });
       }
@@ -48193,7 +50089,7 @@ async function loadFunctionsFromDirectory(directory) {
         const mod = await dynamicImport(fileUrl);
         const exported = mod.default;
         if (!exported) {
-          console.warn(`[functions] ${file}: no default export. Skipping.`);
+          logger.warn(`[functions] ${file}: no default export. Skipping.`);
           continue;
         }
         if (isHonoLike(exported)) {
@@ -48202,7 +50098,7 @@ async function loadFunctionsFromDirectory(directory) {
             name: name2,
             app: exported
           });
-          console.log(`⚡ Loaded function route: ${name2}`);
+          logger.info(`⚡ Loaded function route: ${name2}`);
           continue;
         }
         if (typeof exported === "function") {
@@ -48213,20 +50109,20 @@ async function loadFunctionsFromDirectory(directory) {
               name: name2,
               app: result
             });
-            console.log(`⚡ Loaded function route: ${name2}`);
+            logger.info(`⚡ Loaded function route: ${name2}`);
             continue;
           }
         }
         const exportType = typeof exported;
         const keys2 = exported && typeof exported === "object" ? Object.getOwnPropertyNames(Object.getPrototypeOf(exported)).slice(0, 10).join(", ") : "N/A";
-        console.warn(`[functions] ${file}: default export is not a Hono app or factory. Skipping.
+        logger.warn(`[functions] ${file}: default export is not a Hono app or factory. Skipping.
   export type: ${exportType}${exported?.constructor?.name ? ` (${exported.constructor.name})` : ""}
   prototype methods: ${keys2}
   Hint: ensure the function exports a Hono app created with the same hono version as the server.
   The loader checks for .fetch() and .routes — any Hono-compatible app will work.`);
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        console.error(`[functions] Failed to load ${file}: ${message}`);
+        logger.error(`[functions] Failed to load ${file}: ${message}`);
       }
     }
   }
@@ -48275,12 +50171,12 @@ async function loadCronJobsFromDirectory(directory) {
         const mod = await dynamicImport(fileUrl);
         const exported = mod.default;
         if (!exported || typeof exported !== "object") {
-          console.warn(`[cron] ${file}: no valid default export. Skipping.`);
+          logger.warn(`[cron] ${file}: no valid default export. Skipping.`);
           continue;
         }
         const def = exported;
         if (typeof def.schedule !== "string" || typeof def.handler !== "function") {
-          console.warn(`[cron] ${file}: default export missing required 'schedule' or 'handler'. Skipping.`);
+          logger.warn(`[cron] ${file}: default export missing required 'schedule' or 'handler'. Skipping.`);
           continue;
         }
         const id = path$3.basename(file, path$3.extname(file));
@@ -48296,10 +50192,10 @@ async function loadCronJobsFromDirectory(directory) {
           id,
           definition
         });
-        console.log(`⏰ Loaded cron job: ${id} (${definition.schedule})`);
+        logger.info(`⏰ Loaded cron job: ${id} (${definition.schedule})`);
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        console.error(`[cron] Failed to load ${file}: ${message}`);
+        logger.error(`[cron] Failed to load ${file}: ${message}`);
       }
     }
   }
@@ -48454,12 +50350,12 @@ class CronScheduler {
     for (const loaded of loadedJobs) {
       const validation = validateCronExpression(loaded.definition.schedule);
       if (!validation.valid) {
-        console.error(`[cron] Rejecting job "${loaded.id}": invalid schedule "${loaded.definition.schedule}" — ${validation.reason}`);
+        logger.error(`[cron] Rejecting job "${loaded.id}": invalid schedule "${loaded.definition.schedule}" — ${validation.reason}`);
         continue;
       }
       const existing = this.jobs.get(loaded.id);
       if (existing) {
-        console.warn(`[cron] Duplicate cron job id: "${loaded.id}". Overwriting.`);
+        logger.warn(`[cron] Duplicate cron job id: "${loaded.id}". Overwriting.`);
         this.stopJob(loaded.id);
       }
       const enabled = loaded.definition.enabled !== false;
@@ -48497,7 +50393,9 @@ class CronScheduler {
           }
         }
       }).catch((err) => {
-        console.warn("[cron] Failed to seed job stats from database:", err);
+        logger.warn("[cron] Failed to seed job stats from database", {
+          error: err
+        });
       });
     }
     for (const [id, job] of this.jobs) {
@@ -48505,7 +50403,7 @@ class CronScheduler {
         this.scheduleNext(id);
       }
     }
-    console.log(`⏰ Cron scheduler started with ${this.jobs.size} job(s)`);
+    logger.info(`⏰ Cron scheduler started with ${this.jobs.size} job(s)`);
   }
   /**
    * Stop the scheduler and clear all timers.
@@ -48579,7 +50477,7 @@ class CronScheduler {
     const job = this.jobs.get(id);
     if (!job) return void 0;
     if (job.executing) {
-      console.warn(`[cron] Skipping manual trigger of "${id}" — already executing`);
+      logger.warn(`[cron] Skipping manual trigger of "${id}" — already executing`);
       const logEntry = {
         jobId: id,
         startedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -48623,7 +50521,7 @@ class CronScheduler {
       const timer = setTimeout(async () => {
         if (!job.enabled || !this.started) return;
         if (job.executing) {
-          console.warn(`[cron] Skipping scheduled run of "${id}" — still executing from previous run`);
+          logger.warn(`[cron] Skipping scheduled run of "${id}" — still executing from previous run`);
           this.scheduleNext(id);
           return;
         }
@@ -48637,7 +50535,9 @@ class CronScheduler {
       }
       job.timerId = timer;
     } catch (err) {
-      console.error(`[cron] Failed to schedule "${id}":`, err);
+      logger.error(`[cron] Failed to schedule "${id}"`, {
+        error: err
+      });
       job.state = "error";
       job.lastError = err instanceof Error ? err.message : String(err);
     }
@@ -48722,13 +50622,15 @@ class CronScheduler {
     }
     if (this.store) {
       this.store.insertLog(logEntry).catch((persistErr) => {
-        console.error(`[cron] Failed to persist log for "${job.id}":`, persistErr);
+        logger.error(`[cron] Failed to persist log for "${job.id}"`, {
+          error: persistErr
+        });
       });
     }
     if (success) {
-      console.log(`✅ [cron] "${job.id}" completed in ${durationMs}ms`);
+      logger.info(`✅ [cron] "${job.id}" completed in ${durationMs}ms`);
     } else {
-      console.error(`❌ [cron] "${job.id}" failed in ${durationMs}ms: ${error2}`);
+      logger.error(`❌ [cron] "${job.id}" failed in ${durationMs}ms: ${error2}`);
     }
     return logEntry;
   }
@@ -48846,7 +50748,7 @@ const TABLE = "rebase.cron_logs";
 function createCronStore(driver) {
   const admin = driver.admin;
   if (!isSQLAdmin(admin)) {
-    console.warn("⚠️ [cron-store] DataDriver does not support SQL admin — cron logs will not be persisted.");
+    logger.warn("⚠️ [cron-store] DataDriver does not support SQL admin — cron logs will not be persisted.");
     return void 0;
   }
   const exec = admin.executeSql.bind(admin);
@@ -48872,10 +50774,12 @@ function createCronStore(driver) {
                     CREATE INDEX IF NOT EXISTS idx_cron_logs_job
                     ON ${TABLE}(job_id, started_at DESC)
                 `);
-        console.log("✅ Cron logs table ready");
+        logger.info("✅ Cron logs table ready");
       } catch (err) {
-        console.error("❌ Failed to create cron logs table:", err);
-        console.warn("⚠️ Continuing without cron log persistence.");
+        logger.error("❌ Failed to create cron logs table", {
+          error: err
+        });
+        logger.warn("⚠️ Continuing without cron log persistence.");
       }
     },
     async insertLog(entry) {
@@ -48898,7 +50802,9 @@ function createCronStore(driver) {
                     )
                 `);
       } catch (err) {
-        console.error(`[cron-store] Failed to persist log for "${entry.jobId}":`, err);
+        logger.error(`[cron-store] Failed to persist log for "${entry.jobId}"`, {
+          error: err
+        });
       }
     },
     async fetchLogs(jobId, limit = 50) {
@@ -48912,7 +50818,9 @@ function createCronStore(driver) {
                 `);
         return rows.map(rowToLogEntry);
       } catch (err) {
-        console.error(`[cron-store] Failed to fetch logs for "${jobId}":`, err);
+        logger.error(`[cron-store] Failed to fetch logs for "${jobId}"`, {
+          error: err
+        });
         return [];
       }
     },
@@ -48936,7 +50844,9 @@ function createCronStore(driver) {
           });
         }
       } catch (err) {
-        console.error("[cron-store] Failed to fetch job stats:", err);
+        logger.error("[cron-store] Failed to fetch job stats", {
+          error: err
+        });
       }
       return stats;
     }
@@ -48967,8 +50877,8 @@ function serveSPA(app, config) {
     indexFile = "index.html"
   } = config;
   if (!fs$4.existsSync(frontendPath)) {
-    console.warn(`⚠️ Frontend build path does not exist: ${frontendPath}`);
-    console.warn("   SPA serving is disabled. Build your frontend first.");
+    logger.warn(`⚠️ Frontend build path does not exist: ${frontendPath}`);
+    logger.warn("   SPA serving is disabled. Build your frontend first.");
     return;
   }
   app.use("/*", serveStatic({
@@ -48981,13 +50891,13 @@ function serveSPA(app, config) {
     }
     const indexPath = path$3.join(frontendPath, indexFile);
     if (!fs$4.existsSync(indexPath)) {
-      console.warn(`⚠️ Index file not found: ${indexPath}`);
+      logger.warn(`⚠️ Index file not found: ${indexPath}`);
       return next();
     }
     const html = fs$4.readFileSync(indexPath, "utf-8");
     return c.html(html);
   });
-  console.log(`✅ SPA serving enabled from: ${frontendPath}`);
+  logger.info(`✅ SPA serving enabled from: ${frontendPath}`);
 }
 const MAX_PORT_ATTEMPTS = 20;
 const DEV_PORT_FILENAME = ".rebase-dev-port";
@@ -48995,6 +50905,19 @@ function listenWithPortRetry(server, startPort, options2) {
   const host = options2?.host ?? "0.0.0.0";
   const maxAttempts = options2?.maxAttempts ?? MAX_PORT_ATTEMPTS;
   const portFileDir = options2?.portFileDir;
+  const isProd = process.env.NODE_ENV === "production";
+  if (isProd) {
+    return new Promise((resolve, reject) => {
+      const onError = (err) => {
+        reject(err);
+      };
+      server.once("error", onError);
+      server.listen(startPort, host, () => {
+        server.removeListener("error", onError);
+        resolve(startPort);
+      });
+    });
+  }
   let affinityPort = null;
   if (portFileDir) {
     try {
@@ -49137,6 +51060,8 @@ const rebaseEnvSchema = objectType({
   DB_POOL_MAX: stringType().default("20").transform(Number),
   DB_POOL_IDLE_TIMEOUT: stringType().default("30000").transform(Number),
   DB_POOL_CONNECT_TIMEOUT: stringType().default("10000").transform(Number),
+  DATABASE_DIRECT_URL: stringType().url().optional(),
+  DATABASE_READ_URL: stringType().url().optional(),
   FORCE_LOCAL_STORAGE: optionalBoolString,
   STORAGE_TYPE: enumType(["local", "s3"]).default("local"),
   STORAGE_PATH: stringType().optional(),
@@ -49213,8 +51138,11 @@ export {
   RestApiGenerator,
   S3StorageController,
   SMTPEmailService,
+  TransformCache,
+  TusHandler,
   _resetRebaseMock,
   _setRebaseMock,
+  apiKeyKeyGenerator,
   authJwt,
   authRoles,
   authUid,
@@ -49223,6 +51151,9 @@ export {
   configureLogLevel,
   createAdapterAuthMiddleware,
   createAdminRoutes,
+  createApiKeyRateLimiter,
+  createApiKeyRoutes,
+  createApiKeyStore,
   createAppleProvider,
   createAuthMiddleware,
   createAuthRoutes,
@@ -49260,26 +51191,34 @@ export {
   getWelcomeEmailTemplate,
   hashPassword,
   hashRefreshToken,
+  httpMethodToOperation,
   initializeRebaseBackend,
+  isApiKeyToken,
   isAuthAdapter,
   isDatabaseAdapter,
+  isOperationAllowed,
+  isTransformableImage,
   listenWithPortRetry,
   loadCronJobsFromDirectory,
   loadEnv,
   loadFunctionsFromDirectory,
   logger,
   optionalAuth,
+  parseTransformOptions,
   rebase,
   requestLogger,
   requireAdmin,
   requireAuth,
   resetConsole,
-  resolveAuthOverrides,
+  resolveAuthHooks,
   serveSPA,
   strictAuthLimiter,
+  transformImage,
+  validateApiKey,
   validateCronExpression,
   validatePasswordStrength,
   verifyAccessToken,
-  verifyPassword
+  verifyPassword,
+  z
 };
 //# sourceMappingURL=index.es.js.map