@vertz/server 0.2.13 → 0.2.15

package/dist/index.js

@@ -40,7 +40,13 @@ import {
 // src/auth/billing-period.ts
 function calculateBillingPeriod(startedAt, per, now = new Date) {
   if (per === "month") {
-    return calculateMonthlyPeriod(startedAt, now);
+    return calculateMultiMonthPeriod(startedAt, now, 1);
+  }
+  if (per === "quarter") {
+    return calculateMultiMonthPeriod(startedAt, now, 3);
+  }
+  if (per === "year") {
+    return calculateMultiMonthPeriod(startedAt, now, 12);
   }
   const durationMs = per === "day" ? 24 * 60 * 60 * 1000 : 60 * 60 * 1000;
   const elapsed = now.getTime() - startedAt.getTime();
@@ -49,19 +55,21 @@ function calculateBillingPeriod(startedAt, per, now = new Date) {
   const periodEnd = new Date(periodStart.getTime() + durationMs);
   return { periodStart, periodEnd };
 }
-function calculateMonthlyPeriod(startedAt, now) {
+function calculateMultiMonthPeriod(startedAt, now, monthInterval) {
   if (now.getTime() < startedAt.getTime()) {
-    return { periodStart: new Date(startedAt), periodEnd: addMonths(startedAt, 1) };
+    return { periodStart: new Date(startedAt), periodEnd: addMonths(startedAt, monthInterval) };
   }
-  let periodStart = new Date(startedAt);
   const approxMonths = (now.getUTCFullYear() - startedAt.getUTCFullYear()) * 12 + (now.getUTCMonth() - startedAt.getUTCMonth());
-  if (approxMonths > 0) {
-    periodStart = addMonths(startedAt, approxMonths);
-    if (periodStart.getTime() > now.getTime()) {
-      periodStart = addMonths(startedAt, approxMonths - 1);
-    }
+  const periodsElapsed = Math.floor(approxMonths / monthInterval);
+  let periodStart = addMonths(startedAt, periodsElapsed * monthInterval);
+  if (periodStart.getTime() > now.getTime()) {
+    periodStart = addMonths(startedAt, (periodsElapsed - 1) * monthInterval);
+  }
+  const nextStart = addMonths(startedAt, (periodsElapsed + 1) * monthInterval);
+  if (nextStart.getTime() <= now.getTime()) {
+    periodStart = nextStart;
   }
-  const periodEnd = addMonths(startedAt, getMonthOffset(startedAt, periodStart) + 1);
+  const periodEnd = addMonths(startedAt, getMonthOffset(startedAt, periodStart) + monthInterval);
   return { periodStart, periodEnd };
 }
 function addMonths(base, months) {
@@ -92,6 +100,7 @@ function resolveEffectivePlan(orgPlan, plans, defaultPlan = "free", now) {
 
 class InMemoryPlanStore {
   plans = new Map;
+  addOns = new Map;
   async assignPlan(orgId, planId, startedAt = new Date, expiresAt = null) {
     this.plans.set(orgId, {
       orgId,
@@ -113,9 +122,58 @@ class InMemoryPlanStore {
   async removePlan(orgId) {
     this.plans.delete(orgId);
   }
+  async attachAddOn(orgId, addOnId) {
+    if (!this.addOns.has(orgId)) {
+      this.addOns.set(orgId, new Set);
+    }
+    this.addOns.get(orgId).add(addOnId);
+  }
+  async detachAddOn(orgId, addOnId) {
+    this.addOns.get(orgId)?.delete(addOnId);
+  }
+  async getAddOns(orgId) {
+    return [...this.addOns.get(orgId) ?? []];
+  }
+  async listByPlan(planId) {
+    const result = [];
+    for (const [orgId, plan] of this.plans.entries()) {
+      if (plan.planId === planId) {
+        result.push(orgId);
+      }
+    }
+    return result;
+  }
   dispose() {
     this.plans.clear();
+    this.addOns.clear();
+  }
+}
+function checkAddOnCompatibility(accessDef, addOnId, currentPlanId) {
+  const addOnDef = accessDef.plans?.[addOnId];
+  if (!addOnDef?.requires)
+    return true;
+  return addOnDef.requires.plans.includes(currentPlanId);
+}
+function getIncompatibleAddOns(accessDef, activeAddOnIds, targetPlanId) {
+  return activeAddOnIds.filter((id) => !checkAddOnCompatibility(accessDef, id, targetPlanId));
+}
+
+// src/auth/resolve-inherited-role.ts
+function resolveInheritedRole(sourceType, sourceRole, targetType, accessDef) {
+  const hierarchy = accessDef.hierarchy;
+  const sourceIdx = hierarchy.indexOf(sourceType);
+  const targetIdx = hierarchy.indexOf(targetType);
+  if (sourceIdx === -1 || targetIdx === -1 || sourceIdx >= targetIdx)
+    return null;
+  let currentRole = sourceRole;
+  for (let i = sourceIdx;i < targetIdx; i++) {
+    const currentType = hierarchy[i];
+    const inheritanceMap = accessDef.inheritance[currentType];
+    if (!inheritanceMap || !(currentRole in inheritanceMap))
+      return null;
+    currentRole = inheritanceMap[currentRole];
   }
+  return currentRole;
 }
 
 // src/auth/access-set.ts
@@ -221,50 +279,97 @@ async function computeAccessSet(config) {
       if (effectivePlanId) {
         const planDef = accessDef.plans?.[effectivePlanId];
         if (planDef) {
-          for (const [name, entDef] of Object.entries(accessDef.entitlements)) {
-            if (entDef.plans?.length && !planDef.entitlements.includes(name)) {
+          const effectiveFeatures = new Set(planDef.features ?? []);
+          const addOns = await planStore.getAddOns?.(orgId);
+          if (addOns) {
+            for (const addOnId of addOns) {
+              const addOnDef = accessDef.plans?.[addOnId];
+              if (addOnDef?.features) {
+                for (const f of addOnDef.features)
+                  effectiveFeatures.add(f);
+              }
+            }
+          }
+          for (const name of Object.keys(accessDef.entitlements)) {
+            if (accessDef._planGatedEntitlements.has(name) && !effectiveFeatures.has(name)) {
               const entry = entitlements[name];
               const reasons = [...entry.reasons];
               if (!reasons.includes("plan_required"))
                 reasons.push("plan_required");
+              const requiredPlans = [];
+              for (const [pName, pDef] of Object.entries(accessDef.plans ?? {})) {
+                if (pDef.features?.includes(name))
+                  requiredPlans.push(pName);
+              }
               entitlements[name] = {
                 ...entry,
                 allowed: false,
                 reasons,
                 reason: reasons[0],
-                meta: { ...entry.meta, requiredPlans: [...entDef.plans] }
+                meta: { ...entry.meta, requiredPlans }
               };
             }
-            if (walletStore && planDef.limits?.[name]) {
-              const limitDef = planDef.limits[name];
-              const override = orgPlan.overrides[name];
-              const effectiveLimit = override ? Math.max(override.max, limitDef.max) : limitDef.max;
-              const { periodStart, periodEnd } = calculateBillingPeriod(orgPlan.startedAt, limitDef.per);
-              const consumed = await walletStore.getConsumption(orgId, name, periodStart, periodEnd);
-              const remaining = Math.max(0, effectiveLimit - consumed);
-              const entry = entitlements[name];
-              if (consumed >= effectiveLimit) {
-                const reasons = [...entry.reasons];
-                if (!reasons.includes("limit_reached"))
-                  reasons.push("limit_reached");
-                entitlements[name] = {
-                  ...entry,
-                  allowed: false,
-                  reasons,
-                  reason: reasons[0],
-                  meta: {
-                    ...entry.meta,
-                    limit: { max: effectiveLimit, consumed, remaining }
+            const limitKeys = accessDef._entitlementToLimitKeys[name];
+            if (walletStore && limitKeys?.length) {
+              const limitKey = limitKeys[0];
+              const limitDef = planDef.limits?.[limitKey];
+              if (limitDef) {
+                let effectiveMax = limitDef.max;
+                if (addOns) {
+                  for (const addOnId of addOns) {
+                    const addOnDef = accessDef.plans?.[addOnId];
+                    const addOnLimit = addOnDef?.limits?.[limitKey];
+                    if (addOnLimit) {
+                      if (effectiveMax === -1)
+                        break;
+                      effectiveMax += addOnLimit.max;
+                    }
                   }
-                };
-              } else {
-                entitlements[name] = {
-                  ...entry,
-                  meta: {
-                    ...entry.meta,
-                    limit: { max: effectiveLimit, consumed, remaining }
+                }
+                const override = orgPlan.overrides[limitKey];
+                if (override)
+                  effectiveMax = Math.max(effectiveMax, override.max);
+                if (effectiveMax === -1) {
+                  const entry = entitlements[name];
+                  entitlements[name] = {
+                    ...entry,
+                    meta: {
+                      ...entry.meta,
+                      limit: { key: limitKey, max: -1, consumed: 0, remaining: -1 }
+                    }
+                  };
+                } else {
+                  const period = limitDef.per ? calculateBillingPeriod(orgPlan.startedAt, limitDef.per) : {
+                    periodStart: orgPlan.startedAt,
+                    periodEnd: new Date("9999-12-31T23:59:59Z")
+                  };
+                  const consumed = await walletStore.getConsumption(orgId, limitKey, period.periodStart, period.periodEnd);
+                  const remaining = Math.max(0, effectiveMax - consumed);
+                  const entry = entitlements[name];
+                  if (consumed >= effectiveMax) {
+                    const reasons = [...entry.reasons];
+                    if (!reasons.includes("limit_reached"))
+                      reasons.push("limit_reached");
+                    entitlements[name] = {
+                      ...entry,
+                      allowed: false,
+                      reasons,
+                      reason: reasons[0],
+                      meta: {
+                        ...entry.meta,
+                        limit: { key: limitKey, max: effectiveMax, consumed, remaining }
+                      }
+                    };
+                  } else {
+                    entitlements[name] = {
+                      ...entry,
+                      meta: {
+                        ...entry.meta,
+                        limit: { key: limitKey, max: effectiveMax, consumed, remaining }
+                      }
+                    };
                   }
-                };
+                }
               }
             }
           }
@@ -342,22 +447,6 @@ function addRole(map, resourceType, role) {
   }
   roles.add(role);
 }
-function resolveInheritedRole(sourceType, sourceRole, targetType, accessDef) {
-  const hierarchy = accessDef.hierarchy;
-  const sourceIdx = hierarchy.indexOf(sourceType);
-  const targetIdx = hierarchy.indexOf(targetType);
-  if (sourceIdx === -1 || targetIdx === -1 || sourceIdx >= targetIdx)
-    return null;
-  let currentRole = sourceRole;
-  for (let i = sourceIdx;i < targetIdx; i++) {
-    const currentType = hierarchy[i];
-    const inheritanceMap = accessDef.inheritance[currentType];
-    if (!inheritanceMap || !(currentRole in inheritanceMap))
-      return null;
-    currentRole = inheritanceMap[currentRole];
-  }
-  return currentRole;
-}
 
 // src/auth/cookies.ts
 var DEFAULT_COOKIE_CONFIG = {
@@ -703,7 +792,7 @@ var DEFAULT_PASSWORD_REQUIREMENTS = {
   requireNumbers: false,
   requireSymbols: false
 };
-var BCRYPT_ROUNDS = 12;
+var BCRYPT_ROUNDS = process.env.VERTZ_TEST === "1" ? 4 : 12;
 async function hashPassword(password) {
   return bcrypt.hash(password, BCRYPT_ROUNDS);
 }
@@ -1216,9 +1305,11 @@ function createAccessContext(config) {
     flagStore,
     planStore,
     walletStore,
-    orgResolver
+    overrideStore,
+    orgResolver,
+    planVersionStore
   } = config;
-  async function checkLayers1to4(entitlement, resource, resolvedOrgId) {
+  async function checkLayers1to3(entitlement, resource, resolvedOrgId, overrides) {
     if (!userId)
       return false;
     const entDef = accessDef.entitlements[entitlement];
@@ -1241,29 +1332,44 @@ function createAccessContext(config) {
     } else if (entDef.roles.length > 0 && !resource) {
       return false;
     }
-    if (entDef.plans?.length && planStore && orgResolver) {
+    if (accessDef._planGatedEntitlements.has(entitlement) && planStore && orgResolver) {
       if (!resolvedOrgId)
         return false;
       const orgPlan = await planStore.getPlan(resolvedOrgId);
       const effectivePlanId = resolveEffectivePlan(orgPlan, accessDef.plans, accessDef.defaultPlan);
       if (!effectivePlanId)
         return false;
-      const planDef = accessDef.plans?.[effectivePlanId];
-      if (!planDef || !planDef.entitlements.includes(entitlement)) {
+      const hasFeature = await resolveEffectiveFeatures(resolvedOrgId, entitlement, effectivePlanId, accessDef, planStore, planVersionStore, overrides);
+      if (!hasFeature)
         return false;
-      }
     }
     return true;
   }
   async function can(entitlement, resource) {
     const resolvedOrgId = orgResolver ? await orgResolver(resource) : null;
-    if (!await checkLayers1to4(entitlement, resource, resolvedOrgId))
+    const overrides = resolvedOrgId && overrideStore ? await overrideStore.get(resolvedOrgId) : null;
+    if (!await checkLayers1to3(entitlement, resource, resolvedOrgId, overrides))
       return false;
-    const entDef = accessDef.entitlements[entitlement];
-    if (entDef?.plans?.length && walletStore && planStore && resolvedOrgId) {
-      const walletState = await resolveWalletStateFromOrgId(entitlement, resolvedOrgId, accessDef, planStore, walletStore);
-      if (walletState && walletState.consumed >= walletState.limit) {
-        return false;
+    const limitKeys = accessDef._entitlementToLimitKeys[entitlement];
+    if (limitKeys?.length && walletStore && planStore && resolvedOrgId) {
+      const walletStates = await resolveAllLimitStates(entitlement, resolvedOrgId, accessDef, planStore, walletStore, planVersionStore, overrides);
+      for (const ws of walletStates) {
+        if (ws.max === 0)
+          return false;
+        if (ws.max === -1)
+          continue;
+        if (ws.consumed >= ws.max) {
+          if (ws.hasOverage) {
+            if (ws.overageCap !== undefined) {
+              const overageUnits = ws.consumed - ws.max;
+              const overageCost = overageUnits * (ws.overageAmount ?? 0) / (ws.overagePer ?? 1);
+              if (overageCost >= ws.overageCap)
+                return false;
+            }
+            continue;
+          }
+          return false;
+        }
       }
     }
     return true;
@@ -1287,6 +1393,7 @@ function createAccessContext(config) {
       };
     }
     const resolvedOrgId = orgResolver ? await orgResolver(resource) : null;
+    const overrides = resolvedOrgId && overrideStore ? await overrideStore.get(resolvedOrgId) : null;
     if (entDef.flags?.length && flagStore && orgResolver) {
       if (resolvedOrgId) {
         const disabledFlags = [];
@@ -1315,7 +1422,7 @@ function createAccessContext(config) {
         meta.requiredRoles = [...entDef.roles];
       }
     }
-    if (entDef.plans?.length && planStore && orgResolver) {
+    if (accessDef._planGatedEntitlements.has(entitlement) && planStore && orgResolver) {
       let planDenied = false;
       if (!resolvedOrgId) {
         planDenied = true;
@@ -1325,27 +1432,75 @@ function createAccessContext(config) {
         if (!effectivePlanId) {
           planDenied = true;
         } else {
-          const planDef = accessDef.plans?.[effectivePlanId];
-          if (!planDef || !planDef.entitlements.includes(entitlement)) {
+          const hasFeature = await resolveEffectiveFeatures(resolvedOrgId, entitlement, effectivePlanId, accessDef, planStore, planVersionStore, overrides);
+          if (!hasFeature) {
             planDenied = true;
           }
         }
       }
       if (planDenied) {
         reasons.push("plan_required");
-        meta.requiredPlans = [...entDef.plans];
+        const plansWithFeature = [];
+        if (accessDef.plans) {
+          for (const [pName, pDef] of Object.entries(accessDef.plans)) {
+            if (pDef.features?.includes(entitlement)) {
+              plansWithFeature.push(pName);
+            }
+          }
+        }
+        meta.requiredPlans = plansWithFeature;
       }
     }
-    if (entDef.plans?.length && walletStore && planStore && resolvedOrgId) {
-      const walletState = await resolveWalletStateFromOrgId(entitlement, resolvedOrgId, accessDef, planStore, walletStore);
-      if (walletState) {
-        meta.limit = {
-          max: walletState.limit,
-          consumed: walletState.consumed,
-          remaining: Math.max(0, walletState.limit - walletState.consumed)
-        };
-        if (walletState.consumed >= walletState.limit) {
+    const checkLimitKeys = accessDef._entitlementToLimitKeys[entitlement];
+    if (checkLimitKeys?.length && walletStore && planStore && resolvedOrgId) {
+      const walletStates = await resolveAllLimitStates(entitlement, resolvedOrgId, accessDef, planStore, walletStore, planVersionStore, overrides);
+      for (const ws of walletStates) {
+        const exceeded = ws.max === 0 || ws.max !== -1 && ws.consumed >= ws.max;
+        if (exceeded) {
+          if (ws.hasOverage && ws.max !== 0) {
+            let capHit = false;
+            if (ws.overageCap !== undefined) {
+              const overageUnits = ws.consumed - ws.max;
+              const overageCost = overageUnits * (ws.overageAmount ?? 0) / (ws.overagePer ?? 1);
+              if (overageCost >= ws.overageCap)
+                capHit = true;
+            }
+            if (capHit) {
+              reasons.push("limit_reached");
+              meta.limit = {
+                key: ws.key,
+                max: ws.max,
+                consumed: ws.consumed,
+                remaining: 0,
+                overage: true
+              };
+              break;
+            }
+            meta.limit = {
+              key: ws.key,
+              max: ws.max,
+              consumed: ws.consumed,
+              remaining: 0,
+              overage: true
+            };
+            continue;
+          }
           reasons.push("limit_reached");
+          meta.limit = {
+            key: ws.key,
+            max: ws.max,
+            consumed: ws.consumed,
+            remaining: Math.max(0, ws.max === -1 ? Infinity : ws.max - ws.consumed)
+          };
+          break;
+        }
+        if (!meta.limit) {
+          meta.limit = {
+            key: ws.key,
+            max: ws.max,
+            consumed: ws.consumed,
+            remaining: ws.max === -1 ? Infinity : Math.max(0, ws.max - ws.consumed)
+          };
         }
       }
     }
@@ -1375,14 +1530,26 @@ function createAccessContext(config) {
     }
     return results;
   }
+  async function canBatch(entitlement, resources) {
+    if (resources.length > MAX_BULK_CHECKS) {
+      throw new Error(`canBatch() is limited to ${MAX_BULK_CHECKS} resources per call`);
+    }
+    const results = new Map;
+    for (const resource of resources) {
+      const allowed = await can(entitlement, resource);
+      results.set(resource.id, allowed);
+    }
+    return results;
+  }
   async function canAndConsume(entitlement, resource, amount = 1) {
     const resolvedOrgId = orgResolver ? await orgResolver(resource) : null;
-    if (!await checkLayers1to4(entitlement, resource, resolvedOrgId))
+    const overrides = resolvedOrgId && overrideStore ? await overrideStore.get(resolvedOrgId) : null;
+    if (!await checkLayers1to3(entitlement, resource, resolvedOrgId, overrides))
       return false;
     if (!walletStore || !planStore || !orgResolver)
       return true;
-    const entDef = accessDef.entitlements[entitlement];
-    if (!entDef?.plans?.length)
+    const limitKeys = accessDef._entitlementToLimitKeys[entitlement];
+    if (!limitKeys?.length)
       return true;
     if (!resolvedOrgId)
       return false;
@@ -1392,40 +1559,67 @@ function createAccessContext(config) {
     const effectivePlanId = resolveEffectivePlan(orgPlan, accessDef.plans, accessDef.defaultPlan);
     if (!effectivePlanId)
       return false;
-    const planDef = accessDef.plans?.[effectivePlanId];
-    if (!planDef)
-      return false;
-    const limitDef = planDef.limits?.[entitlement];
-    if (!limitDef)
+    const limitsToConsume = await resolveAllLimitConsumptions(resolvedOrgId, entitlement, effectivePlanId, accessDef, planStore, walletStore, orgPlan, planVersionStore, overrides);
+    if (!limitsToConsume.length)
       return true;
-    const effectiveLimit = resolveEffectiveLimit(orgPlan, entitlement, limitDef);
-    const { periodStart, periodEnd } = calculateBillingPeriod(orgPlan.startedAt, limitDef.per);
-    const result = await walletStore.consume(resolvedOrgId, entitlement, periodStart, periodEnd, effectiveLimit, amount);
-    return result.success;
+    const consumed = [];
+    for (const lc of limitsToConsume) {
+      if (lc.effectiveMax === -1)
+        continue;
+      if (lc.effectiveMax === 0) {
+        await rollbackConsumptions(resolvedOrgId, consumed, walletStore, amount);
+        return false;
+      }
+      let consumeMax = lc.effectiveMax;
+      if (lc.hasOverage) {
+        if (lc.overageCap !== undefined) {
+          const currentConsumed = await walletStore.getConsumption(resolvedOrgId, lc.walletKey, lc.periodStart, lc.periodEnd);
+          const overageUnits = Math.max(0, currentConsumed + amount - lc.effectiveMax);
+          const overageCost = overageUnits * (lc.overageAmount ?? 0) / (lc.overagePer ?? 1);
+          if (overageCost > lc.overageCap) {
+            await rollbackConsumptions(resolvedOrgId, consumed, walletStore, amount);
+            return false;
+          }
+        }
+        consumeMax = Number.MAX_SAFE_INTEGER;
+      }
+      const result = await walletStore.consume(resolvedOrgId, lc.walletKey, lc.periodStart, lc.periodEnd, consumeMax, amount);
+      if (!result.success) {
+        await rollbackConsumptions(resolvedOrgId, consumed, walletStore, amount);
+        return false;
+      }
+      consumed.push({
+        key: lc.walletKey,
+        periodStart: lc.periodStart,
+        periodEnd: lc.periodEnd
+      });
+    }
+    return true;
   }
   async function unconsume(entitlement, resource, amount = 1) {
     if (!walletStore || !planStore || !orgResolver)
       return;
-    const entDef = accessDef.entitlements[entitlement];
-    if (!entDef?.plans?.length)
+    const limitKeys = accessDef._entitlementToLimitKeys[entitlement];
+    if (!limitKeys?.length)
       return;
     const orgId = await orgResolver(resource);
     if (!orgId)
       return;
+    const overrides = overrideStore ? await overrideStore.get(orgId) : null;
     const orgPlan = await planStore.getPlan(orgId);
     if (!orgPlan)
       return;
     const effectivePlanId = resolveEffectivePlan(orgPlan, accessDef.plans, accessDef.defaultPlan);
     if (!effectivePlanId)
       return;
-    const planDef = accessDef.plans?.[effectivePlanId];
-    const limitDef = planDef?.limits?.[entitlement];
-    if (!limitDef)
-      return;
-    const { periodStart, periodEnd } = calculateBillingPeriod(orgPlan.startedAt, limitDef.per);
-    await walletStore.unconsume(orgId, entitlement, periodStart, periodEnd, amount);
+    const limitsToUnconsume = await resolveAllLimitConsumptions(orgId, entitlement, effectivePlanId, accessDef, planStore, walletStore, orgPlan, planVersionStore, overrides);
+    for (const lc of limitsToUnconsume) {
+      if (lc.effectiveMax === -1)
+        continue;
+      await walletStore.unconsume(orgId, lc.walletKey, lc.periodStart, lc.periodEnd, amount);
+    }
   }
-  return { can, check, authorize, canAll, canAndConsume, unconsume };
+  return { can, check, authorize, canAll, canBatch, canAndConsume, unconsume };
 }
 var DENIAL_ORDER = [
   "plan_required",
@@ -1439,25 +1633,174 @@ var DENIAL_ORDER = [
 function orderDenialReasons(reasons) {
   return [...reasons].sort((a, b) => DENIAL_ORDER.indexOf(a) - DENIAL_ORDER.indexOf(b));
 }
-async function resolveWalletStateFromOrgId(entitlement, orgId, accessDef, planStore, walletStore) {
+async function resolveEffectiveFeatures(orgId, entitlement, effectivePlanId, accessDef, planStore, planVersionStore, overrides) {
+  if (planVersionStore) {
+    const tenantVersion = await planVersionStore.getTenantVersion(orgId, effectivePlanId);
+    if (tenantVersion !== null) {
+      const versionInfo = await planVersionStore.getVersion(effectivePlanId, tenantVersion);
+      if (versionInfo) {
+        const snapshotFeatures = versionInfo.snapshot.features;
+        if (snapshotFeatures.includes(entitlement))
+          return true;
+        const addOns2 = await planStore.getAddOns?.(orgId);
+        if (addOns2) {
+          for (const addOnId of addOns2) {
+            const addOnDef = accessDef.plans?.[addOnId];
+            if (addOnDef?.features?.includes(entitlement))
+              return true;
+          }
+        }
+        if (overrides?.features?.includes(entitlement))
+          return true;
+        return false;
+      }
+    }
+  }
+  const planDef = accessDef.plans?.[effectivePlanId];
+  if (planDef?.features?.includes(entitlement))
+    return true;
+  const addOns = await planStore.getAddOns?.(orgId);
+  if (addOns) {
+    for (const addOnId of addOns) {
+      const addOnDef = accessDef.plans?.[addOnId];
+      if (addOnDef?.features?.includes(entitlement))
+        return true;
+    }
+  }
+  if (overrides?.features?.includes(entitlement))
+    return true;
+  return false;
+}
+async function resolveAllLimitStates(entitlement, orgId, accessDef, planStore, walletStore, planVersionStore, overrides) {
   const orgPlan = await planStore.getPlan(orgId);
   const effectivePlanId = resolveEffectivePlan(orgPlan, accessDef.plans, accessDef.defaultPlan);
   if (!effectivePlanId || !orgPlan)
-    return null;
-  const planDef = accessDef.plans?.[effectivePlanId];
-  const limitDef = planDef?.limits?.[entitlement];
-  if (!limitDef)
-    return null;
-  const effectiveLimit = resolveEffectiveLimit(orgPlan, entitlement, limitDef);
-  const { periodStart, periodEnd } = calculateBillingPeriod(orgPlan.startedAt, limitDef.per);
-  const consumed = await walletStore.getConsumption(orgId, entitlement, periodStart, periodEnd);
-  return { limit: effectiveLimit, consumed };
+    return [];
+  const limitKeys = accessDef._entitlementToLimitKeys[entitlement];
+  if (!limitKeys?.length)
+    return [];
+  let versionedLimits = null;
+  if (planVersionStore) {
+    const tenantVersion = await planVersionStore.getTenantVersion(orgId, effectivePlanId);
+    if (tenantVersion !== null) {
+      const versionInfo = await planVersionStore.getVersion(effectivePlanId, tenantVersion);
+      if (versionInfo) {
+        versionedLimits = versionInfo.snapshot.limits;
+      }
+    }
+  }
+  const states = [];
+  for (const limitKey of limitKeys) {
+    let limitDef;
+    if (versionedLimits && limitKey in versionedLimits) {
+      limitDef = versionedLimits[limitKey];
+    } else {
+      const planDef = accessDef.plans?.[effectivePlanId];
+      limitDef = planDef?.limits?.[limitKey];
+    }
+    if (!limitDef)
+      continue;
+    const effectiveMax = computeEffectiveLimit(limitDef.max, limitKey, orgId, orgPlan, accessDef, planStore, overrides);
+    const resolvedMax = await effectiveMax;
+    const hasOverage = !!limitDef.overage;
+    if (resolvedMax === -1) {
+      states.push({ key: limitKey, max: -1, consumed: 0, hasOverage });
+      continue;
+    }
+    const walletKey = limitKey;
+    const period = limitDef.per ? calculateBillingPeriod(orgPlan.startedAt, limitDef.per) : { periodStart: orgPlan.startedAt, periodEnd: new Date("9999-12-31T23:59:59Z") };
+    const consumed = await walletStore.getConsumption(orgId, walletKey, period.periodStart, period.periodEnd);
+    states.push({
+      key: limitKey,
+      max: resolvedMax,
+      consumed,
+      hasOverage,
+      ...limitDef.overage ? {
+        overageCap: limitDef.overage.cap,
+        overageAmount: limitDef.overage.amount,
+        overagePer: limitDef.overage.per
+      } : {}
+    });
+  }
+  return states;
+}
+async function resolveAllLimitConsumptions(orgId, entitlement, effectivePlanId, accessDef, planStore, _walletStore, orgPlan, planVersionStore, overrides) {
+  const limitKeys = accessDef._entitlementToLimitKeys[entitlement];
+  if (!limitKeys?.length)
+    return [];
+  let versionedLimits = null;
+  if (planVersionStore) {
+    const tenantVersion = await planVersionStore.getTenantVersion(orgId, effectivePlanId);
+    if (tenantVersion !== null) {
+      const versionInfo = await planVersionStore.getVersion(effectivePlanId, tenantVersion);
+      if (versionInfo) {
+        versionedLimits = versionInfo.snapshot.limits;
+      }
+    }
+  }
+  const consumptions = [];
+  for (const limitKey of limitKeys) {
+    let limitDef;
+    if (versionedLimits && limitKey in versionedLimits) {
+      limitDef = versionedLimits[limitKey];
+    } else {
+      const planDef = accessDef.plans?.[effectivePlanId];
+      limitDef = planDef?.limits?.[limitKey];
+    }
+    if (!limitDef)
+      continue;
+    const effectiveMax = await computeEffectiveLimit(limitDef.max, limitKey, orgId, orgPlan, accessDef, planStore, overrides);
+    const walletKey = limitKey;
+    const period = limitDef.per ? calculateBillingPeriod(orgPlan.startedAt, limitDef.per) : { periodStart: orgPlan.startedAt, periodEnd: new Date("9999-12-31T23:59:59Z") };
+    consumptions.push({
+      walletKey,
+      periodStart: period.periodStart,
+      periodEnd: period.periodEnd,
+      effectiveMax,
+      hasOverage: !!limitDef.overage,
+      ...limitDef.overage ? {
+        overageCap: limitDef.overage.cap,
+        overageAmount: limitDef.overage.amount,
+        overagePer: limitDef.overage.per
+      } : {}
+    });
+  }
+  return consumptions;
+}
+async function computeEffectiveLimit(basePlanMax, limitKey, orgId, orgPlan, accessDef, planStore, overrides) {
+  let effectiveMax = basePlanMax;
+  const addOns = await planStore.getAddOns?.(orgId);
+  if (addOns) {
+    for (const addOnId of addOns) {
+      const addOnDef = accessDef.plans?.[addOnId];
+      const addOnLimit = addOnDef?.limits?.[limitKey];
+      if (addOnLimit) {
+        if (effectiveMax === -1)
+          break;
+        effectiveMax += addOnLimit.max;
+      }
+    }
+  }
+  const oldOverride = orgPlan.overrides[limitKey];
+  if (oldOverride) {
+    effectiveMax = Math.max(effectiveMax, oldOverride.max);
+  }
+  const limitOverride = overrides?.limits?.[limitKey];
+  if (limitOverride) {
+    if (limitOverride.max !== undefined) {
+      effectiveMax = limitOverride.max;
+    } else if (limitOverride.add !== undefined) {
+      if (effectiveMax !== -1) {
+        effectiveMax = Math.max(0, effectiveMax + limitOverride.add);
+      }
+    }
+  }
+  return effectiveMax;
 }
-function resolveEffectiveLimit(orgPlan, entitlement, planLimit) {
-  const override = orgPlan.overrides[entitlement];
-  if (!override)
-    return planLimit.max;
-  return Math.max(override.max, planLimit.max);
+async function rollbackConsumptions(orgId, consumed, walletStore, amount) {
+  for (const c of consumed) {
+    await walletStore.unconsume(orgId, c.key, c.periodStart, c.periodEnd, amount);
+  }
 }
 // src/auth/access-event-broadcaster.ts
 function createAccessEventBroadcaster(config) {
@@ -1605,6 +1948,22 @@ function createAccessEventBroadcaster(config) {
     const event = { type: "access:plan_changed", orgId };
     broadcastToOrg(orgId, JSON.stringify(event));
   }
+  function broadcastPlanAssigned(orgId, planId) {
+    const event = { type: "access:plan_assigned", orgId, planId };
+    broadcastToOrg(orgId, JSON.stringify(event));
+  }
+  function broadcastAddonAttached(orgId, addonId) {
+    const event = { type: "access:addon_attached", orgId, addonId };
+    broadcastToOrg(orgId, JSON.stringify(event));
+  }
+  function broadcastAddonDetached(orgId, addonId) {
+    const event = { type: "access:addon_detached", orgId, addonId };
+    broadcastToOrg(orgId, JSON.stringify(event));
+  }
+  function broadcastLimitReset(orgId, entitlement, max) {
+    const event = { type: "access:limit_reset", orgId, entitlement, max };
+    broadcastToOrg(orgId, JSON.stringify(event));
+  }
   return {
     handleUpgrade,
     websocket,
@@ -1612,11 +1971,472 @@ function createAccessEventBroadcaster(config) {
     broadcastLimitUpdate,
     broadcastRoleChange,
     broadcastPlanChange,
+    broadcastPlanAssigned,
+    broadcastAddonAttached,
+    broadcastAddonDetached,
+    broadcastLimitReset,
     get getConnectionCount() {
       return connectionCount;
     }
   };
 }
+// src/auth/auth-models.ts
+import { d } from "@vertz/db";
+var authUsersTable = d.table("auth_users", {
+  id: d.text().primary(),
+  email: d.text(),
+  passwordHash: d.text().nullable(),
+  role: d.text().default("user"),
+  plan: d.text().nullable(),
+  emailVerified: d.boolean().default(false),
+  createdAt: d.timestamp().default("now"),
+  updatedAt: d.timestamp().default("now")
+});
+var authSessionsTable = d.table("auth_sessions", {
+  id: d.text().primary(),
+  userId: d.text(),
+  refreshTokenHash: d.text(),
+  previousRefreshHash: d.text().nullable(),
+  currentTokens: d.text().nullable(),
+  ipAddress: d.text(),
+  userAgent: d.text(),
+  createdAt: d.timestamp().default("now"),
+  lastActiveAt: d.timestamp().default("now"),
+  expiresAt: d.timestamp(),
+  revokedAt: d.timestamp().nullable()
+});
+var authOauthAccountsTable = d.table("auth_oauth_accounts", {
+  id: d.text().primary(),
+  userId: d.text(),
+  provider: d.text(),
+  providerId: d.text(),
+  email: d.text().nullable(),
+  createdAt: d.timestamp().default("now")
+});
+var authRoleAssignmentsTable = d.table("auth_role_assignments", {
+  id: d.text().primary(),
+  userId: d.text(),
+  resourceType: d.text(),
+  resourceId: d.text(),
+  role: d.text(),
+  createdAt: d.timestamp().default("now")
+});
+var authClosureTable = d.table("auth_closure", {
+  id: d.text().primary(),
+  ancestorType: d.text(),
+  ancestorId: d.text(),
+  descendantType: d.text(),
+  descendantId: d.text(),
+  depth: d.integer()
+});
+var authPlansTable = d.table("auth_plans", {
+  id: d.text().primary(),
+  tenantId: d.text(),
+  planId: d.text(),
+  startedAt: d.timestamp().default("now"),
+  expiresAt: d.timestamp().nullable()
+});
+var authPlanAddonsTable = d.table("auth_plan_addons", {
+  id: d.text().primary(),
+  tenantId: d.text(),
+  addonId: d.text(),
+  isOneOff: d.boolean().default(false),
+  quantity: d.integer().default(1),
+  createdAt: d.timestamp().default("now")
+});
+var authFlagsTable = d.table("auth_flags", {
+  id: d.text().primary(),
+  tenantId: d.text(),
+  flag: d.text(),
+  enabled: d.boolean().default(false)
+});
+var authOverridesTable = d.table("auth_overrides", {
+  id: d.text().primary(),
+  tenantId: d.text(),
+  overrides: d.text(),
+  updatedAt: d.timestamp().default("now")
+});
+var authModels = {
+  auth_users: d.model(authUsersTable),
+  auth_sessions: d.model(authSessionsTable),
+  auth_oauth_accounts: d.model(authOauthAccountsTable),
+  auth_role_assignments: d.model(authRoleAssignmentsTable),
+  auth_closure: d.model(authClosureTable),
+  auth_plans: d.model(authPlansTable),
+  auth_plan_addons: d.model(authPlanAddonsTable),
+  auth_flags: d.model(authFlagsTable),
+  auth_overrides: d.model(authOverridesTable)
+};
+// src/auth/auth-tables.ts
+import { sql } from "@vertz/db/sql";
+
+// src/auth/dialect-ddl.ts
+function dialectDDL(dialect) {
+  return {
+    boolean: (def) => dialect === "sqlite" ? `INTEGER NOT NULL DEFAULT ${def ? 1 : 0}` : `BOOLEAN NOT NULL DEFAULT ${def}`,
+    timestamp: () => dialect === "sqlite" ? "TEXT NOT NULL" : "TIMESTAMPTZ NOT NULL",
+    timestampNullable: () => dialect === "sqlite" ? "TEXT" : "TIMESTAMPTZ",
+    text: () => "TEXT",
+    textPrimary: () => "TEXT PRIMARY KEY",
+    integer: () => "INTEGER"
+  };
+}
+
+// src/auth/auth-tables.ts
+function generateAuthDDL(dialect) {
+  const t = dialectDDL(dialect);
+  const statements = [];
+  statements.push(`CREATE TABLE IF NOT EXISTS auth_users (
+  id ${t.textPrimary()},
+  email ${t.text()} NOT NULL UNIQUE,
+  password_hash ${t.text()},
+  role ${t.text()} NOT NULL DEFAULT 'user',
+  plan ${t.text()},
+  email_verified ${t.boolean(false)},
+  created_at ${t.timestamp()},
+  updated_at ${t.timestamp()}
+)`);
+  statements.push(`CREATE TABLE IF NOT EXISTS auth_sessions (
+  id ${t.textPrimary()},
+  user_id ${t.text()} NOT NULL,
+  refresh_token_hash ${t.text()} NOT NULL,
+  previous_refresh_hash ${t.text()},
+  current_tokens ${t.text()},
+  ip_address ${t.text()} NOT NULL,
+  user_agent ${t.text()} NOT NULL,
+  created_at ${t.timestamp()},
+  last_active_at ${t.timestamp()},
+  expires_at ${t.timestamp()},
+  revoked_at ${t.timestampNullable()}
+)`);
+  statements.push(`CREATE TABLE IF NOT EXISTS auth_oauth_accounts (
+  id ${t.textPrimary()},
+  user_id ${t.text()} NOT NULL,
+  provider ${t.text()} NOT NULL,
+  provider_id ${t.text()} NOT NULL,
+  email ${t.text()},
+  created_at ${t.timestamp()},
+  UNIQUE(provider, provider_id)
+)`);
+  statements.push(`CREATE TABLE IF NOT EXISTS auth_role_assignments (
+  id ${t.textPrimary()},
+  user_id ${t.text()} NOT NULL,
+  resource_type ${t.text()} NOT NULL,
+  resource_id ${t.text()} NOT NULL,
+  role ${t.text()} NOT NULL,
+  created_at ${t.timestamp()},
+  UNIQUE(user_id, resource_type, resource_id, role)
+)`);
+  statements.push(`CREATE TABLE IF NOT EXISTS auth_closure (
+  id ${t.textPrimary()},
+  ancestor_type ${t.text()} NOT NULL,
+  ancestor_id ${t.text()} NOT NULL,
+  descendant_type ${t.text()} NOT NULL,
+  descendant_id ${t.text()} NOT NULL,
+  depth ${t.integer()} NOT NULL,
+  UNIQUE(ancestor_type, ancestor_id, descendant_type, descendant_id)
+)`);
+  statements.push(`CREATE TABLE IF NOT EXISTS auth_plans (
+  id ${t.textPrimary()},
+  tenant_id ${t.text()} NOT NULL UNIQUE,
+  plan_id ${t.text()} NOT NULL,
+  started_at ${t.timestamp()},
+  expires_at ${t.timestampNullable()}
+)`);
+  statements.push(`CREATE TABLE IF NOT EXISTS auth_plan_addons (
+  id ${t.textPrimary()},
+  tenant_id ${t.text()} NOT NULL,
+  addon_id ${t.text()} NOT NULL,
+  is_one_off ${t.boolean(false)},
+  quantity ${t.integer()} NOT NULL DEFAULT 1,
+  created_at ${t.timestamp()},
+  UNIQUE(tenant_id, addon_id)
+)`);
+  statements.push(`CREATE TABLE IF NOT EXISTS auth_flags (
+  id ${t.textPrimary()},
+  tenant_id ${t.text()} NOT NULL,
+  flag ${t.text()} NOT NULL,
+  enabled ${t.boolean(false)},
+  UNIQUE(tenant_id, flag)
+)`);
+  statements.push(`CREATE TABLE IF NOT EXISTS auth_overrides (
+  id ${t.textPrimary()},
+  tenant_id ${t.text()} NOT NULL UNIQUE,
+  overrides ${t.text()} NOT NULL,
+  updated_at ${t.timestamp()}
+)`);
+  return statements;
+}
+var AUTH_TABLE_NAMES = [
+  "auth_users",
+  "auth_sessions",
+  "auth_oauth_accounts",
+  "auth_role_assignments",
+  "auth_closure",
+  "auth_plans",
+  "auth_plan_addons",
+  "auth_flags",
+  "auth_overrides"
+];
+function validateAuthModels(db) {
+  const dbModels = db._internals.models;
+  const missing = AUTH_TABLE_NAMES.filter((m) => !(m in dbModels));
+  if (missing.length > 0) {
+    throw new Error(`Auth requires models ${missing.map((m) => `"${m}"`).join(", ")} in createDb(). ` + "Add authModels to your createDb() call: createDb({ models: { ...authModels, ...yourModels } })");
+  }
+}
+async function initializeAuthTables(db) {
+  const dialectName = db._internals.dialect.name;
+  const statements = generateAuthDDL(dialectName);
+  for (const ddl of statements) {
+    await db.query(sql.raw(ddl));
+  }
+}
+// src/auth/billing/event-emitter.ts
+function createBillingEventEmitter() {
+  const handlers = new Map;
+  return {
+    on(eventType, handler) {
+      const list = handlers.get(eventType) ?? [];
+      list.push(handler);
+      handlers.set(eventType, list);
+    },
+    off(eventType, handler) {
+      const list = handlers.get(eventType);
+      if (!list)
+        return;
+      const idx = list.indexOf(handler);
+      if (idx >= 0)
+        list.splice(idx, 1);
+    },
+    emit(eventType, event) {
+      const list = handlers.get(eventType);
+      if (!list)
+        return;
+      for (const handler of list) {
+        try {
+          handler(event);
+        } catch {}
+      }
+    }
+  };
+}
+// src/auth/billing/overage.ts
+function computeOverage(input) {
+  const { consumed, max, rate } = input;
+  if (max === -1)
+    return 0;
+  if (consumed <= max)
+    return 0;
+  const overageUnits = consumed - max;
+  const charge = overageUnits * rate;
+  if (input.cap !== undefined && charge > input.cap) {
+    return input.cap;
+  }
+  return charge;
+}
+// src/auth/billing/stripe-adapter.ts
+var INTERVAL_MAP = {
+  month: "month",
+  quarter: "month",
+  year: "year"
+};
+function mapInterval(interval) {
+  if (interval === "quarter") {
+    return { interval: "month", interval_count: 3 };
+  }
+  return { interval: INTERVAL_MAP[interval] ?? "month" };
+}
+function createStripeBillingAdapter(config) {
+  const { stripe, currency = "usd" } = config;
+  async function syncPlans(plans) {
+    const existing = await stripe.products.list();
+    const existingByPlanId = new Map;
+    for (const product of existing.data) {
+      if (product.metadata.vertzPlanId) {
+        existingByPlanId.set(product.metadata.vertzPlanId, product);
+      }
+    }
+    for (const [planId, planDef] of Object.entries(plans)) {
+      const metadata = {
+        vertzPlanId: planId
+      };
+      if (planDef.group)
+        metadata.group = planDef.group;
+      if (planDef.addOn)
+        metadata.addOn = "true";
+      let product = existingByPlanId.get(planId);
+      if (!product) {
+        product = await stripe.products.create({
+          name: planDef.title ?? planId,
+          metadata,
+          description: planDef.description
+        });
+      } else {
+        await stripe.products.update(product.id, {
+          name: planDef.title ?? planId,
+          metadata
+        });
+      }
+      const amount = planDef.price?.amount ?? 0;
+      const interval = planDef.price?.interval;
+      const unitAmount = Math.round(amount * 100);
+      const existingPrices = await stripe.prices.list({ product: product.id });
+      const activePrices = existingPrices.data.filter((p) => p.active);
+      const matchingPrice = activePrices.find((p) => p.unit_amount === unitAmount);
+      if (!matchingPrice) {
+        for (const oldPrice of activePrices) {
+          await stripe.prices.update(oldPrice.id, { active: false });
+        }
+        const priceParams = {
+          product: product.id,
+          unit_amount: unitAmount,
+          currency,
+          metadata: { vertzPlanId: planId }
+        };
+        if (interval && interval !== "one_off") {
+          const mapped = mapInterval(interval);
+          priceParams.recurring = { interval: mapped.interval };
+        }
+        await stripe.prices.create(priceParams);
+      }
+    }
+  }
+  async function createSubscription(_tenantId, _planId) {
+    return "sub_placeholder";
+  }
+  async function cancelSubscription(_tenantId) {}
+  async function attachAddOn(_tenantId, _addOnId) {}
+  async function reportOverage(_tenantId, _limitKey, _amount) {}
+  async function getPortalUrl(_tenantId) {
+    return "https://billing.stripe.com/portal/placeholder";
+  }
+  return {
+    syncPlans,
+    createSubscription,
+    cancelSubscription,
+    attachAddOn,
+    reportOverage,
+    getPortalUrl
+  };
+}
+// src/auth/billing/webhook-handler.ts
+function extractTenantId(obj) {
+  const meta = obj.metadata;
+  if (meta?.tenantId)
+    return meta.tenantId;
+  const subDetails = obj.subscription_details;
+  if (subDetails?.metadata) {
+    const subMeta = subDetails.metadata;
+    if (subMeta.tenantId)
+      return subMeta.tenantId;
+  }
+  return null;
+}
+function extractPlanId(obj) {
+  const meta = obj.metadata;
+  if (meta?.vertzPlanId)
+    return meta.vertzPlanId;
+  const items = obj.items;
+  if (items?.data?.[0]?.price?.metadata?.vertzPlanId) {
+    return items.data[0].price.metadata.vertzPlanId;
+  }
+  return null;
+}
+function createWebhookHandler(config) {
+  const { planStore, emitter, defaultPlan, webhookSecret } = config;
+  return async (request) => {
+    const signature = request.headers.get("stripe-signature");
+    if (signature !== webhookSecret) {
+      return new Response(JSON.stringify({ error: "Invalid signature" }), {
+        status: 400,
+        headers: { "content-type": "application/json" }
+      });
+    }
+    let event;
+    try {
+      const body = await request.text();
+      event = JSON.parse(body);
+    } catch {
+      return new Response(JSON.stringify({ error: "Invalid JSON" }), {
+        status: 400,
+        headers: { "content-type": "application/json" }
+      });
+    }
+    const obj = event.data.object;
+    try {
+      switch (event.type) {
+        case "customer.subscription.created": {
+          const tenantId = extractTenantId(obj);
+          const planId = extractPlanId(obj);
+          if (tenantId && planId) {
+            await planStore.assignPlan(tenantId, planId);
+            emitter.emit("subscription:created", { tenantId, planId });
+          }
+          break;
+        }
+        case "customer.subscription.updated": {
+          const tenantId = extractTenantId(obj);
+          const planId = extractPlanId(obj);
+          if (tenantId && planId) {
+            await planStore.assignPlan(tenantId, planId);
+          }
+          break;
+        }
+        case "customer.subscription.deleted": {
+          const tenantId = extractTenantId(obj);
+          const planId = extractPlanId(obj);
+          if (tenantId) {
+            await planStore.assignPlan(tenantId, defaultPlan);
+            emitter.emit("subscription:canceled", {
+              tenantId,
+              planId: planId ?? defaultPlan
+            });
+          }
+          break;
+        }
+        case "invoice.payment_failed": {
+          const tenantId = extractTenantId(obj);
+          const planId = extractPlanId(obj);
+          const attemptCount = obj.attempt_count ?? 1;
+          if (tenantId) {
+            emitter.emit("billing:payment_failed", {
+              tenantId,
+              planId: planId ?? "",
+              attempt: attemptCount
+            });
+          }
+          break;
+        }
+        case "checkout.session.completed": {
+          const tenantId = extractTenantId(obj);
+          const planId = extractPlanId(obj);
+          const meta = obj.metadata;
+          const isAddOn = meta?.isAddOn === "true";
+          if (tenantId && planId) {
+            if (isAddOn && planStore.attachAddOn) {
+              await planStore.attachAddOn(tenantId, planId);
+            } else {
+              await planStore.assignPlan(tenantId, planId);
+            }
+          }
+          break;
+        }
+        default:
+          break;
+      }
+    } catch {
+      return new Response(JSON.stringify({ error: "Processing failed" }), {
+        status: 500,
+        headers: { "content-type": "application/json" }
+      });
+    }
+    return new Response(JSON.stringify({ received: true }), {
+      status: 200,
+      headers: { "content-type": "application/json" }
+    });
+  };
+}
 // src/auth/closure-store.ts
 var MAX_DEPTH = 4;
 
@@ -1648,112 +2468,739 @@ class InMemoryClosureStore {
       }
     }
   }
-  async removeResource(type, id) {
-    const descendants = await this.getDescendants(type, id);
-    const descendantKeys = new Set(descendants.map((d) => `${d.type}:${d.id}`));
-    this.rows = this.rows.filter((row) => {
-      const ancestorKey = `${row.ancestorType}:${row.ancestorId}`;
-      const descendantKey = `${row.descendantType}:${row.descendantId}`;
-      return !descendantKeys.has(ancestorKey) && !descendantKeys.has(descendantKey);
-    });
+  async removeResource(type, id) {
+    const descendants = await this.getDescendants(type, id);
+    const descendantKeys = new Set(descendants.map((d2) => `${d2.type}:${d2.id}`));
+    this.rows = this.rows.filter((row) => {
+      const ancestorKey = `${row.ancestorType}:${row.ancestorId}`;
+      const descendantKey = `${row.descendantType}:${row.descendantId}`;
+      return !descendantKeys.has(ancestorKey) && !descendantKeys.has(descendantKey);
+    });
+  }
+  async getAncestors(type, id) {
+    return this.rows.filter((row) => row.descendantType === type && row.descendantId === id).map((row) => ({
+      type: row.ancestorType,
+      id: row.ancestorId,
+      depth: row.depth
+    }));
+  }
+  async getDescendants(type, id) {
+    return this.rows.filter((row) => row.ancestorType === type && row.ancestorId === id).map((row) => ({
+      type: row.descendantType,
+      id: row.descendantId,
+      depth: row.depth
+    }));
+  }
+  async hasPath(ancestorType, ancestorId, descendantType, descendantId) {
+    return this.rows.some((row) => row.ancestorType === ancestorType && row.ancestorId === ancestorId && row.descendantType === descendantType && row.descendantId === descendantId);
+  }
+  dispose() {
+    this.rows = [];
+  }
+}
+// src/auth/db-closure-store.ts
+import { sql as sql2 } from "@vertz/db/sql";
+
+// src/auth/db-types.ts
+function boolVal(db, value) {
+  return db._internals.dialect.name === "sqlite" ? value ? 1 : 0 : value;
+}
+function assertWrite(result, context) {
+  if (!result.ok) {
+    throw new Error(`Auth DB write failed (${context}): ${result.error.message}`);
+  }
+}
+
+// src/auth/db-closure-store.ts
+var MAX_DEPTH2 = 4;
+
+class DbClosureStore {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async addResource(type, id, parent) {
+    const selfId = crypto.randomUUID();
+    const selfResult = await this.db.query(sql2`INSERT INTO auth_closure (id, ancestor_type, ancestor_id, descendant_type, descendant_id, depth)
+          VALUES (${selfId}, ${type}, ${id}, ${type}, ${id}, ${0})
+          ON CONFLICT DO NOTHING`);
+    assertWrite(selfResult, "addResource/self");
+    if (parent) {
+      const parentAncestors = await this.getAncestors(parent.parentType, parent.parentId);
+      const maxParentDepth = Math.max(...parentAncestors.map((a) => a.depth), 0);
+      if (maxParentDepth + 1 >= MAX_DEPTH2) {
+        throw new Error("Hierarchy depth exceeds maximum of 4 levels");
+      }
+      for (const ancestor of parentAncestors) {
+        const rowId = crypto.randomUUID();
+        const ancestorResult = await this.db.query(sql2`INSERT INTO auth_closure (id, ancestor_type, ancestor_id, descendant_type, descendant_id, depth)
+              VALUES (${rowId}, ${ancestor.type}, ${ancestor.id}, ${type}, ${id}, ${ancestor.depth + 1})
+              ON CONFLICT DO NOTHING`);
+        assertWrite(ancestorResult, "addResource/ancestor");
+      }
+    }
+  }
+  async removeResource(type, id) {
+    const descendants = await this.getDescendants(type, id);
+    for (const desc of descendants) {
+      const delResult = await this.db.query(sql2`DELETE FROM auth_closure WHERE (descendant_type = ${desc.type} AND descendant_id = ${desc.id}) OR (ancestor_type = ${desc.type} AND ancestor_id = ${desc.id})`);
+      assertWrite(delResult, "removeResource");
+    }
+  }
+  async getAncestors(type, id) {
+    const result = await this.db.query(sql2`SELECT ancestor_type, ancestor_id, depth FROM auth_closure WHERE descendant_type = ${type} AND descendant_id = ${id}`);
+    if (!result.ok)
+      return [];
+    return result.data.rows.map((r) => ({
+      type: r.ancestor_type,
+      id: r.ancestor_id,
+      depth: r.depth
+    }));
+  }
+  async getDescendants(type, id) {
+    const result = await this.db.query(sql2`SELECT descendant_type, descendant_id, depth FROM auth_closure WHERE ancestor_type = ${type} AND ancestor_id = ${id}`);
+    if (!result.ok)
+      return [];
+    return result.data.rows.map((r) => ({
+      type: r.descendant_type,
+      id: r.descendant_id,
+      depth: r.depth
+    }));
+  }
+  async hasPath(ancestorType, ancestorId, descendantType, descendantId) {
+    const result = await this.db.query(sql2`SELECT COUNT(*) as cnt FROM auth_closure WHERE ancestor_type = ${ancestorType} AND ancestor_id = ${ancestorId} AND descendant_type = ${descendantType} AND descendant_id = ${descendantId}`);
+    if (!result.ok)
+      return false;
+    return (result.data.rows[0]?.cnt ?? 0) > 0;
+  }
+  dispose() {}
+}
+// src/auth/db-flag-store.ts
+import { sql as sql3 } from "@vertz/db/sql";
+class DbFlagStore {
+  db;
+  cache = new Map;
+  constructor(db) {
+    this.db = db;
+  }
+  async loadFlags() {
+    const result = await this.db.query(sql3`SELECT tenant_id, flag, enabled FROM auth_flags`);
+    if (!result.ok)
+      return;
+    this.cache.clear();
+    for (const row of result.data.rows) {
+      let orgFlags = this.cache.get(row.tenant_id);
+      if (!orgFlags) {
+        orgFlags = new Map;
+        this.cache.set(row.tenant_id, orgFlags);
+      }
+      orgFlags.set(row.flag, row.enabled === 1 || row.enabled === true);
+    }
+  }
+  setFlag(orgId, flag, enabled) {
+    let orgFlags = this.cache.get(orgId);
+    if (!orgFlags) {
+      orgFlags = new Map;
+      this.cache.set(orgId, orgFlags);
+    }
+    orgFlags.set(flag, enabled);
+    const id = crypto.randomUUID();
+    const val = boolVal(this.db, enabled);
+    this.db.query(sql3`INSERT INTO auth_flags (id, tenant_id, flag, enabled) VALUES (${id}, ${orgId}, ${flag}, ${val})
+          ON CONFLICT(tenant_id, flag) DO UPDATE SET enabled = ${val}`).then((result) => {
+      if (!result.ok) {
+        console.error("[DbFlagStore] Failed to persist flag:", result.error);
+      }
+    });
+  }
+  getFlag(orgId, flag) {
+    return this.cache.get(orgId)?.get(flag) ?? false;
+  }
+  getFlags(orgId) {
+    const orgFlags = this.cache.get(orgId);
+    if (!orgFlags)
+      return {};
+    const result = {};
+    for (const [key, value] of orgFlags) {
+      result[key] = value;
+    }
+    return result;
+  }
+}
+// src/auth/db-oauth-account-store.ts
+import { sql as sql4 } from "@vertz/db/sql";
+class DbOAuthAccountStore {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async linkAccount(userId, provider, providerId, email) {
+    const id = crypto.randomUUID();
+    const now = new Date().toISOString();
+    const emailValue = email ?? null;
+    const result = await this.db.query(sql4`INSERT INTO auth_oauth_accounts (id, user_id, provider, provider_id, email, created_at)
+          VALUES (${id}, ${userId}, ${provider}, ${providerId}, ${emailValue}, ${now})
+          ON CONFLICT DO NOTHING`);
+    assertWrite(result, "linkAccount");
+  }
+  async findByProviderAccount(provider, providerId) {
+    const result = await this.db.query(sql4`SELECT user_id FROM auth_oauth_accounts WHERE provider = ${provider} AND provider_id = ${providerId}`);
+    if (!result.ok || result.data.rows.length === 0)
+      return null;
+    return result.data.rows[0]?.user_id ?? null;
+  }
+  async findByUserId(userId) {
+    const result = await this.db.query(sql4`SELECT provider, provider_id FROM auth_oauth_accounts WHERE user_id = ${userId}`);
+    if (!result.ok)
+      return [];
+    return result.data.rows.map((r) => ({
+      provider: r.provider,
+      providerId: r.provider_id
+    }));
+  }
+  async unlinkAccount(userId, provider) {
+    const result = await this.db.query(sql4`DELETE FROM auth_oauth_accounts WHERE user_id = ${userId} AND provider = ${provider}`);
+    assertWrite(result, "unlinkAccount");
+  }
+  dispose() {}
+}
+// src/auth/db-plan-store.ts
+import { sql as sql5 } from "@vertz/db/sql";
+class DbPlanStore {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async assignPlan(orgId, planId, startedAt = new Date, expiresAt = null) {
+    const id = crypto.randomUUID();
+    const startedAtIso = startedAt.toISOString();
+    const expiresAtIso = expiresAt ? expiresAt.toISOString() : null;
+    const upsertResult = await this.db.query(sql5`INSERT INTO auth_plans (id, tenant_id, plan_id, started_at, expires_at)
+          VALUES (${id}, ${orgId}, ${planId}, ${startedAtIso}, ${expiresAtIso})
+          ON CONFLICT(tenant_id) DO UPDATE SET plan_id = ${planId}, started_at = ${startedAtIso}, expires_at = ${expiresAtIso}`);
+    assertWrite(upsertResult, "assignPlan/upsert");
+    const overrideResult = await this.db.query(sql5`DELETE FROM auth_overrides WHERE tenant_id = ${orgId}`);
+    assertWrite(overrideResult, "assignPlan/clearOverrides");
+  }
+  async getPlan(orgId) {
+    const result = await this.db.query(sql5`SELECT tenant_id, plan_id, started_at, expires_at FROM auth_plans WHERE tenant_id = ${orgId}`);
+    if (!result.ok)
+      return null;
+    const row = result.data.rows[0];
+    if (!row)
+      return null;
+    const overrides = await this.loadOverrides(orgId);
+    return {
+      orgId: row.tenant_id,
+      planId: row.plan_id,
+      startedAt: new Date(row.started_at),
+      expiresAt: row.expires_at ? new Date(row.expires_at) : null,
+      overrides
+    };
+  }
+  async updateOverrides(orgId, overrides) {
+    const planResult = await this.db.query(sql5`SELECT tenant_id FROM auth_plans WHERE tenant_id = ${orgId}`);
+    if (!planResult.ok || planResult.data.rows.length === 0)
+      return;
+    const existing = await this.loadOverrides(orgId);
+    const merged = { ...existing, ...overrides };
+    const overridesJson = JSON.stringify(merged);
+    const now = new Date().toISOString();
+    const overrideResult = await this.db.query(sql5`SELECT tenant_id FROM auth_overrides WHERE tenant_id = ${orgId}`);
+    if (overrideResult.ok && overrideResult.data.rows.length > 0) {
+      const updateResult = await this.db.query(sql5`UPDATE auth_overrides SET overrides = ${overridesJson}, updated_at = ${now} WHERE tenant_id = ${orgId}`);
+      assertWrite(updateResult, "updateOverrides/update");
+    } else {
+      const id = crypto.randomUUID();
+      const insertResult = await this.db.query(sql5`INSERT INTO auth_overrides (id, tenant_id, overrides, updated_at)
+            VALUES (${id}, ${orgId}, ${overridesJson}, ${now})`);
+      assertWrite(insertResult, "updateOverrides/insert");
+    }
+  }
+  async removePlan(orgId) {
+    const planResult = await this.db.query(sql5`DELETE FROM auth_plans WHERE tenant_id = ${orgId}`);
+    assertWrite(planResult, "removePlan/plans");
+    const overrideResult = await this.db.query(sql5`DELETE FROM auth_overrides WHERE tenant_id = ${orgId}`);
+    assertWrite(overrideResult, "removePlan/overrides");
+  }
+  async attachAddOn(orgId, addOnId) {
+    const id = crypto.randomUUID();
+    const now = new Date().toISOString();
+    const result = await this.db.query(sql5`INSERT INTO auth_plan_addons (id, tenant_id, addon_id, quantity, created_at)
+          VALUES (${id}, ${orgId}, ${addOnId}, ${1}, ${now})
+          ON CONFLICT(tenant_id, addon_id) DO NOTHING`);
+    assertWrite(result, "attachAddOn");
+  }
+  async detachAddOn(orgId, addOnId) {
+    const result = await this.db.query(sql5`DELETE FROM auth_plan_addons WHERE tenant_id = ${orgId} AND addon_id = ${addOnId}`);
+    assertWrite(result, "detachAddOn");
+  }
+  async getAddOns(orgId) {
+    const result = await this.db.query(sql5`SELECT addon_id FROM auth_plan_addons WHERE tenant_id = ${orgId}`);
+    if (!result.ok)
+      return [];
+    return result.data.rows.map((r) => r.addon_id);
+  }
+  dispose() {}
+  async loadOverrides(orgId) {
+    const result = await this.db.query(sql5`SELECT overrides FROM auth_overrides WHERE tenant_id = ${orgId}`);
+    if (!result.ok || result.data.rows.length === 0)
+      return {};
+    try {
+      const overridesStr = result.data.rows[0]?.overrides;
+      if (!overridesStr)
+        return {};
+      return JSON.parse(overridesStr);
+    } catch {
+      return {};
+    }
+  }
+}
+// src/auth/db-role-assignment-store.ts
+import { sql as sql6 } from "@vertz/db/sql";
+class DbRoleAssignmentStore {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async assign(userId, resourceType, resourceId, role) {
+    const id = crypto.randomUUID();
+    const now = new Date().toISOString();
+    const result = await this.db.query(sql6`INSERT INTO auth_role_assignments (id, user_id, resource_type, resource_id, role, created_at)
+          VALUES (${id}, ${userId}, ${resourceType}, ${resourceId}, ${role}, ${now})
+          ON CONFLICT DO NOTHING`);
+    assertWrite(result, "assign");
+  }
+  async revoke(userId, resourceType, resourceId, role) {
+    const result = await this.db.query(sql6`DELETE FROM auth_role_assignments WHERE user_id = ${userId} AND resource_type = ${resourceType} AND resource_id = ${resourceId} AND role = ${role}`);
+    assertWrite(result, "revoke");
+  }
+  async getRoles(userId, resourceType, resourceId) {
+    const result = await this.db.query(sql6`SELECT role FROM auth_role_assignments WHERE user_id = ${userId} AND resource_type = ${resourceType} AND resource_id = ${resourceId}`);
+    if (!result.ok)
+      return [];
+    return result.data.rows.map((r) => r.role);
+  }
+  async getRolesForUser(userId) {
+    const result = await this.db.query(sql6`SELECT user_id, resource_type, resource_id, role FROM auth_role_assignments WHERE user_id = ${userId}`);
+    if (!result.ok)
+      return [];
+    return result.data.rows.map((r) => ({
+      userId: r.user_id,
+      resourceType: r.resource_type,
+      resourceId: r.resource_id,
+      role: r.role
+    }));
+  }
+  async getEffectiveRole(userId, resourceType, resourceId, accessDef, closureStore) {
+    const rolesForType = accessDef.roles[resourceType];
+    if (!rolesForType || rolesForType.length === 0)
+      return null;
+    const candidateRoles = [];
+    const directRoles = await this.getRoles(userId, resourceType, resourceId);
+    candidateRoles.push(...directRoles);
+    const ancestors = await closureStore.getAncestors(resourceType, resourceId);
+    for (const ancestor of ancestors) {
+      if (ancestor.depth === 0)
+        continue;
+      const ancestorRoles = await this.getRoles(userId, ancestor.type, ancestor.id);
+      for (const ancestorRole of ancestorRoles) {
+        const inheritedRole = resolveInheritedRole(ancestor.type, ancestorRole, resourceType, accessDef);
+        if (inheritedRole) {
+          candidateRoles.push(inheritedRole);
+        }
+      }
+    }
+    if (candidateRoles.length === 0)
+      return null;
+    const roleOrder = [...rolesForType];
+    let bestIndex = roleOrder.length;
+    for (const role of candidateRoles) {
+      const idx = roleOrder.indexOf(role);
+      if (idx !== -1 && idx < bestIndex) {
+        bestIndex = idx;
+      }
+    }
+    return bestIndex < roleOrder.length ? roleOrder[bestIndex] : null;
+  }
+  dispose() {}
+}
+// src/auth/db-session-store.ts
+import { sql as sql7 } from "@vertz/db/sql";
+class DbSessionStore {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async createSessionWithId(id, data) {
+    const now = new Date;
+    const tokensJson = data.currentTokens ? JSON.stringify(data.currentTokens) : null;
+    const result = await this.db.query(sql7`INSERT INTO auth_sessions (id, user_id, refresh_token_hash, previous_refresh_hash, current_tokens, ip_address, user_agent, created_at, last_active_at, expires_at, revoked_at)
+          VALUES (${id}, ${data.userId}, ${data.refreshTokenHash}, ${null}, ${tokensJson}, ${data.ipAddress}, ${data.userAgent}, ${now.toISOString()}, ${now.toISOString()}, ${data.expiresAt.toISOString()}, ${null})`);
+    assertWrite(result, "createSessionWithId");
+    return {
+      id,
+      userId: data.userId,
+      refreshTokenHash: data.refreshTokenHash,
+      previousRefreshHash: null,
+      ipAddress: data.ipAddress,
+      userAgent: data.userAgent,
+      createdAt: now,
+      lastActiveAt: now,
+      expiresAt: data.expiresAt,
+      revokedAt: null
+    };
+  }
+  async findByRefreshHash(hash) {
+    const nowStr = new Date().toISOString();
+    const result = await this.db.query(sql7`SELECT * FROM auth_sessions WHERE refresh_token_hash = ${hash} AND revoked_at IS NULL AND expires_at > ${nowStr} LIMIT 1`);
+    if (!result.ok)
+      return null;
+    const row = result.data.rows[0];
+    if (!row)
+      return null;
+    return this.rowToSession(row);
+  }
+  async findByPreviousRefreshHash(hash) {
+    const nowStr = new Date().toISOString();
+    const result = await this.db.query(sql7`SELECT * FROM auth_sessions WHERE previous_refresh_hash = ${hash} AND revoked_at IS NULL AND expires_at > ${nowStr} LIMIT 1`);
+    if (!result.ok)
+      return null;
+    const row = result.data.rows[0];
+    if (!row)
+      return null;
+    return this.rowToSession(row);
+  }
+  async revokeSession(id) {
+    const nowStr = new Date().toISOString();
+    const result = await this.db.query(sql7`UPDATE auth_sessions SET revoked_at = ${nowStr}, current_tokens = ${null} WHERE id = ${id}`);
+    assertWrite(result, "revokeSession");
+  }
+  async listActiveSessions(userId) {
+    const nowStr = new Date().toISOString();
+    const result = await this.db.query(sql7`SELECT * FROM auth_sessions WHERE user_id = ${userId} AND revoked_at IS NULL AND expires_at > ${nowStr}`);
+    if (!result.ok)
+      return [];
+    return result.data.rows.map((row) => this.rowToSession(row));
+  }
+  async countActiveSessions(userId) {
+    const nowStr = new Date().toISOString();
+    const result = await this.db.query(sql7`SELECT COUNT(*) as cnt FROM auth_sessions WHERE user_id = ${userId} AND revoked_at IS NULL AND expires_at > ${nowStr}`);
+    if (!result.ok)
+      return 0;
+    return result.data.rows[0]?.cnt ?? 0;
+  }
+  async getCurrentTokens(sessionId) {
+    const result = await this.db.query(sql7`SELECT current_tokens FROM auth_sessions WHERE id = ${sessionId} LIMIT 1`);
+    if (!result.ok)
+      return null;
+    const row = result.data.rows[0];
+    if (!row?.current_tokens)
+      return null;
+    try {
+      return JSON.parse(row.current_tokens);
+    } catch {
+      return null;
+    }
+  }
+  async updateSession(id, data) {
+    const tokensJson = data.currentTokens ? JSON.stringify(data.currentTokens) : null;
+    const result = await this.db.query(sql7`UPDATE auth_sessions SET refresh_token_hash = ${data.refreshTokenHash}, previous_refresh_hash = ${data.previousRefreshHash}, last_active_at = ${data.lastActiveAt.toISOString()}, current_tokens = ${tokensJson} WHERE id = ${id}`);
+    assertWrite(result, "updateSession");
+  }
+  dispose() {}
+  rowToSession(row) {
+    return {
+      id: row.id,
+      userId: row.user_id,
+      refreshTokenHash: row.refresh_token_hash,
+      previousRefreshHash: row.previous_refresh_hash,
+      ipAddress: row.ip_address,
+      userAgent: row.user_agent,
+      createdAt: new Date(row.created_at),
+      lastActiveAt: new Date(row.last_active_at),
+      expiresAt: new Date(row.expires_at),
+      revokedAt: row.revoked_at ? new Date(row.revoked_at) : null
+    };
   }
-  async getAncestors(type, id) {
-    return this.rows.filter((row) => row.descendantType === type && row.descendantId === id).map((row) => ({
-      type: row.ancestorType,
-      id: row.ancestorId,
-      depth: row.depth
-    }));
+}
+// src/auth/db-user-store.ts
+import { sql as sql8 } from "@vertz/db/sql";
+class DbUserStore {
+  db;
+  constructor(db) {
+    this.db = db;
   }
-  async getDescendants(type, id) {
-    return this.rows.filter((row) => row.ancestorType === type && row.ancestorId === id).map((row) => ({
-      type: row.descendantType,
-      id: row.descendantId,
-      depth: row.depth
-    }));
+  async createUser(user, passwordHash) {
+    const result = await this.db.query(sql8`INSERT INTO auth_users (id, email, password_hash, role, plan, email_verified, created_at, updated_at)
+          VALUES (${user.id}, ${user.email.toLowerCase()}, ${passwordHash}, ${user.role}, ${user.plan ?? null}, ${boolVal(this.db, user.emailVerified ?? false)}, ${user.createdAt.toISOString()}, ${user.updatedAt.toISOString()})`);
+    assertWrite(result, "createUser");
   }
-  async hasPath(ancestorType, ancestorId, descendantType, descendantId) {
-    return this.rows.some((row) => row.ancestorType === ancestorType && row.ancestorId === ancestorId && row.descendantType === descendantType && row.descendantId === descendantId);
+  async findByEmail(email) {
+    const result = await this.db.query(sql8`SELECT * FROM auth_users WHERE email = ${email.toLowerCase()} LIMIT 1`);
+    if (!result.ok)
+      return null;
+    const row = result.data.rows[0];
+    if (!row)
+      return null;
+    return {
+      user: this.rowToUser(row),
+      passwordHash: row.password_hash
+    };
   }
-  dispose() {
-    this.rows = [];
+  async findById(id) {
+    const result = await this.db.query(sql8`SELECT * FROM auth_users WHERE id = ${id} LIMIT 1`);
+    if (!result.ok)
+      return null;
+    const row = result.data.rows[0];
+    if (!row)
+      return null;
+    return this.rowToUser(row);
+  }
+  async updatePasswordHash(userId, passwordHash) {
+    const result = await this.db.query(sql8`UPDATE auth_users SET password_hash = ${passwordHash}, updated_at = ${new Date().toISOString()} WHERE id = ${userId}`);
+    assertWrite(result, "updatePasswordHash");
+  }
+  async updateEmailVerified(userId, verified) {
+    const val = boolVal(this.db, verified);
+    const result = await this.db.query(sql8`UPDATE auth_users SET email_verified = ${val}, updated_at = ${new Date().toISOString()} WHERE id = ${userId}`);
+    assertWrite(result, "updateEmailVerified");
+  }
+  rowToUser(row) {
+    return {
+      id: row.id,
+      email: row.email,
+      role: row.role,
+      plan: row.plan ?? undefined,
+      emailVerified: row.email_verified === 1 || row.email_verified === true,
+      createdAt: new Date(row.created_at),
+      updatedAt: new Date(row.updated_at)
+    };
   }
 }
 // src/auth/define-access.ts
 function defineAccess(input) {
-  if (input.hierarchy.length === 0) {
-    throw new Error("Hierarchy must have at least one resource type");
+  const { entities, entitlements: rawEntitlements } = input;
+  for (const [entityName, entityDef] of Object.entries(entities)) {
+    const roleSet = new Set;
+    for (const role of entityDef.roles) {
+      if (roleSet.has(role)) {
+        throw new Error(`Duplicate role '${role}' in entity '${entityName}'`);
+      }
+      roleSet.add(role);
+    }
+  }
+  const parentToChildren = new Map;
+  const childToParent = new Map;
+  const inheritanceMap = {};
+  for (const [entityName, entityDef] of Object.entries(entities)) {
+    if (!entityDef.inherits)
+      continue;
+    const parentEntities = new Set;
+    for (const [inheritKey, localRole] of Object.entries(entityDef.inherits)) {
+      const colonIdx = inheritKey.indexOf(":");
+      if (colonIdx === -1) {
+        throw new Error(`Invalid inherits key '${inheritKey}' in entity '${entityName}' — expected format 'entity:role'`);
+      }
+      const parentEntityName2 = inheritKey.substring(0, colonIdx);
+      const parentRoleName = inheritKey.substring(colonIdx + 1);
+      if (parentEntityName2 === entityName) {
+        throw new Error(`Entity '${entityName}' cannot inherit from itself`);
+      }
+      if (!(parentEntityName2 in entities)) {
+        throw new Error(`Entity '${parentEntityName2}' in ${entityName}.inherits is not defined`);
+      }
+      const parentEntity = entities[parentEntityName2];
+      if (!parentEntity.roles.includes(parentRoleName)) {
+        throw new Error(`Role '${parentRoleName}' does not exist on entity '${parentEntityName2}'`);
+      }
+      if (!entityDef.roles.includes(localRole)) {
+        throw new Error(`Role '${localRole}' does not exist on entity '${entityName}'`);
+      }
+      parentEntities.add(parentEntityName2);
+      if (!inheritanceMap[parentEntityName2]) {
+        inheritanceMap[parentEntityName2] = {};
+      }
+      inheritanceMap[parentEntityName2][parentRoleName] = localRole;
+    }
+    if (parentEntities.size > 1) {
+      throw new Error(`Entity '${entityName}' inherits from multiple parents (${[...parentEntities].join(", ")}). Each entity can only inherit from one parent.`);
+    }
+    const parentEntityName = [...parentEntities][0];
+    if (parentEntityName) {
+      if (!parentToChildren.has(parentEntityName)) {
+        parentToChildren.set(parentEntityName, new Set);
+      }
+      parentToChildren.get(parentEntityName).add(entityName);
+      if (childToParent.has(entityName)) {
+        throw new Error(`Entity '${entityName}' inherits from multiple parents`);
+      }
+      childToParent.set(entityName, parentEntityName);
+    }
   }
-  if (input.hierarchy.length > 4) {
+  detectCycles(childToParent);
+  const hierarchy = inferHierarchy(entities, childToParent, parentToChildren);
+  if (hierarchy.length > 4) {
     throw new Error("Hierarchy depth must not exceed 4 levels");
   }
-  const hierarchySet = new Set(input.hierarchy);
-  for (const resourceType of Object.keys(input.roles)) {
-    if (!hierarchySet.has(resourceType)) {
-      throw new Error(`Roles reference unknown resource type: ${resourceType}`);
+  const resolvedEntitlements = {};
+  const ruleContext = createRuleContext();
+  for (const [entName, entValue] of Object.entries(rawEntitlements)) {
+    const colonIdx = entName.indexOf(":");
+    if (colonIdx === -1) {
+      throw new Error(`Entitlement '${entName}' must use format 'entity:action'`);
+    }
+    const entityPrefix = entName.substring(0, colonIdx);
+    if (!(entityPrefix in entities)) {
+      throw new Error(`Entitlement '${entName}' references undefined entity '${entityPrefix}'`);
+    }
+    let entDef;
+    if (typeof entValue === "function") {
+      entDef = entValue(ruleContext);
+    } else {
+      entDef = entValue;
     }
+    const entityRoles = entities[entityPrefix].roles;
+    for (const role of entDef.roles) {
+      if (!entityRoles.includes(role)) {
+        throw new Error(`Role '${role}' in '${entName}' does not exist on entity '${entityPrefix}'`);
+      }
+    }
+    resolvedEntitlements[entName] = entDef;
   }
-  const inheritance = input.inheritance ?? {};
-  for (const [resourceType, mapping] of Object.entries(inheritance)) {
-    if (!hierarchySet.has(resourceType)) {
-      throw new Error(`Inheritance references unknown resource type: ${resourceType}`);
+  const entitlementSet = new Set(Object.keys(resolvedEntitlements));
+  const entityNameSet = new Set(Object.keys(entities));
+  if (input.plans) {
+    for (const [planName, planDef] of Object.entries(input.plans)) {
+      if (planDef.features) {
+        for (const feature of planDef.features) {
+          if (!entitlementSet.has(feature)) {
+            throw new Error(`Plan '${planName}' feature '${feature}' is not a defined entitlement`);
+          }
+        }
+      }
+      if (planDef.limits) {
+        for (const [limitKey, limitDef] of Object.entries(planDef.limits)) {
+          if (!entitlementSet.has(limitDef.gates)) {
+            throw new Error(`Limit '${limitKey}' gates '${limitDef.gates}' which is not defined`);
+          }
+          if (limitDef.scope && !entityNameSet.has(limitDef.scope)) {
+            throw new Error(`Limit '${limitKey}' scope '${limitDef.scope}' is not a defined entity`);
+          }
+          if (limitDef.max < -1 || limitDef.max < 0 && limitDef.max !== -1) {
+            throw new Error(`Limit '${limitKey}' max must be -1 (unlimited), 0 (disabled), or a positive integer, got ${limitDef.max}`);
+          }
+          if (!Number.isInteger(limitDef.max)) {
+            throw new Error(`Limit '${limitKey}' max must be -1 (unlimited), 0 (disabled), or a positive integer, got ${limitDef.max}`);
+          }
+        }
+      }
+      if (planDef.addOn) {
+        if (planDef.group) {
+          throw new Error(`Add-on '${planName}' must not have a group`);
+        }
+      } else {
+        if (!planDef.group) {
+          throw new Error(`Base plan '${planName}' must have a group`);
+        }
+        if (planDef.requires) {
+          throw new Error(`Plan '${planName}': 'requires' is only valid on add-on plans`);
+        }
+      }
+      if (planDef.addOn && planDef.requires) {
+        for (const reqPlan of planDef.requires.plans) {
+          if (!input.plans[reqPlan]) {
+            throw new Error(`Add-on '${planName}' requires plan '${reqPlan}' is not defined`);
+          }
+        }
+      }
     }
-    const parentRoles = new Set(input.roles[resourceType] ?? []);
-    const hierarchyIdx = input.hierarchy.indexOf(resourceType);
-    const childType = input.hierarchy[hierarchyIdx + 1];
-    const childRoles = childType ? new Set(input.roles[childType] ?? []) : new Set;
-    for (const [parentRole, childRole] of Object.entries(mapping)) {
-      if (!parentRoles.has(parentRole)) {
-        throw new Error(`Inheritance for ${resourceType} references undefined role: ${parentRole}`);
+    if (input.defaultPlan) {
+      const defaultPlanDef = input.plans[input.defaultPlan];
+      if (defaultPlanDef?.addOn) {
+        throw new Error(`defaultPlan '${input.defaultPlan}' is an add-on, not a base plan`);
       }
-      if (!childRoles.has(childRole)) {
-        throw new Error(`Inheritance for ${resourceType} maps to undefined child role: ${childRole}`);
+    }
+    const basePlanLimitKeys = new Set;
+    for (const [, planDef] of Object.entries(input.plans)) {
+      if (!planDef.addOn && planDef.limits) {
+        for (const limitKey of Object.keys(planDef.limits)) {
+          basePlanLimitKeys.add(limitKey);
+        }
       }
     }
-  }
-  const planNameSet = new Set(Object.keys(input.plans ?? {}));
-  for (const [entName, entDef] of Object.entries(input.entitlements)) {
-    if (entDef.plans) {
-      for (const planRef of entDef.plans) {
-        if (!planNameSet.has(planRef)) {
-          throw new Error(`Entitlement "${entName}" references unknown plan: ${planRef}`);
+    for (const [, planDef] of Object.entries(input.plans)) {
+      if (planDef.addOn && planDef.limits) {
+        for (const limitKey of Object.keys(planDef.limits)) {
+          if (!basePlanLimitKeys.has(limitKey)) {
+            throw new Error(`Add-on limit '${limitKey}' not defined in any base plan`);
+          }
         }
       }
     }
   }
-  const entitlementSet = new Set(Object.keys(input.entitlements));
+  const planGatedEntitlements = new Set;
+  const entitlementToLimitKeys = {};
   if (input.plans) {
-    for (const [planName, planDef] of Object.entries(input.plans)) {
-      const planEntitlementSet = new Set(planDef.entitlements);
-      for (const ent of planDef.entitlements) {
-        if (!entitlementSet.has(ent)) {
-          throw new Error(`Plan "${planName}" references unknown entitlement: ${ent}`);
+    for (const [, planDef] of Object.entries(input.plans)) {
+      if (planDef.features) {
+        for (const feature of planDef.features) {
+          planGatedEntitlements.add(feature);
         }
       }
       if (planDef.limits) {
-        for (const limitKey of Object.keys(planDef.limits)) {
-          if (!planEntitlementSet.has(limitKey)) {
-            throw new Error(`Plan "${planName}" has limit for "${limitKey}" which is not in the plan's entitlements`);
+        for (const [limitKey, limitDef] of Object.entries(planDef.limits)) {
+          if (!entitlementToLimitKeys[limitDef.gates]) {
+            entitlementToLimitKeys[limitDef.gates] = [];
+          }
+          if (!entitlementToLimitKeys[limitDef.gates].includes(limitKey)) {
+            entitlementToLimitKeys[limitDef.gates].push(limitKey);
           }
         }
       }
     }
   }
+  const rolesMap = {};
+  for (const [entityName, entityDef] of Object.entries(entities)) {
+    rolesMap[entityName] = Object.freeze([...entityDef.roles]);
+  }
   const config = {
-    hierarchy: Object.freeze([...input.hierarchy]),
-    roles: Object.freeze(Object.fromEntries(Object.entries(input.roles).map(([k, v]) => [k, Object.freeze([...v])]))),
-    inheritance: Object.freeze(Object.fromEntries(Object.entries(input.inheritance ?? {}).map(([k, v]) => [k, Object.freeze({ ...v })]))),
-    entitlements: Object.freeze(Object.fromEntries(Object.entries(input.entitlements).map(([k, v]) => [k, Object.freeze({ ...v })]))),
+    hierarchy: Object.freeze([...hierarchy]),
+    entities: Object.freeze(Object.fromEntries(Object.entries(entities).map(([k, v]) => [
+      k,
+      Object.freeze({
+        roles: Object.freeze([...v.roles]),
+        ...v.inherits ? { inherits: Object.freeze({ ...v.inherits }) } : {}
+      })
+    ]))),
+    roles: Object.freeze(rolesMap),
+    inheritance: Object.freeze(Object.fromEntries(Object.entries(inheritanceMap).map(([k, v]) => [k, Object.freeze({ ...v })]))),
+    entitlements: Object.freeze(Object.fromEntries(Object.entries(resolvedEntitlements).map(([k, v]) => [k, Object.freeze({ ...v })]))),
+    _planGatedEntitlements: Object.freeze(planGatedEntitlements),
+    _entitlementToLimitKeys: Object.freeze(Object.fromEntries(Object.entries(entitlementToLimitKeys).map(([k, v]) => [k, Object.freeze([...v])]))),
     ...input.defaultPlan ? { defaultPlan: input.defaultPlan } : {},
     ...input.plans ? {
       plans: Object.freeze(Object.fromEntries(Object.entries(input.plans).map(([planName, planDef]) => [
         planName,
         Object.freeze({
-          entitlements: Object.freeze([...planDef.entitlements]),
+          ...planDef.title ? { title: planDef.title } : {},
+          ...planDef.description ? { description: planDef.description } : {},
+          ...planDef.group ? { group: planDef.group } : {},
+          ...planDef.addOn ? { addOn: planDef.addOn } : {},
+          ...planDef.price ? { price: Object.freeze({ ...planDef.price }) } : {},
+          ...planDef.features ? { features: Object.freeze([...planDef.features]) } : {},
           ...planDef.limits ? {
             limits: Object.freeze(Object.fromEntries(Object.entries(planDef.limits).map(([k, v]) => [
               k,
               Object.freeze({ ...v })
             ])))
+          } : {},
+          ...planDef.grandfathering ? { grandfathering: Object.freeze({ ...planDef.grandfathering }) } : {},
+          ...planDef.requires ? {
+            requires: Object.freeze({
+              group: planDef.requires.group,
+              plans: Object.freeze([...planDef.requires.plans])
+            })
           } : {}
         })
       ])))
@@ -1761,6 +3208,79 @@ function defineAccess(input) {
   };
   return Object.freeze(config);
 }
+function inferHierarchy(entities, childToParent, parentToChildren) {
+  const inInheritance = new Set;
+  for (const [child, parent] of childToParent.entries()) {
+    inInheritance.add(child);
+    inInheritance.add(parent);
+  }
+  if (inInheritance.size === 0) {
+    return Object.keys(entities);
+  }
+  const roots = [];
+  for (const entity of inInheritance) {
+    if (!childToParent.has(entity)) {
+      roots.push(entity);
+    }
+  }
+  const hierarchy = [];
+  const visited = new Set;
+  function walkChain(entity) {
+    if (visited.has(entity))
+      return;
+    visited.add(entity);
+    hierarchy.push(entity);
+    const children = parentToChildren.get(entity);
+    if (children) {
+      for (const child of children) {
+        walkChain(child);
+      }
+    }
+  }
+  for (const root of roots) {
+    walkChain(root);
+  }
+  for (const entityName of Object.keys(entities)) {
+    if (!visited.has(entityName)) {
+      hierarchy.push(entityName);
+    }
+  }
+  return hierarchy;
+}
+function detectCycles(childToParent) {
+  const visited = new Set;
+  const inPath = new Set;
+  for (const entity of childToParent.keys()) {
+    if (!visited.has(entity)) {
+      walkForCycles(entity, childToParent, visited, inPath);
+    }
+  }
+}
+function walkForCycles(entity, childToParent, visited, inPath) {
+  if (inPath.has(entity)) {
+    throw new Error("Circular inheritance detected");
+  }
+  if (visited.has(entity))
+    return;
+  inPath.add(entity);
+  const parent = childToParent.get(entity);
+  if (parent) {
+    walkForCycles(parent, childToParent, visited, inPath);
+  }
+  inPath.delete(entity);
+  visited.add(entity);
+}
+function createRuleContext() {
+  return {
+    where(conditions) {
+      return { type: "where", conditions: Object.freeze({ ...conditions }) };
+    },
+    user: {
+      id: Object.freeze({ __marker: "user.id" }),
+      tenantId: Object.freeze({ __marker: "user.tenantId" })
+    }
+  };
+}
 // src/auth/entity-access.ts
 async function computeEntityAccess(entitlements, entity, accessContext) {
   const results = {};
@@ -1804,6 +3324,385 @@ function checkFva(payload, maxAgeSeconds) {
   const now = Math.floor(Date.now() / 1000);
   return now - payload.fva < maxAgeSeconds;
 }
+// src/auth/grandfathering-store.ts
+class InMemoryGrandfatheringStore {
+  states = new Map;
+  async setGrandfathered(tenantId, planId, version, graceEnds) {
+    this.states.set(`${tenantId}:${planId}`, { tenantId, planId, version, graceEnds });
+  }
+  async getGrandfathered(tenantId, planId) {
+    return this.states.get(`${tenantId}:${planId}`) ?? null;
+  }
+  async listGrandfathered(planId) {
+    const result = [];
+    for (const state of this.states.values()) {
+      if (state.planId === planId) {
+        result.push(state);
+      }
+    }
+    return result;
+  }
+  async removeGrandfathered(tenantId, planId) {
+    this.states.delete(`${tenantId}:${planId}`);
+  }
+  dispose() {
+    this.states.clear();
+  }
+}
+// src/auth/override-store.ts
+class InMemoryOverrideStore {
+  overrides = new Map;
+  async set(tenantId, overrides) {
+    const existing = this.overrides.get(tenantId) ?? {};
+    if (overrides.features) {
+      const featureSet = new Set(existing.features ?? []);
+      for (const f of overrides.features) {
+        featureSet.add(f);
+      }
+      existing.features = [...featureSet];
+    }
+    if (overrides.limits) {
+      existing.limits = { ...existing.limits, ...overrides.limits };
+    }
+    this.overrides.set(tenantId, existing);
+  }
+  async remove(tenantId, keys) {
+    const existing = this.overrides.get(tenantId);
+    if (!existing)
+      return;
+    if (keys.features && existing.features) {
+      const removeSet = new Set(keys.features);
+      existing.features = existing.features.filter((f) => !removeSet.has(f));
+      if (existing.features.length === 0) {
+        delete existing.features;
+      }
+    }
+    if (keys.limits && existing.limits) {
+      for (const key of keys.limits) {
+        delete existing.limits[key];
+      }
+      if (Object.keys(existing.limits).length === 0) {
+        delete existing.limits;
+      }
+    }
+    if (!existing.features && !existing.limits) {
+      this.overrides.delete(tenantId);
+    }
+  }
+  async get(tenantId) {
+    return this.overrides.get(tenantId) ?? null;
+  }
+  dispose() {
+    this.overrides.clear();
+  }
+}
+function validateOverrides(accessDef, overrides) {
+  const allLimitKeys = new Set;
+  if (accessDef.plans) {
+    for (const planDef of Object.values(accessDef.plans)) {
+      if (planDef.limits) {
+        for (const key of Object.keys(planDef.limits)) {
+          allLimitKeys.add(key);
+        }
+      }
+    }
+  }
+  if (overrides.limits) {
+    for (const [key, limitDef] of Object.entries(overrides.limits)) {
+      if (!allLimitKeys.has(key)) {
+        throw new Error(`Override limit key '${key}' is not defined in any plan`);
+      }
+      if (limitDef.max !== undefined) {
+        if (limitDef.max < -1) {
+          throw new Error(`Override limit '${key}' max must be -1 (unlimited), 0 (disabled), or a positive integer, got ${limitDef.max}`);
+        }
+      }
+      if (limitDef.add !== undefined) {
+        if (!Number.isFinite(limitDef.add)) {
+          throw new Error(`Override limit '${key}' add must be a finite integer, got ${limitDef.add}`);
+        }
+        if (!Number.isInteger(limitDef.add)) {
+          throw new Error(`Override limit '${key}' add must be an integer, got ${limitDef.add}`);
+        }
+      }
+    }
+  }
+  if (overrides.features) {
+    for (const feature of overrides.features) {
+      if (!accessDef.entitlements[feature]) {
+        throw new Error(`Override feature '${feature}' is not a defined entitlement`);
+      }
+    }
+  }
+}
+// src/auth/plan-hash.ts
+async function computePlanHash(config) {
+  const canonical = {
+    features: config.features ?? [],
+    limits: config.limits ?? {},
+    price: config.price ?? null
+  };
+  const json = JSON.stringify(canonical, sortedReplacer);
+  return sha256Hex(json);
+}
+function sortedReplacer(_key, value) {
+  if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+    const sorted = {};
+    for (const k of Object.keys(value).sort()) {
+      sorted[k] = value[k];
+    }
+    return sorted;
+  }
+  return value;
+}
+// src/auth/plan-manager.ts
+var GRACE_DURATION_MS = {
+  "1m": 30 * 24 * 60 * 60 * 1000,
+  "3m": 90 * 24 * 60 * 60 * 1000,
+  "6m": 180 * 24 * 60 * 60 * 1000,
+  "12m": 365 * 24 * 60 * 60 * 1000
+};
+function resolveGraceEnd(planDef, now) {
+  const grace = planDef.grandfathering?.grace;
+  if (grace === "indefinite")
+    return null;
+  if (grace && GRACE_DURATION_MS[grace]) {
+    return new Date(now.getTime() + GRACE_DURATION_MS[grace]);
+  }
+  const interval = planDef.price?.interval;
+  if (interval === "year") {
+    return new Date(now.getTime() + GRACE_DURATION_MS["3m"]);
+  }
+  return new Date(now.getTime() + GRACE_DURATION_MS["1m"]);
+}
+function createPlanManager(config) {
+  const { plans, versionStore, grandfatheringStore, planStore } = config;
+  const clock = config.clock ?? (() => new Date);
+  const handlers = [];
+  function emit(event) {
+    for (const handler of handlers) {
+      handler(event);
+    }
+  }
+  function extractSnapshot(planDef) {
+    return {
+      features: planDef.features ? [...planDef.features] : [],
+      limits: planDef.limits ? { ...planDef.limits } : {},
+      price: planDef.price ? { ...planDef.price } : null
+    };
+  }
+  async function initialize() {
+    const now = clock();
+    for (const [planId, planDef] of Object.entries(plans)) {
+      if (planDef.addOn)
+        continue;
+      const snapshot = extractSnapshot(planDef);
+      const hash = await computePlanHash(snapshot);
+      const currentHash = await versionStore.getCurrentHash(planId);
+      if (currentHash === hash)
+        continue;
+      const version = await versionStore.createVersion(planId, hash, snapshot);
+      const currentVersion = version;
+      emit({
+        type: "plan:version_created",
+        planId,
+        version,
+        currentVersion,
+        timestamp: now
+      });
+      if (version > 1) {
+        const grandfatheredTenants = await listTenantsOnPlan(planId);
+        const graceEnds = resolveGraceEnd(planDef, now);
+        for (const tenantId of grandfatheredTenants) {
+          const tenantVersion = await versionStore.getTenantVersion(tenantId, planId);
+          if (tenantVersion !== null && tenantVersion < version) {
+            await grandfatheringStore.setGrandfathered(tenantId, planId, tenantVersion, graceEnds);
+          }
+        }
+      }
+    }
+  }
+  async function listTenantsOnPlan(planId) {
+    if (planStore.listByPlan) {
+      return planStore.listByPlan(planId);
+    }
+    return [];
+  }
+  async function migrate(planId, opts) {
+    const now = clock();
+    const currentVersion = await versionStore.getCurrentVersion(planId);
+    if (currentVersion === null)
+      return;
+    if (opts?.tenantId) {
+      await migrateTenant(opts.tenantId, planId, currentVersion, now);
+      return;
+    }
+    const grandfatheredList = await grandfatheringStore.listGrandfathered(planId);
+    for (const state of grandfatheredList) {
+      if (state.graceEnds === null)
+        continue;
+      if (state.graceEnds.getTime() <= now.getTime()) {
+        await migrateTenant(state.tenantId, planId, currentVersion, now);
+      }
+    }
+  }
+  async function migrateTenant(tenantId, planId, targetVersion, now) {
+    const previousVersion = await versionStore.getTenantVersion(tenantId, planId);
+    if (previousVersion !== null) {
+      const prevInfo = await versionStore.getVersion(planId, previousVersion);
+      const targetInfo = await versionStore.getVersion(planId, targetVersion);
+      if (prevInfo && targetInfo) {
+        const prevFeatures = new Set(prevInfo.snapshot.features);
+        const targetFeatures = new Set(targetInfo.snapshot.features);
+        for (const f of prevFeatures) {
+          if (!targetFeatures.has(f)) {
+            break;
+          }
+        }
+      }
+    }
+    await versionStore.setTenantVersion(tenantId, planId, targetVersion);
+    await grandfatheringStore.removeGrandfathered(tenantId, planId);
+    emit({
+      type: "plan:migrated",
+      planId,
+      tenantId,
+      version: targetVersion,
+      previousVersion: previousVersion ?? undefined,
+      timestamp: now
+    });
+  }
+  async function schedule(planId, opts) {
+    const at = typeof opts.at === "string" ? new Date(opts.at) : opts.at;
+    const grandfatheredList = await grandfatheringStore.listGrandfathered(planId);
+    for (const state of grandfatheredList) {
+      await grandfatheringStore.setGrandfathered(state.tenantId, planId, state.version, at);
+    }
+  }
+  async function resolve(tenantId) {
+    const orgPlan = await planStore.getPlan(tenantId);
+    if (!orgPlan)
+      return null;
+    const planId = orgPlan.planId;
+    const currentVersion = await versionStore.getCurrentVersion(planId);
+    if (currentVersion === null)
+      return null;
+    const tenantVersion = await versionStore.getTenantVersion(tenantId, planId);
+    const effectiveVersion = tenantVersion ?? currentVersion;
+    const grandfatheringState = await grandfatheringStore.getGrandfathered(tenantId, planId);
+    const versionInfo = await versionStore.getVersion(planId, effectiveVersion);
+    if (!versionInfo)
+      return null;
+    return {
+      planId,
+      version: effectiveVersion,
+      currentVersion,
+      grandfathered: grandfatheringState !== null,
+      graceEnds: grandfatheringState?.graceEnds ?? null,
+      snapshot: versionInfo.snapshot
+    };
+  }
+  async function grandfatheredFn(planId) {
+    return grandfatheringStore.listGrandfathered(planId);
+  }
+  const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000;
+  const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
+  async function checkGraceEvents() {
+    const now = clock();
+    for (const planId of Object.keys(plans)) {
+      const grandfatheredList = await grandfatheringStore.listGrandfathered(planId);
+      for (const state of grandfatheredList) {
+        if (state.graceEnds === null)
+          continue;
+        const timeUntilGraceEnd = state.graceEnds.getTime() - now.getTime();
+        if (timeUntilGraceEnd <= SEVEN_DAYS_MS && timeUntilGraceEnd > 0) {
+          emit({
+            type: "plan:grace_expiring",
+            planId,
+            tenantId: state.tenantId,
+            version: state.version,
+            graceEnds: state.graceEnds,
+            timestamp: now
+          });
+        } else if (timeUntilGraceEnd <= THIRTY_DAYS_MS && timeUntilGraceEnd > SEVEN_DAYS_MS) {
+          emit({
+            type: "plan:grace_approaching",
+            planId,
+            tenantId: state.tenantId,
+            version: state.version,
+            graceEnds: state.graceEnds,
+            timestamp: now
+          });
+        }
+      }
+    }
+  }
+  function on(handler) {
+    handlers.push(handler);
+  }
+  function off(handler) {
+    const idx = handlers.indexOf(handler);
+    if (idx >= 0)
+      handlers.splice(idx, 1);
+  }
+  return {
+    initialize,
+    migrate,
+    schedule,
+    resolve,
+    grandfathered: grandfatheredFn,
+    checkGraceEvents,
+    on,
+    off
+  };
+}
+// src/auth/plan-version-store.ts
+class InMemoryPlanVersionStore {
+  versions = new Map;
+  tenantVersions = new Map;
+  async createVersion(planId, hash, snapshot) {
+    const planVersions = this.versions.get(planId) ?? [];
+    const version = planVersions.length + 1;
+    const info = {
+      planId,
+      version,
+      hash,
+      snapshot,
+      createdAt: new Date
+    };
+    planVersions.push(info);
+    this.versions.set(planId, planVersions);
+    return version;
+  }
+  async getCurrentVersion(planId) {
+    const planVersions = this.versions.get(planId);
+    if (!planVersions || planVersions.length === 0)
+      return null;
+    return planVersions.length;
+  }
+  async getVersion(planId, version) {
+    const planVersions = this.versions.get(planId);
+    if (!planVersions)
+      return null;
+    return planVersions[version - 1] ?? null;
+  }
+  async getTenantVersion(tenantId, planId) {
+    return this.tenantVersions.get(`${tenantId}:${planId}`) ?? null;
+  }
+  async setTenantVersion(tenantId, planId, version) {
+    this.tenantVersions.set(`${tenantId}:${planId}`, version);
+  }
+  async getCurrentHash(planId) {
+    const planVersions = this.versions.get(planId);
+    if (!planVersions || planVersions.length === 0)
+      return null;
+    return planVersions[planVersions.length - 1].hash;
+  }
+  dispose() {
+    this.versions.clear();
+    this.tenantVersions.clear();
+  }
+}
 // src/auth/providers/discord.ts
 var AUTHORIZATION_URL = "https://discord.com/api/oauth2/authorize";
 var TOKEN_URL = "https://discord.com/api/oauth2/token";
@@ -2043,7 +3942,7 @@ class InMemoryRoleAssignmentStore {
         continue;
       const ancestorRoles = await this.getRoles(userId, ancestor.type, ancestor.id);
       for (const ancestorRole of ancestorRoles) {
-        const inheritedRole = resolveInheritedRole2(ancestor.type, ancestorRole, resourceType, accessDef);
+        const inheritedRole = resolveInheritedRole(ancestor.type, ancestorRole, resourceType, accessDef);
         if (inheritedRole) {
           candidateRoles.push(inheritedRole);
         }
@@ -2065,28 +3964,13 @@ class InMemoryRoleAssignmentStore {
     this.assignments = [];
   }
 }
-function resolveInheritedRole2(sourceType, sourceRole, targetType, accessDef) {
-  const hierarchy = accessDef.hierarchy;
-  const sourceIdx = hierarchy.indexOf(sourceType);
-  const targetIdx = hierarchy.indexOf(targetType);
-  if (sourceIdx === -1 || targetIdx === -1 || sourceIdx >= targetIdx)
-    return null;
-  let currentRole = sourceRole;
-  for (let i = sourceIdx;i < targetIdx; i++) {
-    const currentType = hierarchy[i];
-    const inheritanceMap = accessDef.inheritance[currentType];
-    if (!inheritanceMap || !(currentRole in inheritanceMap))
-      return null;
-    currentRole = inheritanceMap[currentRole];
-  }
-  return currentRole;
-}
 // src/auth/rules.ts
 var userMarkers = {
   id: Object.freeze({ __marker: "user.id" }),
   tenantId: Object.freeze({ __marker: "user.tenantId" })
 };
 var rules = {
+  public: Object.freeze({ type: "public" }),
   role(...roleNames) {
     return { type: "role", roles: Object.freeze([...roleNames]) };
   },
@@ -3730,9 +5614,12 @@ async function enforceAccess(operation, accessRules, ctx, row) {
   if (rule === false) {
     return err2(new EntityForbiddenError(`Operation "${operation}" is disabled`));
   }
-  const allowed = await rule(ctx, row ?? {});
-  if (!allowed) {
-    return err2(new EntityForbiddenError(`Access denied for operation "${operation}"`));
+  if (typeof rule === "function") {
+    const allowed = await rule(ctx, row ?? {});
+    if (!allowed) {
+      return err2(new EntityForbiddenError(`Access denied for operation "${operation}"`));
+    }
+    return ok2(undefined);
   }
   return ok2(undefined);
 }
@@ -4565,10 +6452,14 @@ function createServer(config) {
   const allRoutes = [];
   const registry = new EntityRegistry;
   const apiPrefix = config.apiPrefix === undefined ? "/api" : config.apiPrefix;
+  const { db } = config;
+  const hasDbClient = db && isDatabaseClient(db);
+  if (hasDbClient && config.auth) {
+    validateAuthModels(db);
+  }
   if (config.entities && config.entities.length > 0) {
-    const { db } = config;
     let dbFactory;
-    if (db && isDatabaseClient(db)) {
+    if (hasDbClient) {
       const dbModels = db._internals.models;
       const missing = config.entities.filter((e) => !(e.name in dbModels)).map((e) => `"${e.name}"`);
       if (missing.length > 0) {
@@ -4601,10 +6492,27 @@ function createServer(config) {
       allRoutes.push(...routes);
     }
   }
-  return coreCreateServer({
+  const app = coreCreateServer({
     ...config,
     _entityRoutes: allRoutes.length > 0 ? allRoutes : undefined
   });
+  if (hasDbClient && config.auth) {
+    const dbClient = db;
+    const authConfig = {
+      ...config.auth,
+      userStore: config.auth.userStore ?? new DbUserStore(dbClient),
+      sessionStore: config.auth.sessionStore ?? new DbSessionStore(dbClient)
+    };
+    const auth = createAuth(authConfig);
+    const serverInstance = app;
+    serverInstance.auth = auth;
+    serverInstance.initialize = async () => {
+      await initializeAuthTables(dbClient);
+      await auth.initialize();
+    };
+    return serverInstance;
+  }
+  return app;
 }
 // src/entity/entity.ts
 import { deepFreeze } from "@vertz/core";
@@ -4652,14 +6560,18 @@ export {
   vertz,
   verifyPassword,
   validatePassword,
+  validateOverrides,
+  validateAuthModels,
   stripReadOnlyFields,
   stripHiddenFields,
   service,
   rules,
   makeImmutable,
+  initializeAuthTables,
   hashPassword,
   google,
   github,
+  getIncompatibleAddOns,
   generateEntityRoutes,
   entityErrorHandler,
   entity,
@@ -4670,20 +6582,28 @@ export {
   defaultAccess,
   deepFreeze3 as deepFreeze,
   decodeAccessSet,
+  createWebhookHandler,
+  createStripeBillingAdapter,
   createServer,
+  createPlanManager,
   createMiddleware,
   createImmutableProxy,
   createEnv,
   createEntityContext,
   createCrudHandlers,
+  createBillingEventEmitter,
   createAuth,
   createAccessEventBroadcaster,
   createAccessContext,
   createAccess,
+  computePlanHash,
+  computeOverage,
   computeEntityAccess,
   computeAccessSet,
   checkFva,
+  checkAddOnCompatibility,
   calculateBillingPeriod,
+  authModels,
   VertzException2 as VertzException,
   ValidationException2 as ValidationException,
   UnauthorizedException,
@@ -4695,16 +6615,27 @@ export {
   InMemorySessionStore,
   InMemoryRoleAssignmentStore,
   InMemoryRateLimitStore,
+  InMemoryPlanVersionStore,
   InMemoryPlanStore,
   InMemoryPasswordResetStore,
+  InMemoryOverrideStore,
   InMemoryOAuthAccountStore,
   InMemoryMFAStore,
+  InMemoryGrandfatheringStore,
   InMemoryFlagStore,
   InMemoryEmailVerificationStore,
   InMemoryClosureStore,
   ForbiddenException,
   EntityRegistry,
+  DbUserStore,
+  DbSessionStore,
+  DbRoleAssignmentStore,
+  DbPlanStore,
+  DbOAuthAccountStore,
+  DbFlagStore,
+  DbClosureStore,
   ConflictException,
   BadRequestException,
-  AuthorizationError
+  AuthorizationError,
+  AUTH_TABLE_NAMES
 };