@vertz/server 0.2.15 → 0.2.17

package/dist/index.js

@@ -1,6 +1,6 @@
 // src/index.ts
 import {
-  BadRequestException,
+  BadRequestException as BadRequestException2,
   ConflictException,
   createEnv,
   createImmutableProxy,
@@ -20,6 +20,8 @@ import {
 // src/auth/index.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { BadRequestException } from "@vertz/core";
+import { parseBody } from "@vertz/core/internals";
 import {
   createAuthRateLimitedError,
   createAuthValidationError as createAuthValidationError2,
@@ -86,65 +88,83 @@ function getMonthOffset(base, target) {
   return (target.getUTCFullYear() - base.getUTCFullYear()) * 12 + (target.getUTCMonth() - base.getUTCMonth());
 }
 
-// src/auth/plan-store.ts
-function resolveEffectivePlan(orgPlan, plans, defaultPlan = "free", now) {
-  if (!orgPlan)
+// src/auth/resolve-inherited-role.ts
+function resolveInheritedRole(sourceType, sourceRole, targetType, accessDef) {
+  const hierarchy = accessDef.hierarchy;
+  const sourceIdx = hierarchy.indexOf(sourceType);
+  const targetIdx = hierarchy.indexOf(targetType);
+  if (sourceIdx === -1 || targetIdx === -1 || sourceIdx >= targetIdx)
+    return null;
+  let currentRole = sourceRole;
+  for (let i = sourceIdx;i < targetIdx; i++) {
+    const currentType = hierarchy[i];
+    const inheritanceMap = accessDef.inheritance[currentType];
+    if (!inheritanceMap || !(currentRole in inheritanceMap))
+      return null;
+    currentRole = inheritanceMap[currentRole];
+  }
+  return currentRole;
+}
+
+// src/auth/subscription-store.ts
+function resolveEffectivePlan(subscription, plans, defaultPlan = "free", now) {
+  if (!subscription)
     return null;
-  if (orgPlan.expiresAt && orgPlan.expiresAt.getTime() < (now ?? Date.now())) {
+  if (subscription.expiresAt && subscription.expiresAt.getTime() < (now ?? Date.now())) {
     return plans?.[defaultPlan] ? defaultPlan : null;
   }
-  if (!plans?.[orgPlan.planId])
+  if (!plans?.[subscription.planId])
     return null;
-  return orgPlan.planId;
+  return subscription.planId;
 }
 
-class InMemoryPlanStore {
-  plans = new Map;
+class InMemorySubscriptionStore {
+  subscriptions = new Map;
   addOns = new Map;
-  async assignPlan(orgId, planId, startedAt = new Date, expiresAt = null) {
-    this.plans.set(orgId, {
-      orgId,
+  async assign(tenantId, planId, startedAt = new Date, expiresAt = null) {
+    this.subscriptions.set(tenantId, {
+      tenantId,
       planId,
       startedAt,
       expiresAt,
       overrides: {}
     });
   }
-  async getPlan(orgId) {
-    return this.plans.get(orgId) ?? null;
+  async get(tenantId) {
+    return this.subscriptions.get(tenantId) ?? null;
   }
-  async updateOverrides(orgId, overrides) {
-    const plan = this.plans.get(orgId);
-    if (!plan)
+  async updateOverrides(tenantId, overrides) {
+    const sub = this.subscriptions.get(tenantId);
+    if (!sub)
       return;
-    plan.overrides = { ...plan.overrides, ...overrides };
+    sub.overrides = { ...sub.overrides, ...overrides };
   }
-  async removePlan(orgId) {
-    this.plans.delete(orgId);
+  async remove(tenantId) {
+    this.subscriptions.delete(tenantId);
   }
-  async attachAddOn(orgId, addOnId) {
-    if (!this.addOns.has(orgId)) {
-      this.addOns.set(orgId, new Set);
+  async attachAddOn(tenantId, addOnId) {
+    if (!this.addOns.has(tenantId)) {
+      this.addOns.set(tenantId, new Set);
     }
-    this.addOns.get(orgId).add(addOnId);
+    this.addOns.get(tenantId).add(addOnId);
   }
-  async detachAddOn(orgId, addOnId) {
-    this.addOns.get(orgId)?.delete(addOnId);
+  async detachAddOn(tenantId, addOnId) {
+    this.addOns.get(tenantId)?.delete(addOnId);
   }
-  async getAddOns(orgId) {
-    return [...this.addOns.get(orgId) ?? []];
+  async getAddOns(tenantId) {
+    return [...this.addOns.get(tenantId) ?? []];
   }
   async listByPlan(planId) {
     const result = [];
-    for (const [orgId, plan] of this.plans.entries()) {
-      if (plan.planId === planId) {
-        result.push(orgId);
+    for (const [tenantId, sub] of this.subscriptions.entries()) {
+      if (sub.planId === planId) {
+        result.push(tenantId);
       }
     }
     return result;
   }
   dispose() {
-    this.plans.clear();
+    this.subscriptions.clear();
     this.addOns.clear();
   }
 }
@@ -158,24 +178,6 @@ function getIncompatibleAddOns(accessDef, activeAddOnIds, targetPlanId) {
   return activeAddOnIds.filter((id) => !checkAddOnCompatibility(accessDef, id, targetPlanId));
 }
 
-// src/auth/resolve-inherited-role.ts
-function resolveInheritedRole(sourceType, sourceRole, targetType, accessDef) {
-  const hierarchy = accessDef.hierarchy;
-  const sourceIdx = hierarchy.indexOf(sourceType);
-  const targetIdx = hierarchy.indexOf(targetType);
-  if (sourceIdx === -1 || targetIdx === -1 || sourceIdx >= targetIdx)
-    return null;
-  let currentRole = sourceRole;
-  for (let i = sourceIdx;i < targetIdx; i++) {
-    const currentType = hierarchy[i];
-    const inheritanceMap = accessDef.inheritance[currentType];
-    if (!inheritanceMap || !(currentRole in inheritanceMap))
-      return null;
-    currentRole = inheritanceMap[currentRole];
-  }
-  return currentRole;
-}
-
 // src/auth/access-set.ts
 async function computeAccessSet(config) {
   const {
@@ -183,14 +185,13 @@ async function computeAccessSet(config) {
     accessDef,
     roleStore,
     closureStore,
-    plan,
     flagStore,
-    planStore,
+    subscriptionStore,
     walletStore,
-    orgId
+    tenantId
   } = config;
   const entitlements = {};
-  let resolvedPlan = plan ?? null;
+  let resolvedPlan = null;
   if (!userId) {
     for (const name of Object.keys(accessDef.entitlements)) {
       entitlements[name] = {
@@ -202,7 +203,7 @@ async function computeAccessSet(config) {
     return {
       entitlements,
       flags: {},
-      plan: plan ?? null,
+      plan: null,
       computedAt: new Date().toISOString()
     };
   }
@@ -244,14 +245,14 @@ async function computeAccessSet(config) {
     }
   }
   const resolvedFlags = {};
-  if (flagStore && orgId) {
-    const orgFlags = flagStore.getFlags(orgId);
+  if (flagStore && tenantId) {
+    const orgFlags = flagStore.getFlags(tenantId);
     Object.assign(resolvedFlags, orgFlags);
     for (const [name, entDef] of Object.entries(accessDef.entitlements)) {
       if (entDef.flags?.length) {
         const disabledFlags = [];
         for (const flag of entDef.flags) {
-          if (!flagStore.getFlag(orgId, flag)) {
+          if (!flagStore.getFlag(tenantId, flag)) {
             disabledFlags.push(flag);
           }
         }
@@ -271,16 +272,16 @@ async function computeAccessSet(config) {
       }
     }
   }
-  if (planStore && orgId) {
-    const orgPlan = await planStore.getPlan(orgId);
-    if (orgPlan) {
-      const effectivePlanId = resolveEffectivePlan(orgPlan, accessDef.plans, accessDef.defaultPlan);
+  if (subscriptionStore && tenantId) {
+    const subscription = await subscriptionStore.get(tenantId);
+    if (subscription) {
+      const effectivePlanId = resolveEffectivePlan(subscription, accessDef.plans, accessDef.defaultPlan);
       resolvedPlan = effectivePlanId;
       if (effectivePlanId) {
         const planDef = accessDef.plans?.[effectivePlanId];
         if (planDef) {
           const effectiveFeatures = new Set(planDef.features ?? []);
-          const addOns = await planStore.getAddOns?.(orgId);
+          const addOns = await subscriptionStore.getAddOns?.(tenantId);
           if (addOns) {
             for (const addOnId of addOns) {
               const addOnDef = accessDef.plans?.[addOnId];
@@ -326,7 +327,7 @@ async function computeAccessSet(config) {
                     }
                   }
                 }
-                const override = orgPlan.overrides[limitKey];
+                const override = subscription.overrides[limitKey];
                 if (override)
                   effectiveMax = Math.max(effectiveMax, override.max);
                 if (effectiveMax === -1) {
@@ -339,11 +340,11 @@ async function computeAccessSet(config) {
                     }
                   };
                 } else {
-                  const period = limitDef.per ? calculateBillingPeriod(orgPlan.startedAt, limitDef.per) : {
-                    periodStart: orgPlan.startedAt,
+                  const period = limitDef.per ? calculateBillingPeriod(subscription.startedAt, limitDef.per) : {
+                    periodStart: subscription.startedAt,
                     periodEnd: new Date("9999-12-31T23:59:59Z")
                   };
-                  const consumed = await walletStore.getConsumption(orgId, limitKey, period.periodStart, period.periodEnd);
+                  const consumed = await walletStore.getConsumption(tenantId, limitKey, period.periodStart, period.periodEnd);
                   const remaining = Math.max(0, effectiveMax - consumed);
                   const entry = entitlements[name];
                   if (consumed >= effectiveMax) {
@@ -895,6 +896,60 @@ class InMemoryRateLimitStore {
   }
 }
 
+// src/auth/resolve-session-for-ssr.ts
+function extractAccessSet(acl) {
+  if (acl.overflow)
+    return null;
+  if (!acl.set)
+    return null;
+  return {
+    entitlements: Object.fromEntries(Object.entries(acl.set.entitlements).map(([name, check]) => {
+      const data = {
+        allowed: check.allowed,
+        reasons: check.reasons ?? [],
+        ...check.reason ? { reason: check.reason } : {},
+        ...check.meta ? { meta: check.meta } : {}
+      };
+      return [name, data];
+    })),
+    flags: acl.set.flags,
+    plan: acl.set.plan,
+    computedAt: acl.set.computedAt
+  };
+}
+function resolveSessionForSSR(config) {
+  const { jwtSecret, jwtAlgorithm, cookieName } = config;
+  return async (request) => {
+    const cookieHeader = request.headers.get("cookie");
+    if (!cookieHeader)
+      return null;
+    const cookieEntry = cookieHeader.split(";").find((c) => c.trim().startsWith(`${cookieName}=`));
+    if (!cookieEntry)
+      return null;
+    const token = cookieEntry.trim().slice(`${cookieName}=`.length);
+    if (!token)
+      return null;
+    const payload = await verifyJWT(token, jwtSecret, jwtAlgorithm);
+    if (!payload)
+      return null;
+    const user = {
+      id: payload.sub,
+      email: payload.email,
+      role: payload.role
+    };
+    if (payload.tenantId) {
+      user.tenantId = payload.tenantId;
+    }
+    const session = {
+      user,
+      expiresAt: payload.exp * 1000
+    };
+    const acl = payload.acl;
+    const accessSet = acl !== undefined ? extractAccessSet(acl) : undefined;
+    return { session, accessSet };
+  };
+}
+
 // src/auth/session-store.ts
 var DEFAULT_MAX_SESSIONS_PER_USER = 50;
 var CLEANUP_INTERVAL_MS2 = 60000;
@@ -969,6 +1024,13 @@ class InMemorySessionStore {
     }
     return null;
   }
+  async findActiveSessionById(id) {
+    const session = this.sessions.get(id);
+    if (!session || session.revokedAt || session.expiresAt <= new Date) {
+      return null;
+    }
+    return session;
+  }
   async findByPreviousRefreshHash(hash) {
     for (const session of this.sessions.values()) {
       if (session.previousRefreshHash !== null && timingSafeEqual(session.previousRefreshHash, hash) && !session.revokedAt && session.expiresAt > new Date) {
@@ -1139,6 +1201,40 @@ function timingSafeEqual2(a, b) {
   return equal && a.length === b.length;
 }
 
+// src/auth/types.ts
+import {
+  s
+} from "@vertz/schema";
+var authEmailFieldSchema = s.string().min(1).trim();
+var authPasswordFieldSchema = s.string().min(1);
+var signUpInputSchema = s.object({
+  email: authEmailFieldSchema,
+  password: authPasswordFieldSchema
+}).passthrough();
+var signInInputSchema = s.object({
+  email: authEmailFieldSchema,
+  password: authPasswordFieldSchema
+});
+var codeInputSchema = s.object({
+  code: s.string().min(1)
+});
+var passwordInputSchema = s.object({
+  password: s.string().min(1)
+});
+var tokenInputSchema = s.object({
+  token: s.string().min(1).optional()
+});
+var forgotPasswordInputSchema = s.object({
+  email: s.string().min(1).trim()
+});
+var resetPasswordInputSchema = s.object({
+  token: s.string().min(1).optional(),
+  password: s.string().min(1)
+});
+var switchTenantInputSchema = s.object({
+  tenantId: s.string().min(1)
+});
+
 // src/auth/user-store.ts
 class InMemoryUserStore {
   byEmail = new Map;
@@ -1168,6 +1264,13 @@ class InMemoryUserStore {
       user.emailVerified = verified;
     }
   }
+  async deleteUser(id) {
+    const user = this.byId.get(id);
+    if (user) {
+      this.byEmail.delete(user.email.toLowerCase());
+      this.byId.delete(id);
+    }
+  }
 }
 // src/auth/access.ts
 class AuthorizationError extends Error {
@@ -1303,7 +1406,7 @@ function createAccessContext(config) {
     closureStore,
     roleStore,
     flagStore,
-    planStore,
+    subscriptionStore,
     walletStore,
     overrideStore,
     orgResolver,
@@ -1332,14 +1435,14 @@ function createAccessContext(config) {
     } else if (entDef.roles.length > 0 && !resource) {
       return false;
     }
-    if (accessDef._planGatedEntitlements.has(entitlement) && planStore && orgResolver) {
+    if (accessDef._planGatedEntitlements.has(entitlement) && subscriptionStore && orgResolver) {
       if (!resolvedOrgId)
         return false;
-      const orgPlan = await planStore.getPlan(resolvedOrgId);
-      const effectivePlanId = resolveEffectivePlan(orgPlan, accessDef.plans, accessDef.defaultPlan);
+      const subscription = await subscriptionStore.get(resolvedOrgId);
+      const effectivePlanId = resolveEffectivePlan(subscription, accessDef.plans, accessDef.defaultPlan);
       if (!effectivePlanId)
         return false;
-      const hasFeature = await resolveEffectiveFeatures(resolvedOrgId, entitlement, effectivePlanId, accessDef, planStore, planVersionStore, overrides);
+      const hasFeature = await resolveEffectiveFeatures(resolvedOrgId, entitlement, effectivePlanId, accessDef, subscriptionStore, planVersionStore, overrides);
       if (!hasFeature)
         return false;
     }
@@ -1351,8 +1454,8 @@ function createAccessContext(config) {
     if (!await checkLayers1to3(entitlement, resource, resolvedOrgId, overrides))
       return false;
     const limitKeys = accessDef._entitlementToLimitKeys[entitlement];
-    if (limitKeys?.length && walletStore && planStore && resolvedOrgId) {
-      const walletStates = await resolveAllLimitStates(entitlement, resolvedOrgId, accessDef, planStore, walletStore, planVersionStore, overrides);
+    if (limitKeys?.length && walletStore && subscriptionStore && resolvedOrgId) {
+      const walletStates = await resolveAllLimitStates(entitlement, resolvedOrgId, accessDef, subscriptionStore, walletStore, planVersionStore, overrides);
       for (const ws of walletStates) {
         if (ws.max === 0)
           return false;
@@ -1422,17 +1525,17 @@ function createAccessContext(config) {
         meta.requiredRoles = [...entDef.roles];
       }
     }
-    if (accessDef._planGatedEntitlements.has(entitlement) && planStore && orgResolver) {
+    if (accessDef._planGatedEntitlements.has(entitlement) && subscriptionStore && orgResolver) {
       let planDenied = false;
       if (!resolvedOrgId) {
         planDenied = true;
       } else {
-        const orgPlan = await planStore.getPlan(resolvedOrgId);
-        const effectivePlanId = resolveEffectivePlan(orgPlan, accessDef.plans, accessDef.defaultPlan);
+        const subscription = await subscriptionStore.get(resolvedOrgId);
+        const effectivePlanId = resolveEffectivePlan(subscription, accessDef.plans, accessDef.defaultPlan);
         if (!effectivePlanId) {
           planDenied = true;
         } else {
-          const hasFeature = await resolveEffectiveFeatures(resolvedOrgId, entitlement, effectivePlanId, accessDef, planStore, planVersionStore, overrides);
+          const hasFeature = await resolveEffectiveFeatures(resolvedOrgId, entitlement, effectivePlanId, accessDef, subscriptionStore, planVersionStore, overrides);
           if (!hasFeature) {
             planDenied = true;
           }
@@ -1452,8 +1555,8 @@ function createAccessContext(config) {
       }
     }
     const checkLimitKeys = accessDef._entitlementToLimitKeys[entitlement];
-    if (checkLimitKeys?.length && walletStore && planStore && resolvedOrgId) {
-      const walletStates = await resolveAllLimitStates(entitlement, resolvedOrgId, accessDef, planStore, walletStore, planVersionStore, overrides);
+    if (checkLimitKeys?.length && walletStore && subscriptionStore && resolvedOrgId) {
+      const walletStates = await resolveAllLimitStates(entitlement, resolvedOrgId, accessDef, subscriptionStore, walletStore, planVersionStore, overrides);
       for (const ws of walletStates) {
         const exceeded = ws.max === 0 || ws.max !== -1 && ws.consumed >= ws.max;
         if (exceeded) {
@@ -1546,20 +1649,20 @@ function createAccessContext(config) {
     const overrides = resolvedOrgId && overrideStore ? await overrideStore.get(resolvedOrgId) : null;
     if (!await checkLayers1to3(entitlement, resource, resolvedOrgId, overrides))
       return false;
-    if (!walletStore || !planStore || !orgResolver)
+    if (!walletStore || !subscriptionStore || !orgResolver)
       return true;
     const limitKeys = accessDef._entitlementToLimitKeys[entitlement];
     if (!limitKeys?.length)
       return true;
     if (!resolvedOrgId)
       return false;
-    const orgPlan = await planStore.getPlan(resolvedOrgId);
-    if (!orgPlan)
+    const subscription = await subscriptionStore.get(resolvedOrgId);
+    if (!subscription)
       return false;
-    const effectivePlanId = resolveEffectivePlan(orgPlan, accessDef.plans, accessDef.defaultPlan);
+    const effectivePlanId = resolveEffectivePlan(subscription, accessDef.plans, accessDef.defaultPlan);
     if (!effectivePlanId)
       return false;
-    const limitsToConsume = await resolveAllLimitConsumptions(resolvedOrgId, entitlement, effectivePlanId, accessDef, planStore, walletStore, orgPlan, planVersionStore, overrides);
+    const limitsToConsume = await resolveAllLimitConsumptions(resolvedOrgId, entitlement, effectivePlanId, accessDef, subscriptionStore, walletStore, subscription, planVersionStore, overrides);
     if (!limitsToConsume.length)
       return true;
     const consumed = [];
@@ -1597,7 +1700,7 @@ function createAccessContext(config) {
     return true;
   }
   async function unconsume(entitlement, resource, amount = 1) {
-    if (!walletStore || !planStore || !orgResolver)
+    if (!walletStore || !subscriptionStore || !orgResolver)
       return;
     const limitKeys = accessDef._entitlementToLimitKeys[entitlement];
     if (!limitKeys?.length)
@@ -1606,13 +1709,13 @@ function createAccessContext(config) {
     if (!orgId)
       return;
     const overrides = overrideStore ? await overrideStore.get(orgId) : null;
-    const orgPlan = await planStore.getPlan(orgId);
-    if (!orgPlan)
+    const subscription = await subscriptionStore.get(orgId);
+    if (!subscription)
       return;
-    const effectivePlanId = resolveEffectivePlan(orgPlan, accessDef.plans, accessDef.defaultPlan);
+    const effectivePlanId = resolveEffectivePlan(subscription, accessDef.plans, accessDef.defaultPlan);
     if (!effectivePlanId)
       return;
-    const limitsToUnconsume = await resolveAllLimitConsumptions(orgId, entitlement, effectivePlanId, accessDef, planStore, walletStore, orgPlan, planVersionStore, overrides);
+    const limitsToUnconsume = await resolveAllLimitConsumptions(orgId, entitlement, effectivePlanId, accessDef, subscriptionStore, walletStore, subscription, planVersionStore, overrides);
     for (const lc of limitsToUnconsume) {
       if (lc.effectiveMax === -1)
         continue;
@@ -1633,7 +1736,7 @@ var DENIAL_ORDER = [
 function orderDenialReasons(reasons) {
   return [...reasons].sort((a, b) => DENIAL_ORDER.indexOf(a) - DENIAL_ORDER.indexOf(b));
 }
-async function resolveEffectiveFeatures(orgId, entitlement, effectivePlanId, accessDef, planStore, planVersionStore, overrides) {
+async function resolveEffectiveFeatures(orgId, entitlement, effectivePlanId, accessDef, subscriptionStore, planVersionStore, overrides) {
   if (planVersionStore) {
     const tenantVersion = await planVersionStore.getTenantVersion(orgId, effectivePlanId);
     if (tenantVersion !== null) {
@@ -1642,7 +1745,7 @@ async function resolveEffectiveFeatures(orgId, entitlement, effectivePlanId, acc
         const snapshotFeatures = versionInfo.snapshot.features;
         if (snapshotFeatures.includes(entitlement))
           return true;
-        const addOns2 = await planStore.getAddOns?.(orgId);
+        const addOns2 = await subscriptionStore.getAddOns?.(orgId);
         if (addOns2) {
           for (const addOnId of addOns2) {
             const addOnDef = accessDef.plans?.[addOnId];
@@ -1659,7 +1762,7 @@ async function resolveEffectiveFeatures(orgId, entitlement, effectivePlanId, acc
   const planDef = accessDef.plans?.[effectivePlanId];
   if (planDef?.features?.includes(entitlement))
     return true;
-  const addOns = await planStore.getAddOns?.(orgId);
+  const addOns = await subscriptionStore.getAddOns?.(orgId);
   if (addOns) {
     for (const addOnId of addOns) {
       const addOnDef = accessDef.plans?.[addOnId];
@@ -1671,10 +1774,10 @@ async function resolveEffectiveFeatures(orgId, entitlement, effectivePlanId, acc
     return true;
   return false;
 }
-async function resolveAllLimitStates(entitlement, orgId, accessDef, planStore, walletStore, planVersionStore, overrides) {
-  const orgPlan = await planStore.getPlan(orgId);
-  const effectivePlanId = resolveEffectivePlan(orgPlan, accessDef.plans, accessDef.defaultPlan);
-  if (!effectivePlanId || !orgPlan)
+async function resolveAllLimitStates(entitlement, orgId, accessDef, subscriptionStore, walletStore, planVersionStore, overrides) {
+  const subscription = await subscriptionStore.get(orgId);
+  const effectivePlanId = resolveEffectivePlan(subscription, accessDef.plans, accessDef.defaultPlan);
+  if (!effectivePlanId || !subscription)
     return [];
   const limitKeys = accessDef._entitlementToLimitKeys[entitlement];
   if (!limitKeys?.length)
@@ -1700,7 +1803,7 @@ async function resolveAllLimitStates(entitlement, orgId, accessDef, planStore, w
     }
     if (!limitDef)
       continue;
-    const effectiveMax = computeEffectiveLimit(limitDef.max, limitKey, orgId, orgPlan, accessDef, planStore, overrides);
+    const effectiveMax = computeEffectiveLimit(limitDef.max, limitKey, orgId, subscription, accessDef, subscriptionStore, overrides);
     const resolvedMax = await effectiveMax;
     const hasOverage = !!limitDef.overage;
     if (resolvedMax === -1) {
@@ -1708,7 +1811,7 @@ async function resolveAllLimitStates(entitlement, orgId, accessDef, planStore, w
       continue;
     }
     const walletKey = limitKey;
-    const period = limitDef.per ? calculateBillingPeriod(orgPlan.startedAt, limitDef.per) : { periodStart: orgPlan.startedAt, periodEnd: new Date("9999-12-31T23:59:59Z") };
+    const period = limitDef.per ? calculateBillingPeriod(subscription.startedAt, limitDef.per) : { periodStart: subscription.startedAt, periodEnd: new Date("9999-12-31T23:59:59Z") };
     const consumed = await walletStore.getConsumption(orgId, walletKey, period.periodStart, period.periodEnd);
     states.push({
       key: limitKey,
@@ -1724,7 +1827,7 @@ async function resolveAllLimitStates(entitlement, orgId, accessDef, planStore, w
   }
   return states;
 }
-async function resolveAllLimitConsumptions(orgId, entitlement, effectivePlanId, accessDef, planStore, _walletStore, orgPlan, planVersionStore, overrides) {
+async function resolveAllLimitConsumptions(orgId, entitlement, effectivePlanId, accessDef, subscriptionStore, _walletStore, subscription, planVersionStore, overrides) {
   const limitKeys = accessDef._entitlementToLimitKeys[entitlement];
   if (!limitKeys?.length)
     return [];
@@ -1749,9 +1852,9 @@ async function resolveAllLimitConsumptions(orgId, entitlement, effectivePlanId,
     }
     if (!limitDef)
       continue;
-    const effectiveMax = await computeEffectiveLimit(limitDef.max, limitKey, orgId, orgPlan, accessDef, planStore, overrides);
+    const effectiveMax = await computeEffectiveLimit(limitDef.max, limitKey, orgId, subscription, accessDef, subscriptionStore, overrides);
     const walletKey = limitKey;
-    const period = limitDef.per ? calculateBillingPeriod(orgPlan.startedAt, limitDef.per) : { periodStart: orgPlan.startedAt, periodEnd: new Date("9999-12-31T23:59:59Z") };
+    const period = limitDef.per ? calculateBillingPeriod(subscription.startedAt, limitDef.per) : { periodStart: subscription.startedAt, periodEnd: new Date("9999-12-31T23:59:59Z") };
     consumptions.push({
       walletKey,
       periodStart: period.periodStart,
@@ -1767,9 +1870,9 @@ async function resolveAllLimitConsumptions(orgId, entitlement, effectivePlanId,
   }
   return consumptions;
 }
-async function computeEffectiveLimit(basePlanMax, limitKey, orgId, orgPlan, accessDef, planStore, overrides) {
+async function computeEffectiveLimit(basePlanMax, limitKey, orgId, subscription, accessDef, subscriptionStore, overrides) {
   let effectiveMax = basePlanMax;
-  const addOns = await planStore.getAddOns?.(orgId);
+  const addOns = await subscriptionStore.getAddOns?.(orgId);
   if (addOns) {
     for (const addOnId of addOns) {
       const addOnDef = accessDef.plans?.[addOnId];
@@ -1781,7 +1884,7 @@ async function computeEffectiveLimit(basePlanMax, limitKey, orgId, orgPlan, acce
       }
     }
   }
-  const oldOverride = orgPlan.overrides[limitKey];
+  const oldOverride = subscription.overrides[limitKey];
   if (oldOverride) {
     effectiveMax = Math.max(effectiveMax, oldOverride.max);
   }
@@ -2091,7 +2194,6 @@ function generateAuthDDL(dialect) {
   email ${t.text()} NOT NULL UNIQUE,
   password_hash ${t.text()},
   role ${t.text()} NOT NULL DEFAULT 'user',
-  plan ${t.text()},
   email_verified ${t.boolean(false)},
   created_at ${t.timestamp()},
   updated_at ${t.timestamp()}
@@ -2344,7 +2446,7 @@ function extractPlanId(obj) {
   return null;
 }
 function createWebhookHandler(config) {
-  const { planStore, emitter, defaultPlan, webhookSecret } = config;
+  const { subscriptionStore, emitter, defaultPlan, webhookSecret } = config;
   return async (request) => {
     const signature = request.headers.get("stripe-signature");
     if (signature !== webhookSecret) {
@@ -2370,7 +2472,7 @@ function createWebhookHandler(config) {
           const tenantId = extractTenantId(obj);
           const planId = extractPlanId(obj);
           if (tenantId && planId) {
-            await planStore.assignPlan(tenantId, planId);
+            await subscriptionStore.assign(tenantId, planId);
             emitter.emit("subscription:created", { tenantId, planId });
           }
           break;
@@ -2379,7 +2481,7 @@ function createWebhookHandler(config) {
           const tenantId = extractTenantId(obj);
           const planId = extractPlanId(obj);
           if (tenantId && planId) {
-            await planStore.assignPlan(tenantId, planId);
+            await subscriptionStore.assign(tenantId, planId);
           }
           break;
         }
@@ -2387,7 +2489,7 @@ function createWebhookHandler(config) {
           const tenantId = extractTenantId(obj);
           const planId = extractPlanId(obj);
           if (tenantId) {
-            await planStore.assignPlan(tenantId, defaultPlan);
+            await subscriptionStore.assign(tenantId, defaultPlan);
             emitter.emit("subscription:canceled", {
               tenantId,
               planId: planId ?? defaultPlan
@@ -2414,10 +2516,10 @@ function createWebhookHandler(config) {
           const meta = obj.metadata;
           const isAddOn = meta?.isAddOn === "true";
           if (tenantId && planId) {
-            if (isAddOn && planStore.attachAddOn) {
-              await planStore.attachAddOn(tenantId, planId);
+            if (isAddOn && subscriptionStore.attachAddOn) {
+              await subscriptionStore.attachAddOn(tenantId, planId);
             } else {
-              await planStore.assignPlan(tenantId, planId);
+              await subscriptionStore.assign(tenantId, planId);
             }
           }
           break;
@@ -2664,100 +2766,8 @@ class DbOAuthAccountStore {
   }
   dispose() {}
 }
-// src/auth/db-plan-store.ts
-import { sql as sql5 } from "@vertz/db/sql";
-class DbPlanStore {
-  db;
-  constructor(db) {
-    this.db = db;
-  }
-  async assignPlan(orgId, planId, startedAt = new Date, expiresAt = null) {
-    const id = crypto.randomUUID();
-    const startedAtIso = startedAt.toISOString();
-    const expiresAtIso = expiresAt ? expiresAt.toISOString() : null;
-    const upsertResult = await this.db.query(sql5`INSERT INTO auth_plans (id, tenant_id, plan_id, started_at, expires_at)
-          VALUES (${id}, ${orgId}, ${planId}, ${startedAtIso}, ${expiresAtIso})
-          ON CONFLICT(tenant_id) DO UPDATE SET plan_id = ${planId}, started_at = ${startedAtIso}, expires_at = ${expiresAtIso}`);
-    assertWrite(upsertResult, "assignPlan/upsert");
-    const overrideResult = await this.db.query(sql5`DELETE FROM auth_overrides WHERE tenant_id = ${orgId}`);
-    assertWrite(overrideResult, "assignPlan/clearOverrides");
-  }
-  async getPlan(orgId) {
-    const result = await this.db.query(sql5`SELECT tenant_id, plan_id, started_at, expires_at FROM auth_plans WHERE tenant_id = ${orgId}`);
-    if (!result.ok)
-      return null;
-    const row = result.data.rows[0];
-    if (!row)
-      return null;
-    const overrides = await this.loadOverrides(orgId);
-    return {
-      orgId: row.tenant_id,
-      planId: row.plan_id,
-      startedAt: new Date(row.started_at),
-      expiresAt: row.expires_at ? new Date(row.expires_at) : null,
-      overrides
-    };
-  }
-  async updateOverrides(orgId, overrides) {
-    const planResult = await this.db.query(sql5`SELECT tenant_id FROM auth_plans WHERE tenant_id = ${orgId}`);
-    if (!planResult.ok || planResult.data.rows.length === 0)
-      return;
-    const existing = await this.loadOverrides(orgId);
-    const merged = { ...existing, ...overrides };
-    const overridesJson = JSON.stringify(merged);
-    const now = new Date().toISOString();
-    const overrideResult = await this.db.query(sql5`SELECT tenant_id FROM auth_overrides WHERE tenant_id = ${orgId}`);
-    if (overrideResult.ok && overrideResult.data.rows.length > 0) {
-      const updateResult = await this.db.query(sql5`UPDATE auth_overrides SET overrides = ${overridesJson}, updated_at = ${now} WHERE tenant_id = ${orgId}`);
-      assertWrite(updateResult, "updateOverrides/update");
-    } else {
-      const id = crypto.randomUUID();
-      const insertResult = await this.db.query(sql5`INSERT INTO auth_overrides (id, tenant_id, overrides, updated_at)
-            VALUES (${id}, ${orgId}, ${overridesJson}, ${now})`);
-      assertWrite(insertResult, "updateOverrides/insert");
-    }
-  }
-  async removePlan(orgId) {
-    const planResult = await this.db.query(sql5`DELETE FROM auth_plans WHERE tenant_id = ${orgId}`);
-    assertWrite(planResult, "removePlan/plans");
-    const overrideResult = await this.db.query(sql5`DELETE FROM auth_overrides WHERE tenant_id = ${orgId}`);
-    assertWrite(overrideResult, "removePlan/overrides");
-  }
-  async attachAddOn(orgId, addOnId) {
-    const id = crypto.randomUUID();
-    const now = new Date().toISOString();
-    const result = await this.db.query(sql5`INSERT INTO auth_plan_addons (id, tenant_id, addon_id, quantity, created_at)
-          VALUES (${id}, ${orgId}, ${addOnId}, ${1}, ${now})
-          ON CONFLICT(tenant_id, addon_id) DO NOTHING`);
-    assertWrite(result, "attachAddOn");
-  }
-  async detachAddOn(orgId, addOnId) {
-    const result = await this.db.query(sql5`DELETE FROM auth_plan_addons WHERE tenant_id = ${orgId} AND addon_id = ${addOnId}`);
-    assertWrite(result, "detachAddOn");
-  }
-  async getAddOns(orgId) {
-    const result = await this.db.query(sql5`SELECT addon_id FROM auth_plan_addons WHERE tenant_id = ${orgId}`);
-    if (!result.ok)
-      return [];
-    return result.data.rows.map((r) => r.addon_id);
-  }
-  dispose() {}
-  async loadOverrides(orgId) {
-    const result = await this.db.query(sql5`SELECT overrides FROM auth_overrides WHERE tenant_id = ${orgId}`);
-    if (!result.ok || result.data.rows.length === 0)
-      return {};
-    try {
-      const overridesStr = result.data.rows[0]?.overrides;
-      if (!overridesStr)
-        return {};
-      return JSON.parse(overridesStr);
-    } catch {
-      return {};
-    }
-  }
-}
 // src/auth/db-role-assignment-store.ts
-import { sql as sql6 } from "@vertz/db/sql";
+import { sql as sql5 } from "@vertz/db/sql";
 class DbRoleAssignmentStore {
   db;
   constructor(db) {
@@ -2766,23 +2776,23 @@ class DbRoleAssignmentStore {
   async assign(userId, resourceType, resourceId, role) {
     const id = crypto.randomUUID();
     const now = new Date().toISOString();
-    const result = await this.db.query(sql6`INSERT INTO auth_role_assignments (id, user_id, resource_type, resource_id, role, created_at)
+    const result = await this.db.query(sql5`INSERT INTO auth_role_assignments (id, user_id, resource_type, resource_id, role, created_at)
           VALUES (${id}, ${userId}, ${resourceType}, ${resourceId}, ${role}, ${now})
           ON CONFLICT DO NOTHING`);
     assertWrite(result, "assign");
   }
   async revoke(userId, resourceType, resourceId, role) {
-    const result = await this.db.query(sql6`DELETE FROM auth_role_assignments WHERE user_id = ${userId} AND resource_type = ${resourceType} AND resource_id = ${resourceId} AND role = ${role}`);
+    const result = await this.db.query(sql5`DELETE FROM auth_role_assignments WHERE user_id = ${userId} AND resource_type = ${resourceType} AND resource_id = ${resourceId} AND role = ${role}`);
     assertWrite(result, "revoke");
   }
   async getRoles(userId, resourceType, resourceId) {
-    const result = await this.db.query(sql6`SELECT role FROM auth_role_assignments WHERE user_id = ${userId} AND resource_type = ${resourceType} AND resource_id = ${resourceId}`);
+    const result = await this.db.query(sql5`SELECT role FROM auth_role_assignments WHERE user_id = ${userId} AND resource_type = ${resourceType} AND resource_id = ${resourceId}`);
     if (!result.ok)
       return [];
     return result.data.rows.map((r) => r.role);
   }
   async getRolesForUser(userId) {
-    const result = await this.db.query(sql6`SELECT user_id, resource_type, resource_id, role FROM auth_role_assignments WHERE user_id = ${userId}`);
+    const result = await this.db.query(sql5`SELECT user_id, resource_type, resource_id, role FROM auth_role_assignments WHERE user_id = ${userId}`);
     if (!result.ok)
       return [];
     return result.data.rows.map((r) => ({
@@ -2826,7 +2836,7 @@ class DbRoleAssignmentStore {
   dispose() {}
 }
 // src/auth/db-session-store.ts
-import { sql as sql7 } from "@vertz/db/sql";
+import { sql as sql6 } from "@vertz/db/sql";
 class DbSessionStore {
   db;
   constructor(db) {
@@ -2835,7 +2845,7 @@ class DbSessionStore {
   async createSessionWithId(id, data) {
     const now = new Date;
     const tokensJson = data.currentTokens ? JSON.stringify(data.currentTokens) : null;
-    const result = await this.db.query(sql7`INSERT INTO auth_sessions (id, user_id, refresh_token_hash, previous_refresh_hash, current_tokens, ip_address, user_agent, created_at, last_active_at, expires_at, revoked_at)
+    const result = await this.db.query(sql6`INSERT INTO auth_sessions (id, user_id, refresh_token_hash, previous_refresh_hash, current_tokens, ip_address, user_agent, created_at, last_active_at, expires_at, revoked_at)
           VALUES (${id}, ${data.userId}, ${data.refreshTokenHash}, ${null}, ${tokensJson}, ${data.ipAddress}, ${data.userAgent}, ${now.toISOString()}, ${now.toISOString()}, ${data.expiresAt.toISOString()}, ${null})`);
     assertWrite(result, "createSessionWithId");
     return {
@@ -2853,45 +2863,73 @@ class DbSessionStore {
   }
   async findByRefreshHash(hash) {
     const nowStr = new Date().toISOString();
-    const result = await this.db.query(sql7`SELECT * FROM auth_sessions WHERE refresh_token_hash = ${hash} AND revoked_at IS NULL AND expires_at > ${nowStr} LIMIT 1`);
+    const result = await this.db.auth_sessions.get({
+      where: {
+        refreshTokenHash: hash,
+        revokedAt: null,
+        expiresAt: { gt: nowStr }
+      }
+    });
     if (!result.ok)
       return null;
-    const row = result.data.rows[0];
+    const row = result.data;
+    if (!row)
+      return null;
+    return this.recordToSession(row);
+  }
+  async findActiveSessionById(id) {
+    const nowStr = new Date().toISOString();
+    const result = await this.db.auth_sessions.get({
+      where: {
+        id,
+        revokedAt: null,
+        expiresAt: { gt: nowStr }
+      }
+    });
+    if (!result.ok)
+      return null;
+    const row = result.data;
     if (!row)
       return null;
-    return this.rowToSession(row);
+    return this.recordToSession(row);
   }
   async findByPreviousRefreshHash(hash) {
     const nowStr = new Date().toISOString();
-    const result = await this.db.query(sql7`SELECT * FROM auth_sessions WHERE previous_refresh_hash = ${hash} AND revoked_at IS NULL AND expires_at > ${nowStr} LIMIT 1`);
+    const result = await this.db.auth_sessions.get({
+      where: {
+        previousRefreshHash: hash,
+        revokedAt: null,
+        expiresAt: { gt: nowStr }
+      }
+    });
     if (!result.ok)
       return null;
-    const row = result.data.rows[0];
+    const row = result.data;
     if (!row)
       return null;
-    return this.rowToSession(row);
+    return this.recordToSession(row);
   }
   async revokeSession(id) {
     const nowStr = new Date().toISOString();
-    const result = await this.db.query(sql7`UPDATE auth_sessions SET revoked_at = ${nowStr}, current_tokens = ${null} WHERE id = ${id}`);
+    const result = await this.db.query(sql6`UPDATE auth_sessions SET revoked_at = ${nowStr}, current_tokens = ${null} WHERE id = ${id}`);
     assertWrite(result, "revokeSession");
   }
   async listActiveSessions(userId) {
     const nowStr = new Date().toISOString();
-    const result = await this.db.query(sql7`SELECT * FROM auth_sessions WHERE user_id = ${userId} AND revoked_at IS NULL AND expires_at > ${nowStr}`);
+    const result = await this.db.query(sql6`SELECT * FROM auth_sessions WHERE user_id = ${userId} AND revoked_at IS NULL AND expires_at > ${nowStr}`);
     if (!result.ok)
       return [];
     return result.data.rows.map((row) => this.rowToSession(row));
   }
   async countActiveSessions(userId) {
     const nowStr = new Date().toISOString();
-    const result = await this.db.query(sql7`SELECT COUNT(*) as cnt FROM auth_sessions WHERE user_id = ${userId} AND revoked_at IS NULL AND expires_at > ${nowStr}`);
+    const result = await this.db.query(sql6`SELECT COUNT(*) as cnt FROM auth_sessions WHERE user_id = ${userId} AND revoked_at IS NULL AND expires_at > ${nowStr}`);
     if (!result.ok)
       return 0;
     return result.data.rows[0]?.cnt ?? 0;
   }
   async getCurrentTokens(sessionId) {
-    const result = await this.db.query(sql7`SELECT current_tokens FROM auth_sessions WHERE id = ${sessionId} LIMIT 1`);
+    const result = await this.db.query(sql6`SELECT current_tokens FROM auth_sessions WHERE id = ${sessionId} LIMIT 1`);
     if (!result.ok)
       return null;
     const row = result.data.rows[0];
@@ -2905,7 +2943,7 @@ class DbSessionStore {
   }
   async updateSession(id, data) {
     const tokensJson = data.currentTokens ? JSON.stringify(data.currentTokens) : null;
-    const result = await this.db.query(sql7`UPDATE auth_sessions SET refresh_token_hash = ${data.refreshTokenHash}, previous_refresh_hash = ${data.previousRefreshHash}, last_active_at = ${data.lastActiveAt.toISOString()}, current_tokens = ${tokensJson} WHERE id = ${id}`);
+    const result = await this.db.query(sql6`UPDATE auth_sessions SET refresh_token_hash = ${data.refreshTokenHash}, previous_refresh_hash = ${data.previousRefreshHash}, last_active_at = ${data.lastActiveAt.toISOString()}, current_tokens = ${tokensJson} WHERE id = ${id}`);
     assertWrite(result, "updateSession");
   }
   dispose() {}
@@ -2923,6 +2961,118 @@ class DbSessionStore {
       revokedAt: row.revoked_at ? new Date(row.revoked_at) : null
     };
   }
+  recordToSession(rec) {
+    return {
+      id: rec.id,
+      userId: rec.userId,
+      refreshTokenHash: rec.refreshTokenHash,
+      previousRefreshHash: rec.previousRefreshHash,
+      ipAddress: rec.ipAddress,
+      userAgent: rec.userAgent,
+      createdAt: new Date(rec.createdAt),
+      lastActiveAt: new Date(rec.lastActiveAt),
+      expiresAt: new Date(rec.expiresAt),
+      revokedAt: rec.revokedAt ? new Date(rec.revokedAt) : null
+    };
+  }
+}
+// src/auth/db-subscription-store.ts
+import { sql as sql7 } from "@vertz/db/sql";
+class DbSubscriptionStore {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async assign(tenantId, planId, startedAt = new Date, expiresAt = null) {
+    await this.db.transaction(async (tx) => {
+      const id = crypto.randomUUID();
+      const startedAtIso = startedAt.toISOString();
+      const expiresAtIso = expiresAt ? expiresAt.toISOString() : null;
+      const upsertResult = await tx.query(sql7`INSERT INTO auth_plans (id, tenant_id, plan_id, started_at, expires_at)
+            VALUES (${id}, ${tenantId}, ${planId}, ${startedAtIso}, ${expiresAtIso})
+            ON CONFLICT(tenant_id) DO UPDATE SET plan_id = ${planId}, started_at = ${startedAtIso}, expires_at = ${expiresAtIso}`);
+      assertWrite(upsertResult, "assign/upsert");
+      const overrideResult = await tx.query(sql7`DELETE FROM auth_overrides WHERE tenant_id = ${tenantId}`);
+      assertWrite(overrideResult, "assign/clearOverrides");
+    });
+  }
+  async get(tenantId) {
+    const result = await this.db.query(sql7`SELECT tenant_id, plan_id, started_at, expires_at FROM auth_plans WHERE tenant_id = ${tenantId}`);
+    if (!result.ok)
+      return null;
+    const row = result.data.rows[0];
+    if (!row)
+      return null;
+    const overrides = await this.loadOverrides(tenantId);
+    return {
+      tenantId: row.tenant_id,
+      planId: row.plan_id,
+      startedAt: new Date(row.started_at),
+      expiresAt: row.expires_at ? new Date(row.expires_at) : null,
+      overrides
+    };
+  }
+  async updateOverrides(tenantId, overrides) {
+    const planResult = await this.db.query(sql7`SELECT tenant_id FROM auth_plans WHERE tenant_id = ${tenantId}`);
+    if (!planResult.ok || planResult.data.rows.length === 0)
+      return;
+    await this.db.transaction(async (tx) => {
+      const existing = await this.loadOverrides(tenantId);
+      const merged = { ...existing, ...overrides };
+      const overridesJson = JSON.stringify(merged);
+      const now = new Date().toISOString();
+      const overrideResult = await tx.query(sql7`SELECT tenant_id FROM auth_overrides WHERE tenant_id = ${tenantId}`);
+      if (overrideResult.ok && overrideResult.data.rows.length > 0) {
+        const updateResult = await tx.query(sql7`UPDATE auth_overrides SET overrides = ${overridesJson}, updated_at = ${now} WHERE tenant_id = ${tenantId}`);
+        assertWrite(updateResult, "updateOverrides/update");
+      } else {
+        const id = crypto.randomUUID();
+        const insertResult = await tx.query(sql7`INSERT INTO auth_overrides (id, tenant_id, overrides, updated_at)
+              VALUES (${id}, ${tenantId}, ${overridesJson}, ${now})`);
+        assertWrite(insertResult, "updateOverrides/insert");
+      }
+    });
+  }
+  async remove(tenantId) {
+    await this.db.transaction(async (tx) => {
+      const planResult = await tx.query(sql7`DELETE FROM auth_plans WHERE tenant_id = ${tenantId}`);
+      assertWrite(planResult, "remove/plans");
+      const overrideResult = await tx.query(sql7`DELETE FROM auth_overrides WHERE tenant_id = ${tenantId}`);
+      assertWrite(overrideResult, "remove/overrides");
+    });
+  }
+  async attachAddOn(tenantId, addOnId) {
+    const id = crypto.randomUUID();
+    const now = new Date().toISOString();
+    const result = await this.db.query(sql7`INSERT INTO auth_plan_addons (id, tenant_id, addon_id, quantity, created_at)
+          VALUES (${id}, ${tenantId}, ${addOnId}, ${1}, ${now})
+          ON CONFLICT(tenant_id, addon_id) DO NOTHING`);
+    assertWrite(result, "attachAddOn");
+  }
+  async detachAddOn(tenantId, addOnId) {
+    const result = await this.db.query(sql7`DELETE FROM auth_plan_addons WHERE tenant_id = ${tenantId} AND addon_id = ${addOnId}`);
+    assertWrite(result, "detachAddOn");
+  }
+  async getAddOns(tenantId) {
+    const result = await this.db.query(sql7`SELECT addon_id FROM auth_plan_addons WHERE tenant_id = ${tenantId}`);
+    if (!result.ok)
+      return [];
+    return result.data.rows.map((r) => r.addon_id);
+  }
+  dispose() {}
+  async loadOverrides(tenantId) {
+    const result = await this.db.query(sql7`SELECT overrides FROM auth_overrides WHERE tenant_id = ${tenantId}`);
+    if (!result.ok || result.data.rows.length === 0)
+      return {};
+    try {
+      const overridesStr = result.data.rows[0]?.overrides;
+      if (!overridesStr)
+        return {};
+      return JSON.parse(overridesStr);
+    } catch {
+      return {};
+    }
+  }
 }
 // src/auth/db-user-store.ts
 import { sql as sql8 } from "@vertz/db/sql";
@@ -2932,8 +3082,8 @@ class DbUserStore {
     this.db = db;
   }
   async createUser(user, passwordHash) {
-    const result = await this.db.query(sql8`INSERT INTO auth_users (id, email, password_hash, role, plan, email_verified, created_at, updated_at)
-          VALUES (${user.id}, ${user.email.toLowerCase()}, ${passwordHash}, ${user.role}, ${user.plan ?? null}, ${boolVal(this.db, user.emailVerified ?? false)}, ${user.createdAt.toISOString()}, ${user.updatedAt.toISOString()})`);
+    const result = await this.db.query(sql8`INSERT INTO auth_users (id, email, password_hash, role, email_verified, created_at, updated_at)
+          VALUES (${user.id}, ${user.email.toLowerCase()}, ${passwordHash}, ${user.role}, ${boolVal(this.db, user.emailVerified ?? false)}, ${user.createdAt.toISOString()}, ${user.updatedAt.toISOString()})`);
     assertWrite(result, "createUser");
   }
   async findByEmail(email) {
@@ -2966,12 +3116,15 @@ class DbUserStore {
     const result = await this.db.query(sql8`UPDATE auth_users SET email_verified = ${val}, updated_at = ${new Date().toISOString()} WHERE id = ${userId}`);
     assertWrite(result, "updateEmailVerified");
   }
+  async deleteUser(id) {
+    const result = await this.db.query(sql8`DELETE FROM auth_users WHERE id = ${id}`);
+    assertWrite(result, "deleteUser");
+  }
   rowToUser(row) {
     return {
       id: row.id,
       email: row.email,
       role: row.role,
-      plan: row.plan ?? undefined,
       emailVerified: row.email_verified === 1 || row.email_verified === true,
       createdAt: new Date(row.created_at),
       updatedAt: new Date(row.updated_at)
@@ -3295,23 +3448,23 @@ async function computeEntityAccess(entitlements, entity, accessContext) {
 // src/auth/flag-store.ts
 class InMemoryFlagStore {
   flags = new Map;
-  setFlag(orgId, flag, enabled) {
-    let orgFlags = this.flags.get(orgId);
-    if (!orgFlags) {
-      orgFlags = new Map;
-      this.flags.set(orgId, orgFlags);
+  setFlag(tenantId, flag, enabled) {
+    let tenantFlags = this.flags.get(tenantId);
+    if (!tenantFlags) {
+      tenantFlags = new Map;
+      this.flags.set(tenantId, tenantFlags);
     }
-    orgFlags.set(flag, enabled);
+    tenantFlags.set(flag, enabled);
   }
-  getFlag(orgId, flag) {
-    return this.flags.get(orgId)?.get(flag) ?? false;
+  getFlag(tenantId, flag) {
+    return this.flags.get(tenantId)?.get(flag) ?? false;
   }
-  getFlags(orgId) {
-    const orgFlags = this.flags.get(orgId);
-    if (!orgFlags)
+  getFlags(tenantId) {
+    const tenantFlags = this.flags.get(tenantId);
+    if (!tenantFlags)
       return {};
     const result = {};
-    for (const [key, value] of orgFlags) {
+    for (const [key, value] of tenantFlags) {
       result[key] = value;
     }
     return result;
@@ -3476,7 +3629,7 @@ function resolveGraceEnd(planDef, now) {
   return new Date(now.getTime() + GRACE_DURATION_MS["1m"]);
 }
 function createPlanManager(config) {
-  const { plans, versionStore, grandfatheringStore, planStore } = config;
+  const { plans, versionStore, grandfatheringStore, subscriptionStore } = config;
   const clock = config.clock ?? (() => new Date);
   const handlers = [];
   function emit(event) {
@@ -3523,8 +3676,8 @@ function createPlanManager(config) {
     }
   }
   async function listTenantsOnPlan(planId) {
-    if (planStore.listByPlan) {
-      return planStore.listByPlan(planId);
+    if (subscriptionStore.listByPlan) {
+      return subscriptionStore.listByPlan(planId);
     }
     return [];
   }
@@ -3580,10 +3733,10 @@ function createPlanManager(config) {
     }
   }
   async function resolve(tenantId) {
-    const orgPlan = await planStore.getPlan(tenantId);
-    if (!orgPlan)
+    const subscription = await subscriptionStore.get(tenantId);
+    if (!subscription)
       return null;
-    const planId = orgPlan.planId;
+    const planId = subscription.planId;
     const currentVersion = await versionStore.getCurrentVersion(planId);
     if (currentVersion === null)
       return null;
@@ -3761,8 +3914,7 @@ function discord(config) {
         providerId: data.id,
         email: data.email ?? "",
         emailVerified: data.verified ?? false,
-        name: data.global_name ?? data.username,
-        avatarUrl: data.avatar ? `https://cdn.discordapp.com/avatars/${data.id}/${data.avatar}.png` : undefined
+        raw: data
       };
     }
   };
@@ -3804,6 +3956,9 @@ function github(config) {
         })
       });
       const data = await response.json();
+      if (data.error) {
+        throw new Error(`GitHub token exchange failed: ${data.error} — ${data.error_description}`);
+      }
       return {
         accessToken: data.access_token
       };
@@ -3832,8 +3987,7 @@ function github(config) {
         providerId: String(userData.id),
         email: email?.email ?? "",
         emailVerified: email?.verified ?? false,
-        name: userData.name,
-        avatarUrl: userData.avatar_url
+        raw: userData
       };
     }
   };
@@ -3905,8 +4059,7 @@ function google(config) {
         providerId: payload.sub,
         email: payload.email,
         emailVerified: payload.email_verified,
-        name: payload.name,
-        avatarUrl: payload.picture
+        raw: payload
       };
     }
   };
@@ -3997,13 +4150,13 @@ var rules = {
 // src/auth/wallet-store.ts
 class InMemoryWalletStore {
   entries = new Map;
-  key(orgId, entitlement, periodStart) {
-    return `${orgId}:${entitlement}:${periodStart.getTime()}`;
+  key(tenantId, entitlement, periodStart) {
+    return `${tenantId}:${entitlement}:${periodStart.getTime()}`;
   }
-  async consume(orgId, entitlement, periodStart, periodEnd, limit, amount = 1) {
-    const k = this.key(orgId, entitlement, periodStart);
+  async consume(tenantId, entitlement, periodStart, periodEnd, limit, amount = 1) {
+    const k = this.key(tenantId, entitlement, periodStart);
     if (!this.entries.has(k)) {
-      this.entries.set(k, { orgId, entitlement, periodStart, periodEnd, consumed: 0 });
+      this.entries.set(k, { tenantId, entitlement, periodStart, periodEnd, consumed: 0 });
     }
     const entry = this.entries.get(k);
     if (entry.consumed + amount > limit) {
@@ -4022,15 +4175,15 @@ class InMemoryWalletStore {
       remaining: limit - entry.consumed
     };
   }
-  async unconsume(orgId, entitlement, periodStart, _periodEnd, amount = 1) {
-    const k = this.key(orgId, entitlement, periodStart);
+  async unconsume(tenantId, entitlement, periodStart, _periodEnd, amount = 1) {
+    const k = this.key(tenantId, entitlement, periodStart);
     const entry = this.entries.get(k);
     if (!entry)
       return;
     entry.consumed = Math.max(0, entry.consumed - amount);
   }
-  async getConsumption(orgId, entitlement, periodStart, _periodEnd) {
-    const k = this.key(orgId, entitlement, periodStart);
+  async getConsumption(tenantId, entitlement, periodStart, _periodEnd) {
+    const k = this.key(tenantId, entitlement, periodStart);
     const entry = this.entries.get(k);
     return entry?.consumed ?? 0;
   }
@@ -4069,7 +4222,12 @@ function createAuth(config) {
   if (session.strategy !== "jwt") {
     throw new Error(`Session strategy "${session.strategy}" is not yet supported. Use "jwt".`);
   }
-  const cookieConfig = { ...DEFAULT_COOKIE_CONFIG, ...session.cookie };
+  const ttlSeconds = Math.floor(parseDuration(session.ttl) / 1000);
+  const cookieConfig = {
+    ...DEFAULT_COOKIE_CONFIG,
+    maxAge: ttlSeconds,
+    ...session.cookie
+  };
   const refreshName = session.refreshName ?? "vertz.ref";
   const refreshTtlMs = parseDuration(session.refreshTtl ?? "7d");
   const refreshMaxAge = Math.floor(refreshTtlMs / 1000);
@@ -4082,7 +4240,7 @@ function createAuth(config) {
   if (!isProduction && cookieConfig.secure === false) {
     console.warn("Cookie 'secure' flag is disabled. This is allowed in development but must be enabled in production.");
   }
-  const ttlMs = parseDuration(session.ttl);
+  const ttlMs = ttlSeconds * 1000;
   const DUMMY_HASH = "$2a$12$000000000000000000000uGWDREoC/y2KhZ5l2QkI4j0LpDjWcaq";
   const sessionStore = config.sessionStore ?? new InMemorySessionStore;
   const userStore = config.userStore ?? new InMemoryUserStore;
@@ -4112,6 +4270,9 @@ function createAuth(config) {
   const passwordResetTtlMs = parseDuration(passwordResetConfig?.tokenTtl ?? "1h");
   const revokeSessionsOnReset = passwordResetConfig?.revokeSessionsOnReset ?? true;
   const passwordResetStore = config.passwordResetStore ?? (passwordResetEnabled ? new InMemoryPasswordResetStore : undefined);
+  const tenantConfig = config.tenant;
+  const onUserCreated = config.onUserCreated;
+  const entityProxy = config._entityProxy ?? {};
   const rateLimitStore = config.rateLimitStore ?? new InMemoryRateLimitStore;
   const signInWindowMs = parseDuration(emailPassword?.rateLimit?.window || "15m");
   const signUpWindowMs = parseDuration("1h");
@@ -4121,6 +4282,7 @@ function createAuth(config) {
     const expiresAt = new Date(Date.now() + ttlMs);
     const userClaims = claims ? claims(user) : {};
     const fvaClaim = options?.fva !== undefined ? { fva: options.fva } : {};
+    const tenantClaim = options?.tenantId ? { tenantId: options.tenantId } : {};
     let aclClaim = {};
     if (config.access) {
       const accessSet = await computeAccessSet({
@@ -4129,7 +4291,8 @@ function createAuth(config) {
         roleStore: config.access.roleStore,
         closureStore: config.access.closureStore,
         flagStore: config.access.flagStore,
-        plan: user.plan ?? null
+        subscriptionStore: config.access?.subscriptionStore,
+        tenantId: null
       });
       const encoded = encodeAccessSet(accessSet);
       const canonicalJson = JSON.stringify(encoded);
@@ -4149,6 +4312,7 @@ function createAuth(config) {
     const jwt = await createJWT(user, jwtSecret, ttlMs, jwtAlgorithm, () => ({
       ...userClaims,
       ...fvaClaim,
+      ...tenantClaim,
       ...aclClaim,
       jti,
       sid: sessionId
@@ -4164,16 +4328,24 @@ function createAuth(config) {
       sid: sessionId,
       claims: userClaims || undefined,
       ...options?.fva !== undefined ? { fva: options.fva } : {},
+      ...options?.tenantId ? { tenantId: options.tenantId } : {},
       ...aclClaim
     };
     return { jwt, refreshToken, payload, expiresAt };
   }
+  const FORGOT_PASSWORD_MIN_RESPONSE_MS = 15;
   function generateToken() {
     const bytes = crypto.getRandomValues(new Uint8Array(32));
     return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
   }
+  async function waitForMinimumDuration(startedAt, minDurationMs) {
+    const remaining = minDurationMs - (Date.now() - startedAt);
+    if (remaining > 0) {
+      await new Promise((resolve) => setTimeout(resolve, remaining));
+    }
+  }
   async function signUp(data, ctx) {
-    const { email, password, role = "user", ...additionalFields } = data;
+    const { email, password, ...additionalFields } = data;
     if (!email || !email.includes("@")) {
       return err(createAuthValidationError2("Invalid email format", "email", "INVALID_FORMAT"));
     }
@@ -4195,18 +4367,37 @@ function createAuth(config) {
       id: _id,
       createdAt: _c,
       updatedAt: _u,
+      role: _role,
+      emailVerified: _emailVerified,
       ...safeFields
     } = additionalFields;
     const user = {
-      ...safeFields,
       id: crypto.randomUUID(),
       email: email.toLowerCase(),
-      role,
+      role: "user",
       emailVerified: !emailVerificationEnabled,
       createdAt: now,
       updatedAt: now
     };
     await userStore.createUser(user, passwordHash);
+    if (onUserCreated) {
+      const callbackCtx = { entities: entityProxy };
+      const payload = {
+        user,
+        provider: null,
+        signUpData: { ...safeFields }
+      };
+      try {
+        await onUserCreated(payload, callbackCtx);
+      } catch (callbackErr) {
+        try {
+          await userStore.deleteUser(user.id);
+        } catch (rollbackErr) {
+          console.error("[Auth] Failed to rollback user after onUserCreated failure:", rollbackErr);
+        }
+        return err(createAuthValidationError2("User setup failed", "general", "CALLBACK_FAILED"));
+      }
+    }
     if (emailVerificationEnabled && emailVerificationStore && emailVerificationConfig?.onSend) {
       const token = generateToken();
       const tokenHash = await sha256Hex(token);
@@ -4298,6 +4489,10 @@ function createAuth(config) {
     if (!payload) {
       return ok(null);
     }
+    const storedSession = await sessionStore.findActiveSessionById(payload.sid);
+    if (!storedSession || storedSession.userId !== payload.sub) {
+      return ok(null);
+    }
     const user = await userStore.findById(payload.sub);
     if (!user) {
       return ok(null);
@@ -4380,16 +4575,16 @@ function createAuth(config) {
     }
     const currentSid = sessionResult.data.payload.sid;
     const sessions = await sessionStore.listActiveSessions(sessionResult.data.user.id);
-    const infos = sessions.map((s) => ({
-      id: s.id,
-      userId: s.userId,
-      ipAddress: s.ipAddress,
-      userAgent: s.userAgent,
-      deviceName: parseDeviceName(s.userAgent),
-      createdAt: s.createdAt,
-      lastActiveAt: s.lastActiveAt,
-      expiresAt: s.expiresAt,
-      isCurrent: s.id === currentSid
+    const infos = sessions.map((s2) => ({
+      id: s2.id,
+      userId: s2.userId,
+      ipAddress: s2.ipAddress,
+      userAgent: s2.userAgent,
+      deviceName: parseDeviceName(s2.userAgent),
+      createdAt: s2.createdAt,
+      lastActiveAt: s2.lastActiveAt,
+      expiresAt: s2.expiresAt,
+      isCurrent: s2.id === currentSid
     }));
     return ok(infos);
   }
@@ -4401,7 +4596,7 @@ function createAuth(config) {
       return err(createSessionExpiredError("Not authenticated"));
     }
     const targetSessions = await sessionStore.listActiveSessions(sessionResult.data.user.id);
-    const target = targetSessions.find((s) => s.id === sessionId);
+    const target = targetSessions.find((s2) => s2.id === sessionId);
     if (!target) {
       return err(createSessionNotFoundError("Session not found"));
     }
@@ -4417,9 +4612,9 @@ function createAuth(config) {
     }
     const currentSid = sessionResult.data.payload.sid;
     const sessions = await sessionStore.listActiveSessions(sessionResult.data.user.id);
-    for (const s of sessions) {
-      if (s.id !== currentSid) {
-        await sessionStore.revokeSession(s.id);
+    for (const s2 of sessions) {
+      if (s2.id !== currentSid) {
+        await sessionStore.revokeSession(s2.id);
       }
     }
     return ok(undefined);
@@ -4452,6 +4647,32 @@ function createAuth(config) {
       "Referrer-Policy": "strict-origin-when-cross-origin"
     };
   }
+  function authValidationResponse(message) {
+    return new Response(JSON.stringify({
+      error: {
+        code: "AUTH_VALIDATION_ERROR",
+        message
+      }
+    }), {
+      status: 400,
+      headers: { "Content-Type": "application/json", ...securityHeaders() }
+    });
+  }
+  async function parseJsonAuthBody(request, schema) {
+    try {
+      const body = await parseBody(request);
+      const result = schema.safeParse(body);
+      if (!result.ok) {
+        return { ok: false, response: authValidationResponse(result.error.message) };
+      }
+      return { ok: true, data: result.data };
+    } catch (error) {
+      if (error instanceof BadRequestException) {
+        return { ok: false, response: authValidationResponse(error.message) };
+      }
+      throw error;
+    }
+  }
   async function handleAuthRequest(request) {
     const url = new URL(request.url);
     const path = url.pathname.replace("/api/auth", "") || "/";
@@ -4495,7 +4716,11 @@ function createAuth(config) {
     }
     try {
       if (method === "POST" && path === "/signup") {
-        const body = await request.json();
+        const bodyResult = await parseJsonAuthBody(request, signUpInputSchema);
+        if (!bodyResult.ok) {
+          return bodyResult.response;
+        }
+        const body = bodyResult.data;
         const result = await signUp(body, { headers: request.headers });
         if (!result.ok) {
           return new Response(JSON.stringify({ error: result.error }), {
@@ -4520,7 +4745,11 @@ function createAuth(config) {
         });
       }
       if (method === "POST" && path === "/signin") {
-        const body = await request.json();
+        const bodyResult = await parseJsonAuthBody(request, signInInputSchema);
+        if (!bodyResult.ok) {
+          return bodyResult.response;
+        }
+        const body = bodyResult.data;
         const result = await signIn(body, { headers: request.headers });
         if (!result.ok) {
           if (result.error.code === "MFA_REQUIRED" && oauthEncryptionKey) {
@@ -4609,7 +4838,8 @@ function createAuth(config) {
           roleStore: config.access.roleStore,
           closureStore: config.access.closureStore,
           flagStore: config.access.flagStore,
-          plan: sessionResult.data.user.plan ?? null
+          subscriptionStore: config.access?.subscriptionStore,
+          tenantId: sessionResult.data.payload?.tenantId ?? null
         });
         const encoded = encodeAccessSet(accessSet);
         const hashPayload = {
@@ -4625,8 +4855,9 @@ function createAuth(config) {
             status: 304,
             headers: {
               ETag: quotedEtag,
+              Vary: "Cookie",
               ...securityHeaders(),
-              "Cache-Control": "no-cache"
+              "Cache-Control": "private, no-cache"
             }
           });
         }
@@ -4635,8 +4866,9 @@ function createAuth(config) {
           headers: {
             "Content-Type": "application/json",
             ETag: quotedEtag,
+            Vary: "Cookie",
             ...securityHeaders(),
-            "Cache-Control": "no-cache"
+            "Cache-Control": "private, no-cache"
           }
         });
       }
@@ -4710,6 +4942,17 @@ function createAuth(config) {
           headers: { "Content-Type": "application/json", ...securityHeaders() }
         });
       }
+      if (method === "GET" && path === "/providers") {
+        const providerList = Array.from(providers.values()).map((p) => ({
+          id: p.id,
+          name: p.name,
+          authUrl: `/api/auth/oauth/${p.id}`
+        }));
+        return new Response(JSON.stringify(providerList), {
+          status: 200,
+          headers: { "Content-Type": "application/json", ...securityHeaders() }
+        });
+      }
       if (method === "GET" && path.startsWith("/oauth/") && !path.includes("/callback")) {
         const providerId = path.replace("/oauth/", "");
         const provider = providers.get(providerId);
@@ -4756,12 +4999,17 @@ function createAuth(config) {
       if (method === "GET" && path.includes("/oauth/") && path.endsWith("/callback")) {
         const providerId = path.replace("/oauth/", "").replace("/callback", "");
         const provider = providers.get(providerId);
-        const errorRedirect = oauthErrorRedirect;
+        const isAbsoluteUrl = /^https?:\/\//.test(oauthErrorRedirect);
+        const errorUrl = (error) => {
+          const url2 = new URL(oauthErrorRedirect, "http://localhost");
+          url2.searchParams.set("error", error);
+          return isAbsoluteUrl ? url2.toString() : url2.pathname + url2.search + url2.hash;
+        };
         if (!provider || !oauthEncryptionKey || !oauthAccountStore) {
           return new Response(null, {
             status: 302,
             headers: {
-              Location: `${errorRedirect}?error=provider_not_configured`,
+              Location: errorUrl("provider_not_configured"),
               ...securityHeaders()
             }
           });
@@ -4772,7 +5020,7 @@ function createAuth(config) {
           return new Response(null, {
             status: 302,
             headers: {
-              Location: `${errorRedirect}?error=invalid_state`,
+              Location: errorUrl("invalid_state"),
               ...securityHeaders()
             }
           });
@@ -4782,7 +5030,7 @@ function createAuth(config) {
           return new Response(null, {
             status: 302,
             headers: {
-              Location: `${errorRedirect}?error=invalid_state`,
+              Location: errorUrl("invalid_state"),
               ...securityHeaders()
             }
           });
@@ -4793,7 +5041,7 @@ function createAuth(config) {
         const providerError = url.searchParams.get("error");
         if (providerError) {
           const headers = new Headers({
-            Location: `${errorRedirect}?error=${encodeURIComponent(providerError)}`,
+            Location: errorUrl(providerError),
             ...securityHeaders()
           });
           headers.append("Set-Cookie", buildOAuthStateCookie("", cookieConfig, true));
@@ -4801,7 +5049,7 @@ function createAuth(config) {
         }
         if (stateData.state !== queryState || stateData.provider !== providerId) {
           const headers = new Headers({
-            Location: `${errorRedirect}?error=invalid_state`,
+            Location: errorUrl("invalid_state"),
             ...securityHeaders()
           });
           headers.append("Set-Cookie", buildOAuthStateCookie("", cookieConfig, true));
@@ -4809,7 +5057,7 @@ function createAuth(config) {
         }
         if (stateData.expiresAt < Date.now()) {
           const headers = new Headers({
-            Location: `${errorRedirect}?error=invalid_state`,
+            Location: errorUrl("invalid_state"),
             ...securityHeaders()
           });
           headers.append("Set-Cookie", buildOAuthStateCookie("", cookieConfig, true));
@@ -4836,7 +5084,7 @@ function createAuth(config) {
             if (!userId) {
               if (!userInfo.email || !userInfo.email.includes("@")) {
                 const headers = new Headers({
-                  Location: `${errorRedirect}?error=email_required`,
+                  Location: errorUrl("email_required"),
                   ...securityHeaders()
                 });
                 headers.append("Set-Cookie", buildOAuthStateCookie("", cookieConfig, true));
@@ -4846,6 +5094,7 @@ function createAuth(config) {
               const newUser = {
                 id: crypto.randomUUID(),
                 email: userInfo.email.toLowerCase(),
+                emailVerified: userInfo.emailVerified,
                 role: "user",
                 createdAt: now,
                 updatedAt: now
@@ -4853,6 +5102,34 @@ function createAuth(config) {
               await userStore.createUser(newUser, null);
               userId = newUser.id;
               await oauthAccountStore.linkAccount(userId, provider.id, userInfo.providerId, userInfo.email);
+              if (onUserCreated) {
+                const callbackCtx = { entities: entityProxy };
+                const payload = {
+                  user: newUser,
+                  provider: { id: provider.id, name: provider.name },
+                  profile: userInfo.raw
+                };
+                try {
+                  await onUserCreated(payload, callbackCtx);
+                } catch {
+                  try {
+                    await oauthAccountStore.unlinkAccount(userId, provider.id);
+                  } catch (rollbackErr) {
+                    console.error("[Auth] Failed to unlink OAuth account during rollback:", rollbackErr);
+                  }
+                  try {
+                    await userStore.deleteUser(userId);
+                  } catch (rollbackErr) {
+                    console.error("[Auth] Failed to delete user during rollback:", rollbackErr);
+                  }
+                  const headers = new Headers({
+                    Location: errorUrl("user_setup_failed"),
+                    ...securityHeaders()
+                  });
+                  headers.append("Set-Cookie", buildOAuthStateCookie("", cookieConfig, true));
+                  return new Response(null, { status: 302, headers });
+                }
+              }
             }
           }
           const user = await userStore.findById(userId);
@@ -4860,7 +5137,7 @@ function createAuth(config) {
             return new Response(null, {
               status: 302,
               headers: {
-                Location: `${errorRedirect}?error=user_info_failed`,
+                Location: errorUrl("user_info_failed"),
                 ...securityHeaders()
               }
             });
@@ -4881,9 +5158,10 @@ function createAuth(config) {
           responseHeaders.append("Set-Cookie", buildSessionCookie(sessionTokens.jwt, cookieConfig));
           responseHeaders.append("Set-Cookie", buildRefreshCookie(sessionTokens.refreshToken, cookieConfig, refreshName, refreshMaxAge));
           return new Response(null, { status: 302, headers: responseHeaders });
-        } catch {
+        } catch (oauthErr) {
+          console.error("[Auth] OAuth callback error:", oauthErr);
           const headers = new Headers({
-            Location: `${errorRedirect}?error=token_exchange_failed`,
+            Location: errorUrl("token_exchange_failed"),
             ...securityHeaders()
           });
           headers.append("Set-Cookie", buildOAuthStateCookie("", cookieConfig, true));
@@ -4933,7 +5211,11 @@ function createAuth(config) {
             headers: { "Content-Type": "application/json", ...securityHeaders() }
           });
         }
-        const body = await request.json();
+        const bodyResult = await parseJsonAuthBody(request, codeInputSchema);
+        if (!bodyResult.ok) {
+          return bodyResult.response;
+        }
+        const body = bodyResult.data;
         const userId = challengeData.userId;
         const encryptedSecret = await mfaStore.getSecret(userId);
         if (!encryptedSecret) {
@@ -5053,7 +5335,11 @@ function createAuth(config) {
             headers: { "Content-Type": "application/json", ...securityHeaders() }
           });
         }
-        const body = await request.json();
+        const bodyResult = await parseJsonAuthBody(request, codeInputSchema);
+        if (!bodyResult.ok) {
+          return bodyResult.response;
+        }
+        const body = bodyResult.data;
         const valid = await verifyTotpCode(pendingEntry.secret, body.code);
         if (!valid) {
           return new Response(JSON.stringify({ error: createMfaInvalidCodeError() }), {
@@ -5087,7 +5373,11 @@ function createAuth(config) {
           });
         }
         const userId = sessionResult.data.user.id;
-        const body = await request.json();
+        const bodyResult = await parseJsonAuthBody(request, passwordInputSchema);
+        if (!bodyResult.ok) {
+          return bodyResult.response;
+        }
+        const body = bodyResult.data;
         const stored = await userStore.findByEmail(sessionResult.data.user.email);
         if (!stored || !stored.passwordHash) {
           return new Response(JSON.stringify({ error: createInvalidCredentialsError() }), {
@@ -5122,7 +5412,11 @@ function createAuth(config) {
             headers: { "Content-Type": "application/json", ...securityHeaders() }
           });
         }
-        const body = await request.json();
+        const bodyResult = await parseJsonAuthBody(request, passwordInputSchema);
+        if (!bodyResult.ok) {
+          return bodyResult.response;
+        }
+        const body = bodyResult.data;
         const stored = await userStore.findByEmail(sessionResult.data.user.email);
         if (!stored || !stored.passwordHash) {
           return new Response(JSON.stringify({ error: createInvalidCredentialsError() }), {
@@ -5209,7 +5503,11 @@ function createAuth(config) {
             headers: { "Content-Type": "application/json", ...securityHeaders() }
           });
         }
-        const body = await request.json();
+        const bodyResult = await parseJsonAuthBody(request, codeInputSchema);
+        if (!bodyResult.ok) {
+          return bodyResult.response;
+        }
+        const body = bodyResult.data;
         const valid = await verifyTotpCode(totpSecret, body.code);
         if (!valid) {
           return new Response(JSON.stringify({ error: createMfaInvalidCodeError() }), {
@@ -5253,7 +5551,11 @@ function createAuth(config) {
             headers: { "Content-Type": "application/json", ...securityHeaders() }
           });
         }
-        const body = await request.json();
+        const bodyResult = await parseJsonAuthBody(request, tokenInputSchema);
+        if (!bodyResult.ok) {
+          return bodyResult.response;
+        }
+        const body = bodyResult.data;
         if (!body.token) {
           return new Response(JSON.stringify({ error: createTokenInvalidError("Token is required") }), {
             status: 400,
@@ -5332,25 +5634,32 @@ function createAuth(config) {
             headers: { "Content-Type": "application/json", ...securityHeaders() }
           });
         }
-        const body = await request.json();
+        const bodyResult = await parseJsonAuthBody(request, forgotPasswordInputSchema);
+        if (!bodyResult.ok) {
+          return bodyResult.response;
+        }
+        const body = bodyResult.data;
+        const startedAt = Date.now();
         const forgotRateLimit = await rateLimitStore.check(`forgot-password:${(body.email ?? "").toLowerCase()}`, 3, parseDuration("1h"));
         if (!forgotRateLimit.allowed) {
+          await waitForMinimumDuration(startedAt, FORGOT_PASSWORD_MIN_RESPONSE_MS);
           return new Response(JSON.stringify({ ok: true }), {
             status: 200,
             headers: { "Content-Type": "application/json", ...securityHeaders() }
           });
         }
+        const token = generateToken();
+        const tokenHash = await sha256Hex(token);
         const stored = await userStore.findByEmail((body.email ?? "").toLowerCase());
         if (stored) {
-          const token = generateToken();
-          const tokenHash = await sha256Hex(token);
           await passwordResetStore.createReset({
             userId: stored.user.id,
             tokenHash,
             expiresAt: new Date(Date.now() + passwordResetTtlMs)
           });
-          await passwordResetConfig.onSend(stored.user, token);
+          passwordResetConfig.onSend(stored.user, token).catch((error) => console.error("[Auth] Failed to send password reset email", error));
         }
+        await waitForMinimumDuration(startedAt, FORGOT_PASSWORD_MIN_RESPONSE_MS);
         return new Response(JSON.stringify({ ok: true }), {
           status: 200,
           headers: { "Content-Type": "application/json", ...securityHeaders() }
@@ -5365,7 +5674,11 @@ function createAuth(config) {
             headers: { "Content-Type": "application/json", ...securityHeaders() }
           });
         }
-        const body = await request.json();
+        const bodyResult = await parseJsonAuthBody(request, resetPasswordInputSchema);
+        if (!bodyResult.ok) {
+          return bodyResult.response;
+        }
+        const body = bodyResult.data;
         if (!body.token) {
           return new Response(JSON.stringify({ error: createTokenInvalidError("Token is required") }), {
             status: 400,
@@ -5399,8 +5712,8 @@ function createAuth(config) {
         await passwordResetStore.deleteByUserId(resetRecord.userId);
         if (revokeSessionsOnReset) {
           const activeSessions = await sessionStore.listActiveSessions(resetRecord.userId);
-          for (const s of activeSessions) {
-            await sessionStore.revokeSession(s.id);
+          for (const s2 of activeSessions) {
+            await sessionStore.revokeSession(s2.id);
           }
         }
         return new Response(JSON.stringify({ ok: true }), {
@@ -5408,6 +5721,63 @@ function createAuth(config) {
           headers: { "Content-Type": "application/json", ...securityHeaders() }
         });
       }
+      if (method === "POST" && path === "/switch-tenant") {
+        if (!tenantConfig) {
+          return new Response(JSON.stringify({ error: "Not found" }), {
+            status: 404,
+            headers: { "Content-Type": "application/json", ...securityHeaders() }
+          });
+        }
+        const sessionResult = await getSession(request.headers);
+        if (!sessionResult.ok || !sessionResult.data) {
+          return new Response(JSON.stringify({ error: { code: "SESSION_EXPIRED", message: "Not authenticated" } }), {
+            status: 401,
+            headers: { "Content-Type": "application/json", ...securityHeaders() }
+          });
+        }
+        const bodyResult = await parseJsonAuthBody(request, switchTenantInputSchema);
+        if (!bodyResult.ok) {
+          return bodyResult.response;
+        }
+        const { tenantId } = bodyResult.data;
+        const userId = sessionResult.data.user.id;
+        const hasMembership = await tenantConfig.verifyMembership(userId, tenantId);
+        if (!hasMembership) {
+          return new Response(JSON.stringify({
+            error: { code: "AUTH_FORBIDDEN", message: "Not a member of this tenant" }
+          }), {
+            status: 403,
+            headers: { "Content-Type": "application/json", ...securityHeaders() }
+          });
+        }
+        const currentPayload = sessionResult.data.payload;
+        const tokens = await createSessionTokens(sessionResult.data.user, currentPayload.sid, {
+          fva: currentPayload.fva,
+          tenantId
+        });
+        const refreshTokenHash = await sha256Hex(tokens.refreshToken);
+        const previousRefreshHash = (await sessionStore.findActiveSessionById(currentPayload.sid))?.refreshTokenHash ?? "";
+        await sessionStore.updateSession(currentPayload.sid, {
+          refreshTokenHash,
+          previousRefreshHash,
+          lastActiveAt: new Date,
+          currentTokens: { jwt: tokens.jwt, refreshToken: tokens.refreshToken }
+        });
+        const headers = new Headers({
+          "Content-Type": "application/json",
+          ...securityHeaders()
+        });
+        headers.append("Set-Cookie", buildSessionCookie(tokens.jwt, cookieConfig));
+        headers.append("Set-Cookie", buildRefreshCookie(tokens.refreshToken, cookieConfig, refreshName, refreshMaxAge));
+        return new Response(JSON.stringify({
+          tenantId,
+          user: sessionResult.data.user,
+          expiresAt: tokens.expiresAt.getTime()
+        }), {
+          status: 200,
+          headers
+        });
+      }
       return new Response(JSON.stringify({ error: "Not found" }), {
         status: 404,
         headers: { "Content-Type": "application/json" }
@@ -5458,9 +5828,49 @@ function createAuth(config) {
       emailVerificationStore?.dispose();
       passwordResetStore?.dispose();
       pendingMfaSecrets.clear();
+    },
+    resolveSessionForSSR: resolveSessionForSSR({
+      jwtSecret,
+      jwtAlgorithm,
+      cookieName: cookieConfig.name || "vertz.sid"
+    })
+  };
+}
+// src/content/builders.ts
+function stringDescriptor(contentType) {
+  return {
+    _kind: "content",
+    _contentType: contentType,
+    parse(value) {
+      if (typeof value === "string") {
+        return { ok: true, data: value };
+      }
+      return { ok: false, error: new Error(`Expected string, got ${typeof value}`) };
     }
   };
 }
+var content = {
+  xml: () => stringDescriptor("application/xml"),
+  html: () => stringDescriptor("text/html"),
+  text: () => stringDescriptor("text/plain"),
+  binary: () => ({
+    _kind: "content",
+    _contentType: "application/octet-stream",
+    parse(value) {
+      if (value instanceof Uint8Array) {
+        return { ok: true, data: value };
+      }
+      return {
+        ok: false,
+        error: new Error(`Expected Uint8Array, got ${typeof value}`)
+      };
+    }
+  })
+};
+// src/content/content-descriptor.ts
+function isContentDescriptor(value) {
+  return value != null && typeof value === "object" && "_kind" in value && value._kind === "content";
+}
 // src/create-server.ts
 import { createServer as coreCreateServer } from "@vertz/core";
 import {
@@ -5541,10 +5951,15 @@ function narrowRelationFields(relationsConfig, data) {
     if (config === undefined || config === true) {
       result[key] = value;
     } else if (config === false) {} else if (typeof config === "object" && value !== null && typeof value === "object") {
+      const selectMap = config.select;
+      if (!selectMap) {
+        result[key] = value;
+        continue;
+      }
       if (Array.isArray(value)) {
         result[key] = value.map((item) => {
           const narrowed = {};
-          for (const field of Object.keys(config)) {
+          for (const field of Object.keys(selectMap)) {
             if (field in item) {
               narrowed[field] = item[field];
             }
@@ -5553,7 +5968,7 @@ function narrowRelationFields(relationsConfig, data) {
         });
       } else {
         const narrowed = {};
-        for (const field of Object.keys(config)) {
+        for (const field of Object.keys(selectMap)) {
           if (field in value) {
             narrowed[field] = value[field];
           }
@@ -5577,6 +5992,15 @@ function applySelect(select, data) {
   }
   return result;
 }
+function nullGuardedFields(nulledFields, data) {
+  if (nulledFields.size === 0)
+    return data;
+  const result = {};
+  for (const [key, value] of Object.entries(data)) {
+    result[key] = nulledFields.has(key) ? null : value;
+  }
+  return result;
+}
 function stripReadOnlyFields(table, data) {
   const excludedKeys = new Set;
   for (const key of Object.keys(table._columns)) {
@@ -5606,7 +6030,138 @@ import {
 
 // src/entity/access-enforcer.ts
 import { EntityForbiddenError, err as err2, ok as ok2 } from "@vertz/errors";
-async function enforceAccess(operation, accessRules, ctx, row) {
+function deny(operation) {
+  return err2(new EntityForbiddenError(`Access denied for operation "${operation}"`));
+}
+function isUserMarker(value) {
+  return typeof value === "object" && value !== null && "__marker" in value;
+}
+function resolveMarker(marker, ctx) {
+  switch (marker.__marker) {
+    case "user.id":
+      return ctx.userId;
+    case "user.tenantId":
+      return ctx.tenantId;
+    default:
+      return;
+  }
+}
+async function evaluateRule(rule, operation, ctx, row, options) {
+  switch (rule.type) {
+    case "public":
+      return ok2(undefined);
+    case "authenticated":
+      return ctx.authenticated() ? ok2(undefined) : deny(operation);
+    case "role":
+      return ctx.role(...rule.roles) ? ok2(undefined) : deny(operation);
+    case "entitlement": {
+      if (!options.can) {
+        return deny(operation);
+      }
+      const allowed = await options.can(rule.entitlement);
+      return allowed ? ok2(undefined) : deny(operation);
+    }
+    case "where": {
+      for (const [key, expected] of Object.entries(rule.conditions)) {
+        const resolved = isUserMarker(expected) ? resolveMarker(expected, ctx) : expected;
+        if (row[key] !== resolved) {
+          return deny(operation);
+        }
+      }
+      return ok2(undefined);
+    }
+    case "all": {
+      for (const sub of rule.rules) {
+        const result = await evaluateDescriptor(sub, operation, ctx, row, options);
+        if (!result.ok)
+          return result;
+      }
+      return ok2(undefined);
+    }
+    case "any": {
+      for (const sub of rule.rules) {
+        const result = await evaluateDescriptor(sub, operation, ctx, row, options);
+        if (result.ok)
+          return result;
+      }
+      return deny(operation);
+    }
+    case "fva": {
+      if (options.fvaAge === undefined) {
+        return deny(operation);
+      }
+      return options.fvaAge <= rule.maxAge ? ok2(undefined) : deny(operation);
+    }
+  }
+}
+async function evaluateDescriptor(rule, operation, ctx, row, options) {
+  if (typeof rule === "function") {
+    const allowed = await rule(ctx, row);
+    return allowed ? ok2(undefined) : deny(operation);
+  }
+  return evaluateRule(rule, operation, ctx, row, options);
+}
+async function evaluateRuleSkipWhere(rule, operation, ctx, row, options) {
+  if (rule.type === "where") {
+    return ok2(undefined);
+  }
+  if (rule.type === "all") {
+    for (const sub of rule.rules) {
+      const result = await evaluateDescriptorSkipWhere(sub, operation, ctx, row, options);
+      if (!result.ok)
+        return result;
+    }
+    return ok2(undefined);
+  }
+  if (rule.type === "any") {
+    for (const sub of rule.rules) {
+      const result = await evaluateDescriptorSkipWhere(sub, operation, ctx, row, options);
+      if (result.ok)
+        return result;
+    }
+    return deny(operation);
+  }
+  return evaluateRule(rule, operation, ctx, row, options);
+}
+async function evaluateDescriptorSkipWhere(rule, operation, ctx, row, options) {
+  if (typeof rule === "function") {
+    const allowed = await rule(ctx, row);
+    return allowed ? ok2(undefined) : deny(operation);
+  }
+  return evaluateRuleSkipWhere(rule, operation, ctx, row, options);
+}
+function extractFromDescriptor(rule, ctx) {
+  if (typeof rule === "function")
+    return null;
+  switch (rule.type) {
+    case "where": {
+      const resolved = {};
+      for (const [key, value] of Object.entries(rule.conditions)) {
+        resolved[key] = isUserMarker(value) ? resolveMarker(value, ctx) : value;
+      }
+      return resolved;
+    }
+    case "all": {
+      let merged = null;
+      for (const sub of rule.rules) {
+        const extracted = extractFromDescriptor(sub, ctx);
+        if (extracted) {
+          merged = { ...merged ?? {}, ...extracted };
+        }
+      }
+      return merged;
+    }
+    default:
+      return null;
+  }
+}
+function extractWhereConditions(operation, accessRules, ctx) {
+  const rule = accessRules[operation];
+  if (rule === undefined || rule === false)
+    return null;
+  return extractFromDescriptor(rule, ctx);
+}
+async function enforceAccess(operation, accessRules, ctx, row, options) {
   const rule = accessRules[operation];
   if (rule === undefined) {
     return err2(new EntityForbiddenError(`Access denied: no access rule for operation "${operation}"`));
@@ -5614,14 +6169,10 @@ async function enforceAccess(operation, accessRules, ctx, row) {
   if (rule === false) {
     return err2(new EntityForbiddenError(`Operation "${operation}" is disabled`));
   }
-  if (typeof rule === "function") {
-    const allowed = await rule(ctx, row ?? {});
-    if (!allowed) {
-      return err2(new EntityForbiddenError(`Access denied for operation "${operation}"`));
-    }
-    return ok2(undefined);
+  if (options?.skipWhere) {
+    return evaluateDescriptorSkipWhere(rule, operation, ctx, row ?? {}, options);
   }
-  return ok2(undefined);
+  return evaluateDescriptor(rule, operation, ctx, row ?? {}, options ?? {});
 }
 
 // src/entity/action-pipeline.ts
@@ -5663,6 +6214,7 @@ function createEntityContext(request, entityOps, registryProxy) {
   const tenantId = request.tenantId ?? null;
   return {
     userId,
+    tenantId,
     authenticated() {
       return userId !== null;
     },
@@ -5678,7 +6230,12 @@ function createEntityContext(request, entityOps, registryProxy) {
 }
 
 // src/entity/crud-pipeline.ts
-import { EntityNotFoundError as EntityNotFoundError2, err as err4, ok as ok4 } from "@vertz/errors";
+import {
+  EntityForbiddenError as EntityForbiddenError2,
+  EntityNotFoundError as EntityNotFoundError2,
+  err as err4,
+  ok as ok4
+} from "@vertz/errors";
 function resolvePrimaryKeyColumn(table) {
   for (const key of Object.keys(table._columns)) {
     const col = table._columns[key];
@@ -5687,38 +6244,109 @@ function resolvePrimaryKeyColumn(table) {
   }
   return "id";
 }
-function createCrudHandlers(def, db) {
+function createCrudHandlers(def, db, options) {
   const table = def.model.table;
+  const isTenantScoped = def.tenantScoped;
+  const tenantChain = options?.tenantChain ?? def.tenantChain ?? null;
+  const isIndirectlyScoped = tenantChain !== null;
+  const queryParentIds = options?.queryParentIds ?? null;
+  const exposeSelect = def.expose?.select ? {
+    ...def.expose.select,
+    ...Object.fromEntries(Object.entries(def.expose.include ?? {}).filter(([, v]) => v !== false).map(([k]) => [k, true]))
+  } : undefined;
+  function notFound(id) {
+    return err4(new EntityNotFoundError2(`${def.name} with id "${id}" not found`));
+  }
+  function isSameTenant(ctx, row) {
+    if (!isTenantScoped)
+      return true;
+    if (isIndirectlyScoped)
+      return true;
+    return row.tenantId === ctx.tenantId;
+  }
+  function withTenantFilter(ctx, where) {
+    if (!isTenantScoped)
+      return where;
+    if (isIndirectlyScoped)
+      return where;
+    return { ...where, tenantId: ctx.tenantId };
+  }
+  async function resolveIndirectTenantWhere(ctx) {
+    if (!isIndirectlyScoped || !tenantChain || !queryParentIds)
+      return null;
+    if (!ctx.tenantId) {
+      return { [tenantChain.hops[0].foreignKey]: { in: [] } };
+    }
+    const { hops, tenantColumn } = tenantChain;
+    const lastHop = hops[hops.length - 1];
+    let currentIds = await queryParentIds(lastHop.tableName, { [tenantColumn]: ctx.tenantId });
+    for (let i = hops.length - 2;i >= 0; i--) {
+      if (currentIds.length === 0)
+        break;
+      const hop = hops[i];
+      const nextHop = hops[i + 1];
+      currentIds = await queryParentIds(hop.tableName, {
+        [nextHop.foreignKey]: { in: currentIds }
+      });
+    }
+    return { [hops[0].foreignKey]: { in: currentIds } };
+  }
+  async function verifyIndirectTenantOwnership(ctx, row) {
+    if (!isIndirectlyScoped || !tenantChain || !queryParentIds)
+      return true;
+    if (!ctx.tenantId)
+      return false;
+    const indirectWhere = await resolveIndirectTenantWhere(ctx);
+    if (!indirectWhere)
+      return false;
+    const firstHopFK = tenantChain.hops[0].foreignKey;
+    const allowed = indirectWhere[firstHopFK];
+    if (!allowed)
+      return false;
+    return allowed.in.includes(row[firstHopFK]);
+  }
   return {
-    async list(ctx, options) {
-      const accessResult = await enforceAccess("list", def.access, ctx);
+    async list(ctx, options2) {
+      const accessWhere = extractWhereConditions("list", def.access, ctx);
+      const accessResult = await enforceAccess("list", def.access, ctx, undefined, {
+        skipWhere: accessWhere !== null
+      });
       if (!accessResult.ok)
         return err4(accessResult.error);
-      const rawWhere = options?.where;
+      const rawWhere = options2?.where;
       const safeWhere = rawWhere ? stripHiddenFields(table, rawWhere) : undefined;
-      const where = safeWhere && Object.keys(safeWhere).length > 0 ? safeWhere : undefined;
-      const limit = Math.max(0, options?.limit ?? 20);
-      const after = options?.after && options.after.length <= 512 ? options.after : undefined;
-      const orderBy = options?.orderBy;
-      const { data: rows, total } = await db.list({ where, orderBy, limit, after });
-      const data = rows.map((row) => narrowRelationFields(def.relations, stripHiddenFields(table, row)));
+      const cleanWhere = safeWhere && Object.keys(safeWhere).length > 0 ? safeWhere : undefined;
+      const directWhere = withTenantFilter(ctx, { ...accessWhere, ...cleanWhere });
+      const indirectWhere = await resolveIndirectTenantWhere(ctx);
+      const where = indirectWhere ? { ...directWhere, ...indirectWhere } : directWhere;
+      const limit = Math.max(0, options2?.limit ?? 20);
+      const after = options2?.after && options2.after.length <= 512 ? options2.after : undefined;
+      const orderBy = options2?.orderBy;
+      const include = options2?.include;
+      const { data: rows, total } = await db.list({ where, orderBy, limit, after, include });
+      const data = rows.map((row) => applySelect(exposeSelect, narrowRelationFields(def.expose?.include ?? {}, stripHiddenFields(table, row))));
       const pkColumn = resolvePrimaryKeyColumn(table);
       const lastRow = rows[rows.length - 1];
       const nextCursor = limit > 0 && rows.length === limit && lastRow ? String(lastRow[pkColumn]) : null;
       const hasNextPage = nextCursor !== null;
       return ok4({ status: 200, body: { items: data, total, limit, nextCursor, hasNextPage } });
     },
-    async get(ctx, id) {
-      const row = await db.get(id);
-      if (!row) {
-        return err4(new EntityNotFoundError2(`${def.name} with id "${id}" not found`));
+    async get(ctx, id, options2) {
+      const getOptions = options2?.include ? { include: options2.include } : undefined;
+      const row = await db.get(id, getOptions);
+      if (!row)
+        return notFound(id);
+      if (!isSameTenant(ctx, row))
+        return notFound(id);
+      if (isIndirectlyScoped && !await verifyIndirectTenantOwnership(ctx, row)) {
+        return notFound(id);
       }
       const accessResult = await enforceAccess("get", def.access, ctx, row);
       if (!accessResult.ok)
         return err4(accessResult.error);
       return ok4({
         status: 200,
-        body: narrowRelationFields(def.relations, stripHiddenFields(table, row))
+        body: applySelect(exposeSelect, narrowRelationFields(def.expose?.include ?? {}, stripHiddenFields(table, row)))
       });
     },
     async create(ctx, data) {
@@ -5726,6 +6354,29 @@ function createCrudHandlers(def, db) {
       if (!accessResult.ok)
         return err4(accessResult.error);
       let input = stripReadOnlyFields(table, data);
+      if (isIndirectlyScoped && tenantChain && queryParentIds && ctx.tenantId) {
+        const firstHop = tenantChain.hops[0];
+        const parentId = input[firstHop.foreignKey];
+        if (!parentId) {
+          return err4(new EntityNotFoundError2(`Referenced parent not found: ${firstHop.foreignKey} is required`));
+        }
+        const parentExists = await queryParentIds(firstHop.tableName, {
+          [firstHop.targetColumn]: parentId
+        });
+        if (parentExists.length === 0) {
+          return err4(new EntityNotFoundError2(`Referenced parent not found: ${firstHop.tableName} with ${firstHop.targetColumn} "${parentId}" does not exist`));
+        }
+        const indirectWhere = await resolveIndirectTenantWhere(ctx);
+        if (indirectWhere) {
+          const allowed = indirectWhere[firstHop.foreignKey];
+          if (!allowed || !allowed.in.includes(parentId)) {
+            return err4(new EntityForbiddenError2(`Referenced ${firstHop.tableName} does not belong to your tenant`));
+          }
+        }
+      }
+      if (isTenantScoped && !isIndirectlyScoped && ctx.tenantId) {
+        input = { ...input, tenantId: ctx.tenantId };
+      }
       if (def.before.create) {
         input = await def.before.create(input, ctx);
       }
@@ -5736,12 +6387,19 @@ function createCrudHandlers(def, db) {
           await def.after.create(strippedResult, ctx);
         } catch {}
       }
-      return ok4({ status: 201, body: narrowRelationFields(def.relations, strippedResult) });
+      return ok4({
+        status: 201,
+        body: applySelect(exposeSelect, narrowRelationFields(def.expose?.include ?? {}, strippedResult))
+      });
     },
     async update(ctx, id, data) {
       const existing = await db.get(id);
-      if (!existing) {
-        return err4(new EntityNotFoundError2(`${def.name} with id "${id}" not found`));
+      if (!existing)
+        return notFound(id);
+      if (!isSameTenant(ctx, existing))
+        return notFound(id);
+      if (isIndirectlyScoped && !await verifyIndirectTenantOwnership(ctx, existing)) {
+        return notFound(id);
       }
       const accessResult = await enforceAccess("update", def.access, ctx, existing);
       if (!accessResult.ok)
@@ -5760,13 +6418,17 @@ function createCrudHandlers(def, db) {
       }
       return ok4({
         status: 200,
-        body: narrowRelationFields(def.relations, strippedResult)
+        body: applySelect(exposeSelect, narrowRelationFields(def.expose?.include ?? {}, strippedResult))
       });
     },
     async delete(ctx, id) {
       const existing = await db.get(id);
-      if (!existing) {
-        return err4(new EntityNotFoundError2(`${def.name} with id "${id}" not found`));
+      if (!existing)
+        return notFound(id);
+      if (!isSameTenant(ctx, existing))
+        return notFound(id);
+      if (isIndirectlyScoped && !await verifyIndirectTenantOwnership(ctx, existing)) {
+        return notFound(id);
       }
       const accessResult = await enforceAccess("delete", def.access, ctx, existing);
       if (!accessResult.ok)
@@ -5844,17 +6506,104 @@ function entityErrorHandler(error) {
   };
 }
 
+// src/entity/expose-evaluator.ts
+async function evaluateExposeRule(rule, ctx, options) {
+  switch (rule.type) {
+    case "public":
+      return true;
+    case "authenticated":
+      return ctx.authenticated();
+    case "role":
+      return ctx.role(...rule.roles);
+    case "entitlement": {
+      if (!options.can)
+        return false;
+      return options.can(rule.entitlement);
+    }
+    case "where":
+      return false;
+    case "all": {
+      for (const sub of rule.rules) {
+        if (!await evaluateExposeRule(sub, ctx, options))
+          return false;
+      }
+      return true;
+    }
+    case "any": {
+      for (const sub of rule.rules) {
+        if (await evaluateExposeRule(sub, ctx, options))
+          return true;
+      }
+      return false;
+    }
+    case "fva": {
+      if (options.fvaAge === undefined)
+        return false;
+      return options.fvaAge <= rule.maxAge;
+    }
+  }
+}
+async function evaluateExposeDescriptors(expose, ctx, options = {}) {
+  const allowedSelectFields = new Set;
+  const nulledFields = new Set;
+  const allowedWhereFields = new Set;
+  const allowedOrderByFields = new Set;
+  for (const [field, value] of Object.entries(expose.select)) {
+    if (value === true) {
+      allowedSelectFields.add(field);
+    } else {
+      const passed = await evaluateExposeRule(value, ctx, options);
+      if (passed) {
+        allowedSelectFields.add(field);
+      } else {
+        allowedSelectFields.add(field);
+        nulledFields.add(field);
+      }
+    }
+  }
+  if (expose.allowWhere) {
+    for (const [field, value] of Object.entries(expose.allowWhere)) {
+      if (value === true) {
+        allowedWhereFields.add(field);
+      } else {
+        const passed = await evaluateExposeRule(value, ctx, options);
+        if (passed) {
+          allowedWhereFields.add(field);
+        }
+      }
+    }
+  }
+  if (expose.allowOrderBy) {
+    for (const [field, value] of Object.entries(expose.allowOrderBy)) {
+      if (value === true) {
+        allowedOrderByFields.add(field);
+      } else {
+        const passed = await evaluateExposeRule(value, ctx, options);
+        if (passed) {
+          allowedOrderByFields.add(field);
+        }
+      }
+    }
+  }
+  return {
+    allowedSelectFields,
+    nulledFields,
+    allowedWhereFields,
+    allowedOrderByFields
+  };
+}
+
 // src/entity/vertzql-parser.ts
+function extractAllowKeys(allow) {
+  if (!allow)
+    return [];
+  if (Array.isArray(allow))
+    return allow;
+  return Object.keys(allow);
+}
 var MAX_LIMIT = 1000;
 var MAX_Q_BASE64_LENGTH = 10240;
-var ALLOWED_Q_KEYS = new Set([
-  "select",
-  "include",
-  "where",
-  "orderBy",
-  "limit",
-  "offset"
-]);
+var ALLOWED_Q_KEYS = new Set(["select", "include", "where", "orderBy", "limit", "offset"]);
 function parseVertzQL(query) {
   const result = {};
   for (const [key, value] of Object.entries(query)) {
@@ -5937,49 +6686,143 @@ function getHiddenColumns(table) {
   }
   return hidden;
 }
-function validateVertzQL(options, table, relationsConfig) {
+function validateVertzQL(options, table, relationsConfig, exposeConfig, evaluatedExpose) {
   if (options._qError) {
     return { ok: false, error: options._qError };
   }
   const hiddenColumns = getHiddenColumns(table);
   if (options.where) {
+    const allowWhereSet = evaluatedExpose ? evaluatedExpose.allowedWhereFields : null;
+    const allowWhereKeys = !evaluatedExpose && exposeConfig ? extractAllowKeys(exposeConfig.allowWhere) : null;
     for (const field of Object.keys(options.where)) {
       if (hiddenColumns.has(field)) {
         return { ok: false, error: `Field "${field}" is not filterable` };
       }
+      if (allowWhereSet !== null && !allowWhereSet.has(field)) {
+        return { ok: false, error: `Field "${field}" is not filterable` };
+      }
+      if (allowWhereKeys !== null && !allowWhereKeys.includes(field)) {
+        return { ok: false, error: `Field "${field}" is not filterable` };
+      }
     }
   }
   if (options.orderBy) {
+    const allowOrderBySet = evaluatedExpose ? evaluatedExpose.allowedOrderByFields : null;
+    const allowOrderByKeys = !evaluatedExpose && exposeConfig ? extractAllowKeys(exposeConfig.allowOrderBy) : null;
     for (const field of Object.keys(options.orderBy)) {
       if (hiddenColumns.has(field)) {
         return { ok: false, error: `Field "${field}" is not sortable` };
       }
+      if (allowOrderBySet !== null && !allowOrderBySet.has(field)) {
+        return { ok: false, error: `Field "${field}" is not sortable` };
+      }
+      if (allowOrderByKeys !== null && !allowOrderByKeys.includes(field)) {
+        return { ok: false, error: `Field "${field}" is not sortable` };
+      }
     }
   }
   if (options.select) {
+    const exposeSelectKeys = exposeConfig ? extractAllowKeys(exposeConfig.select) : null;
     for (const field of Object.keys(options.select)) {
       if (hiddenColumns.has(field)) {
         return { ok: false, error: `Field "${field}" is not selectable` };
       }
+      if (exposeSelectKeys !== null && exposeSelectKeys.length > 0 && !exposeSelectKeys.includes(field)) {
+        return { ok: false, error: `Field "${field}" is not selectable` };
+      }
     }
   }
   if (options.include && relationsConfig) {
-    for (const [relation, requested] of Object.entries(options.include)) {
-      const entityConfig = relationsConfig[relation];
-      if (entityConfig === undefined || entityConfig === false) {
-        return { ok: false, error: `Relation "${relation}" is not exposed` };
-      }
-      if (typeof entityConfig === "object" && typeof requested === "object") {
-        for (const field of Object.keys(requested)) {
-          if (!(field in entityConfig)) {
-            return {
-              ok: false,
-              error: `Field "${field}" is not exposed on relation "${relation}"`
-            };
-          }
+    const includeResult = validateInclude(options.include, relationsConfig, "");
+    if (!includeResult.ok)
+      return includeResult;
+  }
+  return { ok: true };
+}
+function validateInclude(include, relationsConfig, pathPrefix) {
+  for (const [relation, requested] of Object.entries(include)) {
+    const entityConfig = relationsConfig[relation];
+    const relationPath = pathPrefix ? `${pathPrefix}.${relation}` : relation;
+    if (entityConfig === undefined || entityConfig === false) {
+      return { ok: false, error: `Relation "${relationPath}" is not exposed` };
+    }
+    if (requested === true)
+      continue;
+    const configObj = typeof entityConfig === "object" ? entityConfig : undefined;
+    if (requested.where) {
+      const allowWhereKeys = extractAllowKeys(configObj?.allowWhere);
+      if (!configObj || allowWhereKeys.length === 0) {
+        return {
+          ok: false,
+          error: `Filtering is not enabled on relation '${relationPath}'. ` + "Add 'allowWhere' to the entity relations config."
+        };
+      }
+      const allowedSet = new Set(allowWhereKeys);
+      for (const field of Object.keys(requested.where)) {
+        if (!allowedSet.has(field)) {
+          return {
+            ok: false,
+            error: `Field '${field}' is not filterable on relation '${relationPath}'. ` + `Allowed: ${allowWhereKeys.join(", ")}`
+          };
+        }
+      }
+    }
+    if (requested.orderBy) {
+      const allowOrderByKeys = extractAllowKeys(configObj?.allowOrderBy);
+      if (!configObj || allowOrderByKeys.length === 0) {
+        return {
+          ok: false,
+          error: `Sorting is not enabled on relation '${relationPath}'. ` + "Add 'allowOrderBy' to the entity relations config."
+        };
+      }
+      const allowedSet = new Set(allowOrderByKeys);
+      for (const [field, dir] of Object.entries(requested.orderBy)) {
+        if (!allowedSet.has(field)) {
+          return {
+            ok: false,
+            error: `Field '${field}' is not sortable on relation '${relationPath}'. ` + `Allowed: ${allowOrderByKeys.join(", ")}`
+          };
+        }
+        if (dir !== "asc" && dir !== "desc") {
+          return {
+            ok: false,
+            error: `Invalid orderBy direction '${String(dir)}' for field '${field}' on relation '${relationPath}'. Must be 'asc' or 'desc'.`
+          };
+        }
+      }
+    }
+    if (requested.limit !== undefined) {
+      if (typeof requested.limit !== "number" || !Number.isFinite(requested.limit)) {
+        return {
+          ok: false,
+          error: `Invalid limit on relation '${relationPath}': must be a finite number`
+        };
+      }
+      if (requested.limit < 0) {
+        requested.limit = 0;
+      }
+      if (configObj?.maxLimit !== undefined && requested.limit > configObj.maxLimit) {
+        requested.limit = configObj.maxLimit;
+      }
+    }
+    if (requested.select && configObj?.select) {
+      for (const field of Object.keys(requested.select)) {
+        if (!(field in configObj.select)) {
+          return {
+            ok: false,
+            error: `Field "${field}" is not exposed on relation "${relationPath}"`
+          };
         }
       }
     }
+    if (requested.include) {
+      if (entityConfig === true) {
+        return {
+          ok: false,
+          error: `Nested includes are not supported on relation '${relationPath}' ` + "without a structured relations config."
+        };
+      }
+    }
   }
   return { ok: true };
 }
@@ -6004,10 +6847,31 @@ function extractRequestInfo(ctx) {
 function getParams(ctx) {
   return ctx.params ?? {};
 }
+function hasDescriptorValues(record) {
+  if (!record)
+    return false;
+  return Object.values(record).some((v) => v !== true);
+}
+function hasDescriptors(expose) {
+  return hasDescriptorValues(expose.select) || hasDescriptorValues(expose.allowWhere) || hasDescriptorValues(expose.allowOrderBy);
+}
+function applyNulling(data, nulledFields) {
+  return nullGuardedFields(nulledFields, data);
+}
 function generateEntityRoutes(def, registry, db, options) {
   const prefix = options?.apiPrefix ?? "/api";
   const basePath = `${prefix}/${def.name}`;
-  const crudHandlers = createCrudHandlers(def, db);
+  const tenantChain = options?.tenantChain ?? null;
+  const exposeValidation = def.expose ? {
+    select: def.expose.select,
+    allowWhere: def.expose.allowWhere,
+    allowOrderBy: def.expose.allowOrderBy
+  } : undefined;
+  const exposeEvalConfig = def.expose ? hasDescriptors(def.expose) ? def.expose : null : null;
+  const crudHandlers = createCrudHandlers(def, db, {
+    tenantChain,
+    queryParentIds: options?.queryParentIds
+  });
   const inject = def.inject ?? {};
   const registryProxy = Object.keys(inject).length > 0 ? registry.createScopedProxy(inject) : {};
   const routes = [];
@@ -6037,8 +6901,9 @@ function generateEntityRoutes(def, registry, db, options) {
             const entityCtx = makeEntityCtx(ctx);
             const query = ctx.query ?? {};
             const parsed = parseVertzQL(query);
-            const relationsConfig = def.relations;
-            const validation = validateVertzQL(parsed, def.model.table, relationsConfig);
+            const evaluated = exposeEvalConfig ? await evaluateExposeDescriptors(exposeEvalConfig, entityCtx) : null;
+            const relationsConfig = def.expose?.include ?? {};
+            const validation = validateVertzQL(parsed, def.model.table, relationsConfig, exposeValidation, evaluated ?? undefined);
             if (!validation.ok) {
               return jsonResponse({ error: { code: "BadRequest", message: validation.error } }, 400);
             }
@@ -6046,13 +6911,17 @@ function generateEntityRoutes(def, registry, db, options) {
               where: parsed.where ? parsed.where : undefined,
               orderBy: parsed.orderBy,
               limit: parsed.limit,
-              after: parsed.after
+              after: parsed.after,
+              include: parsed.include
             };
             const result = await crudHandlers.list(entityCtx, options2);
             if (!result.ok) {
               const { status, body } = entityErrorHandler(result.error);
               return jsonResponse(body, status);
             }
+            if (evaluated && evaluated.nulledFields.size > 0 && result.data.body.items) {
+              result.data.body.items = result.data.body.items.map((row) => applyNulling(row, evaluated.nulledFields));
+            }
             if (parsed.select && result.data.body.items) {
               result.data.body.items = result.data.body.items.map((row) => applySelect(parsed.select, row));
             }
@@ -6079,8 +6948,9 @@ function generateEntityRoutes(def, registry, db, options) {
             select: body.select,
             include: body.include
           };
-          const relationsConfig = def.relations;
-          const validation = validateVertzQL(parsed, def.model.table, relationsConfig);
+          const evaluated = exposeEvalConfig ? await evaluateExposeDescriptors(exposeEvalConfig, entityCtx) : null;
+          const relationsConfig = def.expose?.include ?? {};
+          const validation = validateVertzQL(parsed, def.model.table, relationsConfig, exposeValidation, evaluated ?? undefined);
           if (!validation.ok) {
             return jsonResponse({ error: { code: "BadRequest", message: validation.error } }, 400);
           }
@@ -6088,13 +6958,17 @@ function generateEntityRoutes(def, registry, db, options) {
             where: parsed.where,
             orderBy: parsed.orderBy,
             limit: parsed.limit,
-            after: parsed.after
+            after: parsed.after,
+            include: parsed.include
           };
           const result = await crudHandlers.list(entityCtx, options2);
           if (!result.ok) {
             const { status, body: errBody } = entityErrorHandler(result.error);
             return jsonResponse(errBody, status);
           }
+          if (evaluated && evaluated.nulledFields.size > 0 && result.data.body.items) {
+            result.data.body.items = result.data.body.items.map((row) => applyNulling(row, evaluated.nulledFields));
+          }
           if (parsed.select && result.data.body.items) {
             result.data.body.items = result.data.body.items.map((row) => applySelect(parsed.select, row));
           }
@@ -6128,17 +7002,23 @@ function generateEntityRoutes(def, registry, db, options) {
             const id = getParams(ctx).id;
             const query = ctx.query ?? {};
             const parsed = parseVertzQL(query);
-            const relationsConfig = def.relations;
-            const validation = validateVertzQL(parsed, def.model.table, relationsConfig);
+            const evaluated = exposeEvalConfig ? await evaluateExposeDescriptors(exposeEvalConfig, entityCtx) : null;
+            const relationsConfig = def.expose?.include ?? {};
+            const validation = validateVertzQL(parsed, def.model.table, relationsConfig, exposeValidation, evaluated ?? undefined);
             if (!validation.ok) {
               return jsonResponse({ error: { code: "BadRequest", message: validation.error } }, 400);
             }
-            const result = await crudHandlers.get(entityCtx, id);
+            const getOptions = parsed.include ? { include: parsed.include } : undefined;
+            const result = await crudHandlers.get(entityCtx, id, getOptions);
             if (!result.ok) {
               const { status, body: body2 } = entityErrorHandler(result.error);
               return jsonResponse(body2, status);
             }
-            const body = parsed.select ? applySelect(parsed.select, result.data.body) : result.data.body;
+            let responseBody = result.data.body;
+            if (evaluated && evaluated.nulledFields.size > 0) {
+              responseBody = applyNulling(responseBody, evaluated.nulledFields);
+            }
+            const body = parsed.select ? applySelect(parsed.select, responseBody) : responseBody;
             return jsonResponse(body, result.data.status);
           } catch (error) {
             const { status, body } = entityErrorHandler(error);
@@ -6173,7 +7053,14 @@ function generateEntityRoutes(def, registry, db, options) {
               const { status, body } = entityErrorHandler(result.error);
               return jsonResponse(body, status);
             }
-            return jsonResponse(result.data.body, result.data.status);
+            let responseBody = result.data.body;
+            if (exposeEvalConfig) {
+              const evaluated = await evaluateExposeDescriptors(exposeEvalConfig, entityCtx);
+              if (evaluated.nulledFields.size > 0) {
+                responseBody = applyNulling(responseBody, evaluated.nulledFields);
+              }
+            }
+            return jsonResponse(responseBody, result.data.status);
           } catch (error) {
             const { status, body } = entityErrorHandler(error);
             return jsonResponse(body, status);
@@ -6208,7 +7095,14 @@ function generateEntityRoutes(def, registry, db, options) {
               const { status, body } = entityErrorHandler(result.error);
               return jsonResponse(body, status);
             }
-            return jsonResponse(result.data.body, result.data.status);
+            let responseBody = result.data.body;
+            if (exposeEvalConfig) {
+              const evaluated = await evaluateExposeDescriptors(exposeEvalConfig, entityCtx);
+              if (evaluated.nulledFields.size > 0) {
+                responseBody = applyNulling(responseBody, evaluated.nulledFields);
+              }
+            }
+            return jsonResponse(responseBody, result.data.status);
           } catch (error) {
             const { status, body } = entityErrorHandler(error);
             return jsonResponse(body, status);
@@ -6298,13 +7192,106 @@ function generateEntityRoutes(def, registry, db, options) {
   return routes;
 }
 
+// src/entity/tenant-chain.ts
+function resolveTenantChain(entityKey, tenantGraph, registry) {
+  if (!tenantGraph.indirectlyScoped.includes(entityKey)) {
+    return null;
+  }
+  if (tenantGraph.root === null) {
+    return null;
+  }
+  const rootEntry = registry[tenantGraph.root];
+  if (!rootEntry)
+    return null;
+  const rootTableName = rootEntry.table._name;
+  const tableNameToKey = new Map;
+  for (const [key, entry] of Object.entries(registry)) {
+    tableNameToKey.set(entry.table._name, key);
+  }
+  const directlyScopedTableNames = new Set;
+  for (const key of tenantGraph.directlyScoped) {
+    const entry = registry[key];
+    if (entry)
+      directlyScopedTableNames.add(entry.table._name);
+  }
+  directlyScopedTableNames.add(rootTableName);
+  const hops = [];
+  let currentKey = entityKey;
+  const visited = new Set;
+  while (true) {
+    if (visited.has(currentKey)) {
+      return null;
+    }
+    visited.add(currentKey);
+    const currentEntry = registry[currentKey];
+    if (!currentEntry)
+      return null;
+    let foundHop = false;
+    for (const [, rel] of Object.entries(currentEntry.relations)) {
+      if (rel._type !== "one" || !rel._foreignKey)
+        continue;
+      const targetTableName = rel._target()._name;
+      const targetKey = tableNameToKey.get(targetTableName);
+      if (!targetKey)
+        continue;
+      const targetIsDirectlyScoped = directlyScopedTableNames.has(targetTableName);
+      const targetIsIndirectlyScoped = tenantGraph.indirectlyScoped.includes(targetKey);
+      if (!targetIsDirectlyScoped && !targetIsIndirectlyScoped)
+        continue;
+      const targetEntry = registry[targetKey];
+      if (!targetEntry)
+        continue;
+      const targetPk = resolvePrimaryKey(targetEntry.table._columns);
+      hops.push({
+        tableName: targetTableName,
+        foreignKey: rel._foreignKey,
+        targetColumn: targetPk
+      });
+      if (targetIsDirectlyScoped && targetKey !== tenantGraph.root) {
+        const tenantColumn = resolveTenantFk(targetKey, registry);
+        if (!tenantColumn)
+          return null;
+        return { hops, tenantColumn };
+      }
+      if (targetKey === tenantGraph.root) {
+        return { hops, tenantColumn: rel._foreignKey };
+      }
+      currentKey = targetKey;
+      foundHop = true;
+      break;
+    }
+    if (!foundHop)
+      return null;
+  }
+}
+function resolvePrimaryKey(columns) {
+  for (const [key, col] of Object.entries(columns)) {
+    if (col && typeof col === "object" && "_meta" in col) {
+      const meta = col._meta;
+      if (meta.primary)
+        return key;
+    }
+  }
+  return "id";
+}
+function resolveTenantFk(modelKey, registry) {
+  const entry = registry[modelKey];
+  if (!entry || !entry._tenant)
+    return null;
+  const tenantRel = entry.relations[entry._tenant];
+  if (!tenantRel || !tenantRel._foreignKey)
+    return null;
+  return tenantRel._foreignKey;
+}
+
 // src/service/context.ts
-function createServiceContext(request, registryProxy) {
+function createServiceContext(request, registryProxy, rawRequest) {
   const userId = request.userId ?? null;
   const roles = request.roles ?? [];
   const tenantId = request.tenantId ?? null;
   return {
     userId,
+    tenantId,
     authenticated() {
       return userId !== null;
     },
@@ -6314,7 +7301,8 @@ function createServiceContext(request, registryProxy) {
     role(...rolesToCheck) {
       return rolesToCheck.some((r) => roles.includes(r));
     },
-    entities: registryProxy
+    entities: registryProxy,
+    request: rawRequest ?? { url: "", method: "", headers: new Headers, body: undefined }
   };
 }
 
@@ -6363,23 +7351,56 @@ function generateServiceRoutes(def, registry, options) {
       handler: async (ctx) => {
         try {
           const requestInfo = extractRequestInfo2(ctx);
-          const serviceCtx = createServiceContext(requestInfo, registryProxy);
+          const raw = ctx.raw;
+          const ctxHeaders = ctx.headers;
+          const rawRequest = {
+            url: raw?.url ?? "",
+            method: raw?.method ?? "",
+            headers: new Headers(ctxHeaders ?? {}),
+            body: ctx.body
+          };
+          const serviceCtx = createServiceContext(requestInfo, registryProxy, rawRequest);
           const accessResult = await enforceAccess(handlerName, def.access, serviceCtx);
           if (!accessResult.ok) {
             return jsonResponse2({ error: { code: "Forbidden", message: accessResult.error.message } }, 403);
           }
-          const rawBody = ctx.body ?? {};
-          const parsed = handlerDef.body.parse(rawBody);
-          if (!parsed.ok) {
-            const message = parsed.error instanceof Error ? parsed.error.message : "Invalid request body";
-            return jsonResponse2({ error: { code: "BadRequest", message } }, 400);
+          if (handlerDef.body && isContentDescriptor(handlerDef.body)) {
+            const reqContentType = rawRequest.headers.get("content-type")?.toLowerCase() ?? "";
+            const expected = handlerDef.body._contentType;
+            const isXml = expected === "application/xml";
+            const matches = isXml ? reqContentType.includes("application/xml") || reqContentType.includes("text/xml") : reqContentType.includes(expected);
+            if (reqContentType && !matches) {
+              return jsonResponse2({
+                error: {
+                  code: "UnsupportedMediaType",
+                  message: `Expected content-type ${expected}, got ${reqContentType}`
+                }
+              }, 415);
+            }
           }
-          const result = await handlerDef.handler(parsed.data, serviceCtx);
+          let input;
+          if (handlerDef.body) {
+            const rawBody = ctx.body ?? {};
+            const parsed = handlerDef.body.parse(rawBody);
+            if (!parsed.ok) {
+              const message = parsed.error instanceof Error ? parsed.error.message : "Invalid request body";
+              return jsonResponse2({ error: { code: "BadRequest", message } }, 400);
+            }
+            input = parsed.data;
+          }
+          const result = await handlerDef.handler(input, serviceCtx);
           const responseParsed = handlerDef.response.parse(result);
           if (!responseParsed.ok) {
             const message = responseParsed.error instanceof Error ? responseParsed.error.message : "Response validation failed";
             console.warn(`[vertz] Service response validation warning: ${message}`);
           }
+          if (isContentDescriptor(handlerDef.response)) {
+            const body = result instanceof Uint8Array ? result : String(result);
+            return new Response(body, {
+              status: 200,
+              headers: { "content-type": handlerDef.response._contentType }
+            });
+          }
           return jsonResponse2(result, 200);
         } catch (error) {
           const message = error instanceof Error ? error.message : "Internal server error";
@@ -6459,20 +7480,55 @@ function createServer(config) {
   }
   if (config.entities && config.entities.length > 0) {
     let dbFactory;
+    const tableOf = (e) => e.table ?? e.name;
     if (hasDbClient) {
       const dbModels = db._internals.models;
-      const missing = config.entities.filter((e) => !(e.name in dbModels)).map((e) => `"${e.name}"`);
-      if (missing.length > 0) {
+      const missing = config.entities.filter((e) => !(tableOf(e) in dbModels)).map((e) => `"${tableOf(e)}"`);
+      const uniqueMissing = [...new Set(missing)];
+      if (uniqueMissing.length > 0) {
         const registered = Object.keys(dbModels).map((k) => `"${k}"`).join(", ");
-        const plural = missing.length > 1;
-        throw new Error(`${plural ? "Entities" : "Entity"} ${missing.join(", ")} ${plural ? "are" : "is"} not registered in createDb(). ` + `Add the missing model${plural ? "s" : ""} to the models object in your createDb() call. ` + `Registered models: ${registered || "(none)"}`);
+        const plural = uniqueMissing.length > 1;
+        throw new Error(`${plural ? "Entities" : "Entity"} ${uniqueMissing.join(", ")} ${plural ? "are" : "is"} not registered in createDb(). ` + `Add the missing model${plural ? "s" : ""} to the models object in your createDb() call. ` + `Registered models: ${registered || "(none)"}`);
       }
-      dbFactory = (entityDef) => createDatabaseBridgeAdapter(db, entityDef.name);
+      dbFactory = (entityDef) => createDatabaseBridgeAdapter(db, tableOf(entityDef));
     } else if (db) {
       dbFactory = () => db;
     } else {
       dbFactory = config._entityDbFactory ?? createNoopDbAdapter;
     }
+    const tenantChains = new Map;
+    let queryParentIds;
+    if (hasDbClient) {
+      const dbClient = db;
+      const tenantGraph = dbClient._internals.tenantGraph;
+      const dbModelsMap = dbClient._internals.models;
+      for (const entityDef of config.entities) {
+        const eDef = entityDef;
+        if (eDef.tenantScoped === false)
+          continue;
+        const modelKey = tableOf(eDef);
+        const chain = resolveTenantChain(modelKey, tenantGraph, dbModelsMap);
+        if (chain) {
+          tenantChains.set(eDef.name, chain);
+        }
+      }
+      if (tenantChains.size > 0) {
+        queryParentIds = async (tableName, where) => {
+          const delegate = dbClient[tableName];
+          if (!delegate)
+            return [];
+          const result = await delegate.list({ where });
+          if (!result.ok || !result.data)
+            return [];
+          return result.data.map((row) => row.id);
+        };
+      }
+    }
+    if (config._tenantChains) {
+      for (const [name, chain] of config._tenantChains) {
+        tenantChains.set(name, chain);
+      }
+    }
     for (const entityDef of config.entities) {
       const entityDb = dbFactory(entityDef);
       const ops = createEntityOps(entityDef, entityDb);
@@ -6480,8 +7536,11 @@ function createServer(config) {
     }
     for (const entityDef of config.entities) {
       const entityDb = dbFactory(entityDef);
+      const tenantChain = tenantChains.get(entityDef.name) ?? null;
       const routes = generateEntityRoutes(entityDef, registry, entityDb, {
-        apiPrefix
+        apiPrefix,
+        tenantChain,
+        queryParentIds: tenantChain ? queryParentIds ?? config._queryParentIds : undefined
       });
       allRoutes.push(...routes);
     }
@@ -6501,15 +7560,41 @@ function createServer(config) {
     const authConfig = {
       ...config.auth,
       userStore: config.auth.userStore ?? new DbUserStore(dbClient),
-      sessionStore: config.auth.sessionStore ?? new DbSessionStore(dbClient)
+      sessionStore: config.auth.sessionStore ?? new DbSessionStore(dbClient),
+      oauthAccountStore: config.auth.oauthAccountStore ?? (config.auth.providers?.length ? new DbOAuthAccountStore(dbClient) : undefined),
+      _entityProxy: config.auth.onUserCreated ? config.auth._entityProxy ?? registry.createProxy() : undefined
     };
     const auth = createAuth(authConfig);
+    if (apiPrefix !== "/api") {
+      throw new Error(`requestHandler requires apiPrefix to be '/api' (got '${apiPrefix}'). ` + "Custom API prefixes are not yet supported with auth.");
+    }
+    const authPrefix = `${apiPrefix}/auth`;
+    const authPrefixSlash = `${authPrefix}/`;
     const serverInstance = app;
     serverInstance.auth = auth;
     serverInstance.initialize = async () => {
       await initializeAuthTables(dbClient);
       await auth.initialize();
     };
+    let cachedRequestHandler = null;
+    Object.defineProperty(serverInstance, "requestHandler", {
+      get() {
+        if (!cachedRequestHandler) {
+          const entityHandler = this.handler;
+          const authHandler = this.auth.handler;
+          cachedRequestHandler = (request) => {
+            const pathname = new URL(request.url).pathname;
+            if (pathname === authPrefix || pathname.startsWith(authPrefixSlash)) {
+              return authHandler(request);
+            }
+            return entityHandler(request);
+          };
+        }
+        return cachedRequestHandler;
+      },
+      enumerable: true,
+      configurable: false
+    });
     return serverInstance;
   }
   return app;
@@ -6524,6 +7609,8 @@ function entity(name, config) {
   if (!config.model) {
     throw new Error("entity() requires a model in the config.");
   }
+  const hasTenantIdColumn = "tenantId" in config.model.table._columns;
+  const tenantScoped = config.tenantScoped ?? hasTenantIdColumn;
   const def = {
     kind: "entity",
     name,
@@ -6533,7 +7620,10 @@ function entity(name, config) {
     before: config.before ?? {},
     after: config.after ?? {},
     actions: config.actions ?? {},
-    relations: config.relations ?? {}
+    expose: config.expose,
+    table: config.table ?? name,
+    tenantScoped,
+    tenantChain: null
   };
   return deepFreeze(def);
 }
@@ -6566,7 +7656,9 @@ export {
   stripHiddenFields,
   service,
   rules,
+  resolveTenantChain,
   makeImmutable,
+  isContentDescriptor,
   initializeAuthTables,
   hashPassword,
   google,
@@ -6596,6 +7688,7 @@ export {
   createAccessEventBroadcaster,
   createAccessContext,
   createAccess,
+  content,
   computePlanHash,
   computeOverage,
   computeEntityAccess,
@@ -6612,11 +7705,11 @@ export {
   InternalServerErrorException,
   InMemoryWalletStore,
   InMemoryUserStore,
+  InMemorySubscriptionStore,
   InMemorySessionStore,
   InMemoryRoleAssignmentStore,
   InMemoryRateLimitStore,
   InMemoryPlanVersionStore,
-  InMemoryPlanStore,
   InMemoryPasswordResetStore,
   InMemoryOverrideStore,
   InMemoryOAuthAccountStore,
@@ -6628,14 +7721,14 @@ export {
   ForbiddenException,
   EntityRegistry,
   DbUserStore,
+  DbSubscriptionStore,
   DbSessionStore,
   DbRoleAssignmentStore,
-  DbPlanStore,
   DbOAuthAccountStore,
   DbFlagStore,
   DbClosureStore,
   ConflictException,
-  BadRequestException,
+  BadRequestException2 as BadRequestException,
   AuthorizationError,
   AUTH_TABLE_NAMES
 };